smbd: fix the handling of create_options to pass RAW-OPEN
[tprouty/samba.git] / source / smbd / nttrans.c
1 /*
2    Unix SMB/CIFS implementation.
3    SMB NT transaction handling
4    Copyright (C) Jeremy Allison                 1994-2007
5    Copyright (C) Stefan (metze) Metzmacher      2003
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22
23 extern int max_send;
24 extern enum protocol_types Protocol;
25 extern struct current_user current_user;
26
27 static const char *known_nt_pipes[] = {
28         "\\LANMAN",
29         "\\srvsvc",
30         "\\samr",
31         "\\wkssvc",
32         "\\NETLOGON",
33         "\\ntlsa",
34         "\\ntsvcs",
35         "\\lsass",
36         "\\lsarpc",
37         "\\winreg",
38         "\\initshutdown",
39         "\\spoolss",
40         "\\netdfs",
41         "\\rpcecho",
42         "\\svcctl",
43         "\\eventlog",
44         "\\unixinfo",
45         NULL
46 };
47
48 static char *nttrans_realloc(char **ptr, size_t size)
49 {
50         if (ptr==NULL) {
51                 smb_panic("nttrans_realloc() called with NULL ptr");
52         }
53
54         *ptr = (char *)SMB_REALLOC(*ptr, size);
55         if(*ptr == NULL) {
56                 return NULL;
57         }
58         memset(*ptr,'\0',size);
59         return *ptr;
60 }
61
62 /****************************************************************************
63  Send the required number of replies back.
64  We assume all fields other than the data fields are
65  set correctly for the type of call.
66  HACK ! Always assumes smb_setup field is zero.
67 ****************************************************************************/
68
69 void send_nt_replies(connection_struct *conn,
70                         struct smb_request *req, NTSTATUS nt_error,
71                      char *params, int paramsize,
72                      char *pdata, int datasize)
73 {
74         int data_to_send = datasize;
75         int params_to_send = paramsize;
76         int useable_space;
77         char *pp = params;
78         char *pd = pdata;
79         int params_sent_thistime, data_sent_thistime, total_sent_thistime;
80         int alignment_offset = 3;
81         int data_alignment_offset = 0;
82
83         /*
84          * If there genuinely are no parameters or data to send just send
85          * the empty packet.
86          */
87
88         if(params_to_send == 0 && data_to_send == 0) {
89                 reply_outbuf(req, 18, 0);
90                 show_msg((char *)req->outbuf);
91                 return;
92         }
93
94         /*
95          * When sending params and data ensure that both are nicely aligned.
96          * Only do this alignment when there is also data to send - else
97          * can cause NT redirector problems.
98          */
99
100         if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
101                 data_alignment_offset = 4 - (params_to_send % 4);
102         }
103
104         /*
105          * Space is bufsize minus Netbios over TCP header minus SMB header.
106          * The alignment_offset is to align the param bytes on a four byte
107          * boundary (2 bytes for data len, one byte pad).
108          * NT needs this to work correctly.
109          */
110
111         useable_space = max_send - (smb_size
112                                     + 2 * 18 /* wct */
113                                     + alignment_offset
114                                     + data_alignment_offset);
115
116         /*
117          * useable_space can never be more than max_send minus the
118          * alignment offset.
119          */
120
121         useable_space = MIN(useable_space,
122                                 max_send - (alignment_offset+data_alignment_offset));
123
124
125         while (params_to_send || data_to_send) {
126
127                 /*
128                  * Calculate whether we will totally or partially fill this packet.
129                  */
130
131                 total_sent_thistime = params_to_send + data_to_send +
132                                         alignment_offset + data_alignment_offset;
133
134                 /*
135                  * We can never send more than useable_space.
136                  */
137
138                 total_sent_thistime = MIN(total_sent_thistime, useable_space);
139
140                 reply_outbuf(req, 18, total_sent_thistime);
141
142                 /*
143                  * Set total params and data to be sent.
144                  */
145
146                 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
147                 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
148
149                 /*
150                  * Calculate how many parameters and data we can fit into
151                  * this packet. Parameters get precedence.
152                  */
153
154                 params_sent_thistime = MIN(params_to_send,useable_space);
155                 data_sent_thistime = useable_space - params_sent_thistime;
156                 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
157
158                 SIVAL(req->outbuf, smb_ntr_ParameterCount,
159                       params_sent_thistime);
160
161                 if(params_sent_thistime == 0) {
162                         SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
163                         SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
164                 } else {
165                         /*
166                          * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
167                          * parameter bytes, however the first 4 bytes of outbuf are
168                          * the Netbios over TCP header. Thus use smb_base() to subtract
169                          * them from the calculation.
170                          */
171
172                         SIVAL(req->outbuf,smb_ntr_ParameterOffset,
173                               ((smb_buf(req->outbuf)+alignment_offset)
174                                - smb_base(req->outbuf)));
175                         /*
176                          * Absolute displacement of param bytes sent in this packet.
177                          */
178
179                         SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
180                               pp - params);
181                 }
182
183                 /*
184                  * Deal with the data portion.
185                  */
186
187                 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
188
189                 if(data_sent_thistime == 0) {
190                         SIVAL(req->outbuf,smb_ntr_DataOffset,0);
191                         SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
192                 } else {
193                         /*
194                          * The offset of the data bytes is the offset of the
195                          * parameter bytes plus the number of parameters being sent this time.
196                          */
197
198                         SIVAL(req->outbuf, smb_ntr_DataOffset,
199                               ((smb_buf(req->outbuf)+alignment_offset) -
200                                smb_base(req->outbuf))
201                               + params_sent_thistime + data_alignment_offset);
202                         SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
203                 }
204
205                 /*
206                  * Copy the param bytes into the packet.
207                  */
208
209                 if(params_sent_thistime) {
210                         if (alignment_offset != 0) {
211                                 memset(smb_buf(req->outbuf), 0,
212                                        alignment_offset);
213                         }
214                         memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
215                                params_sent_thistime);
216                 }
217
218                 /*
219                  * Copy in the data bytes
220                  */
221
222                 if(data_sent_thistime) {
223                         if (data_alignment_offset != 0) {
224                                 memset((smb_buf(req->outbuf)+alignment_offset+
225                                         params_sent_thistime), 0,
226                                        data_alignment_offset);
227                         }
228                         memcpy(smb_buf(req->outbuf)+alignment_offset
229                                +params_sent_thistime+data_alignment_offset,
230                                pd,data_sent_thistime);
231                 }
232
233                 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
234                         params_sent_thistime, data_sent_thistime, useable_space));
235                 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
236                         params_to_send, data_to_send, paramsize, datasize));
237
238                 if (NT_STATUS_V(nt_error)) {
239                         error_packet_set((char *)req->outbuf,
240                                          0, 0, nt_error,
241                                          __LINE__,__FILE__);
242                 }
243
244                 /* Send the packet */
245                 show_msg((char *)req->outbuf);
246                 if (!srv_send_smb(smbd_server_fd(),
247                                 (char *)req->outbuf,
248                                 IS_CONN_ENCRYPTED(conn))) {
249                         exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
250                 }
251
252                 TALLOC_FREE(req->outbuf);
253
254                 pp += params_sent_thistime;
255                 pd += data_sent_thistime;
256
257                 params_to_send -= params_sent_thistime;
258                 data_to_send -= data_sent_thistime;
259
260                 /*
261                  * Sanity check
262                  */
263
264                 if(params_to_send < 0 || data_to_send < 0) {
265                         DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
266                                 params_to_send, data_to_send));
267                         return;
268                 }
269         }
270 }
271
272 /****************************************************************************
273  Is it an NTFS stream name ?
274  An NTFS file name is <path>.<extention>:<stream name>:<stream type>
275  $DATA can be used as both a stream name and a stream type. A missing stream
276  name or type implies $DATA.
277 ****************************************************************************/
278
279 bool is_ntfs_stream_name(const char *fname)
280 {
281         if (lp_posix_pathnames()) {
282                 return False;
283         }
284         return (strchr_m(fname, ':') != NULL) ? True : False;
285 }
286
287 /****************************************************************************
288  Reply to an NT create and X call on a pipe
289 ****************************************************************************/
290
291 static void nt_open_pipe(char *fname, connection_struct *conn,
292                          struct smb_request *req, int *ppnum)
293 {
294         smb_np_struct *p = NULL;
295         int i;
296
297         DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
298
299         /* See if it is one we want to handle. */
300
301         if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
302                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
303                                 ERRDOS, ERRbadpipe);
304                 return;
305         }
306
307         for( i = 0; known_nt_pipes[i]; i++ ) {
308                 if( strequal(fname,known_nt_pipes[i])) {
309                         break;
310                 }
311         }
312
313         if ( known_nt_pipes[i] == NULL ) {
314                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
315                                 ERRDOS, ERRbadpipe);
316                 return;
317         }
318
319         /* Strip \\ off the name. */
320         fname++;
321
322         DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
323
324         p = open_rpc_pipe_p(fname, conn, req->vuid);
325         if (!p) {
326                 reply_doserror(req, ERRSRV, ERRnofids);
327                 return;
328         }
329
330         /* TODO: Add pipe to db */
331
332         if ( !store_pipe_opendb( p ) ) {
333                 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
334         }
335
336         *ppnum = p->pnum;
337         return;
338 }
339
340 /****************************************************************************
341  Reply to an NT create and X call for pipes.
342 ****************************************************************************/
343
344 static void do_ntcreate_pipe_open(connection_struct *conn,
345                                   struct smb_request *req)
346 {
347         char *fname = NULL;
348         int pnum = -1;
349         char *p = NULL;
350         uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
351         TALLOC_CTX *ctx = talloc_tos();
352
353         srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
354                         smb_buf(req->inbuf), STR_TERMINATE);
355
356         if (!fname) {
357                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
358                                 ERRDOS, ERRbadpipe);
359                 return;
360         }
361         nt_open_pipe(fname, conn, req, &pnum);
362
363         if (req->outbuf) {
364                 /* error reply */
365                 return;
366         }
367
368         /*
369          * Deal with pipe return.
370          */
371
372         if (flags & EXTENDED_RESPONSE_REQUIRED) {
373                 /* This is very strange. We
374                  * return 50 words, but only set
375                  * the wcnt to 42 ? It's definately
376                  * what happens on the wire....
377                  */
378                 reply_outbuf(req, 50, 0);
379                 SCVAL(req->outbuf,smb_wct,42);
380         } else {
381                 reply_outbuf(req, 34, 0);
382         }
383
384         p = (char *)req->outbuf + smb_vwv2;
385         p++;
386         SSVAL(p,0,pnum);
387         p += 2;
388         SIVAL(p,0,FILE_WAS_OPENED);
389         p += 4;
390         p += 32;
391         SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
392         p += 20;
393         /* File type. */
394         SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
395         /* Device state. */
396         SSVAL(p,2, 0x5FF); /* ? */
397         p += 4;
398
399         if (flags & EXTENDED_RESPONSE_REQUIRED) {
400                 p += 25;
401                 SIVAL(p,0,FILE_GENERIC_ALL);
402                 /*
403                  * For pipes W2K3 seems to return
404                  * 0x12019B next.
