2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-1998
5 Copyright (C) Stefan (metze) Metzmacher 2003
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 extern enum protocol_types Protocol;
26 extern int smb_read_error;
27 extern struct current_user current_user;
29 static const char *known_nt_pipes[] = {
50 static char *nttrans_realloc(char **ptr, size_t size)
53 smb_panic("nttrans_realloc() called with NULL ptr");
56 *ptr = (char *)SMB_REALLOC(*ptr, size);
60 memset(*ptr,'\0',size);
64 /****************************************************************************
65 Send the required number of replies back.
66 We assume all fields other than the data fields are
67 set correctly for the type of call.
68 HACK ! Always assumes smb_setup field is zero.
69 ****************************************************************************/
71 int send_nt_replies(const char *inbuf,
80 int data_to_send = datasize;
81 int params_to_send = paramsize;
85 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
86 int alignment_offset = 3;
87 int data_alignment_offset = 0;
90 * Initially set the wcnt area to be 18 - this is true for all
94 set_message(inbuf,outbuf,18,0,True);
96 if (NT_STATUS_V(nt_error)) {
101 * If there genuinely are no parameters or data to send just send
105 if(params_to_send == 0 && data_to_send == 0) {
107 if (!send_smb(smbd_server_fd(),outbuf)) {
108 exit_server_cleanly("send_nt_replies: send_smb failed.");
114 * When sending params and data ensure that both are nicely aligned.
115 * Only do this alignment when there is also data to send - else
116 * can cause NT redirector problems.
119 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
120 data_alignment_offset = 4 - (params_to_send % 4);
124 * Space is bufsize minus Netbios over TCP header minus SMB header.
125 * The alignment_offset is to align the param bytes on a four byte
126 * boundary (2 bytes for data len, one byte pad).
127 * NT needs this to work correctly.
130 useable_space = bufsize - ((smb_buf(outbuf)+
131 alignment_offset+data_alignment_offset) -
135 * useable_space can never be more than max_send minus the
139 useable_space = MIN(useable_space,
140 max_send - (alignment_offset+data_alignment_offset));
143 while (params_to_send || data_to_send) {
146 * Calculate whether we will totally or partially fill this packet.
149 total_sent_thistime = params_to_send + data_to_send +
150 alignment_offset + data_alignment_offset;
153 * We can never send more than useable_space.
156 total_sent_thistime = MIN(total_sent_thistime, useable_space);
158 set_message(inbuf,outbuf, 18, total_sent_thistime, True);
161 * Set total params and data to be sent.
164 SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
165 SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
168 * Calculate how many parameters and data we can fit into
169 * this packet. Parameters get precedence.
172 params_sent_thistime = MIN(params_to_send,useable_space);
173 data_sent_thistime = useable_space - params_sent_thistime;
174 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
176 SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
178 if(params_sent_thistime == 0) {
179 SIVAL(outbuf,smb_ntr_ParameterOffset,0);
180 SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
183 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
184 * parameter bytes, however the first 4 bytes of outbuf are
185 * the Netbios over TCP header. Thus use smb_base() to subtract
186 * them from the calculation.
189 SIVAL(outbuf,smb_ntr_ParameterOffset,
190 ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
192 * Absolute displacement of param bytes sent in this packet.
195 SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
199 * Deal with the data portion.
202 SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
204 if(data_sent_thistime == 0) {
205 SIVAL(outbuf,smb_ntr_DataOffset,0);
206 SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
209 * The offset of the data bytes is the offset of the
210 * parameter bytes plus the number of parameters being sent this time.
213 SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
214 smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
215 SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
219 * Copy the param bytes into the packet.
222 if(params_sent_thistime) {
223 memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
227 * Copy in the data bytes
230 if(data_sent_thistime) {
231 memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
232 data_alignment_offset,pd,data_sent_thistime);
235 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
236 params_sent_thistime, data_sent_thistime, useable_space));
237 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
238 params_to_send, data_to_send, paramsize, datasize));
240 /* Send the packet */
242 if (!send_smb(smbd_server_fd(),outbuf)) {
243 exit_server_cleanly("send_nt_replies: send_smb failed.");
246 pp += params_sent_thistime;
247 pd += data_sent_thistime;
249 params_to_send -= params_sent_thistime;
250 data_to_send -= data_sent_thistime;
256 if(params_to_send < 0 || data_to_send < 0) {
257 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
258 params_to_send, data_to_send));
266 /****************************************************************************
267 Is it an NTFS stream name ?
268 ****************************************************************************/
270 BOOL is_ntfs_stream_name(const char *fname)
272 if (lp_posix_pathnames()) {
275 return (strchr_m(fname, ':') != NULL) ? True : False;
278 /****************************************************************************
280 ****************************************************************************/
282 static BOOL saved_case_sensitive;
283 static BOOL saved_case_preserve;
284 static BOOL saved_short_case_preserve;
286 /****************************************************************************
288 ****************************************************************************/
290 static uint32 set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
292 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
293 return file_attributes;
296 saved_case_sensitive = conn->case_sensitive;
297 saved_case_preserve = conn->case_preserve;
298 saved_short_case_preserve = conn->short_case_preserve;
301 conn->case_sensitive = True;
302 conn->case_preserve = True;
303 conn->short_case_preserve = True;
305 return (file_attributes & ~FILE_FLAG_POSIX_SEMANTICS);
308 /****************************************************************************
309 Restore case semantics.
310 ****************************************************************************/
312 static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
314 if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
318 conn->case_sensitive = saved_case_sensitive;
319 conn->case_preserve = saved_case_preserve;
320 conn->short_case_preserve = saved_short_case_preserve;
323 /****************************************************************************
324 Reply to an NT create and X call on a pipe.
325 ****************************************************************************/
327 static int nt_open_pipe(char *fname, connection_struct *conn,
328 char *inbuf, char *outbuf, int *ppnum)
330 smb_np_struct *p = NULL;
331 uint16 vuid = SVAL(inbuf, smb_uid);
334 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
336 /* See if it is one we want to handle. */
338 if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
339 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
342 for( i = 0; known_nt_pipes[i]; i++ ) {
343 if( strequal(fname,known_nt_pipes[i])) {
348 if ( known_nt_pipes[i] == NULL ) {
349 return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
352 /* Strip \\ off the name. */
355 DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
357 p = open_rpc_pipe_p(fname, conn, vuid);
359 return(ERROR_DOS(ERRSRV,ERRnofids));
362 /* TODO: Add pipe to db */
364 if ( !store_pipe_opendb( p ) ) {
365 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
372 /****************************************************************************
373 Reply to an NT create and X call for pipes.
374 ****************************************************************************/
376 static int do_ntcreate_pipe_open(connection_struct *conn,
377 char *inbuf,char *outbuf,int length,int bufsize)
383 uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
385 srvstr_pull_buf(inbuf, SVAL(inbuf, smb_flg2), fname, smb_buf(inbuf),
386 sizeof(fname), STR_TERMINATE);
388 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
393 * Deal with pipe return.
396 if (flags & EXTENDED_RESPONSE_REQUIRED) {
397 /* This is very strange. We
398 * return 50 words, but only set
399 * the wcnt to 42 ? It's definately
400 * what happens on the wire....
402 set_message(inbuf,outbuf,50,0,True);
403 SCVAL(outbuf,smb_wct,42);
405 set_message(inbuf,outbuf,34,0,True);
408 p = outbuf + smb_vwv2;
412 SIVAL(p,0,FILE_WAS_OPENED);
415 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
418 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
420 SSVAL(p,2, 0x5FF); /* ? */
423 if (flags & EXTENDED_RESPONSE_REQUIRED) {
425 SIVAL(p,0,FILE_GENERIC_ALL);
427 * For pipes W2K3 seems to return
429 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
431 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
434 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
436 return chain_reply(inbuf,outbuf,length,bufsize);
439 /****************************************************************************
440 Reply to an NT create and X call for a quota file.
441 ****************************************************************************/
443 int reply_ntcreate_and_X_quota(connection_struct *conn,
448 enum FAKE_FILE_TYPE fake_file_type,
453 uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
457 status = open_fake_file(conn, fake_file_type, fname, desired_access,
460 if (!NT_STATUS_IS_OK(status)) {
461 return ERROR_NT(status);
464 set_message(inbuf,outbuf,34,0,True);
466 p = outbuf + smb_vwv2;
468 /* SCVAL(p,0,NO_OPLOCK_RETURN); */
470 SSVAL(p,0,fsp->fnum);
472 DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
474 result = chain_reply(inbuf,outbuf,length,bufsize);
478 /****************************************************************************
479 Reply to an NT create and X call.
480 ****************************************************************************/
482 int reply_ntcreate_and_X(connection_struct *conn,
483 char *inbuf,char *outbuf,int length,int bufsize)
487 uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
488 uint32 access_mask = IVAL(inbuf,smb_ntcreate_DesiredAccess);
489 uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
490 uint32 new_file_attributes;
491 uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
492 uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
493 uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
494 uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
495 /* Breakout the oplock request bits so we can set the
496 reply bits separately. */
497 int oplock_request = 0;
499 SMB_OFF_T file_len = 0;
500 SMB_STRUCT_STAT sbuf;
502 files_struct *fsp = NULL;
504 struct timespec c_timespec;
505 struct timespec a_timespec;
506 struct timespec m_timespec;
507 BOOL extended_oplock_granted = False;
509 struct smb_request req;
511 START_PROFILE(SMBntcreateX);
513 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
514 "file_attributes = 0x%x, share_access = 0x%x, "
515 "create_disposition = 0x%x create_options = 0x%x "
516 "root_dir_fid = 0x%x\n",
518 (unsigned int)access_mask,
519 (unsigned int)file_attributes,
520 (unsigned int)share_access,
521 (unsigned int)create_disposition,
522 (unsigned int)create_options,
523 (unsigned int)root_dir_fid ));
525 init_smb_request(&req, (uint8 *)inbuf);
528 * If it's an IPC, use the pipe handler.
