1 /*
2 Unix SMB/CIFS implementation.
3 SMB NT transaction handling
4 Copyright (C) Jeremy Allison 1994-2007
5 Copyright (C) Stefan (metze) Metzmacher 2003
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "system/filesys.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "fake_file.h"
26 #include "../libcli/security/security.h"
27 #include "../librpc/gen_ndr/ndr_security.h"
28 #include "passdb/lookup_sid.h"
29 #include "auth.h"
30 #include "smbprofile.h"
31 #include "libsmb/libsmb.h"
32 #include "lib/util_ea.h"
33 #include "librpc/gen_ndr/ndr_quota.h"
34 #include "librpc/gen_ndr/ndr_security.h"
35
36 extern const struct generic_mapping file_generic_mapping;
37
nttrans_realloc(char ** ptr,size_t size)38 static char *nttrans_realloc(char **ptr, size_t size)
39 {
40 if (ptr==NULL) {
41 smb_panic("nttrans_realloc() called with NULL ptr");
42 }
43
44 *ptr = (char *)SMB_REALLOC(*ptr, size);
45 if(*ptr == NULL) {
46 return NULL;
47 }
48 memset(*ptr,'\0',size);
49 return *ptr;
50 }
51
52 /****************************************************************************
53 Send the required number of replies back.
54 We assume all fields other than the data fields are
55 set correctly for the type of call.
56 HACK ! Always assumes smb_setup field is zero.
57 ****************************************************************************/
58
send_nt_replies(connection_struct * conn,struct smb_request * req,NTSTATUS nt_error,char * params,int paramsize,char * pdata,int datasize)59 static void send_nt_replies(connection_struct *conn,
60 struct smb_request *req, NTSTATUS nt_error,
61 char *params, int paramsize,
62 char *pdata, int datasize)
63 {
64 int data_to_send = datasize;
65 int params_to_send = paramsize;
66 int useable_space;
67 char *pp = params;
68 char *pd = pdata;
69 int params_sent_thistime, data_sent_thistime, total_sent_thistime;
70 int alignment_offset = 1;
71 int data_alignment_offset = 0;
72 struct smbXsrv_connection *xconn = req->xconn;
73 int max_send = xconn->smb1.sessions.max_send;
74
75 /*
76 * If there genuinely are no parameters or data to send just send
77 * the empty packet.
78 */
79
80 if(params_to_send == 0 && data_to_send == 0) {
81 reply_outbuf(req, 18, 0);
82 if (NT_STATUS_V(nt_error)) {
83 error_packet_set((char *)req->outbuf,
84 0, 0, nt_error,
85 __LINE__,__FILE__);
86 }
87 show_msg((char *)req->outbuf);
88 if (!srv_send_smb(xconn,
89 (char *)req->outbuf,
90 true, req->seqnum+1,
91 IS_CONN_ENCRYPTED(conn),
92 &req->pcd)) {
93 exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
94 }
95 TALLOC_FREE(req->outbuf);
96 return;
97 }
98
99 /*
100 * When sending params and data ensure that both are nicely aligned.
101 * Only do this alignment when there is also data to send - else
102 * can cause NT redirector problems.
103 */
104
105 if (((params_to_send % 4) != 0) && (data_to_send != 0)) {
106 data_alignment_offset = 4 - (params_to_send % 4);
107 }
108
109 /*
110 * Space is bufsize minus Netbios over TCP header minus SMB header.
111 * The alignment_offset is to align the param bytes on a four byte
112 * boundary (2 bytes for data len, one byte pad).
113 * NT needs this to work correctly.
114 */
115
116 useable_space = max_send - (smb_size
117 + 2 * 18 /* wct */
118 + alignment_offset
119 + data_alignment_offset);
120
121 if (useable_space < 0) {
122 char *msg = talloc_asprintf(
123 talloc_tos(),
124 "send_nt_replies failed sanity useable_space = %d!!!",
125 useable_space);
126 DEBUG(0, ("%s\n", msg));
127 exit_server_cleanly(msg);
128 }
129
130 while (params_to_send || data_to_send) {
131
132 /*
133 * Calculate whether we will totally or partially fill this packet.
134 */
135
136 total_sent_thistime = params_to_send + data_to_send;
137
138 /*
139 * We can never send more than useable_space.
140 */
141
142 total_sent_thistime = MIN(total_sent_thistime, useable_space);
143
144 reply_outbuf(req, 18,
145 total_sent_thistime + alignment_offset
146 + data_alignment_offset);
147
148 /*
149 * Set total params and data to be sent.
150 */
151
152 SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
153 SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
154
155 /*
156 * Calculate how many parameters and data we can fit into
157 * this packet. Parameters get precedence.
158 */
159
160 params_sent_thistime = MIN(params_to_send,useable_space);
161 data_sent_thistime = useable_space - params_sent_thistime;
162 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
163
164 SIVAL(req->outbuf, smb_ntr_ParameterCount,
165 params_sent_thistime);
166
167 if(params_sent_thistime == 0) {
168 SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
169 SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
170 } else {
171 /*
172 * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
173 * parameter bytes, however the first 4 bytes of outbuf are
174 * the Netbios over TCP header. Thus use smb_base() to subtract
175 * them from the calculation.
176 */
177
178 SIVAL(req->outbuf,smb_ntr_ParameterOffset,
179 ((smb_buf(req->outbuf)+alignment_offset)
180 - smb_base(req->outbuf)));
181 /*
182 * Absolute displacement of param bytes sent in this packet.
183 */
184
185 SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
186 pp - params);
187 }
188
189 /*
190 * Deal with the data portion.
191 */
192
193 SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
194
195 if(data_sent_thistime == 0) {
196 SIVAL(req->outbuf,smb_ntr_DataOffset,0);
197 SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
198 } else {
199 /*
200 * The offset of the data bytes is the offset of the
201 * parameter bytes plus the number of parameters being sent this time.
202 */
203
204 SIVAL(req->outbuf, smb_ntr_DataOffset,
205 ((smb_buf(req->outbuf)+alignment_offset) -
206 smb_base(req->outbuf))
207 + params_sent_thistime + data_alignment_offset);
208 SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
209 }
210
211 /*
212 * Copy the param bytes into the packet.
213 */
214
215 if(params_sent_thistime) {
216 if (alignment_offset != 0) {
217 memset(smb_buf(req->outbuf), 0,
218 alignment_offset);
219 }
220 memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
221 params_sent_thistime);
222 }
223
224 /*
225 * Copy in the data bytes
226 */
227
228 if(data_sent_thistime) {
229 if (data_alignment_offset != 0) {
230 memset((smb_buf(req->outbuf)+alignment_offset+
231 params_sent_thistime), 0,
232 data_alignment_offset);
233 }
234 memcpy(smb_buf(req->outbuf)+alignment_offset
235 +params_sent_thistime+data_alignment_offset,
236 pd,data_sent_thistime);
237 }
238
239 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
240 params_sent_thistime, data_sent_thistime, useable_space));
241 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
242 params_to_send, data_to_send, paramsize, datasize));
243
244 if (NT_STATUS_V(nt_error)) {
245 error_packet_set((char *)req->outbuf,
246 0, 0, nt_error,
247 __LINE__,__FILE__);
248 }
249
250 /* Send the packet */
251 show_msg((char *)req->outbuf);
252 if (!srv_send_smb(xconn,
253 (char *)req->outbuf,
254 true, req->seqnum+1,
255 IS_CONN_ENCRYPTED(conn),
256 &req->pcd)) {
257 exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
258 }
259
260 TALLOC_FREE(req->outbuf);
261
262 pp += params_sent_thistime;
263 pd += data_sent_thistime;
264
265 params_to_send -= params_sent_thistime;
266 data_to_send -= data_sent_thistime;
267
268 /*
269 * Sanity check
270 */
271
272 if(params_to_send < 0 || data_to_send < 0) {
273 DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
274 params_to_send, data_to_send));
275 exit_server_cleanly("send_nt_replies: internal error");
276 }
277 }
278 }
279
280 /****************************************************************************
281 Reply to an NT create and X call on a pipe
282 ****************************************************************************/
283
nt_open_pipe(char * fname,connection_struct * conn,struct smb_request * req,uint16_t * ppnum)284 static void nt_open_pipe(char *fname, connection_struct *conn,
285 struct smb_request *req, uint16_t *ppnum)
286 {
287 files_struct *fsp;
288 NTSTATUS status;
289
290 DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
291
292 /* Strip \\ off the name if present. */
293 while (fname[0] == '\\') {
294 fname++;
295 }
296
297 status = open_np_file(req, fname, &fsp);
298 if (!NT_STATUS_IS_OK(status)) {
299 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
300 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
301 ERRDOS, ERRbadpipe);
302 return;
303 }
304 reply_nterror(req, status);
305 return;
306 }
307
308 *ppnum = fsp->fnum;
309 return;
310 }
311
312 /****************************************************************************
313 Reply to an NT create and X call for pipes.
314 ****************************************************************************/
315
do_ntcreate_pipe_open(connection_struct * conn,struct smb_request * req)316 static void do_ntcreate_pipe_open(connection_struct *conn,
317 struct smb_request *req)
318 {
319 char *fname = NULL;
320 uint16_t pnum = FNUM_FIELD_INVALID;
321 char *p = NULL;
322 uint32_t flags = IVAL(req->vwv+3, 1);
323 TALLOC_CTX *ctx = talloc_tos();
324
325 srvstr_pull_req_talloc(ctx, req, &fname, req->buf, STR_TERMINATE);
326
327 if (!fname) {
328 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
329 ERRDOS, ERRbadpipe);
330 return;
331 }
332 nt_open_pipe(fname, conn, req, &pnum);
333
334 if (req->outbuf) {
335 /* error reply */
336 return;
337 }
338
339 /*
340 * Deal with pipe return.
341 */
342
343 if (flags & EXTENDED_RESPONSE_REQUIRED) {
344 /* This is very strange. We
345 * return 50 words, but only set
346 * the wcnt to 42 ? It's definitely
347 * what happens on the wire....
348 */
349 reply_outbuf(req, 50, 0);
350 SCVAL(req->outbuf,smb_wct,42);
351 } else {
352 reply_outbuf(req, 34, 0);
353 }
354
355 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
356 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
357
358 p = (char *)req->outbuf + smb_vwv2;
359 p++;
360 SSVAL(p,0,pnum);
361 p += 2;
362 SIVAL(p,0,FILE_WAS_OPENED);
363 p += 4;
364 p += 32;
365 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
366 p += 20;
367 /* File type. */
368 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
369 /* Device state. */
370 SSVAL(p,2, 0x5FF); /* ? */
371 p += 4;
372
373 if (flags & EXTENDED_RESPONSE_REQUIRED) {
374 p += 25;
375 SIVAL(p,0,FILE_GENERIC_ALL);
376 /*
377 * For pipes W2K3 seems to return
378 * 0x12019B next.
379 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
380 */
381 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
382 }
383
384 DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
385 }
386
387 struct case_semantics_state {
388 connection_struct *conn;
389 bool case_sensitive;
390 bool case_preserve;
391 bool short_case_preserve;
392 };
393
394 /****************************************************************************
395 Restore case semantics.
396 ****************************************************************************/
397
restore_case_semantics(struct case_semantics_state * state)398 static int restore_case_semantics(struct case_semantics_state *state)
399 {
400 state->conn->case_sensitive = state->case_sensitive;
401 state->conn->case_preserve = state->case_preserve;
402 state->conn->short_case_preserve = state->short_case_preserve;
403 return 0;
404 }
405
406 /****************************************************************************
407 Save case semantics.
408 ****************************************************************************/
409
set_posix_case_semantics(TALLOC_CTX * mem_ctx,connection_struct * conn)410 static struct case_semantics_state *set_posix_case_semantics(TALLOC_CTX *mem_ctx,
411 connection_struct *conn)
412 {
413 struct case_semantics_state *result;
414
415 if (!(result = talloc(mem_ctx, struct case_semantics_state))) {
416 return NULL;
417 }
418
419 result->conn = conn;
420 result->case_sensitive = conn->case_sensitive;
421 result->case_preserve = conn->case_preserve;
422 result->short_case_preserve = conn->short_case_preserve;
423
424 /* Set to POSIX. */
425 conn->case_sensitive = True;
426 conn->case_preserve = True;
427 conn->short_case_preserve = True;
428
429 talloc_set_destructor(result, restore_case_semantics);
430
431 return result;
432 }
433
434 /****************************************************************************
