source3/smbd/smb2_create.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) Jeremy Allison 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/globals.h"
  24 #include "../libcli/smb/smb_common.h"
  25
  26 int map_smb2_oplock_levels_to_samba(uint8_t in_oplock_level)
  27 {
  28         switch(in_oplock_level) {
  29         case SMB2_OPLOCK_LEVEL_NONE:
  30                 return NO_OPLOCK;
  31         case SMB2_OPLOCK_LEVEL_II:
  32                 return LEVEL_II_OPLOCK;
  33         case SMB2_OPLOCK_LEVEL_EXCLUSIVE:
  34                 return EXCLUSIVE_OPLOCK;
  35         case SMB2_OPLOCK_LEVEL_BATCH:
  36                 return BATCH_OPLOCK;
  37         case SMB2_OPLOCK_LEVEL_LEASE:
  38                 DEBUG(2,("map_smb2_oplock_levels_to_samba: "
  39                         "LEASE_OPLOCK_REQUESTED\n"));
  40                 return NO_OPLOCK;
  41         default:
  42                 DEBUG(2,("map_smb2_oplock_levels_to_samba: "
  43                         "unknown level %u\n",
  44                         (unsigned int)in_oplock_level));
  45                 return NO_OPLOCK;
  46         }
  47 }
  48
  49 static uint8_t map_samba_oplock_levels_to_smb2(int oplock_type)
  50 {
  51         if (BATCH_OPLOCK_TYPE(oplock_type)) {
  52                 return SMB2_OPLOCK_LEVEL_BATCH;
  53         } else if (EXCLUSIVE_OPLOCK_TYPE(oplock_type)) {
  54                 return SMB2_OPLOCK_LEVEL_EXCLUSIVE;
  55         } else if (oplock_type == LEVEL_II_OPLOCK) {
  56                 /*
  57                  * Don't use LEVEL_II_OPLOCK_TYPE here as
  58                  * this also includes FAKE_LEVEL_II_OPLOCKs
  59                  * which are internal only.
  60                  */
  61                 return SMB2_OPLOCK_LEVEL_II;
  62         } else {
  63                 return SMB2_OPLOCK_LEVEL_NONE;
  64         }
  65 }
  66
  67 static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
  68                         struct tevent_context *ev,
  69                         struct smbd_smb2_request *smb2req,
  70                         uint8_t in_oplock_level,
  71                         uint32_t in_impersonation_level,
  72                         uint32_t in_desired_access,
  73                         uint32_t in_file_attributes,
  74                         uint32_t in_share_access,
  75                         uint32_t in_create_disposition,
  76                         uint32_t in_create_options,
  77                         const char *in_name,
  78                         struct smb2_create_blobs in_context_blobs);
  79 static NTSTATUS smbd_smb2_create_recv(struct tevent_req *req,
  80                         TALLOC_CTX *mem_ctx,
  81                         uint8_t *out_oplock_level,
  82                         uint32_t *out_create_action,
  83                         NTTIME *out_creation_time,
  84                         NTTIME *out_last_access_time,
  85                         NTTIME *out_last_write_time,
  86                         NTTIME *out_change_time,
  87                         uint64_t *out_allocation_size,
  88                         uint64_t *out_end_of_file,
  89                         uint32_t *out_file_attributes,
  90                         uint64_t *out_file_id_volatile,
  91                         struct smb2_create_blobs *out_context_blobs);
  92
  93 static void smbd_smb2_request_create_done(struct tevent_req *tsubreq);
  94 NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
  95 {
  96         const uint8_t *inbody;
  97         int i = smb2req->current_idx;
  98         size_t expected_body_size = 0x39;
  99         size_t body_size;
 100         uint8_t in_oplock_level;
 101         uint32_t in_impersonation_level;
 102         uint32_t in_desired_access;
 103         uint32_t in_file_attributes;
 104         uint32_t in_share_access;
 105         uint32_t in_create_disposition;
 106         uint32_t in_create_options;
 107         uint16_t in_name_offset;
 108         uint16_t in_name_length;
 109         DATA_BLOB in_name_buffer;
 110         char *in_name_string;
 111         size_t in_name_string_size;
 112         uint32_t name_offset = 0;
 113         uint32_t name_available_length = 0;
 114         uint32_t in_context_offset;
 115         uint32_t in_context_length;
 116         DATA_BLOB in_context_buffer;
 117         struct smb2_create_blobs in_context_blobs;
 118         uint32_t context_offset = 0;
 119         uint32_t context_available_length = 0;
 120         uint32_t dyn_offset;
 121         NTSTATUS status;
 122         bool ok;
 123         struct tevent_req *tsubreq;
 124
 125         if (smb2req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
 126                 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
 127         }
 128
 129         inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
 130
 131         body_size = SVAL(inbody, 0x00);
 132         if (body_size != expected_body_size) {
 133                 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
 134         }
 135
 136         in_oplock_level         = CVAL(inbody, 0x03);
 137         in_impersonation_level  = IVAL(inbody, 0x04);
 138         in_desired_access       = IVAL(inbody, 0x18);
 139         in_file_attributes      = IVAL(inbody, 0x1C);
 140         in_share_access         = IVAL(inbody, 0x20);
 141         in_create_disposition   = IVAL(inbody, 0x24);
 142         in_create_options       = IVAL(inbody, 0x28);
 143         in_name_offset          = SVAL(inbody, 0x2C);
 144         in_name_length          = SVAL(inbody, 0x2E);
 145         in_context_offset       = IVAL(inbody, 0x30);
 146         in_context_length       = IVAL(inbody, 0x34);
 147
 148         /*
 149          * First check if the dynamic name and context buffers
 150          * are correctly specified.