405                  * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
406                  */
407                 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
408         }
409
410         DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
411
412         chain_reply(req);
413 }
414
415 /****************************************************************************
416  Reply to an NT create and X call.
417 ****************************************************************************/
418
419 void reply_ntcreate_and_X(struct smb_request *req)
420 {
421         connection_struct *conn = req->conn;
422         char *fname = NULL;
423         uint32 flags;
424         uint32 access_mask;
425         uint32 file_attributes;
426         uint32 share_access;
427         uint32 create_disposition;
428         uint32 create_options;
429         uint16 root_dir_fid;
430         SMB_BIG_UINT allocation_size;
431         /* Breakout the oplock request bits so we can set the
432            reply bits separately. */
433         uint32 fattr=0;
434         SMB_OFF_T file_len = 0;
435         SMB_STRUCT_STAT sbuf;
436         int info = 0;
437         files_struct *fsp = NULL;
438         char *p = NULL;
439         struct timespec c_timespec;
440         struct timespec a_timespec;
441         struct timespec m_timespec;
442         NTSTATUS status;
443         int oplock_request;
444         uint8_t oplock_granted = NO_OPLOCK_RETURN;
445         TALLOC_CTX *ctx = talloc_tos();
446
447         START_PROFILE(SMBntcreateX);
448
449         if (req->wct < 24) {
450                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
451                 return;
452         }
453
454         flags = IVAL(req->inbuf,smb_ntcreate_Flags);
455         access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
456         file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes);
457         share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess);
458         create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition);
459         create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
460         root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
461
462         allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,
463                                              smb_ntcreate_AllocationSize);
464 #ifdef LARGE_SMB_OFF_T
465         allocation_size |= (((SMB_BIG_UINT)IVAL(
466                                      req->inbuf,
467                                      smb_ntcreate_AllocationSize + 4)) << 32);
468 #endif
469
470         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
471                         smb_buf(req->inbuf), 0, STR_TERMINATE, &status);
472
473         if (!NT_STATUS_IS_OK(status)) {
474                 reply_nterror(req, status);
475                 END_PROFILE(SMBntcreateX);
476                 return;
477         }
478
479         DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
480                   "file_attributes = 0x%x, share_access = 0x%x, "
481                   "create_disposition = 0x%x create_options = 0x%x "
482                   "root_dir_fid = 0x%x, fname = %s\n",
483                         (unsigned int)flags,
484                         (unsigned int)access_mask,
485                         (unsigned int)file_attributes,
486                         (unsigned int)share_access,
487                         (unsigned int)create_disposition,
488                         (unsigned int)create_options,
489                         (unsigned int)root_dir_fid,
490                         fname));
491
492         /*
493          * we need to remove ignored bits when they come directly from the client
494          * because we reuse some of them for internal stuff
495          */
496         create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
497
498         /*
499          * If it's an IPC, use the pipe handler.
500          */
501
502         if (IS_IPC(conn)) {
503                 if (lp_nt_pipe_support()) {
504                         do_ntcreate_pipe_open(conn, req);
505                         END_PROFILE(SMBntcreateX);
506                         return;
507                 }
508                 reply_doserror(req, ERRDOS, ERRnoaccess);
509                 END_PROFILE(SMBntcreateX);
510                 return;
511         }
512
513         oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
514         if (oplock_request) {
515                 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
516                         ? BATCH_OPLOCK : 0;
517         }
518
519         status = create_file(conn, req, root_dir_fid, fname,
520                              access_mask, share_access, create_disposition,
521                              create_options, file_attributes, oplock_request,
522                              allocation_size, NULL, NULL, &fsp, &info, &sbuf);
523
524         if (!NT_STATUS_IS_OK(status)) {
525                 if (open_was_deferred(req->mid)) {
526                         /* We have re-scheduled this call, no error. */
527                         END_PROFILE(SMBntcreateX);
528                         return;
529                 }
530                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
531                         reply_botherror(req, status, ERRDOS, ERRfilexists);
532                 }
533                 else {
534                         reply_nterror(req, status);
535                 }
536                 END_PROFILE(SMBntcreateX);
537                 return;
538         }
539
540         /*
541          * If the caller set the extended oplock request bit
542          * and we granted one (by whatever means) - set the
543          * correct bit for extended oplock reply.
544          */
545
546         if (oplock_request &&
547             (lp_fake_oplocks(SNUM(conn))
548              || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
549
550                 /*
551                  * Exclusive oplock granted
552                  */
553
554                 if (flags & REQUEST_BATCH_OPLOCK) {
555                         oplock_granted = BATCH_OPLOCK_RETURN;
556                 } else {
557                         oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
558                 }
559         } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
560                 oplock_granted = LEVEL_II_OPLOCK_RETURN;
561         } else {
562                 oplock_granted = NO_OPLOCK_RETURN;
563         }
564
565         file_len = sbuf.st_size;
566         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
567         if (fattr == 0) {
568                 fattr = FILE_ATTRIBUTE_NORMAL;
569         }
570
571         if (flags & EXTENDED_RESPONSE_REQUIRED) {
572                 /* This is very strange. We
573                  * return 50 words, but only set
574                  * the wcnt to 42 ? It's definately
575                  * what happens on the wire....
576                  */
577                 reply_outbuf(req, 50, 0);
578                 SCVAL(req->outbuf,smb_wct,42);
579         } else {
580                 reply_outbuf(req, 34, 0);
581         }
582
583         p = (char *)req->outbuf + smb_vwv2;
584
585         SCVAL(p, 0, oplock_granted);
586
587         p++;
588         SSVAL(p,0,fsp->fnum);
589         p += 2;
590         if ((create_disposition == FILE_SUPERSEDE)
591             && (info == FILE_WAS_OVERWRITTEN)) {
592                 SIVAL(p,0,FILE_WAS_SUPERSEDED);
593         } else {
594                 SIVAL(p,0,info);
595         }
596         p += 4;
597
598         /* Create time. */
599         c_timespec = get_create_timespec(
600                 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
601         a_timespec = get_atimespec(&sbuf);
602         m_timespec = get_mtimespec(&sbuf);
603
604         if (lp_dos_filetime_resolution(SNUM(conn))) {
605                 dos_filetime_timespec(&c_timespec);
606                 dos_filetime_timespec(&a_timespec);
607                 dos_filetime_timespec(&m_timespec);
608         }
609
610         put_long_date_timespec(p, c_timespec); /* create time. */
611         p += 8;
612         put_long_date_timespec(p, a_timespec); /* access time */
613         p += 8;
614         put_long_date_timespec(p, m_timespec); /* write time */
615         p += 8;
616         put_long_date_timespec(p, m_timespec); /* change time */
617         p += 8;
618         SIVAL(p,0,fattr); /* File Attributes. */
619         p += 4;
620         SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
621         p += 8;
622         SOFF_T(p,0,file_len);
623         p += 8;
624         if (flags & EXTENDED_RESPONSE_REQUIRED) {
625                 SSVAL(p,2,0x7);
626         }
627         p += 4;
628         SCVAL(p,0,fsp->is_directory ? 1 : 0);
629
630         if (flags & EXTENDED_RESPONSE_REQUIRED) {
631                 uint32 perms = 0;
632                 p += 25;
633                 if (fsp->is_directory
634                     || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
635                         perms = FILE_GENERIC_ALL;
636                 } else {
637                         perms = FILE_GENERIC_READ|FILE_EXECUTE;
638                 }
639                 SIVAL(p,0,perms);
640         }
641
642         DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
643                  fsp->fnum, fsp->fsp_name));
644
645         chain_reply(req);
646         END_PROFILE(SMBntcreateX);
647         return;
648 }
649
650 /****************************************************************************
651  Reply to a NT_TRANSACT_CREATE call to open a pipe.
652 ****************************************************************************/
653
654 static void do_nt_transact_create_pipe(connection_struct *conn,
655                                        struct smb_request *req,
656                                        uint16 **ppsetup, uint32 setup_count,
657                                        char **ppparams, uint32 parameter_count,
658                                        char **ppdata, uint32 data_count)
659 {
660         char *fname = NULL;
661         char *params = *ppparams;
662         int pnum = -1;
663         char *p = NULL;
664         NTSTATUS status;
665         size_t param_len;
666         uint32 flags;
667         TALLOC_CTX *ctx = talloc_tos();
668
669         /*
670          * Ensure minimum number of parameters sent.
671          */
672
673         if(parameter_count < 54) {
674                 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
675                 reply_doserror(req, ERRDOS, ERRnoaccess);
676                 return;
677         }
678
679         flags = IVAL(params,0);
680
681         srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
682                         parameter_count-53, STR_TERMINATE,
683                         &status);
684         if (!NT_STATUS_IS_OK(status)) {
685                 reply_nterror(req, status);
686                 return;
687         }
688
689         nt_open_pipe(fname, conn, req, &pnum);
690
691         if (req->outbuf) {
692                 /* Error return */
693                 return;
694         }
695
696         /* Realloc the size of parameters and data we will return */
697         if (flags & EXTENDED_RESPONSE_REQUIRED) {
698                 /* Extended response is 32 more byyes. */
699                 param_len = 101;
700         } else {
701                 param_len = 69;
702         }
703         params = nttrans_realloc(ppparams, param_len);
704         if(params == NULL) {
705                 reply_doserror(req, ERRDOS, ERRnomem);
706                 return;
707         }
708
709         p = params;
710         SCVAL(p,0,NO_OPLOCK_RETURN);
711
712         p += 2;
713         SSVAL(p,0,pnum);
714         p += 2;
715         SIVAL(p,0,FILE_WAS_OPENED);
716         p += 8;
717
718         p += 32;
719         SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
720         p += 20;
721         /* File type. */
722         SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
723         /* Device state. */
724         SSVAL(p,2, 0x5FF); /* ? */
725         p += 4;
726
727         if (flags & EXTENDED_RESPONSE_REQUIRED) {
728                 p += 25;
729                 SIVAL(p,0,FILE_GENERIC_ALL);
730                 /*
731                  * For pipes W2K3 seems to return
732                  * 0x12019B next.