435 Reply to an NT create and X call.
436 ****************************************************************************/
437
reply_ntcreate_and_X(struct smb_request * req)438 void reply_ntcreate_and_X(struct smb_request *req)
439 {
440 connection_struct *conn = req->conn;
441 struct smb_filename *smb_fname = NULL;
442 char *fname = NULL;
443 uint32_t flags;
444 uint32_t access_mask;
445 uint32_t file_attributes;
446 uint32_t share_access;
447 uint32_t create_disposition;
448 uint32_t create_options;
449 uint16_t root_dir_fid;
450 uint64_t allocation_size;
451 /* Breakout the oplock request bits so we can set the
452 reply bits separately. */
453 uint32_t fattr=0;
454 off_t file_len = 0;
455 int info = 0;
456 files_struct *fsp = NULL;
457 char *p = NULL;
458 struct timespec create_timespec;
459 struct timespec c_timespec;
460 struct timespec a_timespec;
461 struct timespec m_timespec;
462 NTSTATUS status;
463 int oplock_request;
464 uint8_t oplock_granted = NO_OPLOCK_RETURN;
465 struct case_semantics_state *case_state = NULL;
466 uint32_t ucf_flags;
467 TALLOC_CTX *ctx = talloc_tos();
468
469 START_PROFILE(SMBntcreateX);
470
471 if (req->wct < 24) {
472 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
473 goto out;
474 }
475
476 flags = IVAL(req->vwv+3, 1);
477 access_mask = IVAL(req->vwv+7, 1);
478 file_attributes = IVAL(req->vwv+13, 1);
479 share_access = IVAL(req->vwv+15, 1);
480 create_disposition = IVAL(req->vwv+17, 1);
481 create_options = IVAL(req->vwv+19, 1);
482 root_dir_fid = (uint16_t)IVAL(req->vwv+5, 1);
483
484 allocation_size = BVAL(req->vwv+9, 1);
485
486 srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
487 STR_TERMINATE, &status);
488
489 if (!NT_STATUS_IS_OK(status)) {
490 reply_nterror(req, status);
491 goto out;
492 }
493
494 DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
495 "file_attributes = 0x%x, share_access = 0x%x, "
496 "create_disposition = 0x%x create_options = 0x%x "
497 "root_dir_fid = 0x%x, fname = %s\n",
498 (unsigned int)flags,
499 (unsigned int)access_mask,
500 (unsigned int)file_attributes,
501 (unsigned int)share_access,
502 (unsigned int)create_disposition,
503 (unsigned int)create_options,
504 (unsigned int)root_dir_fid,
505 fname));
506
507 /*
508 * we need to remove ignored bits when they come directly from the client
509 * because we reuse some of them for internal stuff
510 */
511 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
512
513 /*
514 * If it's an IPC, use the pipe handler.
515 */
516
517 if (IS_IPC(conn)) {
518 if (lp_nt_pipe_support()) {
519 do_ntcreate_pipe_open(conn, req);
520 goto out;
521 }
522 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
523 goto out;
524 }
525
526 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
527 if (oplock_request) {
528 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
529 ? BATCH_OPLOCK : 0;
530 }
531
532 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
533 case_state = set_posix_case_semantics(ctx, conn);
534 if (!case_state) {
535 reply_nterror(req, NT_STATUS_NO_MEMORY);
536 goto out;
537 }
538 }
539
540 ucf_flags = filename_create_ucf_flags(req, create_disposition);
541 status = filename_convert(ctx,
542 conn,
543 fname,
544 ucf_flags,
545 NULL,
546 NULL,
547 &smb_fname);
548
549 TALLOC_FREE(case_state);
550
551 if (!NT_STATUS_IS_OK(status)) {
552 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
553 reply_botherror(req,
554 NT_STATUS_PATH_NOT_COVERED,
555 ERRSRV, ERRbadpath);
556 goto out;
557 }
558 reply_nterror(req, status);
559 goto out;
560 }
561
562 /*
563 * Bug #6898 - clients using Windows opens should
564 * never be able to set this attribute into the
565 * VFS.
566 */
567 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
568
569 status = SMB_VFS_CREATE_FILE(
570 conn, /* conn */
571 req, /* req */
572 root_dir_fid, /* root_dir_fid */
573 smb_fname, /* fname */
574 access_mask, /* access_mask */
575 share_access, /* share_access */
576 create_disposition, /* create_disposition*/
577 create_options, /* create_options */
578 file_attributes, /* file_attributes */
579 oplock_request, /* oplock_request */
580 NULL, /* lease */
581 allocation_size, /* allocation_size */
582 0, /* private_flags */
583 NULL, /* sd */
584 NULL, /* ea_list */
585 &fsp, /* result */
586 &info, /* pinfo */
587 NULL, NULL); /* create context */
588
589 if (!NT_STATUS_IS_OK(status)) {
590 if (open_was_deferred(req->xconn, req->mid)) {
591 /* We have re-scheduled this call, no error. */
592 goto out;
593 }
594 if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
595 bool ok = defer_smb1_sharing_violation(req);
596 if (ok) {
597 goto out;
598 }
599 }
600 reply_openerror(req, status);
601 goto out;
602 }
603
604 /* Ensure we're pointing at the correct stat struct. */
605 TALLOC_FREE(smb_fname);
606 smb_fname = fsp->fsp_name;
607
608 /*
609 * If the caller set the extended oplock request bit
610 * and we granted one (by whatever means) - set the
611 * correct bit for extended oplock reply.
612 */
613
614 if (oplock_request &&
615 (lp_fake_oplocks(SNUM(conn))
616 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
617
618 /*
619 * Exclusive oplock granted
620 */
621
622 if (flags & REQUEST_BATCH_OPLOCK) {
623 oplock_granted = BATCH_OPLOCK_RETURN;
624 } else {
625 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
626 }
627 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
628 oplock_granted = LEVEL_II_OPLOCK_RETURN;
629 } else {
630 oplock_granted = NO_OPLOCK_RETURN;
631 }
632
633 file_len = smb_fname->st.st_ex_size;
634
635 if (flags & EXTENDED_RESPONSE_REQUIRED) {
636 /* This is very strange. We
637 * return 50 words, but only set
638 * the wcnt to 42 ? It's definitely
639 * what happens on the wire....
640 */
641 reply_outbuf(req, 50, 0);
642 SCVAL(req->outbuf,smb_wct,42);
643 } else {
644 reply_outbuf(req, 34, 0);
645 }
646
647 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
648 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
649
650 p = (char *)req->outbuf + smb_vwv2;
651
652 SCVAL(p, 0, oplock_granted);
653
654 p++;
655 SSVAL(p,0,fsp->fnum);
656 p += 2;
657 if ((create_disposition == FILE_SUPERSEDE)
658 && (info == FILE_WAS_OVERWRITTEN)) {
659 SIVAL(p,0,FILE_WAS_SUPERSEDED);
660 } else {
661 SIVAL(p,0,info);
662 }
663 p += 4;
664
665 fattr = dos_mode(conn, smb_fname);
666 if (fattr == 0) {
667 fattr = FILE_ATTRIBUTE_NORMAL;
668 }
669
670 /* Create time. */
671 create_timespec = get_create_timespec(conn, fsp, smb_fname);
672 a_timespec = smb_fname->st.st_ex_atime;
673 m_timespec = smb_fname->st.st_ex_mtime;
674 c_timespec = get_change_timespec(conn, fsp, smb_fname);
675
676 if (lp_dos_filetime_resolution(SNUM(conn))) {
677 dos_filetime_timespec(&create_timespec);
678 dos_filetime_timespec(&a_timespec);
679 dos_filetime_timespec(&m_timespec);
680 dos_filetime_timespec(&c_timespec);
681 }
682
683 put_long_date_full_timespec(conn->ts_res, p, &create_timespec); /* create time. */
684 p += 8;
685 put_long_date_full_timespec(conn->ts_res, p, &a_timespec); /* access time */
686 p += 8;
687 put_long_date_full_timespec(conn->ts_res, p, &m_timespec); /* write time */
688 p += 8;
689 put_long_date_full_timespec(conn->ts_res, p, &c_timespec); /* change time */
690 p += 8;
691 SIVAL(p,0,fattr); /* File Attributes. */
692 p += 4;
693 SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&smb_fname->st));
694 p += 8;
695 SOFF_T(p,0,file_len);
696 p += 8;
697 if (flags & EXTENDED_RESPONSE_REQUIRED) {
698 uint16_t file_status = (NO_EAS|NO_SUBSTREAMS|NO_REPARSETAG);
699 unsigned int num_streams = 0;
700 struct stream_struct *streams = NULL;
701
702 if (lp_ea_support(SNUM(conn))) {
703 size_t num_names = 0;
704 /* Do we have any EA's ? */
705 status = get_ea_names_from_file(
706 ctx, conn, fsp, smb_fname, NULL, &num_names);
707 if (NT_STATUS_IS_OK(status) && num_names) {
708 file_status &= ~NO_EAS;
709 }
710 }
711
712 status = vfs_streaminfo(conn, NULL, smb_fname, ctx,
713 &num_streams, &streams);
714 /* There is always one stream, ::$DATA. */
715 if (NT_STATUS_IS_OK(status) && num_streams > 1) {
716 file_status &= ~NO_SUBSTREAMS;
717 }
718 TALLOC_FREE(streams);
719 SSVAL(p,2,file_status);
720 }
721 p += 4;
722 SCVAL(p,0,fsp->is_directory ? 1 : 0);
723
724 if (flags & EXTENDED_RESPONSE_REQUIRED) {
725 uint32_t perms = 0;
726 p += 25;
727 if (fsp->is_directory ||
728 fsp->can_write ||
729 can_write_to_file(conn, smb_fname)) {
730 perms = FILE_GENERIC_ALL;
731 } else {
732 perms = FILE_GENERIC_READ|FILE_EXECUTE;
733 }
734 SIVAL(p,0,perms);
735 }
736
737 DEBUG(5,("reply_ntcreate_and_X: %s, open name = %s\n",
738 fsp_fnum_dbg(fsp), smb_fname_str_dbg(smb_fname)));
739
740 out:
741 END_PROFILE(SMBntcreateX);
742 return;
743 }
744
745 /****************************************************************************
746 Reply to a NT_TRANSACT_CREATE call to open a pipe.
747 ****************************************************************************/
748
do_nt_transact_create_pipe(connection_struct * conn,struct smb_request * req,uint16_t ** ppsetup,uint32_t setup_count,char ** ppparams,uint32_t parameter_count,char ** ppdata,uint32_t data_count)749 static void do_nt_transact_create_pipe(connection_struct *conn,
750 struct smb_request *req,
751 uint16_t **ppsetup, uint32_t setup_count,
752 char **ppparams, uint32_t parameter_count,
753 char **ppdata, uint32_t data_count)
754 {
755 char *fname = NULL;
756 char *params = *ppparams;
757 uint16_t pnum = FNUM_FIELD_INVALID;
758 char *p = NULL;
759 NTSTATUS status;
760 size_t param_len;
761 uint32_t flags;
762 TALLOC_CTX *ctx = talloc_tos();
763
764 /*
765 * Ensure minimum number of parameters sent.
766 */
767
768 if(parameter_count < 54) {
769 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
770 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
771 return;
772 }
773
774 flags = IVAL(params,0);
775
776 if (req->posix_pathnames) {
777 srvstr_get_path_posix(ctx,
778 params,
779 req->flags2,
780 &fname,
781 params+53,
782 parameter_count-53,
783 STR_TERMINATE,
784 &status);
785 } else {
786 srvstr_get_path(ctx,
787 params,
788 req->flags2,
789 &fname,
790 params+53,
791 parameter_count-53,
792 STR_TERMINATE,
793 &status);
794 }
795 if (!NT_STATUS_IS_OK(status)) {
796 reply_nterror(req, status);
797 return;
798 }
799
800 nt_open_pipe(fname, conn, req, &pnum);
801
802 if (req->outbuf) {
803 /* Error return */
804 return;
805 }
806
807 /* Realloc the size of parameters and data we will return */
808 if (flags & EXTENDED_RESPONSE_REQUIRED) {
809 /* Extended response is 32 more byyes. */
810 param_len = 101;
811 } else {
812 param_len = 69;
813 }
814 params = nttrans_realloc(ppparams, param_len);
815 if(params == NULL) {
816 reply_nterror(req, NT_STATUS_NO_MEMORY);
817 return;
818 }
819
820 p = params;
821 SCVAL(p,0,NO_OPLOCK_RETURN);
822
823 p += 2;
824 SSVAL(p,0,pnum);
825 p += 2;
826 SIVAL(p,0,FILE_WAS_OPENED);
827 p += 8;
828
829 p += 32;
830 SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
831 p += 20;
832 /* File type. */
833 SSVAL(p,0,FILE_TYPE_MESSAGE_MODE_PIPE);
834 /* Device state. */
835 SSVAL(p,2, 0x5FF); /* ? */
836 p += 4;
837
838 if (flags & EXTENDED_RESPONSE_REQUIRED) {
839 p += 25;
840 SIVAL(p,0,FILE_GENERIC_ALL);
841 /*
842 * For pipes W2K3 seems to return
843 * 0x12019B next.
844 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
845 */
846 SIVAL(p,4,(FILE_GENERIC_READ|FILE_GENERIC_WRITE)&~FILE_APPEND_DATA);
847 }
848
849 DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
850
851 /* Send the required number of replies */
852 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
853
854 return;
855 }
856
857 /*********************************************************************
858 Windows seems to do canonicalization of inheritance bits. Do the
859 same.