 151          *
 152          * Note: That we don't check if the name and context buffers
 153          *       overlap
 154          */
 155
 156         dyn_offset = SMB2_HDR_BODY + (body_size & 0xFFFFFFFE);
 157
 158         if (in_name_offset == 0 && in_name_length == 0) {
 159                 /* This is ok */
 160                 name_offset = 0;
 161         } else if (in_name_offset < dyn_offset) {
 162                 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
 163         } else {
 164                 name_offset = in_name_offset - dyn_offset;
 165         }
 166
 167         if (name_offset > smb2req->in.vector[i+2].iov_len) {
 168                 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
 169         }
 170
 171         name_available_length = smb2req->in.vector[i+2].iov_len - name_offset;
 172
 173         if (in_name_length > name_available_length) {
 174                 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
 175         }
 176
 177         in_name_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base +
 178                               name_offset;
 179         in_name_buffer.length = in_name_length;
 180
 181         if (in_context_offset == 0 && in_context_length == 0) {
 182                 /* This is ok */
 183                 context_offset = 0;
 184         } else if (in_context_offset < dyn_offset) {
 185                 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
 186         } else {
 187                 context_offset = in_context_offset - dyn_offset;
 188         }
 189
 190         if (context_offset > smb2req->in.vector[i+2].iov_len) {
 191                 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
 192         }
 193
 194         context_available_length = smb2req->in.vector[i+2].iov_len - context_offset;
 195
 196         if (in_context_length > context_available_length) {
 197                 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
 198         }
 199
 200         in_context_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base +
 201                                   context_offset;
 202         in_context_buffer.length = in_context_length;
 203
 204         /*
 205          * Now interpret the name and context buffers
 206          */
 207
 208         ok = convert_string_talloc(smb2req, CH_UTF16, CH_UNIX,
 209                                    in_name_buffer.data,
 210                                    in_name_buffer.length,
 211                                    &in_name_string,
 212                                    &in_name_string_size, false);
 213         if (!ok) {
 214                 return smbd_smb2_request_error(smb2req, NT_STATUS_ILLEGAL_CHARACTER);
 215         }
 216
 217         ZERO_STRUCT(in_context_blobs);
 218         status = smb2_create_blob_parse(smb2req, in_context_buffer, &in_context_blobs);
 219         if (!NT_STATUS_IS_OK(status)) {
 220                 return smbd_smb2_request_error(smb2req, status);
 221         }
 222
 223         tsubreq = smbd_smb2_create_send(smb2req,
 224                                        smb2req->sconn->smb2.event_ctx,
 225                                        smb2req,
 226                                        in_oplock_level,
 227                                        in_impersonation_level,
 228                                        in_desired_access,
 229                                        in_file_attributes,
 230                                        in_share_access,
 231                                        in_create_disposition,
 232                                        in_create_options,
 233                                        in_name_string,
 234                                        in_context_blobs);
 235         if (tsubreq == NULL) {
 236                 smb2req->subreq = NULL;
 237                 return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
 238         }
 239         tevent_req_set_callback(tsubreq, smbd_smb2_request_create_done, smb2req);
 240
 241         return smbd_smb2_request_pending_queue(smb2req, tsubreq);
 242 }
 243
 244 static uint64_t get_mid_from_smb2req(struct smbd_smb2_request *smb2req)
 245 {
 246         uint8_t *reqhdr = (uint8_t *)smb2req->out.vector[smb2req->current_idx].iov_base;
 247         return BVAL(reqhdr, SMB2_HDR_MESSAGE_ID);
 248 }
 249
 250 static void smbd_smb2_request_create_done(struct tevent_req *tsubreq)
 251 {
 252         struct smbd_smb2_request *smb2req = tevent_req_callback_data(tsubreq,
 253                                         struct smbd_smb2_request);
 254         int i = smb2req->current_idx;
 255         uint8_t *outhdr;
 256         DATA_BLOB outbody;
 257         DATA_BLOB outdyn;
 258         uint8_t out_oplock_level = 0;
 259         uint32_t out_create_action = 0;
 260         NTTIME out_creation_time = 0;
 261         NTTIME out_last_access_time = 0;
 262         NTTIME out_last_write_time = 0;
 263         NTTIME out_change_time = 0;
 264         uint64_t out_allocation_size = 0;
 265         uint64_t out_end_of_file = 0;
 266         uint32_t out_file_attributes = 0;
 267         uint64_t out_file_id_volatile = 0;
 268         struct smb2_create_blobs out_context_blobs;
 269         DATA_BLOB out_context_buffer;
 270         uint16_t out_context_buffer_offset = 0;
 271         NTSTATUS status;
 272         NTSTATUS error; /* transport error */
 273
 274         if (smb2req->cancelled) {
 275                 uint64_t mid = get_mid_from_smb2req(smb2req);
 276                 DEBUG(10,("smbd_smb2_request_create_done: cancelled mid %llu\n",
 277                         (unsigned long long)mid ));
 278                 error = smbd_smb2_request_error(smb2req, NT_STATUS_CANCELLED);
 279                 if (!NT_STATUS_IS_OK(error)) {
 280                         smbd_server_connection_terminate(smb2req->sconn,
 281                                 nt_errstr(error));
 282                         return;
 283                 }
 284                 return;
 285         }
 286
 287         status = smbd_smb2_create_recv(tsubreq,
 288                                        smb2req,
 289                                        &out_oplock_level,
 290                                        &out_create_action,
 291                                        &out_creation_time,
 292                                        &out_last_access_time,
 293                                        &out_last_write_time,
 294                                        &out_change_time,
 295                                        &out_allocation_size,
 296                                        &out_end_of_file,
 297                                        &out_file_attributes,
 298                                        &out_file_id_volatile,
 299                                        &out_context_blobs);
 300         if (!NT_STATUS_IS_OK(status)) {
 301                 error = smbd_smb2_request_error(smb2req, status);