733                  * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
734                  */
735                 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
736         }
737
738         DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
739
740         /* Send the required number of replies */
741         send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
742
743         return;
744 }
745
746 /****************************************************************************
747  Internal fn to set security descriptors.
748 ****************************************************************************/
749
750 static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
751                        uint32 security_info_sent)
752 {
753         SEC_DESC *psd = NULL;
754         NTSTATUS status;
755
756         if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
757                 return NT_STATUS_OK;
758         }
759
760         status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
761
762         if (!NT_STATUS_IS_OK(status)) {
763                 return status;
764         }
765
766         if (psd->owner_sid==0) {
767                 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
768         }
769         if (psd->group_sid==0) {
770                 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
771         }
772         if (psd->sacl==0) {
773                 security_info_sent &= ~SACL_SECURITY_INFORMATION;
774         }
775         if (psd->dacl==0) {
776                 security_info_sent &= ~DACL_SECURITY_INFORMATION;
777         }
778
779         if (fsp->fh->fd != -1) {
780                 status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
781         }
782         else {
783                 status = SMB_VFS_SET_NT_ACL(fsp, fsp->fsp_name,
784                                             security_info_sent, psd);
785         }
786
787         TALLOC_FREE(psd);
788
789         return status;
790 }
791
792 /****************************************************************************
793  Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
794 ****************************************************************************/
795
796 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
797 {
798         struct ea_list *ea_list_head = NULL;
799         size_t offset = 0;
800
801         if (data_size < 4) {
802                 return NULL;
803         }
804
805         while (offset + 4 <= data_size) {
806                 size_t next_offset = IVAL(pdata,offset);
807                 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
808
809                 if (!eal) {
810                         return NULL;
811                 }
812
813                 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
814                 if (next_offset == 0) {
815                         break;
816                 }
817                 offset += next_offset;
818         }
819
820         return ea_list_head;
821 }
822
823 /****************************************************************************
824  Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
825 ****************************************************************************/
826
827 static void call_nt_transact_create(connection_struct *conn,
828                                     struct smb_request *req,
829                                     uint16 **ppsetup, uint32 setup_count,
830                                     char **ppparams, uint32 parameter_count,
831                                     char **ppdata, uint32 data_count,
832                                     uint32 max_data_count)
833 {
834         char *fname = NULL;
835         char *params = *ppparams;
836         char *data = *ppdata;
837         /* Breakout the oplock request bits so we can set the reply bits separately. */
838         uint32 fattr=0;
839         SMB_OFF_T file_len = 0;
840         SMB_STRUCT_STAT sbuf;
841         int info = 0;
842         files_struct *fsp = NULL;
843         char *p = NULL;
844         uint32 flags;
845         uint32 access_mask;
846         uint32 file_attributes;
847         uint32 share_access;
848         uint32 create_disposition;
849         uint32 create_options;
850         uint32 sd_len;
851         struct security_descriptor *sd = NULL;
852         uint32 ea_len;
853         uint16 root_dir_fid;
854         struct timespec c_timespec;
855         struct timespec a_timespec;
856         struct timespec m_timespec;
857         struct ea_list *ea_list = NULL;
858         NTSTATUS status;
859         size_t param_len;
860         SMB_BIG_UINT allocation_size;
861         int oplock_request;
862         uint8_t oplock_granted;
863         TALLOC_CTX *ctx = talloc_tos();
864
865         DEBUG(5,("call_nt_transact_create\n"));
866
867         /*
868          * If it's an IPC, use the pipe handler.
869          */
870
871         if (IS_IPC(conn)) {
872                 if (lp_nt_pipe_support()) {
873                         do_nt_transact_create_pipe(
874                                 conn, req,
875                                 ppsetup, setup_count,
876                                 ppparams, parameter_count,
877                                 ppdata, data_count);
878                         return;
879                 }
880                 reply_doserror(req, ERRDOS, ERRnoaccess);
881                 return;
882         }
883
884         /*
885          * Ensure minimum number of parameters sent.
886          */
887
888         if(parameter_count < 54) {
889                 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
890                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
891                 return;
892         }
893
894         flags = IVAL(params,0);
895         access_mask = IVAL(params,8);
896         file_attributes = IVAL(params,20);
897         share_access = IVAL(params,24);
898         create_disposition = IVAL(params,28);
899         create_options = IVAL(params,32);
900         sd_len = IVAL(params,36);
901         ea_len = IVAL(params,40);
902         root_dir_fid = (uint16)IVAL(params,4);
903         allocation_size = (SMB_BIG_UINT)IVAL(params,12);
904 #ifdef LARGE_SMB_OFF_T
905         allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
906 #endif
907
908         /*
909          * we need to remove ignored bits when they come directly from the client
910          * because we reuse some of them for internal stuff
911          */
912         create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
913
914         /* Ensure the data_len is correct for the sd and ea values given. */
915         if ((ea_len + sd_len > data_count)
916             || (ea_len > data_count) || (sd_len > data_count)
917             || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
918                 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
919                            "%u, data_count = %u\n", (unsigned int)ea_len,
920                            (unsigned int)sd_len, (unsigned int)data_count));
921                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
922                 return;
923         }
924
925         if (sd_len) {
926                 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
927                            sd_len));
928
929                 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
930                                              &sd);
931                 if (!NT_STATUS_IS_OK(status)) {
932                         DEBUG(10, ("call_nt_transact_create: "
933                                    "unmarshall_sec_desc failed: %s\n",
934                                    nt_errstr(status)));
935                         reply_nterror(req, status);
936                         return;
937                 }
938         }
939
940         if (ea_len) {
941                 if (!lp_ea_support(SNUM(conn))) {
942                         DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
943                                    "EA's not supported.\n",
944                                    (unsigned int)ea_len));
945                         reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
946                         return;
947                 }
948
949                 if (ea_len < 10) {
950                         DEBUG(10,("call_nt_transact_create - ea_len = %u - "
951                                   "too small (should be more than 10)\n",
952                                   (unsigned int)ea_len ));
953                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
954                         return;
955                 }
956
957                 /* We have already checked that ea_len <= data_count here. */
958                 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
959                                                ea_len);
960                 if (ea_list == NULL) {
961                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
962                         return;
963                 }
964         }
965
966         srvstr_get_path(ctx, params, req->flags2, &fname,
967                         params+53, parameter_count-53,
968                         STR_TERMINATE, &status);
969         if (!NT_STATUS_IS_OK(status)) {
970                 reply_nterror(req, status);
971                 return;
972         }
973
974         oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
975         if (oplock_request) {
976                 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
977                         ? BATCH_OPLOCK : 0;
978         }
979
980         status = create_file(conn, req, root_dir_fid, fname,
981                              access_mask, share_access, create_disposition,
982                              create_options, file_attributes, oplock_request,
983                              allocation_size, sd, ea_list, &fsp, &info, &sbuf);
984
985         if(!NT_STATUS_IS_OK(status)) {
986                 if (open_was_deferred(req->mid)) {
987                         /* We have re-scheduled this call, no error. */
988                         return;
989                 }
990                 reply_openerror(req, status);
991                 return;
992         }
993
994         /*
995          * If the caller set the extended oplock request bit
996          * and we granted one (by whatever means) - set the
997          * correct bit for extended oplock reply.
998          */
999
1000         if (oplock_request &&
1001             (lp_fake_oplocks(SNUM(conn))
1002              || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
1003
1004                 /*
1005                  * Exclusive oplock granted
1006                  */
1007
1008                 if (flags & REQUEST_BATCH_OPLOCK) {
1009                         oplock_granted = BATCH_OPLOCK_RETURN;
1010                 } else {
1011                         oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
1012                 }
1013         } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1014                 oplock_granted = LEVEL_II_OPLOCK_RETURN;
1015         } else {
1016                 oplock_granted = NO_OPLOCK_RETURN;
1017         }
1018
1019         file_len = sbuf.st_size;
1020         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1021         if (fattr == 0) {
1022                 fattr = FILE_ATTRIBUTE_NORMAL;
1023         }
1024
1025         /* Realloc the size of parameters and data we will return */
1026         if (flags & EXTENDED_RESPONSE_REQUIRED) {
1027                 /* Extended response is 32 more byyes. */
1028                 param_len = 101;
1029         } else {
1030                 param_len = 69;
1031         }
1032         params = nttrans_realloc(ppparams, param_len);
1033         if(params == NULL) {
1034                 reply_doserror(req, ERRDOS, ERRnomem);
1035                 return;
1036         }
1037
1038         p = params;
1039         SCVAL(p, 0, oplock_granted);
1040
1041         p += 2;
1042         SSVAL(p,0,fsp->fnum);
1043         p += 2;
1044         if ((create_disposition == FILE_SUPERSEDE)
1045             && (info == FILE_WAS_OVERWRITTEN)) {
1046                 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1047         } else {
1048                 SIVAL(p,0,info);
1049         }
1050         p += 8;
1051
1052         /* Create time. */
1053         c_timespec = get_create_timespec(
1054                 &sbuf,lp_fake_dir_create_times(SNUM(conn)));
1055         a_timespec = get_atimespec(&sbuf);
1056         m_timespec = get_mtimespec(&sbuf);
1057
1058         if (lp_dos_filetime_resolution(SNUM(conn))) {
1059                 dos_filetime_timespec(&c_timespec);
1060                 dos_filetime_timespec(&a_timespec);
1061                 dos_filetime_timespec(&m_timespec);
1062         }
1063
1064         put_long_date_timespec(p, c_timespec); /* create time. */
1065         p += 8;
1066         put_long_date_timespec(p, a_timespec); /* access time */
1067         p += 8;
1068         put_long_date_timespec(p, m_timespec); /* write time */
1069         p += 8;
1070         put_long_date_timespec(p, m_timespec); /* change time */
1071         p += 8;
1072         SIVAL(p,0,fattr); /* File Attributes. */
1073         p += 4;
1074         SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1075         p += 8;
1076         SOFF_T(p,0,file_len);
1077         p += 8;
1078         if (flags & EXTENDED_RESPONSE_REQUIRED) {
1079                 SSVAL(p,2,0x7);
1080         }
1081         p += 4;
1082         SCVAL(p,0,fsp->is_directory ? 1 : 0);
1083
1084         if (flags & EXTENDED_RESPONSE_REQUIRED) {
1085                 uint32 perms = 0;
1086                 p += 25;
1087                 if (fsp->is_directory
1088                     || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
1089                         perms = FILE_GENERIC_ALL;
1090                 } else {
1091                         perms = FILE_GENERIC_READ|FILE_EXECUTE;
1092                 }
1093                 SIVAL(p,0,perms);
1094         }
1095
1096         DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name));
1097
1098         /* Send the required number of replies */
1099         send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1100
1101         return;
1102 }
1103
1104 /****************************************************************************
1105  Reply to a NT CANCEL request.
1106  conn POINTER CAN BE NULL HERE !
1107 ****************************************************************************/
1108
1109 void reply_ntcancel(struct smb_request *req)
1110 {
1111         /*
1112          * Go through and cancel any pending change notifies.