860 *********************************************************************/
861
canonicalize_inheritance_bits(struct security_descriptor * psd)862 static void canonicalize_inheritance_bits(struct security_descriptor *psd)
863 {
864 bool set_auto_inherited = false;
865
866 /*
867 * We need to filter out the
868 * SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ
869 * bits. If both are set we store SEC_DESC_DACL_AUTO_INHERITED
870 * as this alters whether SEC_ACE_FLAG_INHERITED_ACE is set
871 * when an ACE is inherited. Otherwise we zero these bits out.
872 * See:
873 *
874 * http://social.msdn.microsoft.com/Forums/eu/os_fileservices/thread/11f77b68-731e-407d-b1b3-064750716531
875 *
876 * for details.
877 */
878
879 if ((psd->type & (SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ))
880 == (SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ)) {
881 set_auto_inherited = true;
882 }
883
884 psd->type &= ~(SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ);
885 if (set_auto_inherited) {
886 psd->type |= SEC_DESC_DACL_AUTO_INHERITED;
887 }
888 }
889
890 /****************************************************************************
891 Internal fn to set security descriptors.
892 ****************************************************************************/
893
set_sd(files_struct * fsp,struct security_descriptor * psd,uint32_t security_info_sent)894 NTSTATUS set_sd(files_struct *fsp, struct security_descriptor *psd,
895 uint32_t security_info_sent)
896 {
897 NTSTATUS status;
898
899 if (!CAN_WRITE(fsp->conn)) {
900 return NT_STATUS_ACCESS_DENIED;
901 }
902
903 if (!lp_nt_acl_support(SNUM(fsp->conn))) {
904 return NT_STATUS_OK;
905 }
906
907 if (S_ISLNK(fsp->fsp_name->st.st_ex_mode)) {
908 DEBUG(10, ("ACL set on symlink %s denied.\n",
909 fsp_str_dbg(fsp)));
910 return NT_STATUS_ACCESS_DENIED;
911 }
912
913 if (psd->owner_sid == NULL) {
914 security_info_sent &= ~SECINFO_OWNER;
915 }
916 if (psd->group_sid == NULL) {
917 security_info_sent &= ~SECINFO_GROUP;
918 }
919
920 /* Ensure we have at least one thing set. */
921 if ((security_info_sent & (SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL)) == 0) {
922 /* Just like W2K3 */
923 return NT_STATUS_OK;
924 }
925
926 /* Ensure we have the rights to do this. */
927 if (security_info_sent & SECINFO_OWNER) {
928 if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
929 return NT_STATUS_ACCESS_DENIED;
930 }
931 }
932
933 if (security_info_sent & SECINFO_GROUP) {
934 if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
935 return NT_STATUS_ACCESS_DENIED;
936 }
937 }
938
939 if (security_info_sent & SECINFO_DACL) {
940 if (!(fsp->access_mask & SEC_STD_WRITE_DAC)) {
941 return NT_STATUS_ACCESS_DENIED;
942 }
943 /* Convert all the generic bits. */
944 if (psd->dacl) {
945 security_acl_map_generic(psd->dacl, &file_generic_mapping);
946 }
947 }
948
949 if (security_info_sent & SECINFO_SACL) {
950 if (!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
951 return NT_STATUS_ACCESS_DENIED;
952 }
953 /* Convert all the generic bits. */
954 if (psd->sacl) {
955 security_acl_map_generic(psd->sacl, &file_generic_mapping);
956 }
957 }
958
959 canonicalize_inheritance_bits(psd);
960
961 if (DEBUGLEVEL >= 10) {
962 DEBUG(10,("set_sd for file %s\n", fsp_str_dbg(fsp)));
963 NDR_PRINT_DEBUG(security_descriptor, psd);
964 }
965
966 status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
967
968 TALLOC_FREE(psd);
969
970 return status;
971 }
972
973 /****************************************************************************
974 Internal fn to set security descriptors from a data blob.
975 ****************************************************************************/
976
set_sd_blob(files_struct * fsp,uint8_t * data,uint32_t sd_len,uint32_t security_info_sent)977 NTSTATUS set_sd_blob(files_struct *fsp, uint8_t *data, uint32_t sd_len,
978 uint32_t security_info_sent)
979 {
980 struct security_descriptor *psd = NULL;
981 NTSTATUS status;
982
983 if (sd_len == 0) {
984 return NT_STATUS_INVALID_PARAMETER;
985 }
986
987 status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
988
989 if (!NT_STATUS_IS_OK(status)) {
990 return status;
991 }
992
993 return set_sd(fsp, psd, security_info_sent);
994 }
995
996 /****************************************************************************
997 Reply to a NT_TRANSACT_CREATE call (needs to process SD's).
998 ****************************************************************************/
999
call_nt_transact_create(connection_struct * conn,struct smb_request * req,uint16_t ** ppsetup,uint32_t setup_count,char ** ppparams,uint32_t parameter_count,char ** ppdata,uint32_t data_count,uint32_t max_data_count)1000 static void call_nt_transact_create(connection_struct *conn,
1001 struct smb_request *req,
1002 uint16_t **ppsetup, uint32_t setup_count,
1003 char **ppparams, uint32_t parameter_count,
1004 char **ppdata, uint32_t data_count,
1005 uint32_t max_data_count)
1006 {
1007 struct smb_filename *smb_fname = NULL;
1008 char *fname = NULL;
1009 char *params = *ppparams;
1010 char *data = *ppdata;
1011 /* Breakout the oplock request bits so we can set the reply bits separately. */
1012 uint32_t fattr=0;
1013 off_t file_len = 0;
1014 int info = 0;
1015 files_struct *fsp = NULL;
1016 char *p = NULL;
1017 uint32_t flags;
1018 uint32_t access_mask;
1019 uint32_t file_attributes;
1020 uint32_t share_access;
1021 uint32_t create_disposition;
1022 uint32_t create_options;
1023 uint32_t sd_len;
1024 struct security_descriptor *sd = NULL;
1025 uint32_t ea_len;
1026 uint16_t root_dir_fid;
1027 struct timespec create_timespec;
1028 struct timespec c_timespec;
1029 struct timespec a_timespec;
1030 struct timespec m_timespec;
1031 struct ea_list *ea_list = NULL;
1032 NTSTATUS status;
1033 size_t param_len;
1034 uint64_t allocation_size;
1035 int oplock_request;
1036 uint8_t oplock_granted;
1037 struct case_semantics_state *case_state = NULL;
1038 uint32_t ucf_flags;
1039 TALLOC_CTX *ctx = talloc_tos();
1040
1041 DEBUG(5,("call_nt_transact_create\n"));
1042
1043 /*
1044 * If it's an IPC, use the pipe handler.
1045 */
1046
1047 if (IS_IPC(conn)) {
1048 if (lp_nt_pipe_support()) {
1049 do_nt_transact_create_pipe(
1050 conn, req,
1051 ppsetup, setup_count,
1052 ppparams, parameter_count,
1053 ppdata, data_count);
1054 goto out;
1055 }
1056 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1057 goto out;
1058 }
1059
1060 /*
1061 * Ensure minimum number of parameters sent.
1062 */
1063
1064 if(parameter_count < 54) {
1065 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
1066 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1067 goto out;
1068 }
1069
1070 flags = IVAL(params,0);
1071 access_mask = IVAL(params,8);
1072 file_attributes = IVAL(params,20);
1073 share_access = IVAL(params,24);
1074 create_disposition = IVAL(params,28);
1075 create_options = IVAL(params,32);
1076 sd_len = IVAL(params,36);
1077 ea_len = IVAL(params,40);
1078 root_dir_fid = (uint16_t)IVAL(params,4);
1079 allocation_size = BVAL(params,12);
1080
1081 /*
1082 * we need to remove ignored bits when they come directly from the client
1083 * because we reuse some of them for internal stuff
1084 */
1085 create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
1086
1087 if (req->posix_pathnames) {
1088 srvstr_get_path_posix(ctx,
1089 params,
1090 req->flags2,
1091 &fname,
1092 params+53,
1093 parameter_count-53,
1094 STR_TERMINATE,
1095 &status);
1096 } else {
1097 srvstr_get_path(ctx,
1098 params,
1099 req->flags2,
1100 &fname,
1101 params+53,
1102 parameter_count-53,
1103 STR_TERMINATE,
1104 &status);
1105 }
1106 if (!NT_STATUS_IS_OK(status)) {
1107 reply_nterror(req, status);
1108 goto out;
1109 }
1110
1111 if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
1112 case_state = set_posix_case_semantics(ctx, conn);
1113 if (!case_state) {
1114 reply_nterror(req, NT_STATUS_NO_MEMORY);
1115 goto out;
1116 }
1117 }
1118
1119 ucf_flags = filename_create_ucf_flags(req, create_disposition);
1120 status = filename_convert(ctx,
1121 conn,
1122 fname,
1123 ucf_flags,
1124 NULL,
1125 NULL,
1126 &smb_fname);
1127
1128 TALLOC_FREE(case_state);
1129
1130 if (!NT_STATUS_IS_OK(status)) {
1131 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1132 reply_botherror(req,
1133 NT_STATUS_PATH_NOT_COVERED,
1134 ERRSRV, ERRbadpath);
1135 goto out;
1136 }
1137 reply_nterror(req, status);
1138 goto out;
1139 }
1140
1141 /* Ensure the data_len is correct for the sd and ea values given. */
1142 if ((ea_len + sd_len > data_count)
1143 || (ea_len > data_count) || (sd_len > data_count)
1144 || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
1145 DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
1146 "%u, data_count = %u\n", (unsigned int)ea_len,
1147 (unsigned int)sd_len, (unsigned int)data_count));
1148 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1149 goto out;
1150 }
1151
1152 if (sd_len) {
1153 DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
1154 sd_len));
1155
1156 status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
1157 &sd);
1158 if (!NT_STATUS_IS_OK(status)) {
1159 DEBUG(10, ("call_nt_transact_create: "
1160 "unmarshall_sec_desc failed: %s\n",
1161 nt_errstr(status)));
1162 reply_nterror(req, status);
1163 goto out;
1164 }
1165 }
1166
1167 if (ea_len) {
1168 if (!lp_ea_support(SNUM(conn))) {
1169 DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
1170 "EA's not supported.\n",
1171 (unsigned int)ea_len));
1172 reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
1173 goto out;
1174 }
1175
1176 if (ea_len < 10) {
1177 DEBUG(10,("call_nt_transact_create - ea_len = %u - "
1178 "too small (should be more than 10)\n",
1179 (unsigned int)ea_len ));
1180 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1181 goto out;
1182 }
1183
1184 /* We have already checked that ea_len <= data_count here. */
1185 ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
1186 ea_len);
1187 if (ea_list == NULL) {
1188 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1189 goto out;
1190 }
1191
1192 if (!req->posix_pathnames &&
1193 ea_list_has_invalid_name(ea_list)) {
1194 /* Realloc the size of parameters and data we will return */
1195 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1196 /* Extended response is 32 more byyes. */
1197 param_len = 101;
1198 } else {
1199 param_len = 69;
1200 }
1201 params = nttrans_realloc(ppparams, param_len);
1202 if(params == NULL) {
1203 reply_nterror(req, NT_STATUS_NO_MEMORY);
1204 goto out;
1205 }
1206
1207 memset(params, '\0', param_len);
1208 send_nt_replies(conn, req, STATUS_INVALID_EA_NAME,
1209 params, param_len, NULL, 0);
1210 goto out;
1211 }
1212 }
1213
1214 oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
1215 if (oplock_request) {
1216 oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
1217 ? BATCH_OPLOCK : 0;
1218 }
1219
1220 /*
1221 * Bug #6898 - clients using Windows opens should
1222 * never be able to set this attribute into the
1223 * VFS.
1224 */
1225 file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
1226
1227 status = SMB_VFS_CREATE_FILE(
1228 conn, /* conn */
1229 req, /* req */
1230 root_dir_fid, /* root_dir_fid */
1231 smb_fname, /* fname */
1232 access_mask, /* access_mask */
1233 share_access, /* share_access */
1234 create_disposition, /* create_disposition*/
1235 create_options, /* create_options */
1236 file_attributes, /* file_attributes */
1237 oplock_request, /* oplock_request */
1238 NULL, /* lease */
1239 allocation_size, /* allocation_size */
1240 0, /* private_flags */
1241 sd, /* sd */
1242 ea_list, /* ea_list */
1243 &fsp, /* result */
1244 &info, /* pinfo */
1245 NULL, NULL); /* create context */
1246
1247 if(!NT_STATUS_IS_OK(status)) {
1248 if (open_was_deferred(req->xconn, req->mid)) {
1249 /* We have re-scheduled this call, no error. */
1250 return;
1251 }
1252 if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
1253 bool ok = defer_smb1_sharing_violation(req);
1254 if (ok) {
1255 return;
1256 }
1257 }
1258 reply_openerror(req, status);
1259 goto out;
1260 }
1261
1262 /* Ensure we're pointing at the correct stat struct. */
1263 TALLOC_FREE(smb_fname);
1264 smb_fname = fsp->fsp_name;
1265
1266 /*
1267 * If the caller set the extended oplock request bit
1268 * and we granted one (by whatever means) - set the
1269 * correct bit for extended oplock reply.