 302                 if (!NT_STATUS_IS_OK(error)) {
 303                         smbd_server_connection_terminate(smb2req->sconn,
 304                                                          nt_errstr(error));
 305                         return;
 306                 }
 307                 return;
 308         }
 309
 310         status = smb2_create_blob_push(smb2req, &out_context_buffer, out_context_blobs);
 311         if (!NT_STATUS_IS_OK(status)) {
 312                 error = smbd_smb2_request_error(smb2req, status);
 313                 if (!NT_STATUS_IS_OK(error)) {
 314                         smbd_server_connection_terminate(smb2req->sconn,
 315                                                          nt_errstr(error));
 316                         return;
 317                 }
 318                 return;
 319         }
 320
 321         if (out_context_buffer.length > 0) {
 322                 out_context_buffer_offset = SMB2_HDR_BODY + 0x58;
 323         }
 324
 325         outhdr = (uint8_t *)smb2req->out.vector[i].iov_base;
 326
 327         outbody = data_blob_talloc(smb2req->out.vector, NULL, 0x58);
 328         if (outbody.data == NULL) {
 329                 error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
 330                 if (!NT_STATUS_IS_OK(error)) {
 331                         smbd_server_connection_terminate(smb2req->sconn,
 332                                                          nt_errstr(error));
 333                         return;
 334                 }
 335                 return;
 336         }
 337
 338         SSVAL(outbody.data, 0x00, 0x58 + 1);    /* struct size */
 339         SCVAL(outbody.data, 0x02,
 340               out_oplock_level);                /* oplock level */
 341         SCVAL(outbody.data, 0x03, 0);           /* reserved */
 342         SIVAL(outbody.data, 0x04,
 343               out_create_action);               /* create action */
 344         SBVAL(outbody.data, 0x08,
 345               out_creation_time);               /* creation time */
 346         SBVAL(outbody.data, 0x10,
 347               out_last_access_time);            /* last access time */
 348         SBVAL(outbody.data, 0x18,
 349               out_last_write_time);             /* last write time */
 350         SBVAL(outbody.data, 0x20,
 351               out_change_time);                 /* change time */
 352         SBVAL(outbody.data, 0x28,
 353               out_allocation_size);             /* allocation size */
 354         SBVAL(outbody.data, 0x30,
 355               out_end_of_file);                 /* end of file */
 356         SIVAL(outbody.data, 0x38,
 357               out_file_attributes);             /* file attributes */
 358         SIVAL(outbody.data, 0x3C, 0);           /* reserved */
 359         SBVAL(outbody.data, 0x40, 0);           /* file id (persistent) */
 360         SBVAL(outbody.data, 0x48,
 361               out_file_id_volatile);            /* file id (volatile) */
 362         SIVAL(outbody.data, 0x50,
 363               out_context_buffer_offset);       /* create contexts offset */
 364         SIVAL(outbody.data, 0x54,
 365               out_context_buffer.length);       /* create contexts length */
 366
 367         outdyn = out_context_buffer;
 368
 369         error = smbd_smb2_request_done(smb2req, outbody, &outdyn);
 370         if (!NT_STATUS_IS_OK(error)) {
 371                 smbd_server_connection_terminate(smb2req->sconn,
 372                                                  nt_errstr(error));
 373                 return;
 374         }
 375 }
 376
 377 struct smbd_smb2_create_state {
 378         struct smbd_smb2_request *smb2req;
 379         struct smb_request *smb1req;
 380         struct timed_event *te;
 381         struct tevent_immediate *im;
 382         struct timeval request_time;
 383         struct file_id id;
 384         DATA_BLOB private_data;
 385         uint8_t out_oplock_level;
 386         uint32_t out_create_action;
 387         NTTIME out_creation_time;
 388         NTTIME out_last_access_time;
 389         NTTIME out_last_write_time;
 390         NTTIME out_change_time;
 391         uint64_t out_allocation_size;
 392         uint64_t out_end_of_file;
 393         uint32_t out_file_attributes;
 394         uint64_t out_file_id_volatile;
 395         struct smb2_create_blobs out_context_blobs;
 396 };
 397
 398 static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 399                         struct tevent_context *ev,
 400                         struct smbd_smb2_request *smb2req,
 401                         uint8_t in_oplock_level,
 402                         uint32_t in_impersonation_level,
 403                         uint32_t in_desired_access,
 404                         uint32_t in_file_attributes,
 405                         uint32_t in_share_access,
 406                         uint32_t in_create_disposition,
 407                         uint32_t in_create_options,
 408                         const char *in_name,
 409                         struct smb2_create_blobs in_context_blobs)
 410 {
 411         struct tevent_req *req = NULL;
 412         struct smbd_smb2_create_state *state = NULL;
 413         NTSTATUS status;
 414         struct smb_request *smb1req = NULL;
 415         files_struct *result = NULL;
 416         int info;
 417         struct timespec write_time_ts;
 418         struct smb2_create_blobs out_context_blobs;
 419
 420         ZERO_STRUCT(out_context_blobs);
 421
 422         if (!smb2req->async) {
 423                 /* New create call. */
 424                 req = tevent_req_create(mem_ctx, &state,
 425                                 struct smbd_smb2_create_state);
 426                 if (req == NULL) {
 427                         return NULL;
 428                 }
 429                 state->smb2req = smb2req;
 430                 smb2req->subreq = req; /* So we can find this when going async. */
 431
 432                 smb1req = smbd_smb2_fake_smb_request(smb2req);
 433                 if (tevent_req_nomem(smb1req, req)) {
 434                         return tevent_req_post(req, ev);
 435                 }
 436                 state->smb1req = smb1req;
 437                 DEBUG(10,("smbd_smb2_create: name[%s]\n",
 438                         in_name));
 439         } else {
 440                 /* Re-entrant create call. */
 441                 req = smb2req->subreq;
 442                 state = tevent_req_data(req,
 443                                 struct smbd_smb2_create_state);
 444                 smb1req = state->smb1req;
 445                 DEBUG(10,("smbd_smb2_create_send: reentrant for file %s\n",
 446                         in_name ));
 447         }
 448
 449         if (IS_IPC(smb1req->conn)) {
 450                 const char *pipe_name = in_name;
 451
 452                 if (!lp_nt_pipe_support()) {