1113          */
1114
1115         START_PROFILE(SMBntcancel);
1116         remove_pending_change_notify_requests_by_mid(req->mid);
1117         remove_pending_lock_requests_by_mid(req->mid);
1118         srv_cancel_sign_response(req->mid);
1119
1120         DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
1121
1122         END_PROFILE(SMBntcancel);
1123         return;
1124 }
1125
1126 /****************************************************************************
1127  Copy a file.
1128 ****************************************************************************/
1129
1130 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1131                                 connection_struct *conn,
1132                                 struct smb_request *req,
1133                                 const char *oldname_in,
1134                                 const char *newname_in,
1135                                 uint32 attrs)
1136 {
1137         SMB_STRUCT_STAT sbuf1, sbuf2;
1138         char *oldname = NULL;
1139         char *newname = NULL;
1140         char *last_component_oldname = NULL;
1141         char *last_component_newname = NULL;
1142         files_struct *fsp1,*fsp2;
1143         uint32 fattr;
1144         int info;
1145         SMB_OFF_T ret=-1;
1146         NTSTATUS status = NT_STATUS_OK;
1147
1148         ZERO_STRUCT(sbuf1);
1149         ZERO_STRUCT(sbuf2);
1150
1151         if (!CAN_WRITE(conn)) {
1152                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1153         }
1154
1155         status = unix_convert(ctx, conn, oldname_in, False, &oldname,
1156                         &last_component_oldname, &sbuf1);
1157         if (!NT_STATUS_IS_OK(status)) {
1158                 return status;
1159         }
1160
1161         status = check_name(conn, oldname);
1162         if (!NT_STATUS_IS_OK(status)) {
1163                 return status;
1164         }
1165
1166         /* Source must already exist. */
1167         if (!VALID_STAT(sbuf1)) {
1168                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1169         }
1170         /* Ensure attributes match. */
1171         fattr = dos_mode(conn,oldname,&sbuf1);
1172         if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1173                 return NT_STATUS_NO_SUCH_FILE;
1174         }
1175
1176         status = unix_convert(ctx, conn, newname_in, False, &newname,
1177                         &last_component_newname, &sbuf2);
1178         if (!NT_STATUS_IS_OK(status)) {
1179                 return status;
1180         }
1181
1182         status = check_name(conn, newname);
1183         if (!NT_STATUS_IS_OK(status)) {
1184                 return status;
1185         }
1186
1187         /* Disallow if newname already exists. */
1188         if (VALID_STAT(sbuf2)) {
1189                 return NT_STATUS_OBJECT_NAME_COLLISION;
1190         }
1191
1192         /* No links from a directory. */
1193         if (S_ISDIR(sbuf1.st_mode)) {
1194                 return NT_STATUS_FILE_IS_A_DIRECTORY;
1195         }
1196
1197         /* Ensure this is within the share. */
1198         status = check_reduced_name(conn, oldname);
1199         if (!NT_STATUS_IS_OK(status)) {
1200                 return status;
1201         }
1202
1203         DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1204                                 oldname, newname));
1205
1206         status = open_file_ntcreate(conn, req, oldname, &sbuf1,
1207                         FILE_READ_DATA, /* Read-only. */
1208                         FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1209                         FILE_OPEN,
1210                         0, /* No create options. */
1211                         FILE_ATTRIBUTE_NORMAL,
1212                         NO_OPLOCK,
1213                         &info, &fsp1);
1214
1215         if (!NT_STATUS_IS_OK(status)) {
1216                 return status;
1217         }
1218
1219         status = open_file_ntcreate(conn, req, newname, &sbuf2,
1220                         FILE_WRITE_DATA, /* Read-only. */
1221                         FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1222                         FILE_CREATE,
1223                         0, /* No create options. */
1224                         fattr,
1225                         NO_OPLOCK,
1226                         &info, &fsp2);
1227
1228         if (!NT_STATUS_IS_OK(status)) {
1229                 close_file(fsp1,ERROR_CLOSE);
1230                 return status;
1231         }
1232
1233         if (sbuf1.st_size) {
1234                 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1235         }
1236
1237         /*
1238          * As we are opening fsp1 read-only we only expect
1239          * an error on close on fsp2 if we are out of space.
1240          * Thus we don't look at the error return from the
1241          * close of fsp1.
1242          */
1243         close_file(fsp1,NORMAL_CLOSE);
1244
1245         /* Ensure the modtime is set correctly on the destination file. */
1246         set_close_write_time(fsp2, get_mtimespec(&sbuf1));
1247
1248         status = close_file(fsp2,NORMAL_CLOSE);
1249
1250         /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1251            creates the file. This isn't the correct thing to do in the copy
1252            case. JRA */
1253         file_set_dosmode(conn, newname, fattr, &sbuf2,
1254                          parent_dirname(newname),false);
1255
1256         if (ret < (SMB_OFF_T)sbuf1.st_size) {
1257                 return NT_STATUS_DISK_FULL;
1258         }
1259
1260         if (!NT_STATUS_IS_OK(status)) {
1261                 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1262                         nt_errstr(status), oldname, newname));
1263         }
1264         return status;
1265 }
1266
1267 /****************************************************************************
1268  Reply to a NT rename request.
1269 ****************************************************************************/
1270
1271 void reply_ntrename(struct smb_request *req)
1272 {
1273         connection_struct *conn = req->conn;
1274         char *oldname = NULL;
1275         char *newname = NULL;
1276         char *p;
1277         NTSTATUS status;
1278         bool src_has_wcard = False;
1279         bool dest_has_wcard = False;
1280         uint32 attrs;
1281         uint16 rename_type;
1282         TALLOC_CTX *ctx = talloc_tos();
1283
1284         START_PROFILE(SMBntrename);
1285
1286         if (req->wct < 4) {
1287                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1288                 END_PROFILE(SMBntrename);
1289                 return;
1290         }
1291
1292         attrs = SVAL(req->inbuf,smb_vwv0);
1293         rename_type = SVAL(req->inbuf,smb_vwv1);
1294
1295         p = smb_buf(req->inbuf) + 1;
1296         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
1297                                    0, STR_TERMINATE, &status,
1298                                    &src_has_wcard);
1299         if (!NT_STATUS_IS_OK(status)) {
1300                 reply_nterror(req, status);
1301                 END_PROFILE(SMBntrename);
1302                 return;
1303         }
1304
1305         if( is_ntfs_stream_name(oldname)) {
1306                 /* Can't rename a stream. */
1307                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1308                 END_PROFILE(SMBntrename);
1309                 return;
1310         }
1311
1312         if (ms_has_wild(oldname)) {
1313                 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1314                 END_PROFILE(SMBntrename);
1315                 return;
1316         }
1317
1318         p++;
1319         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
1320                                    0, STR_TERMINATE, &status,
1321                                    &dest_has_wcard);
1322         if (!NT_STATUS_IS_OK(status)) {
1323                 reply_nterror(req, status);
1324                 END_PROFILE(SMBntrename);
1325                 return;
1326         }
1327
1328         status = resolve_dfspath(ctx, conn,
1329                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1330                                 oldname,
1331                                 &oldname);
1332         if (!NT_STATUS_IS_OK(status)) {
1333                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1334                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1335                                         ERRSRV, ERRbadpath);
1336                         END_PROFILE(SMBntrename);
1337                         return;
1338                 }
1339                 reply_nterror(req, status);
1340                 END_PROFILE(SMBntrename);
1341                 return;
1342         }
1343
1344         status = resolve_dfspath(ctx, conn,
1345                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1346                                 newname,
1347                                 &newname);
1348         if (!NT_STATUS_IS_OK(status)) {
1349                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1350                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1351                                         ERRSRV, ERRbadpath);
1352                         END_PROFILE(SMBntrename);
1353                         return;
1354                 }
1355                 reply_nterror(req, status);
1356                 END_PROFILE(SMBntrename);
1357                 return;
1358         }
1359
1360         DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1361
1362         switch(rename_type) {
1363                 case RENAME_FLAG_RENAME:
1364                         status = rename_internals(ctx, conn, req, oldname,
1365                                         newname, attrs, False, src_has_wcard,
1366                                         dest_has_wcard, DELETE_ACCESS);
1367                         break;
1368                 case RENAME_FLAG_HARD_LINK:
1369                         if (src_has_wcard || dest_has_wcard) {
1370                                 /* No wildcards. */
1371                                 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1372                         } else {
1373                                 status = hardlink_internals(ctx,
1374                                                 conn,
1375                                                 oldname,
1376                                                 newname);
1377                         }
1378                         break;
1379                 case RENAME_FLAG_COPY:
1380                         if (src_has_wcard || dest_has_wcard) {
1381                                 /* No wildcards. */
1382                                 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1383                         } else {
1384                                 status = copy_internals(ctx, conn, req, oldname,
1385                                                         newname, attrs);
1386                         }
1387                         break;
1388                 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1389                         status = NT_STATUS_INVALID_PARAMETER;
1390                         break;
1391                 default:
1392                         status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1393                         break;
1394         }
1395
1396         if (!NT_STATUS_IS_OK(status)) {
1397                 if (open_was_deferred(req->mid)) {
1398                         /* We have re-scheduled this call. */
1399                         END_PROFILE(SMBntrename);
1400                         return;
1401                 }
1402
1403                 reply_nterror(req, status);
1404                 END_PROFILE(SMBntrename);
1405                 return;
1406         }
1407
1408         reply_outbuf(req, 0, 0);
1409
1410         END_PROFILE(SMBntrename);
1411         return;
1412 }
1413
1414 /****************************************************************************
1415  Reply to a notify change - queue the request and
1416  don't allow a directory to be opened.
1417 ****************************************************************************/
1418
1419 static void call_nt_transact_notify_change(connection_struct *conn,
1420                                            struct smb_request *req,
1421                                            uint16 **ppsetup,
1422                                            uint32 setup_count,
1423                                            char **ppparams,
1424                                            uint32 parameter_count,
1425                                            char **ppdata, uint32 data_count,
1426                                            uint32 max_data_count,
1427                                            uint32 max_param_count)
1428 {
1429         uint16 *setup = *ppsetup;
1430         files_struct *fsp;
1431         uint32 filter;
1432         NTSTATUS status;
1433         bool recursive;
1434
1435         if(setup_count < 6) {
1436                 reply_doserror(req, ERRDOS, ERRbadfunc);
1437                 return;
1438         }
1439
1440         fsp = file_fsp(SVAL(setup,4));
1441         filter = IVAL(setup, 0);
1442         recursive = (SVAL(setup, 6) != 0) ? True : False;
1443
1444         DEBUG(3,("call_nt_transact_notify_change\n"));
1445
1446         if(!fsp) {
1447                 reply_doserror(req, ERRDOS, ERRbadfid);
1448                 return;
1449         }
1450
1451         {
1452                 char *filter_string;
1453
1454                 if (!(filter_string = notify_filter_string(NULL, filter))) {
1455                         reply_nterror(req,NT_STATUS_NO_MEMORY);
1456                         return;
1457                 }
1458
1459                 DEBUG(3,("call_nt_transact_notify_change: notify change "
1460                          "called on %s, filter = %s, recursive = %d\n",
1461                          fsp->fsp_name, filter_string, recursive));
1462
1463                 TALLOC_FREE(filter_string);
1464         }
1465
1466         if((!fsp->is_directory) || (conn != fsp->conn)) {
1467                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1468                 return;
1469         }
1470
1471         if (fsp->notify == NULL) {
1472
1473                 status = change_notify_create(fsp, filter, recursive);
1474
1475                 if (!NT_STATUS_IS_OK(status)) {
1476                         DEBUG(10, ("change_notify_create returned %s\n",
1477                                    nt_errstr(status)));
1478                         reply_nterror(req, status);
1479                         return;
1480                 }
1481         }
1482
1483         if (fsp->notify->num_changes != 0) {
1484
1485                 /*
1486                  * We've got changes pending, respond immediately
1487                  */
1488
1489                 /*
1490                  * TODO: write a torture test to check the filtering behaviour
1491                  * here.