1270 */
1271
1272 if (oplock_request &&
1273 (lp_fake_oplocks(SNUM(conn))
1274 || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
1275
1276 /*
1277 * Exclusive oplock granted
1278 */
1279
1280 if (flags & REQUEST_BATCH_OPLOCK) {
1281 oplock_granted = BATCH_OPLOCK_RETURN;
1282 } else {
1283 oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
1284 }
1285 } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
1286 oplock_granted = LEVEL_II_OPLOCK_RETURN;
1287 } else {
1288 oplock_granted = NO_OPLOCK_RETURN;
1289 }
1290
1291 file_len = smb_fname->st.st_ex_size;
1292
1293 /* Realloc the size of parameters and data we will return */
1294 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1295 /* Extended response is 32 more byyes. */
1296 param_len = 101;
1297 } else {
1298 param_len = 69;
1299 }
1300 params = nttrans_realloc(ppparams, param_len);
1301 if(params == NULL) {
1302 reply_nterror(req, NT_STATUS_NO_MEMORY);
1303 goto out;
1304 }
1305
1306 p = params;
1307 SCVAL(p, 0, oplock_granted);
1308
1309 p += 2;
1310 SSVAL(p,0,fsp->fnum);
1311 p += 2;
1312 if ((create_disposition == FILE_SUPERSEDE)
1313 && (info == FILE_WAS_OVERWRITTEN)) {
1314 SIVAL(p,0,FILE_WAS_SUPERSEDED);
1315 } else {
1316 SIVAL(p,0,info);
1317 }
1318 p += 8;
1319
1320 fattr = dos_mode(conn, smb_fname);
1321 if (fattr == 0) {
1322 fattr = FILE_ATTRIBUTE_NORMAL;
1323 }
1324
1325 /* Create time. */
1326 create_timespec = get_create_timespec(conn, fsp, smb_fname);
1327 a_timespec = smb_fname->st.st_ex_atime;
1328 m_timespec = smb_fname->st.st_ex_mtime;
1329 c_timespec = get_change_timespec(conn, fsp, smb_fname);
1330
1331 if (lp_dos_filetime_resolution(SNUM(conn))) {
1332 dos_filetime_timespec(&create_timespec);
1333 dos_filetime_timespec(&a_timespec);
1334 dos_filetime_timespec(&m_timespec);
1335 dos_filetime_timespec(&c_timespec);
1336 }
1337
1338 put_long_date_full_timespec(conn->ts_res, p, &create_timespec); /* create time. */
1339 p += 8;
1340 put_long_date_full_timespec(conn->ts_res, p, &a_timespec); /* access time */
1341 p += 8;
1342 put_long_date_full_timespec(conn->ts_res, p, &m_timespec); /* write time */
1343 p += 8;
1344 put_long_date_full_timespec(conn->ts_res, p, &c_timespec); /* change time */
1345 p += 8;
1346 SIVAL(p,0,fattr); /* File Attributes. */
1347 p += 4;
1348 SOFF_T(p, 0, SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st));
1349 p += 8;
1350 SOFF_T(p,0,file_len);
1351 p += 8;
1352 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1353 uint16_t file_status = (NO_EAS|NO_SUBSTREAMS|NO_REPARSETAG);
1354 unsigned int num_streams = 0;
1355 struct stream_struct *streams = NULL;
1356
1357 if (lp_ea_support(SNUM(conn))) {
1358 size_t num_names = 0;
1359 /* Do we have any EA's ? */
1360 status = get_ea_names_from_file(
1361 ctx, conn, fsp, smb_fname, NULL, &num_names);
1362 if (NT_STATUS_IS_OK(status) && num_names) {
1363 file_status &= ~NO_EAS;
1364 }
1365 }
1366
1367 status = vfs_streaminfo(conn, NULL, smb_fname, ctx,
1368 &num_streams, &streams);
1369 /* There is always one stream, ::$DATA. */
1370 if (NT_STATUS_IS_OK(status) && num_streams > 1) {
1371 file_status &= ~NO_SUBSTREAMS;
1372 }
1373 TALLOC_FREE(streams);
1374 SSVAL(p,2,file_status);
1375 }
1376 p += 4;
1377 SCVAL(p,0,fsp->is_directory ? 1 : 0);
1378
1379 if (flags & EXTENDED_RESPONSE_REQUIRED) {
1380 uint32_t perms = 0;
1381 p += 25;
1382 if (fsp->is_directory ||
1383 fsp->can_write ||
1384 can_write_to_file(conn, smb_fname)) {
1385 perms = FILE_GENERIC_ALL;
1386 } else {
1387 perms = FILE_GENERIC_READ|FILE_EXECUTE;
1388 }
1389 SIVAL(p,0,perms);
1390 }
1391
1392 DEBUG(5,("call_nt_transact_create: open name = %s\n",
1393 smb_fname_str_dbg(smb_fname)));
1394
1395 /* Send the required number of replies */
1396 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
1397 out:
1398 return;
1399 }
1400
1401 /****************************************************************************
1402 Reply to a NT CANCEL request.
1403 conn POINTER CAN BE NULL HERE !
1404 ****************************************************************************/
1405
reply_ntcancel(struct smb_request * req)1406 void reply_ntcancel(struct smb_request *req)
1407 {
1408 struct smbXsrv_connection *xconn = req->xconn;
1409 struct smbd_server_connection *sconn = req->sconn;
1410 bool found;
1411
1412 /*
1413 * Go through and cancel any pending change notifies.
1414 */
1415
1416 START_PROFILE(SMBntcancel);
1417 srv_cancel_sign_response(xconn);
1418 found = remove_pending_change_notify_requests_by_mid(sconn, req->mid);
1419 if (!found) {
1420 smbd_smb1_brl_finish_by_mid(sconn, req->mid);
1421 }
1422
1423 DEBUG(3,("reply_ntcancel: cancel called on mid = %llu.\n",
1424 (unsigned long long)req->mid));
1425
1426 END_PROFILE(SMBntcancel);
1427 return;
1428 }
1429
1430 /****************************************************************************
1431 Copy a file.
1432 ****************************************************************************/
1433
copy_internals(TALLOC_CTX * ctx,connection_struct * conn,struct smb_request * req,struct smb_filename * smb_fname_src,struct smb_filename * smb_fname_dst,uint32_t attrs)1434 static NTSTATUS copy_internals(TALLOC_CTX *ctx,
1435 connection_struct *conn,
1436 struct smb_request *req,
1437 struct smb_filename *smb_fname_src,
1438 struct smb_filename *smb_fname_dst,
1439 uint32_t attrs)
1440 {
1441 files_struct *fsp1,*fsp2;
1442 uint32_t fattr;
1443 int info;
1444 off_t ret=-1;
1445 NTSTATUS status = NT_STATUS_OK;
1446 char *parent;
1447
1448 if (!CAN_WRITE(conn)) {
1449 status = NT_STATUS_MEDIA_WRITE_PROTECTED;
1450 goto out;
1451 }
1452
1453 /* Source must already exist. */
1454 if (!VALID_STAT(smb_fname_src->st)) {
1455 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
1456 goto out;
1457 }
1458
1459 /* Ensure attributes match. */
1460 fattr = dos_mode(conn, smb_fname_src);
1461 if ((fattr & ~attrs) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
1462 status = NT_STATUS_NO_SUCH_FILE;
1463 goto out;
1464 }
1465
1466 /* Disallow if dst file already exists. */
1467 if (VALID_STAT(smb_fname_dst->st)) {
1468 status = NT_STATUS_OBJECT_NAME_COLLISION;
1469 goto out;
1470 }
1471
1472 /* No links from a directory. */
1473 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
1474 status = NT_STATUS_FILE_IS_A_DIRECTORY;
1475 goto out;
1476 }
1477
1478 DEBUG(10,("copy_internals: doing file copy %s to %s\n",
1479 smb_fname_str_dbg(smb_fname_src),
1480 smb_fname_str_dbg(smb_fname_dst)));
1481
1482 status = SMB_VFS_CREATE_FILE(
1483 conn, /* conn */
1484 req, /* req */
1485 0, /* root_dir_fid */
1486 smb_fname_src, /* fname */
1487 FILE_READ_DATA|FILE_READ_ATTRIBUTES|
1488 FILE_READ_EA, /* access_mask */
1489 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
1490 FILE_SHARE_DELETE),
1491 FILE_OPEN, /* create_disposition*/
1492 0, /* create_options */
1493 FILE_ATTRIBUTE_NORMAL, /* file_attributes */
1494 NO_OPLOCK, /* oplock_request */
1495 NULL, /* lease */
1496 0, /* allocation_size */
1497 0, /* private_flags */
1498 NULL, /* sd */
1499 NULL, /* ea_list */
1500 &fsp1, /* result */
1501 &info, /* pinfo */
1502 NULL, NULL); /* create context */
1503
1504 if (!NT_STATUS_IS_OK(status)) {
1505 goto out;
1506 }
1507
1508 status = SMB_VFS_CREATE_FILE(
1509 conn, /* conn */
1510 req, /* req */
1511 0, /* root_dir_fid */
1512 smb_fname_dst, /* fname */
1513 FILE_WRITE_DATA|FILE_WRITE_ATTRIBUTES|
1514 FILE_WRITE_EA, /* access_mask */
1515 (FILE_SHARE_READ | FILE_SHARE_WRITE | /* share_access */
1516 FILE_SHARE_DELETE),
1517 FILE_CREATE, /* create_disposition*/
1518 0, /* create_options */
1519 fattr, /* file_attributes */
1520 NO_OPLOCK, /* oplock_request */
1521 NULL, /* lease */
1522 0, /* allocation_size */
1523 0, /* private_flags */
1524 NULL, /* sd */
1525 NULL, /* ea_list */
1526 &fsp2, /* result */
1527 &info, /* pinfo */
1528 NULL, NULL); /* create context */
1529
1530 if (!NT_STATUS_IS_OK(status)) {
1531 close_file(NULL, fsp1, ERROR_CLOSE);
1532 goto out;
1533 }
1534
1535 if (smb_fname_src->st.st_ex_size) {
1536 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
1537 }
1538
1539 /*
1540 * As we are opening fsp1 read-only we only expect
1541 * an error on close on fsp2 if we are out of space.
1542 * Thus we don't look at the error return from the
1543 * close of fsp1.
1544 */
1545 close_file(NULL, fsp1, NORMAL_CLOSE);
1546
1547 /* Ensure the modtime is set correctly on the destination file. */
1548 set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
1549
1550 status = close_file(NULL, fsp2, NORMAL_CLOSE);
1551
1552 /* Grrr. We have to do this as open_file_ntcreate adds FILE_ATTRIBUTE_ARCHIVE when it
1553 creates the file. This isn't the correct thing to do in the copy
1554 case. JRA */
1555 if (!parent_dirname(talloc_tos(), smb_fname_dst->base_name, &parent,
1556 NULL)) {
1557 status = NT_STATUS_NO_MEMORY;
1558 goto out;
1559 }
1560 file_set_dosmode(conn, smb_fname_dst, fattr, parent, false);
1561 TALLOC_FREE(parent);
1562
1563 if (ret < (off_t)smb_fname_src->st.st_ex_size) {
1564 status = NT_STATUS_DISK_FULL;
1565 goto out;
1566 }
1567 out:
1568 if (!NT_STATUS_IS_OK(status)) {
1569 DEBUG(3,("copy_internals: Error %s copy file %s to %s\n",
1570 nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
1571 smb_fname_str_dbg(smb_fname_dst)));
1572 }
1573
1574 return status;
1575 }
1576
1577 /****************************************************************************
1578 Reply to a NT rename request.
1579 ****************************************************************************/
1580
reply_ntrename(struct smb_request * req)1581 void reply_ntrename(struct smb_request *req)
1582 {
1583 connection_struct *conn = req->conn;
1584 struct smb_filename *smb_fname_old = NULL;
1585 struct smb_filename *smb_fname_new = NULL;
1586 char *oldname = NULL;
1587 char *newname = NULL;
1588 const char *p;
1589 NTSTATUS status;
1590 bool src_has_wcard = False;
1591 bool dest_has_wcard = False;
1592 uint32_t attrs;
1593 uint32_t ucf_flags_src = ucf_flags_from_smb_request(req);
1594 uint32_t ucf_flags_dst = ucf_flags_from_smb_request(req);
1595 uint16_t rename_type;
1596 TALLOC_CTX *ctx = talloc_tos();
1597 bool stream_rename = false;
1598
1599 START_PROFILE(SMBntrename);
1600
1601 if (req->wct < 4) {
1602 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1603 goto out;
1604 }
1605
1606 attrs = SVAL(req->vwv+0, 0);
1607 rename_type = SVAL(req->vwv+1, 0);
1608
1609 p = (const char *)req->buf + 1;
1610 p += srvstr_get_path_req_wcard(ctx, req, &oldname, p, STR_TERMINATE,
1611 &status, &src_has_wcard);
1612 if (!NT_STATUS_IS_OK(status)) {
1613 reply_nterror(req, status);
1614 goto out;
1615 }
1616
1617 if (!req->posix_pathnames && ms_has_wild(oldname)) {
1618 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
1619 goto out;
1620 }
1621
1622 p++;
1623 p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
1624 &status, &dest_has_wcard);
1625 if (!NT_STATUS_IS_OK(status)) {
1626 reply_nterror(req, status);
1627 goto out;
1628 }
1629
1630 if (!req->posix_pathnames) {
1631 /* The newname must begin with a ':' if the
1632 oldname contains a ':'. */
1633 if (strchr_m(oldname, ':')) {
1634 if (newname[0] != ':') {
1635 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1636 goto out;
1637 }
1638 stream_rename = true;
1639 }
1640 }
1641
1642 /*
1643 * If this is a rename operation, allow wildcards and save the
1644 * destination's last component.