 453                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 454                         return tevent_req_post(req, ev);
 455                 }
 456
 457                 /* Strip \\ off the name. */
 458                 if (pipe_name[0] == '\\') {
 459                         pipe_name++;
 460                 }
 461
 462                 status = open_np_file(smb1req, pipe_name, &result);
 463                 if (!NT_STATUS_IS_OK(status)) {
 464                         tevent_req_nterror(req, status);
 465                         return tevent_req_post(req, ev);
 466                 }
 467                 info = FILE_WAS_OPENED;
 468         } else if (CAN_PRINT(smb1req->conn)) {
 469                 status = file_new(smb1req, smb1req->conn, &result);
 470                 if(!NT_STATUS_IS_OK(status)) {
 471                         tevent_req_nterror(req, status);
 472                         return tevent_req_post(req, ev);
 473                 }
 474
 475                 status = print_fsp_open(smb1req,
 476                                         smb1req->conn,
 477                                         in_name,
 478                                         smb1req->vuid,
 479                                         result);
 480                 if (!NT_STATUS_IS_OK(status)) {
 481                         file_free(smb1req, result);
 482                         tevent_req_nterror(req, status);
 483                         return tevent_req_post(req, ev);
 484                 }
 485                 info = FILE_WAS_CREATED;
 486         } else {
 487                 char *fname;
 488                 struct smb_filename *smb_fname = NULL;
 489                 struct smb2_create_blob *exta = NULL;
 490                 struct ea_list *ea_list = NULL;
 491                 struct smb2_create_blob *mxac = NULL;
 492                 NTTIME max_access_time = 0;
 493                 struct smb2_create_blob *secd = NULL;
 494                 struct security_descriptor *sec_desc = NULL;
 495                 struct smb2_create_blob *dhnq = NULL;
 496                 struct smb2_create_blob *dhnc = NULL;
 497                 struct smb2_create_blob *alsi = NULL;
 498                 uint64_t allocation_size = 0;
 499                 struct smb2_create_blob *twrp = NULL;
 500                 struct smb2_create_blob *qfid = NULL;
 501
 502                 exta = smb2_create_blob_find(&in_context_blobs,
 503                                              SMB2_CREATE_TAG_EXTA);
 504                 mxac = smb2_create_blob_find(&in_context_blobs,
 505                                              SMB2_CREATE_TAG_MXAC);
 506                 secd = smb2_create_blob_find(&in_context_blobs,
 507                                              SMB2_CREATE_TAG_SECD);
 508                 dhnq = smb2_create_blob_find(&in_context_blobs,
 509                                              SMB2_CREATE_TAG_DHNQ);
 510                 dhnc = smb2_create_blob_find(&in_context_blobs,
 511                                              SMB2_CREATE_TAG_DHNC);
 512                 alsi = smb2_create_blob_find(&in_context_blobs,
 513                                              SMB2_CREATE_TAG_ALSI);
 514                 twrp = smb2_create_blob_find(&in_context_blobs,
 515                                              SMB2_CREATE_TAG_TWRP);
 516                 qfid = smb2_create_blob_find(&in_context_blobs,
 517                                              SMB2_CREATE_TAG_QFID);
 518
 519                 fname = talloc_strdup(state, in_name);
 520                 if (tevent_req_nomem(fname, req)) {
 521                         return tevent_req_post(req, ev);
 522                 }
 523
 524                 if (exta) {
 525                         if (dhnc) {
 526                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 527                                 return tevent_req_post(req, ev);
 528                         }
 529
 530                         ea_list = read_nttrans_ea_list(mem_ctx,
 531                                 (const char *)exta->data.data, exta->data.length);
 532                         if (!ea_list) {
 533                                 DEBUG(10,("smbd_smb2_create_send: read_ea_name_list failed.\n"));
 534                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 535                                 return tevent_req_post(req, ev);
 536                         }
 537                 }
 538
 539                 if (mxac) {
 540                         if (dhnc) {
 541                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 542                                 return tevent_req_post(req, ev);
 543                         }
 544
 545                         if (mxac->data.length == 0) {
 546                                 max_access_time = 0;
 547                         } else if (mxac->data.length == 8) {
 548                                 max_access_time = BVAL(mxac->data.data, 0);
 549                         } else {
 550                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 551                                 return tevent_req_post(req, ev);
 552                         }
 553                 }
 554
 555                 if (secd) {
 556                         enum ndr_err_code ndr_err;
 557
 558                         if (dhnc) {
 559                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 560                                 return tevent_req_post(req, ev);
 561                         }
 562
 563                         sec_desc = talloc_zero(state, struct security_descriptor);
 564                         if (tevent_req_nomem(sec_desc, req)) {
 565                                 return tevent_req_post(req, ev);
 566                         }
 567
 568                         ndr_err = ndr_pull_struct_blob(&secd->data,
 569                                 sec_desc, sec_desc,
 570                                 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
 571                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 572                                 DEBUG(2,("ndr_pull_security_descriptor failed: %s\n",
 573                                          ndr_errstr(ndr_err)));
 574                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 575                                 return tevent_req_post(req, ev);
 576                         }
 577                 }
 578
 579                 if (dhnq) {
 580                         if (dhnc) {
 581                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 582                                 return tevent_req_post(req, ev);
 583                         }
 584
 585                         if (dhnq->data.length != 16) {
 586                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 587                                 return tevent_req_post(req, ev);
 588                         }
 589                         /*