1492                  */
1493
1494                 change_notify_reply(fsp->conn, req->inbuf, max_param_count, fsp->notify);
1495
1496                 /*
1497                  * change_notify_reply() above has independently sent its
1498                  * results
1499                  */
1500                 return;
1501         }
1502
1503         /*
1504          * No changes pending, queue the request
1505          */
1506
1507         status = change_notify_add_request(req,
1508                         max_param_count,
1509                         filter,
1510                         recursive, fsp);
1511         if (!NT_STATUS_IS_OK(status)) {
1512                 reply_nterror(req, status);
1513         }
1514         return;
1515 }
1516
1517 /****************************************************************************
1518  Reply to an NT transact rename command.
1519 ****************************************************************************/
1520
1521 static void call_nt_transact_rename(connection_struct *conn,
1522                                     struct smb_request *req,
1523                                     uint16 **ppsetup, uint32 setup_count,
1524                                     char **ppparams, uint32 parameter_count,
1525                                     char **ppdata, uint32 data_count,
1526                                     uint32 max_data_count)
1527 {
1528         char *params = *ppparams;
1529         char *new_name = NULL;
1530         files_struct *fsp = NULL;
1531         bool dest_has_wcard = False;
1532         NTSTATUS status;
1533         TALLOC_CTX *ctx = talloc_tos();
1534
1535         if(parameter_count < 5) {
1536                 reply_doserror(req, ERRDOS, ERRbadfunc);
1537                 return;
1538         }
1539
1540         fsp = file_fsp(SVAL(params, 0));
1541         if (!check_fsp(conn, req, fsp, &current_user)) {
1542                 return;
1543         }
1544         srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
1545                               parameter_count - 4,
1546                               STR_TERMINATE, &status, &dest_has_wcard);
1547         if (!NT_STATUS_IS_OK(status)) {
1548                 reply_nterror(req, status);
1549                 return;
1550         }
1551
1552         /*
1553          * W2K3 ignores this request as the RAW-RENAME test
1554          * demonstrates, so we do.
1555          */
1556         send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1557
1558         DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1559                  fsp->fsp_name, new_name));
1560
1561         return;
1562 }
1563
1564 /******************************************************************************
1565  Fake up a completely empty SD.
1566 *******************************************************************************/
1567
1568 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
1569 {
1570         size_t sd_size;
1571
1572         *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1573         if(!*ppsd) {
1574                 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1575                 return NT_STATUS_NO_MEMORY;
1576         }
1577
1578         return NT_STATUS_OK;
1579 }
1580
1581 /****************************************************************************
1582  Reply to query a security descriptor.
1583 ****************************************************************************/
1584
1585 static void call_nt_transact_query_security_desc(connection_struct *conn,
1586                                                  struct smb_request *req,
1587                                                  uint16 **ppsetup,
1588                                                  uint32 setup_count,
1589                                                  char **ppparams,
1590                                                  uint32 parameter_count,
1591                                                  char **ppdata,
1592                                                  uint32 data_count,
1593                                                  uint32 max_data_count)
1594 {
1595         char *params = *ppparams;
1596         char *data = *ppdata;
1597         SEC_DESC *psd = NULL;
1598         size_t sd_size;
1599         uint32 security_info_wanted;
1600         files_struct *fsp = NULL;
1601         NTSTATUS status;
1602         DATA_BLOB blob;
1603
1604         if(parameter_count < 8) {
1605                 reply_doserror(req, ERRDOS, ERRbadfunc);
1606                 return;
1607         }
1608
1609         fsp = file_fsp(SVAL(params,0));
1610         if(!fsp) {
1611                 reply_doserror(req, ERRDOS, ERRbadfid);
1612                 return;
1613         }
1614
1615         security_info_wanted = IVAL(params,4);
1616
1617         DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
1618                         (unsigned int)security_info_wanted ));
1619
1620         params = nttrans_realloc(ppparams, 4);
1621         if(params == NULL) {
1622                 reply_doserror(req, ERRDOS, ERRnomem);
1623                 return;
1624         }
1625
1626         /*
1627          * Get the permissions to return.
1628          */
1629
1630         if (!lp_nt_acl_support(SNUM(conn))) {
1631                 status = get_null_nt_acl(talloc_tos(), &psd);
1632         } else {
1633                 if (fsp->fh->fd != -1) {
1634                         status = SMB_VFS_FGET_NT_ACL(
1635                                 fsp, security_info_wanted, &psd);
1636                 }
1637                 else {
1638                         status = SMB_VFS_GET_NT_ACL(
1639                                 conn, fsp->fsp_name, security_info_wanted, &psd);
1640                 }
1641         }
1642
1643         if (!NT_STATUS_IS_OK(status)) {
1644                 reply_nterror(req, status);
1645                 return;
1646         }
1647
1648         sd_size = ndr_size_security_descriptor(psd, 0);
1649
1650         DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
1651
1652         SIVAL(params,0,(uint32)sd_size);
1653
1654         if (max_data_count < sd_size) {
1655                 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
1656                                 params, 4, *ppdata, 0);
1657                 return;
1658         }
1659
1660         /*
1661          * Allocate the data we will point this at.
1662          */
1663
1664         data = nttrans_realloc(ppdata, sd_size);
1665         if(data == NULL) {
1666                 reply_doserror(req, ERRDOS, ERRnomem);
1667                 return;
1668         }
1669
1670         status = marshall_sec_desc(talloc_tos(), psd,
1671                                    &blob.data, &blob.length);
1672
1673         if (!NT_STATUS_IS_OK(status)) {
1674                 reply_nterror(req, status);
1675                 return;
1676         }
1677
1678         SMB_ASSERT(sd_size == blob.length);
1679         memcpy(data, blob.data, sd_size);
1680
1681         send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
1682
1683         return;
1684 }
1685
1686 /****************************************************************************
1687  Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
1688 ****************************************************************************/
1689
1690 static void call_nt_transact_set_security_desc(connection_struct *conn,
1691                                                struct smb_request *req,
1692                                                uint16 **ppsetup,
1693                                                uint32 setup_count,
1694                                                char **ppparams,
1695                                                uint32 parameter_count,
1696                                                char **ppdata,
1697                                                uint32 data_count,
1698                                                uint32 max_data_count)
1699 {
1700         char *params= *ppparams;
1701         char *data = *ppdata;
1702         files_struct *fsp = NULL;
1703         uint32 security_info_sent = 0;
1704         NTSTATUS status;
1705
1706         if(parameter_count < 8) {
1707                 reply_doserror(req, ERRDOS, ERRbadfunc);
1708                 return;
1709         }
1710
1711         if((fsp = file_fsp(SVAL(params,0))) == NULL) {
1712                 reply_doserror(req, ERRDOS, ERRbadfid);
1713                 return;
1714         }
1715
1716         if(!lp_nt_acl_support(SNUM(conn))) {
1717                 goto done;
1718         }
1719
1720         security_info_sent = IVAL(params,4);
1721
1722         DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
1723                 (unsigned int)security_info_sent ));
1724
1725         if (data_count == 0) {
1726                 reply_doserror(req, ERRDOS, ERRnoaccess);
1727                 return;
1728         }
1729
1730         status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
1731
1732         if (!NT_STATUS_IS_OK(status)) {
1733                 reply_nterror(req, status);
1734                 return;
1735         }
1736
1737   done:
1738         send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1739         return;
1740 }
1741
1742 /****************************************************************************
1743  Reply to NT IOCTL
1744 ****************************************************************************/
1745
1746 static void call_nt_transact_ioctl(connection_struct *conn,
1747                                    struct smb_request *req,
1748                                    uint16 **ppsetup, uint32 setup_count,
1749                                    char **ppparams, uint32 parameter_count,
1750                                    char **ppdata, uint32 data_count,
1751                                    uint32 max_data_count)
1752 {
1753         uint32 function;
1754         uint16 fidnum;
1755         files_struct *fsp;
1756         uint8 isFSctl;
1757         uint8 compfilter;
1758         static bool logged_message;
1759         char *pdata = *ppdata;
1760
1761         if (setup_count != 8) {
1762                 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
1763                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1764                 return;
1765         }
1766
1767         function = IVAL(*ppsetup, 0);
1768         fidnum = SVAL(*ppsetup, 4);
1769         isFSctl = CVAL(*ppsetup, 6);
1770         compfilter = CVAL(*ppsetup, 7);
1771
1772         DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n", 
1773                  function, fidnum, isFSctl, compfilter));
1774
1775         fsp=file_fsp(fidnum);
1776         /* this check is done in each implemented function case for now
1777            because I don't want to break anything... --metze
1778         FSP_BELONGS_CONN(fsp,conn);*/
1779
1780         switch (function) {
1781         case FSCTL_SET_SPARSE:
1782                 /* pretend this succeeded - tho strictly we should
1783                    mark the file sparse (if the local fs supports it)
1784                    so we can know if we need to pre-allocate or not */
1785
1786                 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
1787                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1788                 return;
1789
1790         case FSCTL_CREATE_OR_GET_OBJECT_ID:
1791         {
1792                 unsigned char objid[16];
1793
1794                 /* This should return the object-id on this file.
1795                  * I think I'll make this be the inode+dev. JRA.
1796                  */
1797
1798                 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
1799
1800                 if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
1801                         return;
1802                 }
1803
1804                 data_count = 64;
1805                 pdata = nttrans_realloc(ppdata, data_count);
1806                 if (pdata == NULL) {
1807                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1808                         return;
1809                 }
1810                 push_file_id_16(pdata, &fsp->file_id);
1811                 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
1812                 push_file_id_16(pdata+32, &fsp->file_id);
1813                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1814                                 pdata, data_count);
1815                 return;
1816         }
1817
1818         case FSCTL_GET_REPARSE_POINT:
1819                 /* pretend this fail - my winXP does it like this
1820                  * --metze
1821                  */
1822
1823                 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1824                 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1825                 return;
1826
1827         case FSCTL_SET_REPARSE_POINT:
1828                 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
1829                  * --metze
1830                  */
1831
1832                 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
1833                 reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
1834                 return;
1835
1836         case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
1837         {
1838                 /*
1839                  * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
1840                  * and return their volume names.  If max_data_count is 16, then it is just
1841                  * asking for the number of volumes and length of the combined names.
1842                  *
1843                  * pdata is the data allocated by our caller, but that uses
1844                  * total_data_count (which is 0 in our case) rather than max_data_count.
1845                  * Allocate the correct amount and return the pointer to let
1846                  * it be deallocated when we return.