1645 */
1646 if (rename_type == RENAME_FLAG_RENAME) {
1647 ucf_flags_src |= UCF_COND_ALLOW_WCARD_LCOMP;
1648 ucf_flags_dst |= UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP;
1649 }
1650
1651 /* rename_internals() calls unix_convert(), so don't call it here. */
1652 status = filename_convert(ctx, conn,
1653 oldname,
1654 ucf_flags_src,
1655 NULL,
1656 NULL,
1657 &smb_fname_old);
1658 if (!NT_STATUS_IS_OK(status)) {
1659 if (NT_STATUS_EQUAL(status,
1660 NT_STATUS_PATH_NOT_COVERED)) {
1661 reply_botherror(req,
1662 NT_STATUS_PATH_NOT_COVERED,
1663 ERRSRV, ERRbadpath);
1664 goto out;
1665 }
1666 reply_nterror(req, status);
1667 goto out;
1668 }
1669
1670 status = filename_convert(ctx, conn,
1671 newname,
1672 ucf_flags_dst,
1673 NULL,
1674 &dest_has_wcard,
1675 &smb_fname_new);
1676 if (!NT_STATUS_IS_OK(status)) {
1677 if (NT_STATUS_EQUAL(status,
1678 NT_STATUS_PATH_NOT_COVERED)) {
1679 reply_botherror(req,
1680 NT_STATUS_PATH_NOT_COVERED,
1681 ERRSRV, ERRbadpath);
1682 goto out;
1683 }
1684 reply_nterror(req, status);
1685 goto out;
1686 }
1687
1688 if (stream_rename) {
1689 /* smb_fname_new must be the same as smb_fname_old. */
1690 TALLOC_FREE(smb_fname_new->base_name);
1691 smb_fname_new->base_name = talloc_strdup(smb_fname_new,
1692 smb_fname_old->base_name);
1693 if (!smb_fname_new->base_name) {
1694 reply_nterror(req, NT_STATUS_NO_MEMORY);
1695 goto out;
1696 }
1697 }
1698
1699 DEBUG(3,("reply_ntrename: %s -> %s\n",
1700 smb_fname_str_dbg(smb_fname_old),
1701 smb_fname_str_dbg(smb_fname_new)));
1702
1703 switch(rename_type) {
1704 case RENAME_FLAG_RENAME:
1705 status = rename_internals(ctx, conn, req,
1706 smb_fname_old, smb_fname_new,
1707 attrs, False, src_has_wcard,
1708 dest_has_wcard,
1709 DELETE_ACCESS);
1710 break;
1711 case RENAME_FLAG_HARD_LINK:
1712 if (src_has_wcard || dest_has_wcard) {
1713 /* No wildcards. */
1714 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1715 } else {
1716 status = hardlink_internals(ctx, conn,
1717 req,
1718 false,
1719 smb_fname_old,
1720 smb_fname_new);
1721 }
1722 break;
1723 case RENAME_FLAG_COPY:
1724 if (src_has_wcard || dest_has_wcard) {
1725 /* No wildcards. */
1726 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
1727 } else {
1728 status = copy_internals(ctx, conn, req,
1729 smb_fname_old,
1730 smb_fname_new,
1731 attrs);
1732 }
1733 break;
1734 case RENAME_FLAG_MOVE_CLUSTER_INFORMATION:
1735 status = NT_STATUS_INVALID_PARAMETER;
1736 break;
1737 default:
1738 status = NT_STATUS_ACCESS_DENIED; /* Default error. */
1739 break;
1740 }
1741
1742 if (!NT_STATUS_IS_OK(status)) {
1743 if (open_was_deferred(req->xconn, req->mid)) {
1744 /* We have re-scheduled this call. */
1745 goto out;
1746 }
1747 if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
1748 bool ok = defer_smb1_sharing_violation(req);
1749 if (ok) {
1750 goto out;
1751 }
1752 }
1753
1754 reply_nterror(req, status);
1755 goto out;
1756 }
1757
1758 reply_outbuf(req, 0, 0);
1759 out:
1760 END_PROFILE(SMBntrename);
1761 return;
1762 }
1763
1764 /****************************************************************************
1765 Reply to a notify change - queue the request and
1766 don't allow a directory to be opened.
1767 ****************************************************************************/
1768
smbd_smb1_notify_reply(struct smb_request * req,NTSTATUS error_code,uint8_t * buf,size_t len)1769 static void smbd_smb1_notify_reply(struct smb_request *req,
1770 NTSTATUS error_code,
1771 uint8_t *buf, size_t len)
1772 {
1773 send_nt_replies(req->conn, req, error_code, (char *)buf, len, NULL, 0);
1774 }
1775
call_nt_transact_notify_change(connection_struct * conn,struct smb_request * req,uint16_t ** ppsetup,uint32_t setup_count,char ** ppparams,uint32_t parameter_count,char ** ppdata,uint32_t data_count,uint32_t max_data_count,uint32_t max_param_count)1776 static void call_nt_transact_notify_change(connection_struct *conn,
1777 struct smb_request *req,
1778 uint16_t **ppsetup,
1779 uint32_t setup_count,
1780 char **ppparams,
1781 uint32_t parameter_count,
1782 char **ppdata, uint32_t data_count,
1783 uint32_t max_data_count,
1784 uint32_t max_param_count)
1785 {
1786 uint16_t *setup = *ppsetup;
1787 files_struct *fsp;
1788 uint32_t filter;
1789 NTSTATUS status;
1790 bool recursive;
1791
1792 if(setup_count < 6) {
1793 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1794 return;
1795 }
1796
1797 fsp = file_fsp(req, SVAL(setup,4));
1798 filter = IVAL(setup, 0);
1799 recursive = (SVAL(setup, 6) != 0) ? True : False;
1800
1801 DEBUG(3,("call_nt_transact_notify_change\n"));
1802
1803 if(!fsp) {
1804 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1805 return;
1806 }
1807
1808 {
1809 char *filter_string;
1810
1811 if (!(filter_string = notify_filter_string(NULL, filter))) {
1812 reply_nterror(req,NT_STATUS_NO_MEMORY);
1813 return;
1814 }
1815
1816 DEBUG(3,("call_nt_transact_notify_change: notify change "
1817 "called on %s, filter = %s, recursive = %d\n",
1818 fsp_str_dbg(fsp), filter_string, recursive));
1819
1820 TALLOC_FREE(filter_string);
1821 }
1822
1823 if((!fsp->is_directory) || (conn != fsp->conn)) {
1824 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1825 return;
1826 }
1827
1828 if (fsp->notify == NULL) {
1829
1830 status = change_notify_create(fsp,
1831 max_param_count,
1832 filter,
1833 recursive);
1834 if (!NT_STATUS_IS_OK(status)) {
1835 DEBUG(10, ("change_notify_create returned %s\n",
1836 nt_errstr(status)));
1837 reply_nterror(req, status);
1838 return;
1839 }
1840 }
1841
1842 if (change_notify_fsp_has_changes(fsp)) {
1843
1844 /*
1845 * We've got changes pending, respond immediately
1846 */
1847
1848 /*
1849 * TODO: write a torture test to check the filtering behaviour
1850 * here.
1851 */
1852
1853 change_notify_reply(req,
1854 NT_STATUS_OK,
1855 max_param_count,
1856 fsp->notify,
1857 smbd_smb1_notify_reply);
1858
1859 /*
1860 * change_notify_reply() above has independently sent its
1861 * results
1862 */
1863 return;
1864 }
1865
1866 /*
1867 * No changes pending, queue the request
1868 */
1869
1870 status = change_notify_add_request(req,
1871 max_param_count,
1872 filter,
1873 recursive, fsp,
1874 smbd_smb1_notify_reply);
1875 if (!NT_STATUS_IS_OK(status)) {
1876 reply_nterror(req, status);
1877 }
1878 return;
1879 }
1880
1881 /****************************************************************************
1882 Reply to an NT transact rename command.
1883 ****************************************************************************/
1884
call_nt_transact_rename(connection_struct * conn,struct smb_request * req,uint16_t ** ppsetup,uint32_t setup_count,char ** ppparams,uint32_t parameter_count,char ** ppdata,uint32_t data_count,uint32_t max_data_count)1885 static void call_nt_transact_rename(connection_struct *conn,
1886 struct smb_request *req,
1887 uint16_t **ppsetup, uint32_t setup_count,
1888 char **ppparams, uint32_t parameter_count,
1889 char **ppdata, uint32_t data_count,
1890 uint32_t max_data_count)
1891 {
1892 char *params = *ppparams;
1893 char *new_name = NULL;
1894 files_struct *fsp = NULL;
1895 bool dest_has_wcard = False;
1896 NTSTATUS status;
1897 TALLOC_CTX *ctx = talloc_tos();
1898
1899 if(parameter_count < 5) {
1900 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1901 return;
1902 }
1903
1904 fsp = file_fsp(req, SVAL(params, 0));
1905 if (!check_fsp(conn, req, fsp)) {
1906 return;
1907 }
1908 if (req->posix_pathnames) {
1909 srvstr_get_path_wcard_posix(ctx,
1910 params,
1911 req->flags2,
1912 &new_name,
1913 params+4,
1914 parameter_count - 4,
1915 STR_TERMINATE,
1916 &status,
1917 &dest_has_wcard);
1918 } else {
1919 srvstr_get_path_wcard(ctx,
1920 params,
1921 req->flags2,
1922 &new_name,
1923 params+4,
1924 parameter_count - 4,
1925 STR_TERMINATE,
1926 &status,
1927 &dest_has_wcard);
1928 }
1929
1930 if (!NT_STATUS_IS_OK(status)) {
1931 reply_nterror(req, status);
1932 return;
1933 }
1934
1935 /*
1936 * W2K3 ignores this request as the RAW-RENAME test
1937 * demonstrates, so we do.
1938 */
1939 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
1940
1941 DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
1942 fsp_str_dbg(fsp), new_name));
1943
1944 return;
1945 }
1946
1947 /******************************************************************************
1948 Fake up a completely empty SD.
1949 *******************************************************************************/
1950
get_null_nt_acl(TALLOC_CTX * mem_ctx,struct security_descriptor ** ppsd)1951 static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, struct security_descriptor **ppsd)
1952 {
1953 size_t sd_size;
1954
1955 *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
1956 if(!*ppsd) {
1957 DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
1958 return NT_STATUS_NO_MEMORY;
1959 }
1960
1961 return NT_STATUS_OK;
1962 }
1963
1964 /****************************************************************************
1965 Reply to query a security descriptor.
1966 Callable from SMB1 and SMB2.
1967 If it returns NT_STATUS_BUFFER_TOO_SMALL, pdata_size is initialized with
1968 the required size.
1969 ****************************************************************************/
1970
smbd_do_query_security_desc(connection_struct * conn,TALLOC_CTX * mem_ctx,files_struct * fsp,uint32_t security_info_wanted,uint32_t max_data_count,uint8_t ** ppmarshalled_sd,size_t * psd_size)1971 NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
1972 TALLOC_CTX *mem_ctx,
1973 files_struct *fsp,
1974 uint32_t security_info_wanted,
1975 uint32_t max_data_count,
1976 uint8_t **ppmarshalled_sd,
1977 size_t *psd_size)
1978 {
1979 NTSTATUS status;
1980 struct security_descriptor *psd = NULL;
1981 TALLOC_CTX *frame = talloc_stackframe();
1982
1983 /*
1984 * Get the permissions to return.