 590                          * we don't support durable handles yet
 591                          * and have to ignore this
 592                          */
 593                 }
 594
 595                 if (dhnc) {
 596                         if (dhnc->data.length != 16) {
 597                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 598                                 return tevent_req_post(req, ev);
 599                         }
 600                         /* we don't support durable handles yet */
 601                         tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
 602                         return tevent_req_post(req, ev);
 603                 }
 604
 605                 if (alsi) {
 606                         if (dhnc) {
 607                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 608                                 return tevent_req_post(req, ev);
 609                         }
 610
 611                         if (alsi->data.length != 8) {
 612                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 613                                 return tevent_req_post(req, ev);
 614                         }
 615                         allocation_size = BVAL(alsi->data.data, 0);
 616                 }
 617
 618                 if (twrp) {
 619                         NTTIME nttime;
 620                         time_t t;
 621                         struct tm *tm;
 622
 623                         if (dhnc) {
 624                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 625                                 return tevent_req_post(req, ev);
 626                         }
 627
 628                         if (twrp->data.length != 8) {
 629                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 630                                 return tevent_req_post(req, ev);
 631                         }
 632
 633                         nttime = BVAL(twrp->data.data, 0);
 634                         t = nt_time_to_unix(nttime);
 635                         tm = gmtime(&t);
 636
 637                         TALLOC_FREE(fname);
 638                         fname = talloc_asprintf(state,
 639                                         "@GMT-%04u.%02u.%02u-%02u.%02u.%02u\\%s",
 640                                         tm->tm_year + 1900,
 641                                         tm->tm_mon + 1,
 642                                         tm->tm_mday,
 643                                         tm->tm_hour,
 644                                         tm->tm_min,
 645                                         tm->tm_sec,
 646                                         in_name);
 647                         if (tevent_req_nomem(fname, req)) {
 648                                 return tevent_req_post(req, ev);
 649                         }
 650                 }
 651
 652                 if (qfid) {
 653                         if (qfid->data.length != 0) {
 654                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 655                                 return tevent_req_post(req, ev);
 656                         }
 657                 }
 658
 659                 /* these are ignored for SMB2 */
 660                 in_create_options &= ~(0x10);/* NTCREATEX_OPTIONS_SYNC_ALERT */
 661                 in_create_options &= ~(0x20);/* NTCREATEX_OPTIONS_ASYNC_ALERT */
 662
 663                 /* convert '\\' into '/' */
 664                 status = check_path_syntax(fname);
 665                 if (!NT_STATUS_IS_OK(status)) {
 666                         tevent_req_nterror(req, status);
 667                         return tevent_req_post(req, ev);
 668                 }
 669
 670                 status = filename_convert(req,
 671                                           smb1req->conn,
 672                                           smb1req->flags2 & FLAGS2_DFS_PATHNAMES,
 673                                           fname,
 674                                           0,
 675                                           NULL,
 676                                           &smb_fname);
 677                 if (!NT_STATUS_IS_OK(status)) {
 678                         tevent_req_nterror(req, status);
 679                         return tevent_req_post(req, ev);
 680                 }
 681
 682                 in_file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
 683
 684                 status = SMB_VFS_CREATE_FILE(smb1req->conn,
 685                                              smb1req,
 686                                              0, /* root_dir_fid */
 687                                              smb_fname,
 688                                              in_desired_access,
 689                                              in_share_access,
 690                                              in_create_disposition,
 691                                              in_create_options,
 692                                              in_file_attributes,
 693                                              map_smb2_oplock_levels_to_samba(in_oplock_level),
 694                                              allocation_size,
 695                                              0, /* private_flags */
 696                                              sec_desc,
 697                                              ea_list,
 698                                              &result,
 699                                              &info);
 700                 if (!NT_STATUS_IS_OK(status)) {
 701                         if (open_was_deferred(smb1req->mid)) {
 702                                 return req;
 703                         }
 704                         tevent_req_nterror(req, status);
 705                         return tevent_req_post(req, ev);
 706                 }
 707
 708                 if (mxac) {
 709                         NTTIME last_write_time;
 710
 711                         unix_timespec_to_nt_time(&last_write_time,
 712                                                  result->fsp_name->st.st_ex_mtime);
 713                         if (last_write_time != max_access_time) {
 714                                 uint8_t p[8];
 715                                 uint32_t max_access_granted;
 716                                 DATA_BLOB blob = data_blob_const(p, sizeof(p));
 717
 718                                 status = smbd_check_open_rights(smb1req->conn,
 719                                                         result->fsp_name,
 720                                                         SEC_FLAG_MAXIMUM_ALLOWED,
 721                                                         &max_access_granted);
 722
 723                                 SIVAL(p, 0, NT_STATUS_V(status));
 724                                 SIVAL(p, 4, max_access_granted);
 725
 726                                 status = smb2_create_blob_add(state,
 727                                                         &out_context_blobs,