532 if (lp_nt_pipe_support()) {
533 END_PROFILE(SMBntcreateX);
534 return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
536 END_PROFILE(SMBntcreateX);
537 return(ERROR_DOS(ERRDOS,ERRnoaccess));
541 if (create_options & FILE_OPEN_BY_FILE_ID) {
542 END_PROFILE(SMBntcreateX);
543 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
550 if(root_dir_fid != 0) {
552 * This filename is relative to a directory fid.
555 files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
559 END_PROFILE(SMBntcreateX);
560 return ERROR_DOS(ERRDOS,ERRbadfid);
563 if(!dir_fsp->is_directory) {
565 srvstr_get_path(inbuf, SVAL(inbuf,smb_flg2), fname,
566 smb_buf(inbuf), sizeof(fname), 0,
567 STR_TERMINATE, &status);
568 if (!NT_STATUS_IS_OK(status)) {
569 END_PROFILE(SMBntcreateX);
570 return ERROR_NT(status);
574 * Check to see if this is a mac fork of some kind.
577 if( is_ntfs_stream_name(fname)) {
578 END_PROFILE(SMBntcreateX);
579 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
583 we need to handle the case when we get a
584 relative open relative to a file and the
585 pathname is blank - this is a reopen!
586 (hint from demyn plantenberg)
589 END_PROFILE(SMBntcreateX);
590 return(ERROR_DOS(ERRDOS,ERRbadfid));
594 * Copy in the base directory name.
597 pstrcpy( fname, dir_fsp->fsp_name );
598 dir_name_len = strlen(fname);
601 * Ensure it ends in a '\'.
604 if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
609 srvstr_get_path(inbuf, SVAL(inbuf,smb_flg2), rel_fname,
610 smb_buf(inbuf), sizeof(rel_fname), 0,
611 STR_TERMINATE, &status);
612 if (!NT_STATUS_IS_OK(status)) {
613 END_PROFILE(SMBntcreateX);
614 return ERROR_NT(status);
616 pstrcat(fname, rel_fname);
618 srvstr_get_path(inbuf, SVAL(inbuf,smb_flg2), fname,
619 smb_buf(inbuf), sizeof(fname), 0,
620 STR_TERMINATE, &status);
621 if (!NT_STATUS_IS_OK(status)) {
622 END_PROFILE(SMBntcreateX);
623 return ERROR_NT(status);
627 * Check to see if this is a mac fork of some kind.
630 if( is_ntfs_stream_name(fname)) {
631 enum FAKE_FILE_TYPE fake_file_type = is_fake_file(fname);
632 if (fake_file_type!=FAKE_FILE_TYPE_NONE) {
634 * Here we go! support for changing the disk quotas --metze
636 * We need to fake up to open this MAGIC QUOTA file
637 * and return a valid FID.
639 * w2k close this file directly after openening
640 * xp also tries a QUERY_FILE_INFO on the file and then close it
642 result = reply_ntcreate_and_X_quota(conn, inbuf, outbuf, length, bufsize,
643 fake_file_type, fname);
644 END_PROFILE(SMBntcreateX);
647 END_PROFILE(SMBntcreateX);
648 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
654 * Now contruct the smb_open_mode value from the filename,
655 * desired access and the share access.
657 status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
658 if (!NT_STATUS_IS_OK(status)) {
659 END_PROFILE(SMBntcreateX);
660 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
661 return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
663 return ERROR_NT(status);
666 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
667 if (oplock_request) {
668 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
672 * Ordinary file or directory.
676 * Check if POSIX semantics are wanted.
679 new_file_attributes = set_posix_case_semantics(conn, file_attributes);
681 status = unix_convert(conn, fname, False, NULL, &sbuf);
682 if (!NT_STATUS_IS_OK(status)) {
683 restore_case_semantics(conn, file_attributes);
684 END_PROFILE(SMBntcreateX);
685 return ERROR_NT(status);
687 /* All file access must go through check_name() */
688 status = check_name(conn, fname);
689 if (!NT_STATUS_IS_OK(status)) {
690 restore_case_semantics(conn, file_attributes);
691 END_PROFILE(SMBntcreateX);
692 return ERROR_NT(status);
695 /* This is the correct thing to do (check every time) but can_delete is
696 expensive (it may have to read the parent directory permissions). So
697 for now we're not doing it unless we have a strong hint the client
698 is really going to delete this file. If the client is forcing FILE_CREATE
699 let the filesystem take care of the permissions. */
701 /* Setting FILE_SHARE_DELETE is the hint. */
703 if (lp_acl_check_permissions(SNUM(conn))
704 && (create_disposition != FILE_CREATE)
705 && (share_access & FILE_SHARE_DELETE)
706 && (access_mask & DELETE_ACCESS)) {
707 if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) ||
708 !can_delete_file_in_directory(conn, fname)) {
709 restore_case_semantics(conn, file_attributes);
710 END_PROFILE(SMBntcreateX);
711 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
716 /* We need to support SeSecurityPrivilege for this. */
717 if ((access_mask & SEC_RIGHT_SYSTEM_SECURITY)) &&
718 !user_has_privileges(current_user.nt_user_token,
720 restore_case_semantics(conn, file_attributes);
721 END_PROFILE(SMBntcreateX);
722 return ERROR_NT(NT_STATUS_PRIVILEGE_NOT_HELD);
727 * If it's a request for a directory open, deal with it separately.
730 if(create_options & FILE_DIRECTORY_FILE) {
732 /* Can't open a temp directory. IFS kit test. */
733 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
734 END_PROFILE(SMBntcreateX);
735 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
739 status = open_directory(conn, &req, fname, &sbuf,
747 restore_case_semantics(conn, file_attributes);
749 if(!NT_STATUS_IS_OK(status)) {
750 if (!use_nt_status() && NT_STATUS_EQUAL(
751 status, NT_STATUS_OBJECT_NAME_COLLISION)) {
752 status = NT_STATUS_DOS(ERRDOS, ERRfilexists);
754 END_PROFILE(SMBntcreateX);
755 return ERROR_NT(status);
761 * Ordinary file case.
764 /* NB. We have a potential bug here. If we
765 * cause an oplock break to ourselves, then we
766 * could end up processing filename related
767 * SMB requests whilst we await the oplock
768 * break response. As we may have changed the
769 * filename case semantics to be POSIX-like,
770 * this could mean a filename request could
771 * fail when it should succeed. This is a rare
772 * condition, but eventually we must arrange
773 * to restore the correct case semantics
774 * before issuing an oplock break request to
775 * our client. JRA. */
777 status = open_file_ntcreate(conn, &req, fname, &sbuf,
786 if (!NT_STATUS_IS_OK(status)) {
787 /* We cheat here. There are two cases we
788 * care about. One is a directory rename,
789 * where the NT client will attempt to
790 * open the source directory for
791 * DELETE access. Note that when the
792 * NT client does this it does *not*
793 * set the directory bit in the
794 * request packet. This is translated
795 * into a read/write open
796 * request. POSIX states that any open
797 * for write request on a directory
798 * will generate an EISDIR error, so
799 * we can catch this here and open a
800 * pseudo handle that is flagged as a
801 * directory. The second is an open
802 * for a permissions read only, which
803 * we handle in the open_file_stat case. JRA.
806 if (NT_STATUS_EQUAL(status,
807 NT_STATUS_FILE_IS_A_DIRECTORY)) {
810 * Fail the open if it was explicitly a non-directory file.
813 if (create_options & FILE_NON_DIRECTORY_FILE) {
814 restore_case_semantics(conn, file_attributes);
815 END_PROFILE(SMBntcreateX);
816 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
820 status = open_directory(conn, &req, fname,
829 if(!NT_STATUS_IS_OK(status)) {
830 restore_case_semantics(conn, file_attributes);
831 if (!use_nt_status() && NT_STATUS_EQUAL(
832 status, NT_STATUS_OBJECT_NAME_COLLISION)) {
833 status = NT_STATUS_DOS(ERRDOS, ERRfilexists);
835 END_PROFILE(SMBntcreateX);
836 return ERROR_NT(status);
839 restore_case_semantics(conn, file_attributes);
840 END_PROFILE(SMBntcreateX);
841 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
842 /* We have re-scheduled this call. */
845 return ERROR_NT(status);
850 restore_case_semantics(conn, file_attributes);
852 file_len = sbuf.st_size;
853 fattr = dos_mode(conn,fname,&sbuf);
855 fattr = FILE_ATTRIBUTE_NORMAL;
857 if (!fsp->is_directory && (fattr & aDIR)) {
858 close_file(fsp,ERROR_CLOSE);
859 END_PROFILE(SMBntcreateX);
860 return ERROR_DOS(ERRDOS,ERRnoaccess);
863 /* Save the requested allocation size. */
864 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
865 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
866 #ifdef LARGE_SMB_OFF_T
867 allocation_size |= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
869 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
870 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
871 if (fsp->is_directory) {
872 close_file(fsp,ERROR_CLOSE);
873 END_PROFILE(SMBntcreateX);
874 /* Can't set allocation size on a directory. */
875 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
877 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
878 close_file(fsp,ERROR_CLOSE);
879 END_PROFILE(SMBntcreateX);
880 return ERROR_NT(NT_STATUS_DISK_FULL);
883 fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
888 * If the caller set the extended oplock request bit
889 * and we granted one (by whatever means) - set the
890 * correct bit for extended oplock reply.
893 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
894 extended_oplock_granted = True;
897 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
898 extended_oplock_granted = True;
901 if (flags & EXTENDED_RESPONSE_REQUIRED) {
902 /* This is very strange. We
903 * return 50 words, but only set
904 * the wcnt to 42 ? It's definately
905 * what happens on the wire....
907 set_message(inbuf,outbuf,50,0,True);
908 SCVAL(outbuf,smb_wct,42);
910 set_message(inbuf,outbuf,34,0,True);
913 p = outbuf + smb_vwv2;
916 * Currently as we don't support level II oplocks we just report
917 * exclusive & batch here.