1847                  */
1848                 SHADOW_COPY_DATA *shadow_data = NULL;
1849                 TALLOC_CTX *shadow_mem_ctx = NULL;
1850                 bool labels = False;
1851                 uint32 labels_data_count = 0;
1852                 uint32 i;
1853                 char *cur_pdata;
1854
1855                 if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
1856                         return;
1857                 }
1858
1859                 if (max_data_count < 16) {
1860                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
1861                                 max_data_count));
1862                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1863                         return;
1864                 }
1865
1866                 if (max_data_count > 16) {
1867                         labels = True;
1868                 }
1869
1870                 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
1871                 if (shadow_mem_ctx == NULL) {
1872                         DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
1873                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1874                         return;
1875                 }
1876
1877                 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
1878                 if (shadow_data == NULL) {
1879                         DEBUG(0,("TALLOC_ZERO() failed!\n"));
1880                         talloc_destroy(shadow_mem_ctx);
1881                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1882                         return;
1883                 }
1884
1885                 shadow_data->mem_ctx = shadow_mem_ctx;
1886
1887                 /*
1888                  * Call the VFS routine to actually do the work.
1889                  */
1890                 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
1891                         talloc_destroy(shadow_data->mem_ctx);
1892                         if (errno == ENOSYS) {
1893                                 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n", 
1894                                         conn->connectpath));
1895                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
1896                                 return;
1897                         } else {
1898                                 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n", 
1899                                         conn->connectpath));
1900                                 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1901                                 return;
1902                         }
1903                 }
1904
1905                 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
1906
1907                 if (!labels) {
1908                         data_count = 16;
1909                 } else {
1910                         data_count = 12+labels_data_count+4;
1911                 }
1912
1913                 if (max_data_count<data_count) {
1914                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
1915                                 max_data_count,data_count));
1916                         talloc_destroy(shadow_data->mem_ctx);
1917                         reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1918                         return;
1919                 }
1920
1921                 pdata = nttrans_realloc(ppdata, data_count);
1922                 if (pdata == NULL) {
1923                         talloc_destroy(shadow_data->mem_ctx);
1924                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1925                         return;
1926                 }
1927
1928                 cur_pdata = pdata;
1929
1930                 /* num_volumes 4 bytes */
1931                 SIVAL(pdata,0,shadow_data->num_volumes);
1932
1933                 if (labels) {
1934                         /* num_labels 4 bytes */
1935                         SIVAL(pdata,4,shadow_data->num_volumes);
1936                 }
1937
1938                 /* needed_data_count 4 bytes */
1939                 SIVAL(pdata,8,labels_data_count);
1940
1941                 cur_pdata+=12;
1942
1943                 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
1944                         shadow_data->num_volumes,fsp->fsp_name));
1945                 if (labels && shadow_data->labels) {
1946                         for (i=0;i<shadow_data->num_volumes;i++) {
1947                                 srvstr_push(pdata, req->flags2,
1948                                             cur_pdata, shadow_data->labels[i],
1949                                             2*sizeof(SHADOW_COPY_LABEL),
1950                                             STR_UNICODE|STR_TERMINATE);
1951                                 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
1952                                 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
1953                         }
1954                 }
1955
1956                 talloc_destroy(shadow_data->mem_ctx);
1957
1958                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
1959                                 pdata, data_count);
1960
1961                 return;
1962         }
1963
1964         case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
1965         {
1966                 /* pretend this succeeded -
1967                  *
1968                  * we have to send back a list with all files owned by this SID
1969                  *
1970                  * but I have to check that --metze
1971                  */
1972                 DOM_SID sid;
1973                 uid_t uid;
1974                 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
1975
1976                 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
1977
1978                 if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
1979                         return;
1980                 }
1981
1982                 /* unknown 4 bytes: this is not the length of the sid :-(  */
1983                 /*unknown = IVAL(pdata,0);*/
1984
1985                 sid_parse(pdata+4,sid_len,&sid);
1986                 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
1987
1988                 if (!sid_to_uid(&sid, &uid)) {
1989                         DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
1990                                  sid_string_dbg(&sid),
1991                                  (unsigned long)sid_len));
1992                         uid = (-1);
1993                 }
1994
1995                 /* we can take a look at the find source :-)
1996                  *
1997                  * find ./ -uid $uid  -name '*'   is what we need here
1998                  *
1999                  *
2000                  * and send 4bytes len and then NULL terminated unicode strings
2001                  * for each file
2002                  *
2003                  * but I don't know how to deal with the paged results
2004                  * (maybe we can hang the result anywhere in the fsp struct)
2005                  *
2006                  * we don't send all files at once
2007                  * and at the next we should *not* start from the beginning,
2008                  * so we have to cache the result
2009                  *
2010                  * --metze
2011                  */
2012
2013                 /* this works for now... */
2014                 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2015                 return;
2016         }
2017         default:
2018                 if (!logged_message) {
2019                         logged_message = True; /* Only print this once... */
2020                         DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2021                                  function));
2022                 }
2023         }
2024
2025         reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2026 }
2027
2028
2029 #ifdef HAVE_SYS_QUOTAS
2030 /****************************************************************************
2031  Reply to get user quota
2032 ****************************************************************************/
2033
2034 static void call_nt_transact_get_user_quota(connection_struct *conn,
2035                                             struct smb_request *req,
2036                                             uint16 **ppsetup,
2037                                             uint32 setup_count,
2038                                             char **ppparams,
2039                                             uint32 parameter_count,
2040                                             char **ppdata,
2041                                             uint32 data_count,
2042                                             uint32 max_data_count)
2043 {
2044         NTSTATUS nt_status = NT_STATUS_OK;
2045         char *params = *ppparams;
2046         char *pdata = *ppdata;
2047         char *entry;
2048         int data_len=0,param_len=0;
2049         int qt_len=0;
2050         int entry_len = 0;
2051         files_struct *fsp = NULL;
2052         uint16 level = 0;
2053         size_t sid_len;
2054         DOM_SID sid;
2055         bool start_enum = True;
2056         SMB_NTQUOTA_STRUCT qt;
2057         SMB_NTQUOTA_LIST *tmp_list;
2058         SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2059
2060         ZERO_STRUCT(qt);
2061
2062         /* access check */
2063         if (current_user.ut.uid != 0) {
2064                 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2065                         lp_servicename(SNUM(conn)),conn->user));
2066                 reply_doserror(req, ERRDOS, ERRnoaccess);
2067                 return;
2068         }
2069
2070         /*
2071          * Ensure minimum number of parameters sent.
2072          */
2073
2074         if (parameter_count < 4) {
2075                 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2076                 reply_doserror(req, ERRDOS, ERRinvalidparam);
2077                 return;
2078         }
2079
2080         /* maybe we can check the quota_fnum */
2081         fsp = file_fsp(SVAL(params,0));
2082         if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2083                 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2084                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2085                 return;
2086         }
2087
2088         /* the NULL pointer checking for fsp->fake_file_handle->pd
2089          * is done by CHECK_NTQUOTA_HANDLE_OK()
2090          */
2091         qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2092
2093         level = SVAL(params,2);
2094
2095         /* unknown 12 bytes leading in params */
2096
2097         switch (level) {
2098                 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2099                         /* seems that we should continue with the enum here --metze */
2100
2101                         if (qt_handle->quota_list!=NULL &&
2102                             qt_handle->tmp_list==NULL) {
2103
2104                                 /* free the list */
2105                                 free_ntquota_list(&(qt_handle->quota_list));
2106
2107                                 /* Realloc the size of parameters and data we will return */
2108                                 param_len = 4;
2109                                 params = nttrans_realloc(ppparams, param_len);
2110                                 if(params == NULL) {
2111                                         reply_doserror(req, ERRDOS, ERRnomem);
2112                                         return;
2113                                 }
2114
2115                                 data_len = 0;
2116                                 SIVAL(params,0,data_len);
2117
2118                                 break;
2119                         }
2120
2121                         start_enum = False;
2122
2123                 case TRANSACT_GET_USER_QUOTA_LIST_START:
2124
2125                         if (qt_handle->quota_list==NULL &&
2126                                 qt_handle->tmp_list==NULL) {
2127                                 start_enum = True;
2128                         }
2129
2130                         if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
2131                                 reply_doserror(req, ERRSRV, ERRerror);
2132                                 return;
2133                         }
2134
2135                         /* Realloc the size of parameters and data we will return */
2136                         param_len = 4;
2137                         params = nttrans_realloc(ppparams, param_len);
2138                         if(params == NULL) {
2139                                 reply_doserror(req, ERRDOS, ERRnomem);
2140                                 return;
2141                         }
2142
2143                         /* we should not trust the value in max_data_count*/
2144                         max_data_count = MIN(max_data_count,2048);
2145
2146                         pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2147                         if(pdata == NULL) {
2148                                 reply_doserror(req, ERRDOS, ERRnomem);
2149                                 return;
2150                         }
2151
2152                         entry = pdata;
2153
2154                         /* set params Size of returned Quota Data 4 bytes*/
2155                         /* but set it later when we know it */
2156
2157                         /* for each entry push the data */
2158
2159                         if (start_enum) {
2160                                 qt_handle->tmp_list = qt_handle->quota_list;
2161                         }
2162
2163                         tmp_list = qt_handle->tmp_list;
2164
2165                         for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2166                                 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2167
2168                                 sid_len = ndr_size_dom_sid(
2169                                         &tmp_list->quotas->sid, 0);
2170                                 entry_len = 40 + sid_len;
2171
2172                                 /* nextoffset entry 4 bytes */
2173                                 SIVAL(entry,0,entry_len);
2174
2175                                 /* then the len of the SID 4 bytes */
2176                                 SIVAL(entry,4,sid_len);
2177
2178                                 /* unknown data 8 bytes SMB_BIG_UINT */
2179                                 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2180
2181                                 /* the used disk space 8 bytes SMB_BIG_UINT */
2182                                 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2183
2184                                 /* the soft quotas 8 bytes SMB_BIG_UINT */
2185                                 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2186
2187                                 /* the hard quotas 8 bytes SMB_BIG_UINT */
2188                                 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2189
2190                                 /* and now the SID */
2191                                 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2192                         }
2193
2194                         qt_handle->tmp_list = tmp_list;
2195
2196                         /* overwrite the offset of the last entry */
2197                         SIVAL(entry-entry_len,0,0);
2198
2199                         data_len = 4+qt_len;
2200                         /* overwrite the params quota_data_len */
2201                         SIVAL(params,0,data_len);
2202
2203                         break;
2204
2205                 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2206
2207                         /* unknown 4 bytes IVAL(pdata,0) */