 728                                                         SMB2_CREATE_TAG_MXAC,
 729                                                         blob);
 730                                 if (!NT_STATUS_IS_OK(status)) {
 731                                         tevent_req_nterror(req, status);
 732                                         return tevent_req_post(req, ev);
 733                                 }
 734                         }
 735                 }
 736
 737                 if (qfid) {
 738                         uint8_t p[32];
 739                         DATA_BLOB blob = data_blob_const(p, sizeof(p));
 740
 741                         ZERO_STRUCT(p);
 742
 743                         /* TODO: maybe use result->file_id */
 744                         SIVAL(p, 0, result->fsp_name->st.st_ex_ino);/* FileIndexLow */
 745                         SIVAL(p, 4, result->fsp_name->st.st_ex_dev);/* FileIndexHigh */
 746
 747                         status = smb2_create_blob_add(state, &out_context_blobs,
 748                                                       SMB2_CREATE_TAG_QFID,
 749                                                       blob);
 750                         if (!NT_STATUS_IS_OK(status)) {
 751                                 tevent_req_nterror(req, status);
 752                                 return tevent_req_post(req, ev);
 753                         }
 754                 }
 755         }
 756
 757         smb2req->compat_chain_fsp = smb1req->chain_fsp;
 758
 759         state->out_oplock_level = map_samba_oplock_levels_to_smb2(result->oplock_type);
 760
 761         if ((in_create_disposition == FILE_SUPERSEDE)
 762             && (info == FILE_WAS_OVERWRITTEN)) {
 763                 state->out_create_action = FILE_WAS_SUPERSEDED;
 764         } else {
 765                 state->out_create_action = info;
 766         }
 767         state->out_file_attributes = dos_mode(result->conn,
 768                                            result->fsp_name);
 769         /* Deal with other possible opens having a modified
 770            write time. JRA. */
 771         ZERO_STRUCT(write_time_ts);
 772         get_file_infos(result->file_id, NULL, &write_time_ts);
 773         if (!null_timespec(write_time_ts)) {
 774                 update_stat_ex_mtime(&result->fsp_name->st, write_time_ts);
 775         }
 776
 777         unix_timespec_to_nt_time(&state->out_creation_time,
 778                         get_create_timespec(smb1req->conn, result,
 779                                         result->fsp_name));
 780         unix_timespec_to_nt_time(&state->out_last_access_time,
 781                         result->fsp_name->st.st_ex_atime);
 782         unix_timespec_to_nt_time(&state->out_last_write_time,
 783                         result->fsp_name->st.st_ex_mtime);
 784         unix_timespec_to_nt_time(&state->out_change_time,
 785                         get_change_timespec(smb1req->conn, result,
 786                                         result->fsp_name));
 787         state->out_allocation_size =
 788                         result->fsp_name->st.st_ex_blksize *
 789                         result->fsp_name->st.st_ex_blocks;
 790         state->out_end_of_file = result->fsp_name->st.st_ex_size;
 791         if (state->out_file_attributes == 0) {
 792                 state->out_file_attributes = FILE_ATTRIBUTE_NORMAL;
 793         }
 794         state->out_file_id_volatile = result->fnum;
 795         state->out_context_blobs = out_context_blobs;
 796
 797         tevent_req_done(req);
 798         return tevent_req_post(req, ev);
 799 }
 800
 801 static NTSTATUS smbd_smb2_create_recv(struct tevent_req *req,
 802                         TALLOC_CTX *mem_ctx,
 803                         uint8_t *out_oplock_level,
 804                         uint32_t *out_create_action,
 805                         NTTIME *out_creation_time,
 806                         NTTIME *out_last_access_time,
 807                         NTTIME *out_last_write_time,
 808                         NTTIME *out_change_time,
 809                         uint64_t *out_allocation_size,
 810                         uint64_t *out_end_of_file,
 811                         uint32_t *out_file_attributes,
 812                         uint64_t *out_file_id_volatile,
 813                         struct smb2_create_blobs *out_context_blobs)
 814 {
 815         NTSTATUS status;
 816         struct smbd_smb2_create_state *state = tevent_req_data(req,
 817                                                struct smbd_smb2_create_state);
 818
 819         if (tevent_req_is_nterror(req, &status)) {
 820                 tevent_req_received(req);
 821                 return status;
 822         }
 823
 824         *out_oplock_level       = state->out_oplock_level;
 825         *out_create_action      = state->out_create_action;
 826         *out_creation_time      = state->out_creation_time;
 827         *out_last_access_time   = state->out_last_access_time;
 828         *out_last_write_time    = state->out_last_write_time;
 829         *out_change_time        = state->out_change_time;
 830         *out_allocation_size    = state->out_allocation_size;
 831         *out_end_of_file        = state->out_end_of_file;
 832         *out_file_attributes    = state->out_file_attributes;
 833         *out_file_id_volatile   = state->out_file_id_volatile;
 834         *out_context_blobs      = state->out_context_blobs;
 835
 836         talloc_steal(mem_ctx, state->out_context_blobs.blobs);
 837
 838         tevent_req_received(req);
 839         return NT_STATUS_OK;
 840 }
 841
 842 /*********************************************************
 843  Code for dealing with deferred opens.
 844 *********************************************************/
 845
 846 bool get_deferred_open_message_state_smb2(struct smbd_smb2_request *smb2req,
 847                         struct timeval *p_request_time,
 848                         void **pp_state)
 849 {
 850         struct smbd_smb2_create_state *state = NULL;
 851         struct tevent_req *req = NULL;
 852
 853         if (!smb2req) {
 854                 return false;
 855         }
 856         if (!smb2req->async) {
 857                 return false;
 858         }
 859         req = smb2req->subreq;
 860         if (!req) {
 861                 return false;
 862         }
 863         state = tevent_req_data(req, struct smbd_smb2_create_state);
 864         if (!state) {
 865                 return false;
 866         }
 867         if (p_request_time) {
 868                 *p_request_time = state->request_time;
 869         }
 870         if (pp_state) {
 871                 *pp_state = (void *)state->private_data.data;
 872         }
 873         return true;
 874 }
 875
 876 /*********************************************************
 877  Re-process this call early - requested by message or
 878  close.