920 if (extended_oplock_granted) {
921 if (flags & REQUEST_BATCH_OPLOCK) {
922 SCVAL(p,0, BATCH_OPLOCK_RETURN);
924 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
926 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
927 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
929 SCVAL(p,0,NO_OPLOCK_RETURN);
933 SSVAL(p,0,fsp->fnum);
935 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
936 SIVAL(p,0,FILE_WAS_SUPERSEDED);
943 c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
944 a_timespec = get_atimespec(&sbuf);
945 m_timespec = get_mtimespec(&sbuf);
947 if (lp_dos_filetime_resolution(SNUM(conn))) {
948 dos_filetime_timespec(&c_timespec);
949 dos_filetime_timespec(&a_timespec);
950 dos_filetime_timespec(&m_timespec);
953 put_long_date_timespec(p, c_timespec); /* create time. */
955 put_long_date_timespec(p, a_timespec); /* access time */
957 put_long_date_timespec(p, m_timespec); /* write time */
959 put_long_date_timespec(p, m_timespec); /* change time */
961 SIVAL(p,0,fattr); /* File Attributes. */
963 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
965 SOFF_T(p,0,file_len);
967 if (flags & EXTENDED_RESPONSE_REQUIRED) {
971 SCVAL(p,0,fsp->is_directory ? 1 : 0);
973 if (flags & EXTENDED_RESPONSE_REQUIRED) {
976 if (fsp->is_directory || can_write_to_file(conn, fname, &sbuf)) {
977 perms = FILE_GENERIC_ALL;
979 perms = FILE_GENERIC_READ|FILE_EXECUTE;
984 DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
986 result = chain_reply(inbuf,outbuf,length,bufsize);
987 END_PROFILE(SMBntcreateX);
991 /****************************************************************************
992 Reply to a NT_TRANSACT_CREATE call to open a pipe.
993 ****************************************************************************/
995 static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
996 uint16 **ppsetup, uint32 setup_count,
997 char **ppparams, uint32 parameter_count,
998 char **ppdata, uint32 data_count)
1001 char *params = *ppparams;
1010 * Ensure minimum number of parameters sent.
1013 if(parameter_count < 54) {
1014 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1015 return ERROR_DOS(ERRDOS,ERRnoaccess);
1018 flags = IVAL(params,0);
1020 srvstr_get_path(inbuf, SVAL(inbuf,smb_flg2), fname, params+53,
1021 sizeof(fname), parameter_count-53, STR_TERMINATE,
1023 if (!NT_STATUS_IS_OK(status)) {
1024 return ERROR_NT(status);
1027 if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
1031 /* Realloc the size of parameters and data we will return */
1032 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1033 /* Extended response is 32 more byyes. */
1038 params = nttrans_realloc(ppparams, param_len);
1039 if(params == NULL) {
1040 return ERROR_DOS(ERRDOS,ERRnomem);
1044 SCVAL(p,0,NO_OPLOCK_RETURN);
1049 SIVAL(p,0,FILE_WAS_OPENED);
1053 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
1056 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
1058 SSVAL(p,2, 0x5FF); /* ? */
1061 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1063 SIVAL(p,0,FILE_GENERIC_ALL);
1065 * For pipes W2K3 seems to return
1067 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
1069 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
1072 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
1074 /* Send the required number of replies */
1075 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len, *ppdata, 0);
1080 /****************************************************************************
1081 Internal fn to set security descriptors.
1082 ****************************************************************************/
1084 static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
1087 SEC_DESC *psd = NULL;
1088 TALLOC_CTX *mem_ctx;
1091 if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
1092 return NT_STATUS_OK;
1096 * Init the parse struct we will unmarshall from.
1099 if ((mem_ctx = talloc_init("set_sd")) == NULL) {
1100 DEBUG(0,("set_sd: talloc_init failed.\n"));
1101 return NT_STATUS_NO_MEMORY;
1104 prs_init(&pd, 0, mem_ctx, UNMARSHALL);
1107 * Setup the prs_struct to point at the memory we just
1111 prs_give_memory( &pd, data, sd_len, False);
1114 * Finally, unmarshall from the data buffer.
1117 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
1118 DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
1120 * Return access denied for want of a better error message..
1122 talloc_destroy(mem_ctx);
1123 return NT_STATUS_NO_MEMORY;
1126 if (psd->owner_sid==0) {
1127 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
1129 if (psd->group_sid==0) {
1130 security_info_sent &= ~GROUP_SECURITY_INFORMATION;
1133 security_info_sent &= ~SACL_SECURITY_INFORMATION;
1136 security_info_sent &= ~DACL_SECURITY_INFORMATION;
1139 status = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
1141 talloc_destroy(mem_ctx);
1145 /****************************************************************************
1146 Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
1147 ****************************************************************************/
1149 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
1151 struct ea_list *ea_list_head = NULL;
1154 if (data_size < 4) {
1158 while (offset + 4 <= data_size) {
1159 size_t next_offset = IVAL(pdata,offset);
1160 struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset + 4, data_size - offset - 4, NULL);
1166 DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
1167 if (next_offset == 0) {
1170 offset += next_offset;
1173 return ea_list_head;
1176 /****************************************************************************
1177 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
1178 ****************************************************************************/
1180 static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
1181 uint16 **ppsetup, uint32 setup_count,
1182 char **ppparams, uint32 parameter_count,
1183 char **ppdata, uint32 data_count, uint32 max_data_count)
1186 char *params = *ppparams;
1187 char *data = *ppdata;
1188 /* Breakout the oplock request bits so we can set the reply bits separately. */
1189 int oplock_request = 0;
1191 SMB_OFF_T file_len = 0;
1192 SMB_STRUCT_STAT sbuf;
1194 files_struct *fsp = NULL;
1196 BOOL extended_oplock_granted = False;
1199 uint32 file_attributes;
1200 uint32 new_file_attributes;
1201 uint32 share_access;
1202 uint32 create_disposition;
1203 uint32 create_options;
1206 uint16 root_dir_fid;
1207 struct timespec c_timespec;
1208 struct timespec a_timespec;
1209 struct timespec m_timespec;
1210 struct ea_list *ea_list = NULL;
1211 TALLOC_CTX *ctx = NULL;
1215 struct smb_request req;
1217 DEBUG(5,("call_nt_transact_create\n"));
1220 * If it's an IPC, use the pipe handler.
1224 if (lp_nt_pipe_support()) {
1225 return do_nt_transact_create_pipe(conn, inbuf, outbuf, length,
1227 ppsetup, setup_count,
1228 ppparams, parameter_count,
1229 ppdata, data_count);
1231 return ERROR_DOS(ERRDOS,ERRnoaccess);
1236 * Ensure minimum number of parameters sent.
1239 if(parameter_count < 54) {
1240 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1241 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1244 init_smb_request(&req, (uint8 *)inbuf);
1246 flags = IVAL(params,0);
1247 access_mask = IVAL(params,8);
1248 file_attributes = IVAL(params,20);
1249 share_access = IVAL(params,24);
1250 create_disposition = IVAL(params,28);
1251 create_options = IVAL(params,32);
1252 sd_len = IVAL(params,36);
1253 ea_len = IVAL(params,40);
1254 root_dir_fid = (uint16)IVAL(params,4);
1256 /* Ensure the data_len is correct for the sd and ea values given. */
1257 if ((ea_len + sd_len > data_count) ||
1258 (ea_len > data_count) || (sd_len > data_count) ||
1259 (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1260 DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
1261 (unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
1262 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1266 if (!lp_ea_support(SNUM(conn))) {
1267 DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
1268 (unsigned int)ea_len ));
1269 return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
1273 DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
1274 (unsigned int)ea_len ));
1275 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1279 if (create_options & FILE_OPEN_BY_FILE_ID) {
1280 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
1284 * Get the file name.
1287 if(root_dir_fid != 0) {
1289 * This filename is relative to a directory fid.
1291 files_struct *dir_fsp = file_fsp(params,4);
1292 size_t dir_name_len;
1295 return ERROR_DOS(ERRDOS,ERRbadfid);
1298 if(!dir_fsp->is_directory) {
1299 srvstr_get_path(inbuf, SVAL(inbuf,smb_flg2), fname,
1300 params+53, sizeof(fname),
1301 parameter_count-53, STR_TERMINATE,
1303 if (!NT_STATUS_IS_OK(status)) {
1304 return ERROR_NT(status);
1308 * Check to see if this is a mac fork of some kind.
1311 if( is_ntfs_stream_name(fname)) {
1312 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1315 return ERROR_DOS(ERRDOS,ERRbadfid);
1319 * Copy in the base directory name.
1322 pstrcpy( fname, dir_fsp->fsp_name );
1323 dir_name_len = strlen(fname);
1326 * Ensure it ends in a '\'.
1329 if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
1330 pstrcat(fname, "/");
1336 srvstr_get_path(inbuf, SVAL(inbuf,smb_flg2), tmpname,
1337 params+53, sizeof(tmpname),
1338 parameter_count-53, STR_TERMINATE,
1340 if (!NT_STATUS_IS_OK(status)) {
1341 return ERROR_NT(status);
1343 pstrcat(fname, tmpname);
1346 srvstr_get_path(inbuf, SVAL(inbuf,smb_flg2), fname, params+53,
1347 sizeof(fname), parameter_count-53,
1348 STR_TERMINATE, &status);
1349 if (!NT_STATUS_IS_OK(status)) {
1350 return ERROR_NT(status);
1354 * Check to see if this is a mac fork of some kind.
1357 if( is_ntfs_stream_name(fname)) {
1358 return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
1362 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1363 if (oplock_request) {
1364 oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
1368 * Ordinary file or directory.
1372 * Check if POSIX semantics are wanted.