2208
2209                         if (data_count < 8) {
2210                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2211                                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2212                                 return;
2213                         }
2214
2215                         sid_len = IVAL(pdata,4);
2216                         /* Ensure this is less than 1mb. */
2217                         if (sid_len > (1024*1024)) {
2218                                 reply_doserror(req, ERRDOS, ERRnomem);
2219                                 return;
2220                         }
2221
2222                         if (data_count < 8+sid_len) {
2223                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2224                                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2225                                 return;
2226                         }
2227
2228                         data_len = 4+40+sid_len;
2229
2230                         if (max_data_count < data_len) {
2231                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2232                                         max_data_count, data_len));
2233                                 param_len = 4;
2234                                 SIVAL(params,0,data_len);
2235                                 data_len = 0;
2236                                 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2237                                 break;
2238                         }
2239
2240                         sid_parse(pdata+8,sid_len,&sid);
2241
2242                         if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2243                                 ZERO_STRUCT(qt);
2244                                 /*
2245                                  * we have to return zero's in all fields
2246                                  * instead of returning an error here
2247                                  * --metze
2248                                  */
2249                         }
2250
2251                         /* Realloc the size of parameters and data we will return */
2252                         param_len = 4;
2253                         params = nttrans_realloc(ppparams, param_len);
2254                         if(params == NULL) {
2255                                 reply_doserror(req, ERRDOS, ERRnomem);
2256                                 return;
2257                         }
2258
2259                         pdata = nttrans_realloc(ppdata, data_len);
2260                         if(pdata == NULL) {
2261                                 reply_doserror(req, ERRDOS, ERRnomem);
2262                                 return;
2263                         }
2264
2265                         entry = pdata;
2266
2267                         /* set params Size of returned Quota Data 4 bytes*/
2268                         SIVAL(params,0,data_len);
2269
2270                         /* nextoffset entry 4 bytes */
2271                         SIVAL(entry,0,0);
2272
2273                         /* then the len of the SID 4 bytes */
2274                         SIVAL(entry,4,sid_len);
2275
2276                         /* unknown data 8 bytes SMB_BIG_UINT */
2277                         SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2278
2279                         /* the used disk space 8 bytes SMB_BIG_UINT */
2280                         SBIG_UINT(entry,16,qt.usedspace);
2281
2282                         /* the soft quotas 8 bytes SMB_BIG_UINT */
2283                         SBIG_UINT(entry,24,qt.softlim);
2284
2285                         /* the hard quotas 8 bytes SMB_BIG_UINT */
2286                         SBIG_UINT(entry,32,qt.hardlim);
2287
2288                         /* and now the SID */
2289                         sid_linearize(entry+40, sid_len, &sid);
2290
2291                         break;
2292
2293                 default:
2294                         DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2295                         reply_doserror(req, ERRSRV, ERRerror);
2296                         return;
2297                         break;
2298         }
2299
2300         send_nt_replies(conn, req, nt_status, params, param_len,
2301                         pdata, data_len);
2302 }
2303
2304 /****************************************************************************
2305  Reply to set user quota
2306 ****************************************************************************/
2307
2308 static void call_nt_transact_set_user_quota(connection_struct *conn,
2309                                             struct smb_request *req,
2310                                             uint16 **ppsetup,
2311                                             uint32 setup_count,
2312                                             char **ppparams,
2313                                             uint32 parameter_count,
2314                                             char **ppdata,
2315                                             uint32 data_count,
2316                                             uint32 max_data_count)
2317 {
2318         char *params = *ppparams;
2319         char *pdata = *ppdata;
2320         int data_len=0,param_len=0;
2321         SMB_NTQUOTA_STRUCT qt;
2322         size_t sid_len;
2323         DOM_SID sid;
2324         files_struct *fsp = NULL;
2325
2326         ZERO_STRUCT(qt);
2327
2328         /* access check */
2329         if (current_user.ut.uid != 0) {
2330                 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2331                         lp_servicename(SNUM(conn)),conn->user));
2332                 reply_doserror(req, ERRDOS, ERRnoaccess);
2333                 return;
2334         }
2335
2336         /*
2337          * Ensure minimum number of parameters sent.
2338          */
2339
2340         if (parameter_count < 2) {
2341                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2342                 reply_doserror(req, ERRDOS, ERRinvalidparam);
2343                 return;
2344         }
2345
2346         /* maybe we can check the quota_fnum */
2347         fsp = file_fsp(SVAL(params,0));
2348         if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2349                 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2350                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2351                 return;
2352         }
2353
2354         if (data_count < 40) {
2355                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2356                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2357                 return;
2358         }
2359
2360         /* offset to next quota record.
2361          * 4 bytes IVAL(pdata,0)
2362          * unused here...
2363          */
2364
2365         /* sid len */
2366         sid_len = IVAL(pdata,4);
2367
2368         if (data_count < 40+sid_len) {
2369                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2370                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2371                 return;
2372         }
2373
2374         /* unknown 8 bytes in pdata
2375          * maybe its the change time in NTTIME
2376          */
2377
2378         /* the used space 8 bytes (SMB_BIG_UINT)*/
2379         qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2380 #ifdef LARGE_SMB_OFF_T
2381         qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2382 #else /* LARGE_SMB_OFF_T */
2383         if ((IVAL(pdata,20) != 0)&&
2384                 ((qt.usedspace != 0xFFFFFFFF)||
2385                 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2386                 /* more than 32 bits? */
2387                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2388                 return;
2389         }
2390 #endif /* LARGE_SMB_OFF_T */
2391
2392         /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2393         qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2394 #ifdef LARGE_SMB_OFF_T
2395         qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2396 #else /* LARGE_SMB_OFF_T */
2397         if ((IVAL(pdata,28) != 0)&&
2398                 ((qt.softlim != 0xFFFFFFFF)||
2399                 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2400                 /* more than 32 bits? */
2401                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2402                 return;
2403         }
2404 #endif /* LARGE_SMB_OFF_T */
2405
2406         /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2407         qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2408 #ifdef LARGE_SMB_OFF_T
2409         qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2410 #else /* LARGE_SMB_OFF_T */
2411         if ((IVAL(pdata,36) != 0)&&
2412                 ((qt.hardlim != 0xFFFFFFFF)||
2413                 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2414                 /* more than 32 bits? */
2415                 reply_doserror(req, ERRDOS, ERRunknownlevel);
2416                 return;
2417         }
2418 #endif /* LARGE_SMB_OFF_T */
2419
2420         sid_parse(pdata+40,sid_len,&sid);
2421         DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
2422
2423         /* 44 unknown bytes left... */
2424
2425         if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2426                 reply_doserror(req, ERRSRV, ERRerror);
2427                 return;
2428         }
2429
2430         send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2431                         pdata, data_len);
2432 }
2433 #endif /* HAVE_SYS_QUOTAS */
2434
2435 static void handle_nttrans(connection_struct *conn,
2436                            struct trans_state *state,
2437                            struct smb_request *req)
2438 {
2439         if (Protocol >= PROTOCOL_NT1) {
2440                 req->flags2 |= 0x40; /* IS_LONG_NAME */
2441                 SSVAL(req->inbuf,smb_flg2,req->flags2);
2442         }
2443
2444         /* Now we must call the relevant NT_TRANS function */
2445         switch(state->call) {
2446                 case NT_TRANSACT_CREATE:
2447                 {
2448                         START_PROFILE(NT_transact_create);
2449                         call_nt_transact_create(
2450                                 conn, req,
2451                                 &state->setup, state->setup_count,
2452                                 &state->param, state->total_param,
2453                                 &state->data, state->total_data,
2454                                 state->max_data_return);
2455                         END_PROFILE(NT_transact_create);
2456                         break;
2457                 }
2458
2459                 case NT_TRANSACT_IOCTL:
2460                 {
2461                         START_PROFILE(NT_transact_ioctl);
2462                         call_nt_transact_ioctl(
2463                                 conn, req,
2464                                 &state->setup, state->setup_count,
2465                                 &state->param, state->total_param,
2466                                 &state->data, state->total_data,
2467                                 state->max_data_return);
2468                         END_PROFILE(NT_transact_ioctl);
2469                         break;
2470                 }
2471
2472                 case NT_TRANSACT_SET_SECURITY_DESC:
2473                 {
2474                         START_PROFILE(NT_transact_set_security_desc);
2475                         call_nt_transact_set_security_desc(
2476                                 conn, req,
2477                                 &state->setup, state->setup_count,
2478                                 &state->param, state->total_param,
2479                                 &state->data, state->total_data,
2480                                 state->max_data_return);
2481                         END_PROFILE(NT_transact_set_security_desc);
2482                         break;
2483                 }
2484
2485                 case NT_TRANSACT_NOTIFY_CHANGE:
2486                 {
2487                         START_PROFILE(NT_transact_notify_change);
2488                         call_nt_transact_notify_change(
2489                                 conn, req,
2490                                 &state->setup, state->setup_count,
2491                                 &state->param, state->total_param,
2492                                 &state->data, state->total_data,
2493                                 state->max_data_return,
2494                                 state->max_param_return);
2495                         END_PROFILE(NT_transact_notify_change);
2496                         break;
2497                 }
2498
2499                 case NT_TRANSACT_RENAME:
2500                 {
2501                         START_PROFILE(NT_transact_rename);
2502                         call_nt_transact_rename(
2503                                 conn, req,
2504                                 &state->setup, state->setup_count,
2505                                 &state->param, state->total_param,
2506                                 &state->data, state->total_data,
2507                                 state->max_data_return);
2508                         END_PROFILE(NT_transact_rename);
2509                         break;
2510                 }
2511
2512                 case NT_TRANSACT_QUERY_SECURITY_DESC:
2513                 {
2514                         START_PROFILE(NT_transact_query_security_desc);
2515                         call_nt_transact_query_security_desc(
2516                                 conn, req,
2517                                 &state->setup, state->setup_count,
2518                                 &state->param, state->total_param,
2519                                 &state->data, state->total_data,
2520                                 state->max_data_return);
2521                         END_PROFILE(NT_transact_query_security_desc);
2522                         break;
2523                 }
2524
2525 #ifdef HAVE_SYS_QUOTAS
2526                 case NT_TRANSACT_GET_USER_QUOTA:
2527                 {
2528                         START_PROFILE(NT_transact_get_user_quota);
2529                         call_nt_transact_get_user_quota(
2530                                 conn, req,
2531                                 &state->setup, state->setup_count,
2532                                 &state->param, state->total_param,
2533                                 &state->data, state->total_data,
2534                                 state->max_data_return);
2535                         END_PROFILE(NT_transact_get_user_quota);
2536                         break;
2537                 }
2538
2539                 case NT_TRANSACT_SET_USER_QUOTA:
2540                 {
2541                         START_PROFILE(NT_transact_set_user_quota);
2542                         call_nt_transact_set_user_quota(
2543                                 conn, req,
2544                                 &state->setup, state->setup_count,
2545                                 &state->param, state->total_param,
2546                                 &state->data, state->total_data,
2547                                 state->max_data_return);
2548                         END_PROFILE(NT_transact_set_user_quota);
2549                         break;
2550                 }
2551 #endif /* HAVE_SYS_QUOTAS */
2552
2553                 default:
2554                         /* Error in request */
2555                         DEBUG(0,("handle_nttrans: Unknown request %d in "
2556                                  "nttrans call\n", state->call));
2557                         reply_doserror(req, ERRSRV, ERRerror);
2558                         return;
2559         }
2560         return;
2561 }
2562
2563 /****************************************************************************