 879 *********************************************************/
 880
 881 static struct smbd_smb2_request *find_open_smb2req(uint64_t mid)
 882 {
 883         struct smbd_server_connection *sconn = smbd_server_conn;
 884         struct smbd_smb2_request *smb2req;
 885
 886         for (smb2req = sconn->smb2.requests; smb2req; smb2req = smb2req->next) {
 887                 uint64_t message_id;
 888                 if (smb2req->subreq == NULL) {
 889                         /* This message has been processed. */
 890                         continue;
 891                 }
 892                 if (!tevent_req_is_in_progress(smb2req->subreq)) {
 893                         /* This message has been processed. */
 894                         continue;
 895                 }
 896                 message_id = get_mid_from_smb2req(smb2req);
 897                 if (message_id == mid) {
 898                         return smb2req;
 899                 }
 900         }
 901         return NULL;
 902 }
 903
 904 bool open_was_deferred_smb2(uint64_t mid)
 905 {
 906         struct smbd_smb2_create_state *state = NULL;
 907         struct smbd_smb2_request *smb2req = find_open_smb2req(mid);
 908
 909         if (!smb2req) {
 910                 DEBUG(10,("open_was_deferred_smb2: mid %llu smb2req == NULL\n",
 911                         (unsigned long long)mid));
 912                 return false;
 913         }
 914         if (!smb2req->subreq) {
 915                 return false;
 916         }
 917         if (!tevent_req_is_in_progress(smb2req->subreq)) {
 918                 return false;
 919         }
 920         state = tevent_req_data(smb2req->subreq,
 921                         struct smbd_smb2_create_state);
 922         if (!state) {
 923                 return false;
 924         }
 925         /* It's not in progress if there's no timeout event. */
 926         if (!state->te) {
 927                 return false;
 928         }
 929
 930         DEBUG(10,("open_was_deferred_smb2: mid = %llu\n",
 931                         (unsigned long long)mid));
 932
 933         return true;
 934 }
 935
 936 static void remove_deferred_open_message_smb2_internal(struct smbd_smb2_request *smb2req,
 937                                                         uint64_t mid)
 938 {
 939         struct smbd_smb2_create_state *state = NULL;
 940
 941         if (!smb2req->subreq) {
 942                 return;
 943         }
 944         if (!tevent_req_is_in_progress(smb2req->subreq)) {
 945                 return;
 946         }
 947         state = tevent_req_data(smb2req->subreq,
 948                         struct smbd_smb2_create_state);
 949         if (!state) {
 950                 return;
 951         }
 952
 953         DEBUG(10,("remove_deferred_open_message_smb2_internal: "
 954                 "mid %llu\n",
 955                 (unsigned long long)mid ));
 956
 957         /* Ensure we don't have any outstanding timer event. */
 958         TALLOC_FREE(state->te);
 959         /* Ensure we don't have any outstanding immediate event. */
 960         TALLOC_FREE(state->im);
 961 }
 962
 963 void remove_deferred_open_message_smb2(uint64_t mid)
 964 {
 965         struct smbd_smb2_request *smb2req = find_open_smb2req(mid);
 966
 967         if (!smb2req) {
 968                 DEBUG(10,("remove_deferred_open_message_smb2: "
 969                         "can't find mid %llu\n",
 970                         (unsigned long long)mid ));
 971                 return;
 972         }
 973         remove_deferred_open_message_smb2_internal(smb2req, mid);
 974 }
 975
 976 static void smbd_smb2_create_request_dispatch_immediate(struct tevent_context *ctx,
 977                                         struct tevent_immediate *im,
 978                                         void *private_data)
 979 {
 980         struct smbd_smb2_request *smb2req = talloc_get_type_abort(private_data,
 981                                         struct smbd_smb2_request);
 982         struct smbd_server_connection *sconn = smb2req->sconn;
 983         uint64_t mid = get_mid_from_smb2req(smb2req);
 984         NTSTATUS status;
 985
 986         DEBUG(10,("smbd_smb2_create_request_dispatch_immediate: "
 987                 "re-dispatching mid %llu\n",
 988                 (unsigned long long)mid ));
 989
 990         status = smbd_smb2_request_dispatch(smb2req);
 991         if (!NT_STATUS_IS_OK(status)) {
 992                 smbd_server_connection_terminate(sconn, nt_errstr(status));
 993                 return;
 994         }
 995 }
 996
 997 void schedule_deferred_open_message_smb2(uint64_t mid)
 998 {
 999         struct smbd_smb2_create_state *state = NULL;
1000         struct smbd_smb2_request *smb2req = find_open_smb2req(mid);
1001
1002         if (!smb2req) {
1003                 DEBUG(10,("schedule_deferred_open_message_smb2: "
1004                         "can't find mid %llu\n",
1005                         (unsigned long long)mid ));
1006                 return;
1007         }
1008         if (!smb2req->subreq) {
1009                 return;
1010         }
1011         if (!tevent_req_is_in_progress(smb2req->subreq)) {
1012                 return;
1013         }
1014         state = tevent_req_data(smb2req->subreq,
1015                         struct smbd_smb2_create_state);
1016         if (!state) {
1017                 return;
1018         }
1019
1020         /* Ensure we don't have any outstanding timer event. */
1021         TALLOC_FREE(state->te);
1022         /* Ensure we don't have any outstanding immediate event. */
1023         TALLOC_FREE(state->im);
1024
1025         /*
1026          * This is subtle. We must null out the callback
1027          * before resheduling, else the first call to
1028          * tevent_req_nterror() causes the _receive()
1029          * function to be called, this causing tevent_req_post()
1030          * to crash.