1375 new_file_attributes = set_posix_case_semantics(conn, file_attributes);
1377 status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1378 if (!NT_STATUS_IS_OK(status)) {
1379 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1380 return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1382 return ERROR_NT(status);
1385 status = unix_convert(conn, fname, False, NULL, &sbuf);
1386 if (!NT_STATUS_IS_OK(status)) {
1387 restore_case_semantics(conn, file_attributes);
1388 return ERROR_NT(status);
1390 /* All file access must go through check_name() */
1391 status = check_name(conn, fname);
1392 if (!NT_STATUS_IS_OK(status)) {
1393 restore_case_semantics(conn, file_attributes);
1394 return ERROR_NT(status);
1397 /* This is the correct thing to do (check every time) but can_delete is
1398 expensive (it may have to read the parent directory permissions). So
1399 for now we're not doing it unless we have a strong hint the client
1400 is really going to delete this file. If the client is forcing FILE_CREATE
1401 let the filesystem take care of the permissions. */
1403 /* Setting FILE_SHARE_DELETE is the hint. */
1405 if (lp_acl_check_permissions(SNUM(conn))
1406 && (create_disposition != FILE_CREATE)
1407 && (share_access & FILE_SHARE_DELETE)
1408 && (access_mask & DELETE_ACCESS)) {
1409 if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) ||
1410 !can_delete_file_in_directory(conn, fname)) {
1411 restore_case_semantics(conn, file_attributes);
1412 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1417 /* We need to support SeSecurityPrivilege for this. */
1418 if ((access_mask & SEC_RIGHT_SYSTEM_SECURITY)) &&
1419 !user_has_privileges(current_user.nt_user_token,
1421 restore_case_semantics(conn, file_attributes);
1422 return ERROR_NT(NT_STATUS_PRIVILEGE_NOT_HELD);
1427 pdata = data + sd_len;
1429 /* We have already checked that ea_len <= data_count here. */
1430 ea_list = read_nttrans_ea_list(tmp_talloc_ctx(), pdata,
1433 restore_case_semantics(conn, file_attributes);
1434 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1439 * If it's a request for a directory open, deal with it separately.
1442 if(create_options & FILE_DIRECTORY_FILE) {
1444 /* Can't open a temp directory. IFS kit test. */
1445 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
1446 restore_case_semantics(conn, file_attributes);
1447 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1451 * We will get a create directory here if the Win32
1452 * app specified a security descriptor in the
1453 * CreateDirectory() call.
1457 status = open_directory(conn, &req, fname, &sbuf,
1462 new_file_attributes,
1464 if(!NT_STATUS_IS_OK(status)) {
1465 restore_case_semantics(conn, file_attributes);
1466 return ERROR_NT(status);
1472 * Ordinary file case.
1475 status = open_file_ntcreate(conn,&req,fname,&sbuf,
1480 new_file_attributes,
1484 if (!NT_STATUS_IS_OK(status)) {
1485 if (NT_STATUS_EQUAL(status,
1486 NT_STATUS_FILE_IS_A_DIRECTORY)) {
1489 * Fail the open if it was explicitly a non-directory file.
1492 if (create_options & FILE_NON_DIRECTORY_FILE) {
1493 restore_case_semantics(conn, file_attributes);
1494 return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
1498 status = open_directory(conn, &req, fname,
1504 new_file_attributes,
1506 if(!NT_STATUS_IS_OK(status)) {
1507 restore_case_semantics(conn, file_attributes);
1508 return ERROR_NT(status);
1511 restore_case_semantics(conn, file_attributes);
1512 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1513 /* We have re-scheduled this call. */
1516 return ERROR_NT(status);
1522 * According to the MS documentation, the only time the security
1523 * descriptor is applied to the opened file is iff we *created* the
1524 * file; an existing file stays the same.
1526 * Also, it seems (from observation) that you can open the file with
1527 * any access mask but you can still write the sd. We need to override
1528 * the granted access before we call set_sd
1529 * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
1532 if (lp_nt_acl_support(SNUM(conn)) && sd_len && info == FILE_WAS_CREATED) {
1533 uint32 saved_access_mask = fsp->access_mask;
1535 /* We have already checked that sd_len <= data_count here. */
1537 fsp->access_mask = FILE_GENERIC_ALL;
1539 status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
1540 if (!NT_STATUS_IS_OK(status)) {
1541 talloc_destroy(ctx);
1542 close_file(fsp,ERROR_CLOSE);
1543 restore_case_semantics(conn, file_attributes);
1544 return ERROR_NT(status);
1546 fsp->access_mask = saved_access_mask;
1549 if (ea_len && (info == FILE_WAS_CREATED)) {
1550 status = set_ea(conn, fsp, fname, ea_list);
1551 if (!NT_STATUS_IS_OK(status)) {
1552 close_file(fsp,ERROR_CLOSE);
1553 restore_case_semantics(conn, file_attributes);
1554 return ERROR_NT(status);
1558 restore_case_semantics(conn, file_attributes);
1560 file_len = sbuf.st_size;
1561 fattr = dos_mode(conn,fname,&sbuf);
1563 fattr = FILE_ATTRIBUTE_NORMAL;
1565 if (!fsp->is_directory && (fattr & aDIR)) {
1566 close_file(fsp,ERROR_CLOSE);
1567 return ERROR_DOS(ERRDOS,ERRnoaccess);
1570 /* Save the requested allocation size. */
1571 if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
1572 SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
1573 #ifdef LARGE_SMB_OFF_T
1574 allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
1576 if (allocation_size && (allocation_size > file_len)) {
1577 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1578 if (fsp->is_directory) {
1579 close_file(fsp,ERROR_CLOSE);
1580 /* Can't set allocation size on a directory. */
1581 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1583 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1584 close_file(fsp,ERROR_CLOSE);
1585 return ERROR_NT(NT_STATUS_DISK_FULL);
1588 fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
1593 * If the caller set the extended oplock request bit
1594 * and we granted one (by whatever means) - set the
1595 * correct bit for extended oplock reply.
1598 if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1599 extended_oplock_granted = True;
1602 if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1603 extended_oplock_granted = True;
1606 /* Realloc the size of parameters and data we will return */
1607 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1608 /* Extended response is 32 more byyes. */
1613 params = nttrans_realloc(ppparams, param_len);
1614 if(params == NULL) {
1615 return ERROR_DOS(ERRDOS,ERRnomem);
1619 if (extended_oplock_granted) {
1620 if (flags & REQUEST_BATCH_OPLOCK) {
1621 SCVAL(p,0, BATCH_OPLOCK_RETURN);
1623 SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
1625 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1626 SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
1628 SCVAL(p,0,NO_OPLOCK_RETURN);
1632 SSVAL(p,0,fsp->fnum);
1634 if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
1635 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1642 c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
1643 a_timespec = get_atimespec(&sbuf);
1644 m_timespec = get_mtimespec(&sbuf);
1646 if (lp_dos_filetime_resolution(SNUM(conn))) {
1647 dos_filetime_timespec(&c_timespec);
1648 dos_filetime_timespec(&a_timespec);
1649 dos_filetime_timespec(&m_timespec);
1652 put_long_date_timespec(p, c_timespec); /* create time. */
1654 put_long_date_timespec(p, a_timespec); /* access time */
1656 put_long_date_timespec(p, m_timespec); /* write time */
1658 put_long_date_timespec(p, m_timespec); /* change time */
1660 SIVAL(p,0,fattr); /* File Attributes. */
1662 SOFF_T(p, 0, get_allocation_size(conn,fsp,&sbuf));
1664 SOFF_T(p,0,file_len);
1666 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1670 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1672 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1675 if (fsp->is_directory || can_write_to_file(conn, fname, &sbuf)) {
1676 perms = FILE_GENERIC_ALL;
1678 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1683 DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
1685 /* Send the required number of replies */
1686 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len, *ppdata, 0);
1691 /****************************************************************************
1692 Reply to a NT CANCEL request.
1693 conn POINTER CAN BE NULL HERE !
1694 ****************************************************************************/
1696 int reply_ntcancel(connection_struct *conn,
1697 char *inbuf,char *outbuf,int length,int bufsize)
1700 * Go through and cancel any pending change notifies.
1703 int mid = SVAL(inbuf,smb_mid);
1704 START_PROFILE(SMBntcancel);
1705 remove_pending_change_notify_requests_by_mid(mid);
1706 remove_pending_lock_requests_by_mid(mid);
1707 srv_cancel_sign_response(mid);
1709 DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
1711 END_PROFILE(SMBntcancel);
1715 /****************************************************************************
1717 ****************************************************************************/
1719 static NTSTATUS copy_internals(connection_struct *conn,
1720 struct smb_request *req,
1721 char *oldname, char *newname, uint32 attrs)
1723 SMB_STRUCT_STAT sbuf1, sbuf2;
1724 pstring last_component_oldname;
1725 pstring last_component_newname;
1726 files_struct *fsp1,*fsp2;
1730 NTSTATUS status = NT_STATUS_OK;
1735 if (!CAN_WRITE(conn)) {
1736 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1739 status = unix_convert(conn, oldname, False, last_component_oldname, &sbuf1);
1740 if (!NT_STATUS_IS_OK(status)) {
1744 status = check_name(conn, oldname);
1745 if (!NT_STATUS_IS_OK(status)) {
1749 /* Source must already exist. */
1750 if (!VALID_STAT(sbuf1)) {
1751 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1753 /* Ensure attributes match. */
1754 fattr = dos_mode(conn,oldname,&sbuf1);
1755 if ((fattr & ~attrs) & (aHIDDEN | aSYSTEM)) {
1756 return NT_STATUS_NO_SUCH_FILE;
1759 status = unix_convert(conn, newname, False, last_component_newname, &sbuf2);
1760 if (!NT_STATUS_IS_OK(status)) {
1764 status = check_name(conn, newname);
1765 if (!NT_STATUS_IS_OK(status)) {
1769 /* Disallow if newname already exists. */
1770 if (VALID_STAT(sbuf2)) {
1771 return NT_STATUS_OBJECT_NAME_COLLISION;
1774 /* No links from a directory. */
1775 if (S_ISDIR(sbuf1.st_mode)) {
1776 return NT_STATUS_FILE_IS_A_DIRECTORY;
1779 /* Ensure this is within the share. */
1780 status = reduce_name(conn, oldname);
1781 if (!NT_STATUS_IS_OK(status)) {
1785 DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
1787 status = open_file_ntcreate(conn, req, oldname, &sbuf1,
1788 FILE_READ_DATA, /* Read-only. */
1789 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1791 0, /* No create options. */
1792 FILE_ATTRIBUTE_NORMAL,
1796 if (!NT_STATUS_IS_OK(status)) {
1800 status = open_file_ntcreate(conn, req, newname, &sbuf2,
1801 FILE_WRITE_DATA, /* Read-only. */
1802 FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1804 0, /* No create options. */
1809 if (!NT_STATUS_IS_OK(status)) {
1810 close_file(fsp1,ERROR_CLOSE);
1814 if (sbuf1.st_size) {
1815 ret = vfs_transfer_file(fsp1, fsp2, sbuf1.st_size);
1819 * As we are opening fsp1 read-only we only expect
1820 * an error on close on fsp2 if we are out of space.