2564  Reply to a SMBNTtrans.
2565 ****************************************************************************/
2566
2567 void reply_nttrans(struct smb_request *req)
2568 {
2569         connection_struct *conn = req->conn;
2570         uint32_t pscnt;
2571         uint32_t psoff;
2572         uint32_t dscnt;
2573         uint32_t dsoff;
2574         uint16 function_code;
2575         NTSTATUS result;
2576         struct trans_state *state;
2577         uint32_t size;
2578         uint32_t av_size;
2579
2580         START_PROFILE(SMBnttrans);
2581
2582         if (req->wct < 19) {
2583                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2584                 END_PROFILE(SMBnttrans);
2585                 return;
2586         }
2587
2588         size = smb_len(req->inbuf) + 4;
2589         av_size = smb_len(req->inbuf);
2590         pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
2591         psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
2592         dscnt = IVAL(req->inbuf,smb_nt_DataCount);
2593         dsoff = IVAL(req->inbuf,smb_nt_DataOffset);
2594         function_code = SVAL(req->inbuf, smb_nt_Function);
2595
2596         if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2597                 reply_doserror(req, ERRSRV, ERRaccess);
2598                 END_PROFILE(SMBnttrans);
2599                 return;
2600         }
2601
2602         result = allow_new_trans(conn->pending_trans, req->mid);
2603         if (!NT_STATUS_IS_OK(result)) {
2604                 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2605                 reply_nterror(req, result);
2606                 END_PROFILE(SMBnttrans);
2607                 return;
2608         }
2609
2610         if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
2611                 reply_doserror(req, ERRSRV, ERRaccess);
2612                 END_PROFILE(SMBnttrans);
2613                 return;
2614         }
2615
2616         state->cmd = SMBnttrans;
2617
2618         state->mid = req->mid;
2619         state->vuid = req->vuid;
2620         state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount);
2621         state->data = NULL;
2622         state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount);
2623         state->param = NULL;
2624         state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount);
2625         state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount);
2626
2627         /* setup count is in *words* */
2628         state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount);
2629         state->setup = NULL;
2630         state->call = function_code;
2631
2632         /*
2633          * All nttrans messages we handle have smb_wct == 19 +
2634          * state->setup_count.  Ensure this is so as a sanity check.
2635          */
2636
2637         if(req->wct != 19 + (state->setup_count/2)) {
2638                 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
2639                          req->wct, 19 + (state->setup_count/2)));
2640                 goto bad_param;
2641         }
2642
2643         /* Don't allow more than 128mb for each value. */
2644         if ((state->total_data > (1024*1024*128)) ||
2645             (state->total_param > (1024*1024*128))) {
2646                 reply_doserror(req, ERRDOS, ERRnomem);
2647                 END_PROFILE(SMBnttrans);
2648                 return;
2649         }
2650
2651         if ((dscnt > state->total_data) || (pscnt > state->total_param))
2652                 goto bad_param;
2653
2654         if (state->total_data)  {
2655                 /* Can't use talloc here, the core routines do realloc on the
2656                  * params and data. */
2657                 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
2658                         DEBUG(0,("reply_nttrans: data malloc fail for %u "
2659                                  "bytes !\n", (unsigned int)state->total_data));
2660                         TALLOC_FREE(state);
2661                         reply_doserror(req, ERRDOS, ERRnomem);
2662                         END_PROFILE(SMBnttrans);
2663                         return;
2664                 }
2665
2666                 if (dscnt > state->total_data ||
2667                                 dsoff+dscnt < dsoff) {
2668                         goto bad_param;
2669                 }
2670
2671                 if (dsoff > av_size ||
2672                                 dscnt > av_size ||
2673                                 dsoff+dscnt > av_size) {
2674                         goto bad_param;
2675                 }
2676
2677                 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
2678         }
2679
2680         if (state->total_param) {
2681                 /* Can't use talloc here, the core routines do realloc on the
2682                  * params and data. */
2683                 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
2684                         DEBUG(0,("reply_nttrans: param malloc fail for %u "
2685                                  "bytes !\n", (unsigned int)state->total_param));
2686                         SAFE_FREE(state->data);
2687                         TALLOC_FREE(state);
2688                         reply_doserror(req, ERRDOS, ERRnomem);
2689                         END_PROFILE(SMBnttrans);
2690                         return;
2691                 }
2692
2693                 if (pscnt > state->total_param ||
2694                                 psoff+pscnt < psoff) {
2695                         goto bad_param;
2696                 }
2697
2698                 if (psoff > av_size ||
2699                                 pscnt > av_size ||
2700                                 psoff+pscnt > av_size) {
2701                         goto bad_param;
2702                 }
2703
2704                 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
2705         }
2706
2707         state->received_data  = dscnt;
2708         state->received_param = pscnt;
2709
2710         if(state->setup_count > 0) {
2711                 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
2712                           state->setup_count));
2713                 state->setup = (uint16 *)TALLOC(state, state->setup_count);
2714                 if (state->setup == NULL) {
2715                         DEBUG(0,("reply_nttrans : Out of memory\n"));
2716                         SAFE_FREE(state->data);
2717                         SAFE_FREE(state->param);
2718                         TALLOC_FREE(state);
2719                         reply_doserror(req, ERRDOS, ERRnomem);
2720                         END_PROFILE(SMBnttrans);
2721                         return;
2722                 }
2723
2724                 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
2725                     (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
2726                         goto bad_param;
2727                 }
2728                 if (smb_nt_SetupStart + state->setup_count > size) {
2729                         goto bad_param;
2730                 }
2731
2732                 memcpy( state->setup, &req->inbuf[smb_nt_SetupStart],
2733                         state->setup_count);
2734                 dump_data(10, (uint8 *)state->setup, state->setup_count);
2735         }
2736
2737         if ((state->received_data == state->total_data) &&
2738             (state->received_param == state->total_param)) {
2739                 handle_nttrans(conn, state, req);
2740                 SAFE_FREE(state->param);
2741                 SAFE_FREE(state->data);
2742                 TALLOC_FREE(state);
2743                 END_PROFILE(SMBnttrans);
2744                 return;
2745         }
2746
2747         DLIST_ADD(conn->pending_trans, state);
2748
2749         /* We need to send an interim response then receive the rest
2750            of the parameter/data bytes */
2751         reply_outbuf(req, 0, 0);
2752         show_msg((char *)req->outbuf);
2753         END_PROFILE(SMBnttrans);
2754         return;
2755
2756   bad_param:
2757
2758         DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
2759         SAFE_FREE(state->data);
2760         SAFE_FREE(state->param);
2761         TALLOC_FREE(state);
2762         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2763         END_PROFILE(SMBnttrans);
2764         return;
2765 }
2766
2767 /****************************************************************************
2768  Reply to a SMBnttranss
2769  ****************************************************************************/
2770
2771 void reply_nttranss(struct smb_request *req)
2772 {
2773         connection_struct *conn = req->conn;
2774         uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
2775         struct trans_state *state;
2776         uint32_t av_size;
2777         uint32_t size;
2778
2779         START_PROFILE(SMBnttranss);
2780
2781         show_msg((char *)req->inbuf);
2782
2783         if (req->wct < 18) {
2784                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2785                 END_PROFILE(SMBnttranss);
2786                 return;
2787         }
2788
2789         for (state = conn->pending_trans; state != NULL;
2790              state = state->next) {
2791                 if (state->mid == req->mid) {
2792                         break;
2793                 }
2794         }
2795
2796         if ((state == NULL) || (state->cmd != SMBnttrans)) {
2797                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2798                 END_PROFILE(SMBnttranss);
2799                 return;
2800         }
2801
2802         /* Revise state->total_param and state->total_data in case they have
2803            changed downwards */
2804         if (IVAL(req->inbuf, smb_nts_TotalParameterCount)
2805             < state->total_param) {
2806                 state->total_param = IVAL(req->inbuf,
2807                                           smb_nts_TotalParameterCount);
2808         }
2809         if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) {
2810                 state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount);
2811         }
2812
2813         size = smb_len(req->inbuf) + 4;
2814         av_size = smb_len(req->inbuf);
2815
2816         pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
2817         poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
2818         pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement);
2819
2820         dcnt = IVAL(req->inbuf, smb_nts_DataCount);
2821         ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement);
2822         doff = IVAL(req->inbuf, smb_nts_DataOffset);
2823
2824         state->received_param += pcnt;
2825         state->received_data += dcnt;
2826
2827         if ((state->received_data > state->total_data) ||
2828             (state->received_param > state->total_param))
2829                 goto bad_param;
2830
2831         if (pcnt) {
2832                 if (pdisp > state->total_param ||
2833                                 pcnt > state->total_param ||
2834                                 pdisp+pcnt > state->total_param ||
2835                                 pdisp+pcnt < pdisp) {
2836                         goto bad_param;
2837                 }
2838
2839                 if (poff > av_size ||
2840                                 pcnt > av_size ||
2841                                 poff+pcnt > av_size ||
2842                                 poff+pcnt < poff) {
2843                         goto bad_param;
2844                 }
2845
2846                 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
2847                        pcnt);
2848         }
2849
2850         if (dcnt) {
2851                 if (ddisp > state->total_data ||
2852                                 dcnt > state->total_data ||
2853                                 ddisp+dcnt > state->total_data ||
2854                                 ddisp+dcnt < ddisp) {
2855                         goto bad_param;
2856                 }
2857
2858                 if (ddisp > av_size ||
2859                                 dcnt > av_size ||
2860                                 ddisp+dcnt > av_size ||
2861                                 ddisp+dcnt < ddisp) {
2862                         goto bad_param;
2863                 }
2864
2865                 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
2866                        dcnt);
2867         }
2868
2869         if ((state->received_param < state->total_param) ||
2870             (state->received_data < state->total_data)) {
2871                 END_PROFILE(SMBnttranss);
2872                 return;
2873         }
2874
2875         /*
2876          * construct_reply_common will copy smb_com from inbuf to
2877          * outbuf. SMBnttranss is wrong here.
2878          */
2879         SCVAL(req->inbuf,smb_com,SMBnttrans);
2880
2881         handle_nttrans(conn, state, req);
2882
2883         DLIST_REMOVE(conn->pending_trans, state);
2884         SAFE_FREE(state->data);
2885         SAFE_FREE(state->param);
2886         TALLOC_FREE(state);
2887         END_PROFILE(SMBnttranss);
2888         return;
2889
2890   bad_param:
2891
2892         DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
2893         DLIST_REMOVE(conn->pending_trans, state);
2894         SAFE_FREE(state->data);
2895         SAFE_FREE(state->param);
2896         TALLOC_FREE(state);
2897         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2898         END_PROFILE(SMBnttranss);
2899         return;
2900 }