1031          */
1032         tevent_req_set_callback(smb2req->subreq, NULL, NULL);
1033
1034         state->im = tevent_create_immediate(smb2req);
1035         if (!state->im) {
1036                 smbd_server_connection_terminate(smb2req->sconn,
1037                         nt_errstr(NT_STATUS_NO_MEMORY));
1038         }
1039
1040         DEBUG(10,("schedule_deferred_open_message_smb2: "
1041                 "re-processing mid %llu\n",
1042                 (unsigned long long)mid ));
1043
1044         tevent_schedule_immediate(state->im,
1045                         smb2req->sconn->smb2.event_ctx,
1046                         smbd_smb2_create_request_dispatch_immediate,
1047                         smb2req);
1048 }
1049
1050 /*********************************************************
1051  Re-process this call.
1052 *********************************************************/
1053
1054 static void smb2_deferred_open_timer(struct event_context *ev,
1055                                         struct timed_event *te,
1056                                         struct timeval _tval,
1057                                         void *private_data)
1058 {
1059         NTSTATUS status;
1060         struct smbd_smb2_create_state *state = NULL;
1061         struct smbd_smb2_request *smb2req = talloc_get_type(private_data,
1062                                                 struct smbd_smb2_request);
1063
1064         DEBUG(10,("smb2_deferred_open_timer: [idx=%d], %s\n",
1065                 smb2req->current_idx,
1066                 tevent_req_default_print(smb2req->subreq, talloc_tos()) ));
1067
1068         state = tevent_req_data(smb2req->subreq,
1069                         struct smbd_smb2_create_state);
1070         if (!state) {
1071                 return;
1072         }
1073         /*
1074          * Null this out, don't talloc_free. It will
1075          * be talloc_free'd by the tevent library when
1076          * this returns.
1077          */
1078         state->te = NULL;
1079         /* Ensure we don't have any outstanding immediate event. */
1080         TALLOC_FREE(state->im);
1081
1082         /*
1083          * This is subtle. We must null out the callback
1084          * before resheduling, else the first call to
1085          * tevent_req_nterror() causes the _receive()
1086          * function to be called, this causing tevent_req_post()
1087          * to crash.
1088          */
1089         tevent_req_set_callback(smb2req->subreq, NULL, NULL);
1090
1091         status = smbd_smb2_request_dispatch(smb2req);
1092
1093         if (!NT_STATUS_IS_OK(status)) {
1094                 smbd_server_connection_terminate(smb2req->sconn,
1095                                 nt_errstr(status));
1096         }
1097 }
1098
1099 static bool smbd_smb2_create_cancel(struct tevent_req *req)
1100 {
1101         struct smbd_smb2_request *smb2req = NULL;
1102         struct smbd_smb2_create_state *state = tevent_req_data(req,
1103                                 struct smbd_smb2_create_state);
1104         uint64_t mid;
1105
1106         if (!state) {
1107                 return false;
1108         }
1109
1110         if (!state->smb2req) {
1111                 return false;
1112         }
1113
1114         smb2req = state->smb2req;
1115         mid = get_mid_from_smb2req(smb2req);
1116
1117         remove_deferred_open_entry(state->id, mid);
1118         remove_deferred_open_message_smb2_internal(smb2req, mid);
1119         smb2req->cancelled = true;
1120
1121         tevent_req_done(req);
1122         return true;
1123 }
1124
1125 bool push_deferred_open_message_smb2(struct smbd_smb2_request *smb2req,
1126                                 struct timeval request_time,
1127                                 struct timeval timeout,
1128                                 struct file_id id,
1129                                 char *private_data,
1130                                 size_t priv_len)
1131 {
1132         struct tevent_req *req = NULL;
1133         struct smbd_smb2_create_state *state = NULL;
1134         struct timeval end_time;
1135
1136         if (!smb2req) {
1137                 return false;
1138         }
1139         req = smb2req->subreq;
1140         if (!req) {
1141                 return false;
1142         }
1143         state = tevent_req_data(req, struct smbd_smb2_create_state);
1144         if (!state) {
1145                 return false;
1146         }
1147         state->id = id;
1148         state->request_time = request_time;
1149         state->private_data = data_blob_talloc(state, private_data,
1150                                                 priv_len);
1151         if (!state->private_data.data) {
1152                 return false;
1153         }
1154 #if 0
1155         /* Boo - turns out this isn't what W2K8R2
1156            does. It actually sends the STATUS_PENDING
1157            message followed by the STATUS_SHARING_VIOLATION
1158            message. Surely this means that all open
1159            calls (even on directories) will potentially
1160            fail in a chain.... ? And I've seen directory
1161            opens as the start of a chain. JRA.
1162         */
1163         /*
1164          * More subtlety. To match W2K8R2 don't
1165          * send a "gone async" message if it's simply
1166          * a STATUS_SHARING_VIOLATION (short) wait, not
1167          * an oplock break wait. We do this by prematurely
1168          * setting smb2req->async flag.
1169          */
1170         if (timeout.tv_sec < 2) {
1171                 DEBUG(10,("push_deferred_open_message_smb2: "
1172                         "short timer wait (usec = %u). "
1173                         "Don't send async message.\n",
1174                         (unsigned int)timeout.tv_usec ));
1175                 smb2req->async = true;
1176         }
1177 #endif
1178
1179         /* Re-schedule us to retry on timer expiry. */
1180         end_time = timeval_sum(&request_time, &timeout);
1181
1182         DEBUG(10,("push_deferred_open_message_smb2: "
1183                 "timeout at %s\n",
1184                 timeval_string(talloc_tos(),
1185                                 &end_time,
1186                                 true) ));
1187
1188         state->te = event_add_timed(smb2req->sconn->smb2.event_ctx,
1189                                 state,
1190                                 end_time,
1191                                 smb2_deferred_open_timer,
1192                                 smb2req);
1193         if (!state->te) {
1194                 return false;
1195         }
1196
1197         /* allow this request to be canceled */
1198         tevent_req_set_cancel_fn(req, smbd_smb2_create_cancel);
1199
1200         return true;
1201 }