1821 * Thus we don't look at the error return from the
1824 close_file(fsp1,NORMAL_CLOSE);
1826 /* Ensure the modtime is set correctly on the destination file. */
1827 fsp_set_pending_modtime(fsp2, get_mtimespec(&sbuf1));
1829 status = close_file(fsp2,NORMAL_CLOSE);
1831 /* Grrr. We have to do this as open_file_ntcreate adds aARCH when it
1832 creates the file. This isn't the correct thing to do in the copy
1834 file_set_dosmode(conn, newname, fattr, &sbuf2,
1835 parent_dirname(newname));
1837 if (ret < (SMB_OFF_T)sbuf1.st_size) {
1838 return NT_STATUS_DISK_FULL;
1841 if (!NT_STATUS_IS_OK(status)) {
1842 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1843 nt_errstr(status), oldname, newname));
1848 /****************************************************************************
1849 Reply to a NT rename request.
1850 ****************************************************************************/
1852 int reply_ntrename(connection_struct *conn,
1853 char *inbuf,char *outbuf,int length,int bufsize)
1860 BOOL src_has_wcard = False;
1861 BOOL dest_has_wcard = False;
1862 uint32 attrs = SVAL(inbuf,smb_vwv0);
1863 uint16 rename_type = SVAL(inbuf,smb_vwv1);
1864 struct smb_request req;
1866 START_PROFILE(SMBntrename);
1868 init_smb_request(&req, (uint8 *)inbuf);
1870 p = smb_buf(inbuf) + 1;
1871 p += srvstr_get_path_wcard(inbuf, SVAL(inbuf,smb_flg2), oldname, p,
1872 sizeof(oldname), 0, STR_TERMINATE, &status,
1874 if (!NT_STATUS_IS_OK(status)) {
1875 END_PROFILE(SMBntrename);
1876 return ERROR_NT(status);
1879 if( is_ntfs_stream_name(oldname)) {
1880 /* Can't rename a stream. */
1881 END_PROFILE(SMBntrename);
1882 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
1885 if (ms_has_wild(oldname)) {
1886 END_PROFILE(SMBntrename);
1887 return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1891 p += srvstr_get_path_wcard(inbuf, SVAL(inbuf,smb_flg2), newname, p,
1892 sizeof(newname), 0, STR_TERMINATE, &status,
1894 if (!NT_STATUS_IS_OK(status)) {
1895 END_PROFILE(SMBntrename);
1896 return ERROR_NT(status);
1899 status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, oldname);
1900 if (!NT_STATUS_IS_OK(status)) {
1901 END_PROFILE(SMBntrename);
1902 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1903 return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1905 return ERROR_NT(status);
1908 status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, newname);
1909 if (!NT_STATUS_IS_OK(status)) {
1910 END_PROFILE(SMBntrename);
1911 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1912 return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1914 return ERROR_NT(status);
1917 DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
1919 switch(rename_type) {
1920 case RENAME_FLAG_RENAME:
1921 status = rename_internals(conn, &req, oldname, newname,
1922 attrs, False, src_has_wcard,
1925 case RENAME_FLAG_HARD_LINK:
1926 if (src_has_wcard || dest_has_wcard) {
1928 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1930 status = hardlink_internals(conn, oldname, newname);
1933 case RENAME_FLAG_COPY:
1934 if (src_has_wcard || dest_has_wcard) {
1936 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1938 status = copy_internals(conn, &req, oldname,
1942 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1943 status = NT_STATUS_INVALID_PARAMETER;
1946 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1950 if (!NT_STATUS_IS_OK(status)) {
1951 END_PROFILE(SMBntrename);
1952 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1953 /* We have re-scheduled this call. */
1956 return ERROR_NT(status);
1959 outsize = set_message(inbuf,outbuf,0,0,False);
1961 END_PROFILE(SMBntrename);
1965 /****************************************************************************
1966 Reply to a notify change - queue the request and
1967 don't allow a directory to be opened.
1968 ****************************************************************************/
1970 static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf,
1971 char *outbuf, int length,
1973 uint16 **ppsetup, uint32 setup_count,
1975 uint32 parameter_count,
1976 char **ppdata, uint32 data_count,
1977 uint32 max_data_count,
1978 uint32 max_param_count)
1980 uint16 *setup = *ppsetup;
1986 if(setup_count < 6) {
1987 return ERROR_DOS(ERRDOS,ERRbadfunc);
1990 fsp = file_fsp((char *)setup,4);
1991 filter = IVAL(setup, 0);
1992 recursive = (SVAL(setup, 6) != 0) ? True : False;
1994 DEBUG(3,("call_nt_transact_notify_change\n"));
1997 return ERROR_DOS(ERRDOS,ERRbadfid);
2001 char *filter_string;
2003 if (!(filter_string = notify_filter_string(NULL, filter))) {
2004 return ERROR_NT(NT_STATUS_NO_MEMORY);
2007 DEBUG(3,("call_nt_transact_notify_change: notify change "
2008 "called on %s, filter = %s, recursive = %d\n",
2009 fsp->fsp_name, filter_string, recursive));
2011 TALLOC_FREE(filter_string);
2014 if((!fsp->is_directory) || (conn != fsp->conn)) {
2015 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2018 if (fsp->notify == NULL) {
2020 status = change_notify_create(fsp, filter, recursive);
2022 if (!NT_STATUS_IS_OK(status)) {
2023 DEBUG(10, ("change_notify_create returned %s\n",
2024 nt_errstr(status)));
2025 return ERROR_NT(status);
2029 if (fsp->notify->num_changes != 0) {
2032 * We've got changes pending, respond immediately
2036 * TODO: write a torture test to check the filtering behaviour
2040 change_notify_reply(inbuf, fsp->notify);
2043 * change_notify_reply() above has independently sent its
2050 * No changes pending, queue the request
2053 status = change_notify_add_request(inbuf, filter, recursive, fsp);
2054 if (!NT_STATUS_IS_OK(status)) {
2055 return ERROR_NT(status);
2061 /****************************************************************************
2062 Reply to an NT transact rename command.
2063 ****************************************************************************/
2065 static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2066 uint16 **ppsetup, uint32 setup_count,
2067 char **ppparams, uint32 parameter_count,
2068 char **ppdata, uint32 data_count, uint32 max_data_count)
2070 char *params = *ppparams;
2072 files_struct *fsp = NULL;
2073 BOOL replace_if_exists = False;
2074 BOOL dest_has_wcard = False;
2076 struct smb_request req;
2078 init_smb_request(&req, (uint8 *)inbuf);
2080 if(parameter_count < 5) {
2081 return ERROR_DOS(ERRDOS,ERRbadfunc);
2084 fsp = file_fsp(params, 0);
2085 replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
2086 CHECK_FSP(fsp, conn);
2087 srvstr_get_path_wcard(inbuf, SVAL(inbuf,smb_flg2), new_name, params+4,
2088 sizeof(new_name), parameter_count - 4,
2089 STR_TERMINATE, &status, &dest_has_wcard);
2090 if (!NT_STATUS_IS_OK(status)) {
2091 return ERROR_NT(status);
2094 status = rename_internals(conn, &req, fsp->fsp_name,
2095 new_name, 0, replace_if_exists, False, dest_has_wcard);
2097 if (!NT_STATUS_IS_OK(status)) {
2098 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
2099 /* We have re-scheduled this call. */
2102 return ERROR_NT(status);
2106 * Rename was successful.
2108 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2110 DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
2111 fsp->fsp_name, new_name));
2116 /******************************************************************************
2117 Fake up a completely empty SD.
2118 *******************************************************************************/
2120 static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
2124 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
2126 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
2133 /****************************************************************************
2134 Reply to query a security descriptor.
2135 ****************************************************************************/
2137 static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2138 uint16 **ppsetup, uint32 setup_count,
2139 char **ppparams, uint32 parameter_count,
2140 char **ppdata, uint32 data_count, uint32 max_data_count)
2142 char *params = *ppparams;
2143 char *data = *ppdata;
2145 SEC_DESC *psd = NULL;
2147 uint32 security_info_wanted;
2148 TALLOC_CTX *mem_ctx;
2149 files_struct *fsp = NULL;
2151 if(parameter_count < 8) {
2152 return ERROR_DOS(ERRDOS,ERRbadfunc);
2155 fsp = file_fsp(params,0);
2157 return ERROR_DOS(ERRDOS,ERRbadfid);
2160 security_info_wanted = IVAL(params,4);
2162 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, info_wanted = 0x%x\n", fsp->fsp_name,
2163 (unsigned int)security_info_wanted ));
2165 params = nttrans_realloc(ppparams, 4);
2166 if(params == NULL) {
2167 return ERROR_DOS(ERRDOS,ERRnomem);
2170 if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
2171 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
2172 return ERROR_DOS(ERRDOS,ERRnomem);
2176 * Get the permissions to return.
