s3:smb2_server: return OBJECT_NAME_INVALID if the path is terminated in SMB2_CREATE

[metze/samba/wip.git] / source3 / smbd / smb2_create.c

diff --git a/source3/smbd/smb2_create.c b/source3/smbd/smb2_create.c
index 6e292468f9ef2c820b258a6cf11c891f1177eda8..fad80a21c17a69083393cab83afecb9a7b6bf591 100644 (file)
--- a/source3/smbd/smb2_create.c
+++ b/source3/smbd/smb2_create.c
@@ -25,6 +25,7 @@
 #include "smbd/globals.h"
 #include "../libcli/smb/smb_common.h"
 #include "../librpc/gen_ndr/ndr_security.h"
+#include "../lib/util/tevent_ntstatus.h"
 
 int map_smb2_oplock_levels_to_samba(uint8_t in_oplock_level)
 {
@@ -99,8 +100,6 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
 {
        const uint8_t *inbody;
        int i = smb2req->current_idx;
-       size_t expected_body_size = 0x39;
-       size_t body_size;
        uint8_t in_oplock_level;
        uint32_t in_impersonation_level;
        uint32_t in_desired_access;
@@ -126,17 +125,12 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
        bool ok;
        struct tevent_req *tsubreq;
 
-       if (smb2req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-               return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
+       status = smbd_smb2_request_verify_sizes(smb2req, 0x39);
+       if (!NT_STATUS_IS_OK(status)) {
+               return smbd_smb2_request_error(smb2req, status);
        }
-
        inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
 
-       body_size = SVAL(inbody, 0x00);
-       if (body_size != expected_body_size) {
-               return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
-       }
-
        in_oplock_level         = CVAL(inbody, 0x03);
        in_impersonation_level  = IVAL(inbody, 0x04);
        in_desired_access       = IVAL(inbody, 0x18);
@@ -157,7 +151,7 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
         *       overlap
         */
 
-       dyn_offset = SMB2_HDR_BODY + (body_size & 0xFFFFFFFE);
+       dyn_offset = SMB2_HDR_BODY + smb2req->in.vector[i+1].iov_len;
 
        if (in_name_offset == 0 && in_name_length == 0) {
                /* This is ok */
@@ -218,6 +212,14 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
                return smbd_smb2_request_error(smb2req, NT_STATUS_ILLEGAL_CHARACTER);
        }
 
+       if (in_name_buffer.length == 0) {
+               in_name_string_size = 0;
+       }
+
+       if (strlen(in_name_string) != in_name_string_size) {
+               return smbd_smb2_request_error(smb2req, NT_STATUS_OBJECT_NAME_INVALID);
+       }
+
        ZERO_STRUCT(in_context_blobs);
        status = smb2_create_blob_parse(smb2req, in_context_buffer, &in_context_blobs);
        if (!NT_STATUS_IS_OK(status)) {
@@ -536,7 +538,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 
                if (exta) {
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req,NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -551,7 +553,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 
                if (mxac) {
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -569,7 +571,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        enum ndr_err_code ndr_err;
 
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -591,7 +593,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 
                if (dhnq) {
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -617,7 +619,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 
                if (alsi) {
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -634,7 +636,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        struct tm *tm;
 
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -718,7 +720,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                                             &result,
                                             &info);
                if (!NT_STATUS_IS_OK(status)) {
-                       if (open_was_deferred(smb1req->mid)) {
+                       if (open_was_deferred(smb1req->sconn, smb1req->mid)) {
                                return req;
                        }
                        tevent_req_nterror(req, status);
@@ -735,8 +737,13 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                                uint32_t max_access_granted;
                                DATA_BLOB blob = data_blob_const(p, sizeof(p));
 
-                               status = smbd_check_open_rights(smb1req->conn,
+                               status = smbd_calculate_access_mask(smb1req->conn,
                                                        result->fsp_name,
+                                                       /*
+                                                        * at this stage
+                                                        * it exists
+                                                        */
+                                                       true,
                                                        SEC_FLAG_MAXIMUM_ALLOWED,
                                                        &max_access_granted);
 
@@ -1075,6 +1082,7 @@ void schedule_deferred_open_message_smb2(
        if (!state->im) {
                smbd_server_connection_terminate(smb2req->sconn,
                        nt_errstr(NT_STATUS_NO_MEMORY));
+               return;
        }
 
        DEBUG(10,("schedule_deferred_open_message_smb2: "