1985 */
1986
1987 if ((security_info_wanted & SECINFO_SACL) &&
1988 !(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
1989 DEBUG(10, ("Access to SACL denied.\n"));
1990 TALLOC_FREE(frame);
1991 return NT_STATUS_ACCESS_DENIED;
1992 }
1993
1994 if ((security_info_wanted & (SECINFO_DACL|SECINFO_OWNER|SECINFO_GROUP)) &&
1995 !(fsp->access_mask & SEC_STD_READ_CONTROL)) {
1996 DEBUG(10, ("Access to DACL, OWNER, or GROUP denied.\n"));
1997 TALLOC_FREE(frame);
1998 return NT_STATUS_ACCESS_DENIED;
1999 }
2000
2001 if (S_ISLNK(fsp->fsp_name->st.st_ex_mode)) {
2002 DEBUG(10, ("ACL get on symlink %s denied.\n",
2003 fsp_str_dbg(fsp)));
2004 TALLOC_FREE(frame);
2005 return NT_STATUS_ACCESS_DENIED;
2006 }
2007
2008 if (security_info_wanted & (SECINFO_DACL|SECINFO_OWNER|
2009 SECINFO_GROUP|SECINFO_SACL)) {
2010 /* Don't return SECINFO_LABEL if anything else was
2011 requested. See bug #8458. */
2012 security_info_wanted &= ~SECINFO_LABEL;
2013 }
2014
2015 if (!lp_nt_acl_support(SNUM(conn))) {
2016 status = get_null_nt_acl(frame, &psd);
2017 } else if (security_info_wanted & SECINFO_LABEL) {
2018 /* Like W2K3 return a null object. */
2019 status = get_null_nt_acl(frame, &psd);
2020 } else {
2021 status = SMB_VFS_FGET_NT_ACL(
2022 fsp, security_info_wanted, frame, &psd);
2023 }
2024 if (!NT_STATUS_IS_OK(status)) {
2025 TALLOC_FREE(frame);
2026 return status;
2027 }
2028
2029 if (!(security_info_wanted & SECINFO_OWNER)) {
2030 psd->owner_sid = NULL;
2031 }
2032 if (!(security_info_wanted & SECINFO_GROUP)) {
2033 psd->group_sid = NULL;
2034 }
2035 if (!(security_info_wanted & SECINFO_DACL)) {
2036 psd->type &= ~SEC_DESC_DACL_PRESENT;
2037 psd->dacl = NULL;
2038 }
2039 if (!(security_info_wanted & SECINFO_SACL)) {
2040 psd->type &= ~SEC_DESC_SACL_PRESENT;
2041 psd->sacl = NULL;
2042 }
2043
2044 /* If the SACL/DACL is NULL, but was requested, we mark that it is
2045 * present in the reply to match Windows behavior */
2046 if (psd->sacl == NULL &&
2047 security_info_wanted & SECINFO_SACL)
2048 psd->type |= SEC_DESC_SACL_PRESENT;
2049 if (psd->dacl == NULL &&
2050 security_info_wanted & SECINFO_DACL)
2051 psd->type |= SEC_DESC_DACL_PRESENT;
2052
2053 if (security_info_wanted & SECINFO_LABEL) {
2054 /* Like W2K3 return a null object. */
2055 psd->owner_sid = NULL;
2056 psd->group_sid = NULL;
2057 psd->dacl = NULL;
2058 psd->sacl = NULL;
2059 psd->type &= ~(SEC_DESC_DACL_PRESENT|SEC_DESC_SACL_PRESENT);
2060 }
2061
2062 *psd_size = ndr_size_security_descriptor(psd, 0);
2063
2064 DEBUG(3,("smbd_do_query_security_desc: sd_size = %lu.\n",
2065 (unsigned long)*psd_size));
2066
2067 if (DEBUGLEVEL >= 10) {
2068 DEBUG(10,("smbd_do_query_security_desc for file %s\n",
2069 fsp_str_dbg(fsp)));
2070 NDR_PRINT_DEBUG(security_descriptor, psd);
2071 }
2072
2073 if (max_data_count < *psd_size) {
2074 TALLOC_FREE(frame);
2075 return NT_STATUS_BUFFER_TOO_SMALL;
2076 }
2077
2078 status = marshall_sec_desc(mem_ctx, psd,
2079 ppmarshalled_sd, psd_size);
2080
2081 if (!NT_STATUS_IS_OK(status)) {
2082 TALLOC_FREE(frame);
2083 return status;
2084 }
2085
2086 TALLOC_FREE(frame);
2087 return NT_STATUS_OK;
2088 }
2089
2090 /****************************************************************************
2091 SMB1 reply to query a security descriptor.
2092 ****************************************************************************/
2093
call_nt_transact_query_security_desc(connection_struct * conn,struct smb_request * req,uint16_t ** ppsetup,uint32_t setup_count,char ** ppparams,uint32_t parameter_count,char ** ppdata,uint32_t data_count,uint32_t max_data_count)2094 static void call_nt_transact_query_security_desc(connection_struct *conn,
2095 struct smb_request *req,
2096 uint16_t **ppsetup,
2097 uint32_t setup_count,
2098 char **ppparams,
2099 uint32_t parameter_count,
2100 char **ppdata,
2101 uint32_t data_count,
2102 uint32_t max_data_count)
2103 {
2104 char *params = *ppparams;
2105 char *data = *ppdata;
2106 size_t sd_size = 0;
2107 uint32_t security_info_wanted;
2108 files_struct *fsp = NULL;
2109 NTSTATUS status;
2110 uint8_t *marshalled_sd = NULL;
2111
2112 if(parameter_count < 8) {
2113 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2114 return;
2115 }
2116
2117 fsp = file_fsp(req, SVAL(params,0));
2118 if(!fsp) {
2119 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2120 return;
2121 }
2122
2123 security_info_wanted = IVAL(params,4);
2124
2125 DEBUG(3,("call_nt_transact_query_security_desc: file = %s, "
2126 "info_wanted = 0x%x\n", fsp_str_dbg(fsp),
2127 (unsigned int)security_info_wanted));
2128
2129 params = nttrans_realloc(ppparams, 4);
2130 if(params == NULL) {
2131 reply_nterror(req, NT_STATUS_NO_MEMORY);
2132 return;
2133 }
2134
2135 /*
2136 * Get the permissions to return.
2137 */
2138
2139 status = smbd_do_query_security_desc(conn,
2140 talloc_tos(),
2141 fsp,
2142 security_info_wanted &
2143 SMB_SUPPORTED_SECINFO_FLAGS,
2144 max_data_count,
2145 &marshalled_sd,
2146 &sd_size);
2147
2148 if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
2149 SIVAL(params,0,(uint32_t)sd_size);
2150 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
2151 params, 4, NULL, 0);
2152 return;
2153 }
2154
2155 if (!NT_STATUS_IS_OK(status)) {
2156 reply_nterror(req, status);
2157 return;
2158 }
2159
2160 SMB_ASSERT(sd_size > 0);
2161
2162 SIVAL(params,0,(uint32_t)sd_size);
2163
2164 if (max_data_count < sd_size) {
2165 send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
2166 params, 4, NULL, 0);
2167 return;
2168 }
2169
2170 /*
2171 * Allocate the data we will return.
2172 */
2173
2174 data = nttrans_realloc(ppdata, sd_size);
2175 if(data == NULL) {
2176 reply_nterror(req, NT_STATUS_NO_MEMORY);
2177 return;
2178 }
2179
2180 memcpy(data, marshalled_sd, sd_size);
2181
2182 send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
2183
2184 return;
2185 }
2186
2187 /****************************************************************************
2188 Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs.
2189 ****************************************************************************/
2190
call_nt_transact_set_security_desc(connection_struct * conn,struct smb_request * req,uint16_t ** ppsetup,uint32_t setup_count,char ** ppparams,uint32_t parameter_count,char ** ppdata,uint32_t data_count,uint32_t max_data_count)2191 static void call_nt_transact_set_security_desc(connection_struct *conn,
2192 struct smb_request *req,
2193 uint16_t **ppsetup,
2194 uint32_t setup_count,
2195 char **ppparams,
2196 uint32_t parameter_count,
2197 char **ppdata,
2198 uint32_t data_count,
2199 uint32_t max_data_count)
2200 {
2201 char *params= *ppparams;
2202 char *data = *ppdata;
2203 files_struct *fsp = NULL;
2204 uint32_t security_info_sent = 0;
2205 NTSTATUS status;
2206
2207 if(parameter_count < 8) {
2208 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2209 return;
2210 }
2211
2212 if((fsp = file_fsp(req, SVAL(params,0))) == NULL) {
2213 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
2214 return;
2215 }
2216
2217 if (!CAN_WRITE(fsp->conn)) {
2218 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2219 return;
2220 }
2221
2222 if(!lp_nt_acl_support(SNUM(conn))) {
2223 goto done;
2224 }
2225
2226 security_info_sent = IVAL(params,4);
2227
2228 DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n",
2229 fsp_str_dbg(fsp), (unsigned int)security_info_sent));
2230
2231 if (data_count == 0) {
2232 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2233 return;
2234 }
2235
2236 status = set_sd_blob(fsp, (uint8_t *)data, data_count,
2237 security_info_sent & SMB_SUPPORTED_SECINFO_FLAGS);
2238 if (!NT_STATUS_IS_OK(status)) {
2239 reply_nterror(req, status);
2240 return;
2241 }
2242
2243 done:
2244 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
2245 return;
2246 }
2247
2248 /****************************************************************************
2249 Reply to NT IOCTL
2250 ****************************************************************************/
2251
call_nt_transact_ioctl(connection_struct * conn,struct smb_request * req,uint16_t ** ppsetup,uint32_t setup_count,char ** ppparams,uint32_t parameter_count,char ** ppdata,uint32_t data_count,uint32_t max_data_count)2252 static void call_nt_transact_ioctl(connection_struct *conn,
2253 struct smb_request *req,
2254 uint16_t **ppsetup, uint32_t setup_count,
2255 char **ppparams, uint32_t parameter_count,
2256 char **ppdata, uint32_t data_count,
2257 uint32_t max_data_count)
2258 {
2259 NTSTATUS status;
2260 uint32_t function;
2261 uint16_t fidnum;
2262 files_struct *fsp;
2263 uint8_t isFSctl;
2264 uint8_t compfilter;
2265 char *out_data = NULL;
2266 uint32_t out_data_len = 0;
2267 char *pdata = *ppdata;
2268 TALLOC_CTX *ctx = talloc_tos();
2269
2270 if (setup_count != 8) {
2271 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
2272 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2273 return;
2274 }
2275
2276 function = IVAL(*ppsetup, 0);
2277 fidnum = SVAL(*ppsetup, 4);
2278 isFSctl = CVAL(*ppsetup, 6);
2279 compfilter = CVAL(*ppsetup, 7);
2280
2281 DEBUG(10, ("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
2282 function, fidnum, isFSctl, compfilter));
2283
2284 fsp=file_fsp(req, fidnum);
2285
2286 /*
2287 * We don't really implement IOCTLs, especially on files.
2288 */
2289 if (!isFSctl) {
2290 DEBUG(10, ("isFSctl: 0x%02X indicates IOCTL, not FSCTL!\n",
2291 isFSctl));
2292 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
2293 return;
2294 }
2295
2296 /* Has to be for an open file! */
2297 if (!check_fsp_open(conn, req, fsp)) {
2298 return;
2299 }
2300
2301 SMB_PERFCOUNT_SET_IOCTL(&req->pcd, function);
2302
2303 /*
2304 * out_data might be allocated by the VFS module, but talloc should be
2305 * used, and should be cleaned up when the request ends.