2179 if (!lp_nt_acl_support(SNUM(conn))) {
2180 sd_size = get_null_nt_acl(mem_ctx, &psd);
2182 sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd, security_info_wanted, &psd);
2186 talloc_destroy(mem_ctx);
2187 return(UNIXERROR(ERRDOS,ERRnoaccess));
2190 DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
2192 SIVAL(params,0,(uint32)sd_size);
2194 if(max_data_count < sd_size) {
2196 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
2197 params, 4, *ppdata, 0);
2198 talloc_destroy(mem_ctx);
2203 * Allocate the data we will point this at.
2206 data = nttrans_realloc(ppdata, sd_size);
2208 talloc_destroy(mem_ctx);
2209 return ERROR_DOS(ERRDOS,ERRnomem);
2213 * Init the parse struct we will marshall into.
2216 prs_init(&pd, 0, mem_ctx, MARSHALL);
2219 * Setup the prs_struct to point at the memory we just
2223 prs_give_memory( &pd, data, (uint32)sd_size, False);
2226 * Finally, linearize into the outgoing buffer.
2229 if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
2230 DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
2231 security descriptor.\n"));
2233 * Return access denied for want of a better error message..
2235 talloc_destroy(mem_ctx);
2236 return(UNIXERROR(ERRDOS,ERRnoaccess));
2240 * Now we can delete the security descriptor.
2243 talloc_destroy(mem_ctx);
2245 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, 4, data,
2250 /****************************************************************************
2251 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2252 ****************************************************************************/
2254 static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2255 uint16 **ppsetup, uint32 setup_count,
2256 char **ppparams, uint32 parameter_count,
2257 char **ppdata, uint32 data_count, uint32 max_data_count)
2259 char *params= *ppparams;
2260 char *data = *ppdata;
2261 files_struct *fsp = NULL;
2262 uint32 security_info_sent = 0;
2265 if(parameter_count < 8) {
2266 return ERROR_DOS(ERRDOS,ERRbadfunc);
2269 if((fsp = file_fsp(params,0)) == NULL) {
2270 return ERROR_DOS(ERRDOS,ERRbadfid);
2273 if(!lp_nt_acl_support(SNUM(conn))) {
2277 security_info_sent = IVAL(params,4);
2279 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name,
2280 (unsigned int)security_info_sent ));
2282 if (data_count == 0) {
2283 return ERROR_DOS(ERRDOS, ERRnoaccess);
2286 if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
2287 return ERROR_NT(nt_status);
2292 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
2296 /****************************************************************************
2298 ****************************************************************************/
2300 static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2301 uint16 **ppsetup, uint32 setup_count,
2302 char **ppparams, uint32 parameter_count,
2303 char **ppdata, uint32 data_count, uint32 max_data_count)
2310 static BOOL logged_message;
2311 char *pdata = *ppdata;
2313 if (setup_count != 8) {
2314 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2315 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2318 function = IVAL(*ppsetup, 0);
2319 fidnum = SVAL(*ppsetup, 4);
2320 isFSctl = CVAL(*ppsetup, 6);
2321 compfilter = CVAL(*ppsetup, 7);
2323 DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2324 function, fidnum, isFSctl, compfilter));
2326 fsp=file_fsp((char *)*ppsetup, 4);
2327 /* this check is done in each implemented function case for now
2328 because I don't want to break anything... --metze
2329 FSP_BELONGS_CONN(fsp,conn);*/
2332 case FSCTL_SET_SPARSE:
2333 /* pretend this succeeded - tho strictly we should
2334 mark the file sparse (if the local fs supports it)
2335 so we can know if we need to pre-allocate or not */
2337 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
2338 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
2342 case FSCTL_CREATE_OR_GET_OBJECT_ID:
2344 unsigned char objid[16];
2346 /* This should return the object-id on this file.
2347 * I think I'll make this be the inode+dev. JRA.
2350 DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
2353 pdata = nttrans_realloc(ppdata, data_count);
2354 if (pdata == NULL) {
2355 return ERROR_NT(NT_STATUS_NO_MEMORY);
2357 push_file_id_16(pdata, &fsp->file_id);
2358 memcpy(pdata+16,create_volume_objectid(conn,objid),16);
2359 push_file_id_16(pdata+32, &fsp->file_id);
2360 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, pdata, data_count);
2364 case FSCTL_GET_REPARSE_POINT:
2365 /* pretend this fail - my winXP does it like this
2369 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2370 return ERROR_NT(NT_STATUS_NOT_A_REPARSE_POINT);
2372 case FSCTL_SET_REPARSE_POINT:
2373 /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
2377 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
2378 return ERROR_NT(NT_STATUS_NOT_A_REPARSE_POINT);
2380 case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
2383 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
2384 * and return their volume names. If max_data_count is 16, then it is just
2385 * asking for the number of volumes and length of the combined names.
2387 * pdata is the data allocated by our caller, but that uses
2388 * total_data_count (which is 0 in our case) rather than max_data_count.
2389 * Allocate the correct amount and return the pointer to let
2390 * it be deallocated when we return.
2392 SHADOW_COPY_DATA *shadow_data = NULL;
2393 TALLOC_CTX *shadow_mem_ctx = NULL;
2394 BOOL labels = False;
2395 uint32 labels_data_count = 0;
2399 FSP_BELONGS_CONN(fsp,conn);
2401 if (max_data_count < 16) {
2402 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
2404 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2407 if (max_data_count > 16) {
2411 shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA");
2412 if (shadow_mem_ctx == NULL) {
2413 DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
2414 return ERROR_NT(NT_STATUS_NO_MEMORY);
2417 shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
2418 if (shadow_data == NULL) {
2419 DEBUG(0,("TALLOC_ZERO() failed!\n"));
2420 talloc_destroy(shadow_mem_ctx);
2421 return ERROR_NT(NT_STATUS_NO_MEMORY);
2424 shadow_data->mem_ctx = shadow_mem_ctx;
2427 * Call the VFS routine to actually do the work.
2429 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) {
2430 talloc_destroy(shadow_data->mem_ctx);
2431 if (errno == ENOSYS) {
2432 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n",
2433 conn->connectpath));
2434 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2436 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n",
2437 conn->connectpath));
2438 return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
2442 labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
2447 data_count = 12+labels_data_count+4;
2450 if (max_data_count<data_count) {
2451 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
2452 max_data_count,data_count));
2453 talloc_destroy(shadow_data->mem_ctx);
2454 return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
2457 pdata = nttrans_realloc(ppdata, data_count);
2458 if (pdata == NULL) {
2459 talloc_destroy(shadow_data->mem_ctx);
2460 return ERROR_NT(NT_STATUS_NO_MEMORY);
2465 /* num_volumes 4 bytes */
2466 SIVAL(pdata,0,shadow_data->num_volumes);
2469 /* num_labels 4 bytes */
2470 SIVAL(pdata,4,shadow_data->num_volumes);
2473 /* needed_data_count 4 bytes */
2474 SIVAL(pdata,8,labels_data_count);
2478 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
2479 shadow_data->num_volumes,fsp->fsp_name));
2480 if (labels && shadow_data->labels) {
2481 for (i=0;i<shadow_data->num_volumes;i++) {
2482 srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
2483 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
2484 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
2488 talloc_destroy(shadow_data->mem_ctx);
2490 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2496 case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
2498 /* pretend this succeeded -
2500 * we have to send back a list with all files owned by this SID
2502 * but I have to check that --metze
2506 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
2508 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
2510 FSP_BELONGS_CONN(fsp,conn);
2512 /* unknown 4 bytes: this is not the length of the sid :-( */
2513 /*unknown = IVAL(pdata,0);*/
2515 sid_parse(pdata+4,sid_len,&sid);
2516 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
2518 if (!sid_to_uid(&sid, &uid)) {
2519 DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
2520 sid_string_static(&sid),(unsigned long)sid_len));
2524 /* we can take a look at the find source :-)
2526 * find ./ -uid $uid -name '*' is what we need here
2529 * and send 4bytes len and then NULL terminated unicode strings
2532 * but I don't know how to deal with the paged results
2533 * (maybe we can hang the result anywhere in the fsp struct)
2535 * we don't send all files at once
2536 * and at the next we should *not* start from the beginning,
2537 * so we have to cache the result
2542 /* this works for now... */
2543 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0,
2548 if (!logged_message) {
2549 logged_message = True; /* Only print this once... */
2550 DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n",
2555 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2559 #ifdef HAVE_SYS_QUOTAS
2560 /****************************************************************************
2561 Reply to get user quota
2562 ****************************************************************************/
2564 static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2565 uint16 **ppsetup, uint32 setup_count,
2566 char **ppparams, uint32 parameter_count,
2567 char **ppdata, uint32 data_count, uint32 max_data_count)
2569 NTSTATUS nt_status = NT_STATUS_OK;
2570 char *params = *ppparams;
2571 char *pdata = *ppdata;
2573 int data_len=0,param_len=0;
2576 files_struct *fsp = NULL;
2580 BOOL start_enum = True;
2581 SMB_NTQUOTA_STRUCT qt;
2582 SMB_NTQUOTA_LIST *tmp_list;
2583 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2588 if (current_user.ut.uid != 0) {
2589 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
2590 lp_servicename(SNUM(conn)),conn->user));
2591 return ERROR_DOS(ERRDOS,ERRnoaccess);
2595 * Ensure minimum number of parameters sent.
2598 if (parameter_count < 4) {
2599 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
2600 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2603 /* maybe we can check the quota_fnum */
2604 fsp = file_fsp(params,0);
2605 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2606 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2607 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2610 /* the NULL pointer checking for fsp->fake_file_handle->pd
2611 * is done by CHECK_NTQUOTA_HANDLE_OK()
2613 qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
2615 level = SVAL(params,2);
2617 /* unknown 12 bytes leading in params */
2620 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
2621 /* seems that we should continue with the enum here --metze */
2623 if (qt_handle->quota_list!=NULL &&
2624 qt_handle->tmp_list==NULL) {
2627 free_ntquota_list(&(qt_handle->quota_list));
2629 /* Realloc the size of parameters and data we will return */
2631 params = nttrans_realloc(ppparams, param_len);
2632 if(params == NULL) {
2633 return ERROR_DOS(ERRDOS,ERRnomem);
2637 SIVAL(params,0,data_len);
2644 case TRANSACT_GET_USER_QUOTA_LIST_START:
2646 if (qt_handle->quota_list==NULL &&
2647 qt_handle->tmp_list==NULL) {
2651 if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
2652 return ERROR_DOS(ERRSRV,ERRerror);
2654 /* Realloc the size of parameters and data we will return */
2656 params = nttrans_realloc(ppparams, param_len);
2657 if(params == NULL) {
2658 return ERROR_DOS(ERRDOS,ERRnomem);
2661 /* we should not trust the value in max_data_count*/
2662 max_data_count = MIN(max_data_count,2048);
2664 pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
2666 return ERROR_DOS(ERRDOS,ERRnomem);
2671 /* set params Size of returned Quota Data 4 bytes*/
2672 /* but set it later when we know it */
2674 /* for each entry push the data */
2677 qt_handle->tmp_list = qt_handle->quota_list;
2680 tmp_list = qt_handle->tmp_list;
2682 for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
2683 tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
2685 sid_len = sid_size(&tmp_list->quotas->sid);
2686 entry_len = 40 + sid_len;
2688 /* nextoffset entry 4 bytes */
2689 SIVAL(entry,0,entry_len);
2691 /* then the len of the SID 4 bytes */
2692 SIVAL(entry,4,sid_len);
2694 /* unknown data 8 bytes SMB_BIG_UINT */
2695 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
2697 /* the used disk space 8 bytes SMB_BIG_UINT */
2698 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
2700 /* the soft quotas 8 bytes SMB_BIG_UINT */
2701 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
2703 /* the hard quotas 8 bytes SMB_BIG_UINT */
2704 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
2706 /* and now the SID */
2707 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
2710 qt_handle->tmp_list = tmp_list;
2712 /* overwrite the offset of the last entry */
2713 SIVAL(entry-entry_len,0,0);
2715 data_len = 4+qt_len;
2716 /* overwrite the params quota_data_len */
2717 SIVAL(params,0,data_len);
2721 case TRANSACT_GET_USER_QUOTA_FOR_SID:
2723 /* unknown 4 bytes IVAL(pdata,0) */
2725 if (data_count < 8) {
2726 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
2727 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2730 sid_len = IVAL(pdata,4);
2731 /* Ensure this is less than 1mb. */
2732 if (sid_len > (1024*1024)) {
2733 return ERROR_DOS(ERRDOS,ERRnomem);
2736 if (data_count < 8+sid_len) {
2737 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
2738 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2741 data_len = 4+40+sid_len;
2743 if (max_data_count < data_len) {
2744 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n",
2745 max_data_count, data_len));
2747 SIVAL(params,0,data_len);
2749 nt_status = NT_STATUS_BUFFER_TOO_SMALL;
2753 sid_parse(pdata+8,sid_len,&sid);
2755 if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2758 * we have to return zero's in all fields
2759 * instead of returning an error here
2764 /* Realloc the size of parameters and data we will return */
2766 params = nttrans_realloc(ppparams, param_len);
2767 if(params == NULL) {
2768 return ERROR_DOS(ERRDOS,ERRnomem);
2771 pdata = nttrans_realloc(ppdata, data_len);
2773 return ERROR_DOS(ERRDOS,ERRnomem);
2778 /* set params Size of returned Quota Data 4 bytes*/
2779 SIVAL(params,0,data_len);
2781 /* nextoffset entry 4 bytes */
2784 /* then the len of the SID 4 bytes */
2785 SIVAL(entry,4,sid_len);
2787 /* unknown data 8 bytes SMB_BIG_UINT */
2788 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
2790 /* the used disk space 8 bytes SMB_BIG_UINT */
2791 SBIG_UINT(entry,16,qt.usedspace);
2793 /* the soft quotas 8 bytes SMB_BIG_UINT */
2794 SBIG_UINT(entry,24,qt.softlim);
2796 /* the hard quotas 8 bytes SMB_BIG_UINT */
2797 SBIG_UINT(entry,32,qt.hardlim);
2799 /* and now the SID */
2800 sid_linearize(entry+40, sid_len, &sid);
2805 DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
2806 return ERROR_DOS(ERRSRV,ERRerror);
2810 send_nt_replies(inbuf, outbuf, bufsize, nt_status, params, param_len,
2816 /****************************************************************************
2817 Reply to set user quota
2818 ****************************************************************************/
2820 static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
2821 uint16 **ppsetup, uint32 setup_count,
2822 char **ppparams, uint32 parameter_count,
2823 char **ppdata, uint32 data_count, uint32 max_data_count)
2825 char *params = *ppparams;
2826 char *pdata = *ppdata;
2827 int data_len=0,param_len=0;
2828 SMB_NTQUOTA_STRUCT qt;
2831 files_struct *fsp = NULL;
2836 if (current_user.ut.uid != 0) {
2837 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
2838 lp_servicename(SNUM(conn)),conn->user));
2839 return ERROR_DOS(ERRDOS,ERRnoaccess);
2843 * Ensure minimum number of parameters sent.
2846 if (parameter_count < 2) {
2847 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2848 return ERROR_DOS(ERRDOS,ERRinvalidparam);
2851 /* maybe we can check the quota_fnum */
2852 fsp = file_fsp(params,0);
2853 if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
2854 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2855 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
2858 if (data_count < 40) {
2859 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
2860 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2863 /* offset to next quota record.
2864 * 4 bytes IVAL(pdata,0)
2869 sid_len = IVAL(pdata,4);
2871 if (data_count < 40+sid_len) {
2872 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
2873 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2876 /* unknown 8 bytes in pdata
2877 * maybe its the change time in NTTIME
2880 /* the used space 8 bytes (SMB_BIG_UINT)*/
2881 qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16);
2882 #ifdef LARGE_SMB_OFF_T
2883 qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32);
2884 #else /* LARGE_SMB_OFF_T */
2885 if ((IVAL(pdata,20) != 0)&&
2886 ((qt.usedspace != 0xFFFFFFFF)||
2887 (IVAL(pdata,20)!=0xFFFFFFFF))) {
2888 /* more than 32 bits? */
2889 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2891 #endif /* LARGE_SMB_OFF_T */
2893 /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
2894 qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
2895 #ifdef LARGE_SMB_OFF_T
2896 qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
2897 #else /* LARGE_SMB_OFF_T */
2898 if ((IVAL(pdata,28) != 0)&&
2899 ((qt.softlim != 0xFFFFFFFF)||
2900 (IVAL(pdata,28)!=0xFFFFFFFF))) {
2901 /* more than 32 bits? */
2902 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2904 #endif /* LARGE_SMB_OFF_T */
2906 /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
2907 qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
2908 #ifdef LARGE_SMB_OFF_T
2909 qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
2910 #else /* LARGE_SMB_OFF_T */
2911 if ((IVAL(pdata,36) != 0)&&
2912 ((qt.hardlim != 0xFFFFFFFF)||
2913 (IVAL(pdata,36)!=0xFFFFFFFF))) {
2914 /* more than 32 bits? */
2915 return ERROR_DOS(ERRDOS,ERRunknownlevel);
2917 #endif /* LARGE_SMB_OFF_T */
2919 sid_parse(pdata+40,sid_len,&sid);
2920 DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
2922 /* 44 unknown bytes left... */
2924 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2925 return ERROR_DOS(ERRSRV,ERRerror);
2928 send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len,
2933 #endif /* HAVE_SYS_QUOTAS */
2935 static int handle_nttrans(connection_struct *conn,
2936 struct trans_state *state,
2937 char *inbuf, char *outbuf, int size, int bufsize)
2941 if (Protocol >= PROTOCOL_NT1) {
2942 SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | 0x40); /* IS_LONG_NAME */
2945 /* Now we must call the relevant NT_TRANS function */
2946 switch(state->call) {
2947 case NT_TRANSACT_CREATE:
2949 START_PROFILE(NT_transact_create);
2950 outsize = call_nt_transact_create(conn, inbuf, outbuf,
2952 &state->setup, state->setup_count,
2953 &state->param, state->total_param,
2954 &state->data, state->total_data,
2955 state->max_data_return);
2956 END_PROFILE(NT_transact_create);
2960 case NT_TRANSACT_IOCTL:
2962 START_PROFILE(NT_transact_ioctl);
2963 outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
2965 &state->setup, state->setup_count,
2966 &state->param, state->total_param,
2967 &state->data, state->total_data, state->max_data_return);
2968 END_PROFILE(NT_transact_ioctl);
2972 case NT_TRANSACT_SET_SECURITY_DESC:
2974 START_PROFILE(NT_transact_set_security_desc);
2975 outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf,
2977 &state->setup, state->setup_count,
2978 &state->param, state->total_param,
2979 &state->data, state->total_data, state->max_data_return);
2980 END_PROFILE(NT_transact_set_security_desc);
2984 case NT_TRANSACT_NOTIFY_CHANGE:
2986 START_PROFILE(NT_transact_notify_change);
2987 outsize = call_nt_transact_notify_change(
2988 conn, inbuf, outbuf, size, bufsize,
2989 &state->setup, state->setup_count,
2990 &state->param, state->total_param,
2991 &state->data, state->total_data,
2992 state->max_data_return,
2993 state->max_param_return);
2994 END_PROFILE(NT_transact_notify_change);
2998 case NT_TRANSACT_RENAME:
3000 START_PROFILE(NT_transact_rename);
3001 outsize = call_nt_transact_rename(conn, inbuf, outbuf,
3003 &state->setup, state->setup_count,
3004 &state->param, state->total_param,
3005 &state->data, state->total_data, state->max_data_return);
3006 END_PROFILE(NT_transact_rename);
3010 case NT_TRANSACT_QUERY_SECURITY_DESC:
3012 START_PROFILE(NT_transact_query_security_desc);
3013 outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf,
3015 &state->setup, state->setup_count,
3016 &state->param, state->total_param,
3017 &state->data, state->total_data, state->max_data_return);
3018 END_PROFILE(NT_transact_query_security_desc);
3022 #ifdef HAVE_SYS_QUOTAS
3023 case NT_TRANSACT_GET_USER_QUOTA:
3025 START_PROFILE(NT_transact_get_user_quota);
3026 outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf,
3028 &state->setup, state->setup_count,
3029 &state->param, state->total_param,
3030 &state->data, state->total_data, state->max_data_return);
3031 END_PROFILE(NT_transact_get_user_quota);
3035 case NT_TRANSACT_SET_USER_QUOTA:
3037 START_PROFILE(NT_transact_set_user_quota);
3038 outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf,
3040 &state->setup, state->setup_count,
3041 &state->param, state->total_param,
3042 &state->data, state->total_data, state->max_data_return);
3043 END_PROFILE(NT_transact_set_user_quota);
3046 #endif /* HAVE_SYS_QUOTAS */
3049 /* Error in request */
3050 DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n",
3052 return ERROR_DOS(ERRSRV,ERRerror);
3057 /****************************************************************************