2306 */
2307 status = SMB_VFS_FSCTL(fsp,
2308 ctx,
2309 function,
2310 req->flags2,
2311 (uint8_t *)pdata,
2312 data_count,
2313 (uint8_t **)&out_data,
2314 max_data_count,
2315 &out_data_len);
2316 if (!NT_STATUS_IS_OK(status)) {
2317 reply_nterror(req, status);
2318 } else {
2319 send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, out_data, out_data_len);
2320 }
2321 }
2322
2323
2324 #ifdef HAVE_SYS_QUOTAS
fill_qtlist_from_sids(TALLOC_CTX * mem_ctx,struct files_struct * fsp,SMB_NTQUOTA_HANDLE * qt_handle,struct dom_sid * sids,uint32_t elems)2325 static enum ndr_err_code fill_qtlist_from_sids(TALLOC_CTX *mem_ctx,
2326 struct files_struct *fsp,
2327 SMB_NTQUOTA_HANDLE *qt_handle,
2328 struct dom_sid *sids,
2329 uint32_t elems)
2330 {
2331 uint32_t i;
2332 TALLOC_CTX *list_ctx = NULL;
2333
2334 list_ctx = talloc_init("quota_sid_list");
2335
2336 if (list_ctx == NULL) {
2337 DBG_ERR("failed to allocate\n");
2338 return NDR_ERR_ALLOC;
2339 }
2340
2341 if (qt_handle->quota_list!=NULL) {
2342 free_ntquota_list(&(qt_handle->quota_list));
2343 }
2344 for (i = 0; i < elems; i++) {
2345 SMB_NTQUOTA_STRUCT qt;
2346 SMB_NTQUOTA_LIST *list_item;
2347 bool ok;
2348
2349 if (!NT_STATUS_IS_OK(vfs_get_ntquota(fsp,
2350 SMB_USER_QUOTA_TYPE,
2351 &sids[i], &qt))) {
2352 /* non fatal error, return empty item in result */
2353 ZERO_STRUCT(qt);
2354 continue;
2355 }
2356
2357
2358 list_item = talloc_zero(list_ctx, SMB_NTQUOTA_LIST);
2359 if (list_item == NULL) {
2360 DBG_ERR("failed to allocate\n");
2361 return NDR_ERR_ALLOC;
2362 }
2363
2364 ok = sid_to_uid(&sids[i], &list_item->uid);
2365 if (!ok) {
2366 struct dom_sid_buf buf;
2367 DBG_WARNING("Could not convert SID %s to uid\n",
2368 dom_sid_str_buf(&sids[i], &buf));
2369 /* No idea what to return here... */
2370 return NDR_ERR_INVALID_POINTER;
2371 }
2372
2373 list_item->quotas = talloc_zero(list_item, SMB_NTQUOTA_STRUCT);
2374 if (list_item->quotas == NULL) {
2375 DBG_ERR("failed to allocate\n");
2376 return NDR_ERR_ALLOC;
2377 }
2378
2379 *list_item->quotas = qt;
2380 list_item->mem_ctx = list_ctx;
2381 DLIST_ADD(qt_handle->quota_list, list_item);
2382 }
2383 qt_handle->tmp_list = qt_handle->quota_list;
2384 return NDR_ERR_SUCCESS;
2385 }
2386
extract_sids_from_buf(TALLOC_CTX * mem_ctx,uint32_t sidlistlength,DATA_BLOB * sid_buf,struct dom_sid ** sids,uint32_t * num)2387 static enum ndr_err_code extract_sids_from_buf(TALLOC_CTX *mem_ctx,
2388 uint32_t sidlistlength,
2389 DATA_BLOB *sid_buf,
2390 struct dom_sid **sids,
2391 uint32_t *num)
2392 {
2393 DATA_BLOB blob;
2394 uint32_t i = 0;
2395 enum ndr_err_code err;
2396
2397 struct sid_list_elem {
2398 struct sid_list_elem *prev, *next;
2399 struct dom_sid sid;
2400 };
2401
2402 struct sid_list_elem *sid_list = NULL;
2403 struct sid_list_elem *iter = NULL;
2404 TALLOC_CTX *list_ctx = talloc_init("sid_list");
2405 if (!list_ctx) {
2406 DBG_ERR("OOM\n");
2407 err = NDR_ERR_ALLOC;
2408 goto done;
2409 }
2410
2411 *num = 0;
2412 *sids = NULL;
2413
2414 if (sidlistlength) {
2415 uint32_t offset = 0;
2416 struct ndr_pull *ndr_pull = NULL;
2417
2418 if (sidlistlength > sid_buf->length) {
2419 DBG_ERR("sid_list_length 0x%x exceeds "
2420 "available bytes %zx\n",
2421 sidlistlength,
2422 sid_buf->length);
2423 err = NDR_ERR_OFFSET;
2424 goto done;
2425 }
2426 while (true) {
2427 struct file_get_quota_info info;
2428 struct sid_list_elem *item = NULL;
2429 uint32_t new_offset = 0;
2430 blob.data = sid_buf->data + offset;
2431 blob.length = sidlistlength - offset;
2432 ndr_pull = ndr_pull_init_blob(&blob, list_ctx);
2433 if (!ndr_pull) {
2434 DBG_ERR("OOM\n");
2435 err = NDR_ERR_ALLOC;
2436 goto done;
2437 }
2438 err = ndr_pull_file_get_quota_info(ndr_pull,
2439 NDR_SCALARS | NDR_BUFFERS, &info);
2440 if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
2441 DBG_ERR("Failed to pull file_get_quota_info "
2442 "from sidlist buffer\n");
2443 goto done;
2444 }
2445 item = talloc_zero(list_ctx, struct sid_list_elem);
2446 if (!item) {
2447 DBG_ERR("OOM\n");
2448 err = NDR_ERR_ALLOC;
2449 goto done;
2450 }
2451 item->sid = info.sid;
2452 DLIST_ADD(sid_list, item);
2453 i++;
2454 if (i == UINT32_MAX) {
2455 DBG_ERR("Integer overflow\n");
2456 err = NDR_ERR_ARRAY_SIZE;
2457 goto done;
2458 }
2459 new_offset = info.next_entry_offset;
2460
2461 /* if new_offset == 0 no more sid(s) to read. */
2462 if (new_offset == 0) {
2463 break;
2464 }
2465
2466 /* Integer wrap? */
2467 if ((offset + new_offset) < offset) {
2468 DBG_ERR("Integer wrap while adding "
2469 "new_offset 0x%x to current "
2470 "buffer offset 0x%x\n",
2471 new_offset, offset);
2472 err = NDR_ERR_OFFSET;
2473 goto done;
2474 }
2475
2476 offset += new_offset;
2477
2478 /* check if new offset is outside buffer boundry. */
2479 if (offset >= sidlistlength) {
2480 DBG_ERR("bufsize 0x%x exceeded by "
2481 "new offset 0x%x)\n",
2482 sidlistlength,
2483 offset);
2484 err = NDR_ERR_OFFSET;
2485 goto done;
2486 }
2487 }
2488 *sids = talloc_zero_array(mem_ctx, struct dom_sid, i);
2489 if (*sids == NULL) {
2490 DBG_ERR("OOM\n");
2491 err = NDR_ERR_ALLOC;
2492 goto done;
2493 }
2494
2495 *num = i;
2496
2497 for (iter = sid_list, i = 0; iter; iter = iter->next, i++) {
2498 struct dom_sid_buf buf;
2499 (*sids)[i] = iter->sid;
2500 DBG_DEBUG("quota SID[%u] %s\n",
2501 (unsigned int)i,
2502 dom_sid_str_buf(&iter->sid, &buf));
2503 }
2504 }
2505 err = NDR_ERR_SUCCESS;
2506 done:
2507 TALLOC_FREE(list_ctx);
2508 return err;
2509 }
2510
smbd_do_query_getinfo_quota(TALLOC_CTX * mem_ctx,files_struct * fsp,bool restart_scan,bool return_single,uint32_t sid_list_length,DATA_BLOB * sid_buf,uint32_t max_data_count,uint8_t ** p_data,uint32_t * p_data_size)2511 NTSTATUS smbd_do_query_getinfo_quota(TALLOC_CTX *mem_ctx,
2512 files_struct *fsp,
2513 bool restart_scan,
2514 bool return_single,
2515 uint32_t sid_list_length,
2516 DATA_BLOB *sid_buf,
2517 uint32_t max_data_count,
2518 uint8_t **p_data,
2519 uint32_t *p_data_size)
2520 {
2521 NTSTATUS status;
2522 SMB_NTQUOTA_HANDLE *qt_handle = NULL;
2523 SMB_NTQUOTA_LIST *qt_list = NULL;
2524 DATA_BLOB blob = data_blob_null;
2525 enum ndr_err_code err;
2526
2527 qt_handle =
2528 (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->private_data;
2529
2530 if (sid_list_length ) {
2531 struct dom_sid *sids;
2532 uint32_t elems = 0;
2533 /*
2534 * error check pulled offsets and lengths for wrap and
2535 * exceeding available bytes.
2536 */
2537 if (sid_list_length > sid_buf->length) {
2538 DBG_ERR("sid_list_length 0x%x exceeds "
2539 "available bytes %zx\n",
2540 sid_list_length,
2541 sid_buf->length);
2542 return NT_STATUS_INVALID_PARAMETER;
2543 }
2544
2545 err = extract_sids_from_buf(mem_ctx, sid_list_length,
2546 sid_buf, &sids, &elems);
2547 if (!NDR_ERR_CODE_IS_SUCCESS(err) || elems == 0) {
2548 return NT_STATUS_INVALID_PARAMETER;
2549 }
2550 err = fill_qtlist_from_sids(mem_ctx,
2551 fsp,
2552 qt_handle,
2553 sids,
2554 elems);
2555 if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
2556 return NT_STATUS_INVALID_PARAMETER;
2557 }
2558 } else if (restart_scan) {
2559 if (vfs_get_user_ntquota_list(fsp,
2560 &(qt_handle->quota_list))!=0) {
2561 return NT_STATUS_INTERNAL_ERROR;
2562 }
2563 } else {
2564 if (qt_handle->quota_list!=NULL &&
2565 qt_handle->tmp_list==NULL) {
2566 free_ntquota_list(&(qt_handle->quota_list));
2567 }
2568 }
2569
2570 if (restart_scan !=0 ) {
2571 qt_list = qt_handle->quota_list;
2572 } else {
2573 qt_list = qt_handle->tmp_list;
2574 }
2575 status = fill_quota_buffer(mem_ctx, qt_list,
2576 return_single != 0,
2577 max_data_count,
2578 &blob,
2579 &qt_handle->tmp_list);
2580 if (!NT_STATUS_IS_OK(status)) {
2581 return status;
2582 }
2583 if (blob.length > max_data_count) {
2584 return NT_STATUS_BUFFER_TOO_SMALL;
2585 }
2586
2587 *p_data = blob.data;
2588 *p_data_size = blob.length;
2589 return NT_STATUS_OK;
2590 }
2591
2592 /****************************************************************************
2593 Reply to get user quota
2594 ****************************************************************************/
2595
call_nt_transact_get_user_quota(connection_struct * conn,struct smb_request * req,uint16_t ** ppsetup,uint32_t setup_count,char ** ppparams,uint32_t parameter_count,char ** ppdata,uint32_t data_count,uint32_t max_data_count)2596 static void call_nt_transact_get_user_quota(connection_struct *conn,
2597 struct smb_request *req,
2598 uint16_t **ppsetup,
2599 uint32_t setup_count,
2600 char **ppparams,
2601 uint32_t parameter_count,
2602 char **ppdata,
2603 uint32_t data_count,
2604 uint32_t max_data_count)
2605 {
2606 const struct loadparm_substitution *lp_sub =
2607 loadparm_s3_global_substitution();
2608 NTSTATUS nt_status = NT_STATUS_OK;
2609 char *params = *ppparams;
2610 char *pdata = *ppdata;
2611 int data_len = 0;
2612 int param_len = 0;
2613 files_struct *fsp = NULL;
2614 DATA_BLOB blob = data_blob_null;
2615 struct nttrans_query_quota_params info = {0};
2616 enum ndr_err_code err;
2617 TALLOC_CTX *tmp_ctx = NULL;
2618 uint32_t resp_len = 0;
2619 uint8_t *resp_data = 0;
2620
2621 tmp_ctx = talloc_init("ntquota_list");
2622 if (!tmp_ctx) {
2623 nt_status = NT_STATUS_NO_MEMORY;
2624 goto error;
2625 }
2626
2627 /* access check */
2628 if (get_current_uid(conn) != sec_initial_uid()) {
2629 DEBUG(1,("get_user_quota: access_denied service [%s] user "
2630 "[%s]\n", lp_servicename(talloc_tos(), lp_sub, SNUM(conn)),
2631 conn->session_info->unix_info->unix_name));
2632 nt_status = NT_STATUS_ACCESS_DENIED;
2633 goto error;
2634 }
2635
2636 blob.data = (uint8_t*)params;
2637 blob.length = parameter_count;
2638
2639 err = ndr_pull_struct_blob(&blob, tmp_ctx, &info,
2640 (ndr_pull_flags_fn_t)ndr_pull_nttrans_query_quota_params);
2641
2642 if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
2643 DEBUG(0,("TRANSACT_GET_USER_QUOTA: failed to pull "
2644 "query_quota_params."));
2645 nt_status = NT_STATUS_INVALID_PARAMETER;
2646 goto error;
2647 }
2648 DBG_DEBUG("info.return_single_entry = %u, info.restart_scan = %u, "
2649 "info.sid_list_length = %u, info.start_sid_length = %u, "
2650 "info.start_sid_offset = %u\n",
2651 (unsigned int)info.return_single_entry,
2652 (unsigned int)info.restart_scan,
2653 (unsigned int)info.sid_list_length,
2654 (unsigned int)info.start_sid_length,
2655 (unsigned int)info.start_sid_offset);
2656
2657 /* set blob to point at data for further parsing */
2658 blob.data = (uint8_t*)pdata;
2659 blob.length = data_count;
2660 /*
2661 * Although MS-SMB ref is ambiguous here, a microsoft client will
2662 * only ever send a start sid (as part of a list) with
2663 * sid_list_length & start_sid_offset both set to the actual list
2664 * length. Note: Only a single result is returned in this case
2665 * In the case where either start_sid_offset or start_sid_length
2666 * are set alone or if both set (but have different values) then
2667 * it seems windows will return a number of entries from the start
2668 * of the list of users with quotas set. This behaviour is undocumented
2669 * and windows clients do not send messages of that type. As such we
2670 * currently will reject these requests.