3058 Reply to a SMBNTtrans.
3059 ****************************************************************************/
3061 int reply_nttrans(connection_struct *conn,
3062 char *inbuf,char *outbuf,int size,int bufsize)
3065 uint32 pscnt = IVAL(inbuf,smb_nt_ParameterCount);
3066 uint32 psoff = IVAL(inbuf,smb_nt_ParameterOffset);
3067 uint32 dscnt = IVAL(inbuf,smb_nt_DataCount);
3068 uint32 dsoff = IVAL(inbuf,smb_nt_DataOffset);
3070 uint16 function_code = SVAL( inbuf, smb_nt_Function);
3072 struct trans_state *state;
3074 START_PROFILE(SMBnttrans);
3076 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
3077 END_PROFILE(SMBnttrans);
3078 return ERROR_DOS(ERRSRV,ERRaccess);
3081 result = allow_new_trans(conn->pending_trans, SVAL(inbuf, smb_mid));
3082 if (!NT_STATUS_IS_OK(result)) {
3083 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
3084 END_PROFILE(SMBnttrans);
3085 return ERROR_NT(result);
3088 if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
3089 END_PROFILE(SMBnttrans);
3090 return ERROR_DOS(ERRSRV,ERRaccess);
3093 state->cmd = SMBnttrans;
3095 state->mid = SVAL(inbuf,smb_mid);
3096 state->vuid = SVAL(inbuf,smb_uid);
3097 state->total_data = IVAL(inbuf, smb_nt_TotalDataCount);
3099 state->total_param = IVAL(inbuf, smb_nt_TotalParameterCount);
3100 state->param = NULL;
3101 state->max_data_return = IVAL(inbuf,smb_nt_MaxDataCount);
3102 state->max_param_return = IVAL(inbuf,smb_nt_MaxParameterCount);
3104 /* setup count is in *words* */
3105 state->setup_count = 2*CVAL(inbuf,smb_nt_SetupCount);
3106 state->setup = NULL;
3107 state->call = function_code;
3110 * All nttrans messages we handle have smb_wct == 19 +
3111 * state->setup_count. Ensure this is so as a sanity check.
3114 if(CVAL(inbuf, smb_wct) != 19 + (state->setup_count/2)) {
3115 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
3116 CVAL(inbuf, smb_wct), 19 + (state->setup_count/2)));
3120 /* Don't allow more than 128mb for each value. */
3121 if ((state->total_data > (1024*1024*128)) ||
3122 (state->total_param > (1024*1024*128))) {
3123 END_PROFILE(SMBnttrans);
3124 return ERROR_DOS(ERRDOS,ERRnomem);
3127 if ((dscnt > state->total_data) || (pscnt > state->total_param))
3130 if (state->total_data) {
3131 /* Can't use talloc here, the core routines do realloc on the
3132 * params and data. */
3133 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
3134 DEBUG(0,("reply_nttrans: data malloc fail for %u "
3135 "bytes !\n", (unsigned int)state->total_data));
3137 END_PROFILE(SMBnttrans);
3138 return(ERROR_DOS(ERRDOS,ERRnomem));
3140 if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
3142 if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) ||
3143 (smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
3146 memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
3149 if (state->total_param) {
3150 /* Can't use talloc here, the core routines do realloc on the
3151 * params and data. */
3152 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
3153 DEBUG(0,("reply_nttrans: param malloc fail for %u "
3154 "bytes !\n", (unsigned int)state->total_param));
3155 SAFE_FREE(state->data);
3157 END_PROFILE(SMBnttrans);
3158 return(ERROR_DOS(ERRDOS,ERRnomem));
3160 if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
3162 if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) ||
3163 (smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
3166 memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
3169 state->received_data = dscnt;
3170 state->received_param = pscnt;
3172 if(state->setup_count > 0) {
3173 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
3174 state->setup_count));
3175 state->setup = (uint16 *)TALLOC(state, state->setup_count);
3176 if (state->setup == NULL) {
3177 DEBUG(0,("reply_nttrans : Out of memory\n"));
3178 SAFE_FREE(state->data);
3179 SAFE_FREE(state->param);
3181 END_PROFILE(SMBnttrans);
3182 return ERROR_DOS(ERRDOS,ERRnomem);
3185 if ((smb_nt_SetupStart + state->setup_count < smb_nt_SetupStart) ||
3186 (smb_nt_SetupStart + state->setup_count < state->setup_count)) {
3189 if (smb_nt_SetupStart + state->setup_count > size) {
3193 memcpy( state->setup, &inbuf[smb_nt_SetupStart], state->setup_count);
3194 dump_data(10, (uint8 *)state->setup, state->setup_count);
3197 if ((state->received_data == state->total_data) &&
3198 (state->received_param == state->total_param)) {
3199 outsize = handle_nttrans(conn, state, inbuf, outbuf,
3201 SAFE_FREE(state->param);
3202 SAFE_FREE(state->data);
3204 END_PROFILE(SMBnttrans);
3208 DLIST_ADD(conn->pending_trans, state);
3210 /* We need to send an interim response then receive the rest
3211 of the parameter/data bytes */
3212 outsize = set_message(inbuf,outbuf,0,0,False);
3214 END_PROFILE(SMBnttrans);
3219 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3220 SAFE_FREE(state->data);
3221 SAFE_FREE(state->param);
3223 END_PROFILE(SMBnttrans);
3224 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3227 /****************************************************************************
3228 Reply to a SMBnttranss
3229 ****************************************************************************/
3231 int reply_nttranss(connection_struct *conn, char *inbuf,char *outbuf,
3232 int size,int bufsize)
3235 unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
3236 struct trans_state *state;
3238 START_PROFILE(SMBnttranss);
3242 for (state = conn->pending_trans; state != NULL;
3243 state = state->next) {
3244 if (state->mid == SVAL(inbuf,smb_mid)) {
3249 if ((state == NULL) || (state->cmd != SMBnttrans)) {
3250 END_PROFILE(SMBnttranss);
3251 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
3254 /* Revise state->total_param and state->total_data in case they have
3255 changed downwards */
3256 if (IVAL(inbuf, smb_nts_TotalParameterCount) < state->total_param) {
3257 state->total_param = IVAL(inbuf, smb_nts_TotalParameterCount);
3259 if (IVAL(inbuf, smb_nts_TotalDataCount) < state->total_data) {
3260 state->total_data = IVAL(inbuf, smb_nts_TotalDataCount);
3263 pcnt = IVAL(inbuf,smb_nts_ParameterCount);
3264 poff = IVAL(inbuf, smb_nts_ParameterOffset);
3265 pdisp = IVAL(inbuf, smb_nts_ParameterDisplacement);
3267 dcnt = IVAL(inbuf, smb_nts_DataCount);
3268 ddisp = IVAL(inbuf, smb_nts_DataDisplacement);
3269 doff = IVAL(inbuf, smb_nts_DataOffset);
3271 state->received_param += pcnt;
3272 state->received_data += dcnt;
3274 if ((state->received_data > state->total_data) ||
3275 (state->received_param > state->total_param))
3279 if (pdisp+pcnt > state->total_param)
3281 if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
3283 if (pdisp > state->total_param)
3285 if ((smb_base(inbuf) + poff + pcnt > inbuf + size) ||
3286 (smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
3288 if (state->param + pdisp < state->param)
3291 memcpy(state->param+pdisp,smb_base(inbuf)+poff,
3296 if (ddisp+dcnt > state->total_data)
3298 if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
3300 if (ddisp > state->total_data)
3302 if ((smb_base(inbuf) + doff + dcnt > inbuf + size) ||
3303 (smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
3305 if (state->data + ddisp < state->data)
3308 memcpy(state->data+ddisp, smb_base(inbuf)+doff,
3312 if ((state->received_param < state->total_param) ||
3313 (state->received_data < state->total_data)) {
3314 END_PROFILE(SMBnttranss);
3318 /* construct_reply_common has done us the favor to pre-fill the
3319 * command field with SMBnttranss which is wrong :-)
3321 SCVAL(outbuf,smb_com,SMBnttrans);
3323 outsize = handle_nttrans(conn, state, inbuf, outbuf,
3326 DLIST_REMOVE(conn->pending_trans, state);
3327 SAFE_FREE(state->data);
3328 SAFE_FREE(state->param);
3332 END_PROFILE(SMBnttranss);
3333 return(ERROR_DOS(ERRSRV,ERRnosupport));
3336 END_PROFILE(SMBnttranss);
3341 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3342 DLIST_REMOVE(conn->pending_trans, state);
3343 SAFE_FREE(state->data);
3344 SAFE_FREE(state->param);
3346 END_PROFILE(SMBnttranss);
3347 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);