2671 */
2672 if (info.start_sid_length
2673 || (info.sid_list_length != info.start_sid_offset)) {
2674 DBG_ERR("TRANSACT_GET_USER_QUOTA: unsupported single or "
2675 "compound sid format\n");
2676 nt_status = NT_STATUS_INVALID_PARAMETER;
2677 goto error;
2678 }
2679
2680 /* maybe we can check the quota_fnum */
2681 fsp = file_fsp(req, info.fid);
2682 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2683 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2684 nt_status = NT_STATUS_INVALID_HANDLE;
2685 goto error;
2686 }
2687 nt_status = smbd_do_query_getinfo_quota(tmp_ctx,
2688 fsp,
2689 info.restart_scan,
2690 info.return_single_entry,
2691 info.sid_list_length,
2692 &blob,
2693 max_data_count,
2694 &resp_data,
2695 &resp_len);
2696 if (!NT_STATUS_IS_OK(nt_status)) {
2697 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MORE_ENTRIES)) {
2698 goto error;
2699 }
2700 nt_status = NT_STATUS_OK;
2701 }
2702
2703 param_len = 4;
2704 params = nttrans_realloc(ppparams, param_len);
2705 if(params == NULL) {
2706 nt_status = NT_STATUS_NO_MEMORY;
2707 goto error;
2708 }
2709
2710 data_len = resp_len;
2711 SIVAL(params, 0, data_len);
2712 pdata = nttrans_realloc(ppdata, data_len);
2713 memcpy(pdata, resp_data, data_len);
2714
2715 TALLOC_FREE(tmp_ctx);
2716 send_nt_replies(conn, req, nt_status, params, param_len,
2717 pdata, data_len);
2718 return;
2719 error:
2720 TALLOC_FREE(tmp_ctx);
2721 reply_nterror(req, nt_status);
2722 }
2723
2724 /****************************************************************************
2725 Reply to set user quota
2726 ****************************************************************************/
2727
call_nt_transact_set_user_quota(connection_struct * conn,struct smb_request * req,uint16_t ** ppsetup,uint32_t setup_count,char ** ppparams,uint32_t parameter_count,char ** ppdata,uint32_t data_count,uint32_t max_data_count)2728 static void call_nt_transact_set_user_quota(connection_struct *conn,
2729 struct smb_request *req,
2730 uint16_t **ppsetup,
2731 uint32_t setup_count,
2732 char **ppparams,
2733 uint32_t parameter_count,
2734 char **ppdata,
2735 uint32_t data_count,
2736 uint32_t max_data_count)
2737 {
2738 const struct loadparm_substitution *lp_sub =
2739 loadparm_s3_global_substitution();
2740 char *params = *ppparams;
2741 char *pdata = *ppdata;
2742 int data_len=0,param_len=0;
2743 SMB_NTQUOTA_STRUCT qt;
2744 struct file_quota_information info = {0};
2745 enum ndr_err_code err;
2746 struct dom_sid sid;
2747 DATA_BLOB inblob;
2748 files_struct *fsp = NULL;
2749 TALLOC_CTX *ctx = NULL;
2750 NTSTATUS status = NT_STATUS_OK;
2751 ZERO_STRUCT(qt);
2752
2753 /* access check */
2754 if (get_current_uid(conn) != sec_initial_uid()) {
2755 DEBUG(1,("set_user_quota: access_denied service [%s] user "
2756 "[%s]\n", lp_servicename(talloc_tos(), lp_sub, SNUM(conn)),
2757 conn->session_info->unix_info->unix_name));
2758 status = NT_STATUS_ACCESS_DENIED;
2759 goto error;
2760 }
2761
2762 /*
2763 * Ensure minimum number of parameters sent.
2764 */
2765
2766 if (parameter_count < 2) {
2767 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
2768 status = NT_STATUS_INVALID_PARAMETER;
2769 goto error;
2770 }
2771
2772 /* maybe we can check the quota_fnum */
2773 fsp = file_fsp(req, SVAL(params,0));
2774 if (!check_fsp_ntquota_handle(conn, req, fsp)) {
2775 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
2776 status = NT_STATUS_INVALID_HANDLE;
2777 goto error;
2778 }
2779
2780 ctx = talloc_init("set_user_quota");
2781 if (!ctx) {
2782 status = NT_STATUS_NO_MEMORY;
2783 goto error;
2784 }
2785 inblob.data = (uint8_t*)pdata;
2786 inblob.length = data_count;
2787
2788 err = ndr_pull_struct_blob(
2789 &inblob,
2790 ctx,
2791 &info,
2792 (ndr_pull_flags_fn_t)ndr_pull_file_quota_information);
2793
2794 if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
2795 DEBUG(0,("TRANSACT_SET_USER_QUOTA: failed to pull "
2796 "file_quota_information\n"));
2797 status = NT_STATUS_INVALID_PARAMETER;
2798 goto error;
2799 }
2800 qt.usedspace = info.quota_used;
2801
2802 qt.softlim = info.quota_threshold;
2803
2804 qt.hardlim = info.quota_limit;
2805
2806 sid = info.sid;
2807
2808 if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
2809 status = NT_STATUS_INTERNAL_ERROR;
2810 goto error;
2811 }
2812
2813 send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
2814 pdata, data_len);
2815 TALLOC_FREE(ctx);
2816 return;
2817 error:
2818 TALLOC_FREE(ctx);
2819 reply_nterror(req, status);
2820 }
2821 #endif /* HAVE_SYS_QUOTAS */
2822
handle_nttrans(connection_struct * conn,struct trans_state * state,struct smb_request * req)2823 static void handle_nttrans(connection_struct *conn,
2824 struct trans_state *state,
2825 struct smb_request *req)
2826 {
2827 if (get_Protocol() >= PROTOCOL_NT1) {
2828 req->flags2 |= 0x40; /* IS_LONG_NAME */
2829 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_flg2,req->flags2);
2830 }
2831
2832
2833 SMB_PERFCOUNT_SET_SUBOP(&req->pcd, state->call);
2834
2835 /* Now we must call the relevant NT_TRANS function */
2836 switch(state->call) {
2837 case NT_TRANSACT_CREATE:
2838 {
2839 START_PROFILE(NT_transact_create);
2840 call_nt_transact_create(
2841 conn, req,
2842 &state->setup, state->setup_count,
2843 &state->param, state->total_param,
2844 &state->data, state->total_data,
2845 state->max_data_return);
2846 END_PROFILE(NT_transact_create);
2847 break;
2848 }
2849
2850 case NT_TRANSACT_IOCTL:
2851 {
2852 START_PROFILE(NT_transact_ioctl);
2853 call_nt_transact_ioctl(
2854 conn, req,
2855 &state->setup, state->setup_count,
2856 &state->param, state->total_param,
2857 &state->data, state->total_data,
2858 state->max_data_return);
2859 END_PROFILE(NT_transact_ioctl);
2860 break;
2861 }
2862
2863 case NT_TRANSACT_SET_SECURITY_DESC:
2864 {
2865 START_PROFILE(NT_transact_set_security_desc);
2866 call_nt_transact_set_security_desc(
2867 conn, req,
2868 &state->setup, state->setup_count,
2869 &state->param, state->total_param,
2870 &state->data, state->total_data,
2871 state->max_data_return);
2872 END_PROFILE(NT_transact_set_security_desc);
2873 break;
2874 }
2875
2876 case NT_TRANSACT_NOTIFY_CHANGE:
2877 {
2878 START_PROFILE(NT_transact_notify_change);
2879 call_nt_transact_notify_change(
2880 conn, req,
2881 &state->setup, state->setup_count,
2882 &state->param, state->total_param,
2883 &state->data, state->total_data,
2884 state->max_data_return,
2885 state->max_param_return);
2886 END_PROFILE(NT_transact_notify_change);
2887 break;
2888 }
2889
2890 case NT_TRANSACT_RENAME:
2891 {
2892 START_PROFILE(NT_transact_rename);
2893 call_nt_transact_rename(
2894 conn, req,
2895 &state->setup, state->setup_count,
2896 &state->param, state->total_param,
2897 &state->data, state->total_data,
2898 state->max_data_return);
2899 END_PROFILE(NT_transact_rename);
2900 break;
2901 }
2902
2903 case NT_TRANSACT_QUERY_SECURITY_DESC:
2904 {
2905 START_PROFILE(NT_transact_query_security_desc);
2906 call_nt_transact_query_security_desc(
2907 conn, req,
2908 &state->setup, state->setup_count,
2909 &state->param, state->total_param,
2910 &state->data, state->total_data,
2911 state->max_data_return);
2912 END_PROFILE(NT_transact_query_security_desc);
2913 break;
2914 }
2915
2916 #ifdef HAVE_SYS_QUOTAS
2917 case NT_TRANSACT_GET_USER_QUOTA:
2918 {
2919 START_PROFILE(NT_transact_get_user_quota);
2920 call_nt_transact_get_user_quota(
2921 conn, req,
2922 &state->setup, state->setup_count,
2923 &state->param, state->total_param,
2924 &state->data, state->total_data,
2925 state->max_data_return);
2926 END_PROFILE(NT_transact_get_user_quota);
2927 break;
2928 }
2929
2930 case NT_TRANSACT_SET_USER_QUOTA:
2931 {
2932 START_PROFILE(NT_transact_set_user_quota);
2933 call_nt_transact_set_user_quota(
2934 conn, req,
2935 &state->setup, state->setup_count,
2936 &state->param, state->total_param,
2937 &state->data, state->total_data,
2938 state->max_data_return);
2939 END_PROFILE(NT_transact_set_user_quota);
2940 break;
2941 }
2942 #endif /* HAVE_SYS_QUOTAS */
2943
2944 default:
2945 /* Error in request */
2946 DEBUG(0,("handle_nttrans: Unknown request %d in "
2947 "nttrans call\n", state->call));
2948 reply_nterror(req, NT_STATUS_INVALID_LEVEL);
2949 return;
2950 }
2951 return;
2952 }
2953
2954 /****************************************************************************
2955 Reply to a SMBNTtrans.
2956 ****************************************************************************/
2957
reply_nttrans(struct smb_request * req)2958 void reply_nttrans(struct smb_request *req)
2959 {
2960 connection_struct *conn = req->conn;
2961 uint32_t pscnt;
2962 uint32_t psoff;
2963 uint32_t dscnt;
2964 uint32_t dsoff;
2965 uint16_t function_code;
2966 NTSTATUS result;
2967 struct trans_state *state;
2968
2969 START_PROFILE(SMBnttrans);
2970
2971 if (req->wct < 19) {
2972 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2973 END_PROFILE(SMBnttrans);
2974 return;
2975 }
2976
2977 pscnt = IVAL(req->vwv+9, 1);
2978 psoff = IVAL(req->vwv+11, 1);
2979 dscnt = IVAL(req->vwv+13, 1);
2980 dsoff = IVAL(req->vwv+15, 1);
2981 function_code = SVAL(req->vwv+18, 0);
2982
2983 if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
2984 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2985 END_PROFILE(SMBnttrans);
2986 return;
2987 }
2988
2989 result = allow_new_trans(conn->pending_trans, req->mid);
2990 if (!NT_STATUS_IS_OK(result)) {
2991 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
2992 reply_nterror(req, result);
2993 END_PROFILE(SMBnttrans);
2994 return;
2995 }
2996
2997 if ((state = talloc(conn, struct trans_state)) == NULL) {
2998 reply_nterror(req, NT_STATUS_NO_MEMORY);
2999 END_PROFILE(SMBnttrans);
3000 return;
3001 }
3002
3003 state->cmd = SMBnttrans;
3004
3005 state->mid = req->mid;
3006 state->vuid = req->vuid;
3007 state->total_data = IVAL(req->vwv+3, 1);
3008 state->data = NULL;
3009 state->total_param = IVAL(req->vwv+1, 1);
3010 state->param = NULL;
3011 state->max_data_return = IVAL(req->vwv+7, 1);
3012 state->max_param_return = IVAL(req->vwv+5, 1);
3013
3014 /* setup count is in *words* */
3015 state->setup_count = 2*CVAL(req->vwv+17, 1);
3016 state->setup = NULL;
3017 state->call = function_code;
3018
3019 DEBUG(10, ("num_setup=%u, "
3020 "param_total=%u, this_param=%u, max_param=%u, "
3021 "data_total=%u, this_data=%u, max_data=%u, "
3022 "param_offset=%u, data_offset=%u\n",
3023 (unsigned)state->setup_count,
3024 (unsigned)state->total_param, (unsigned)pscnt,
3025 (unsigned)state->max_param_return,
3026 (unsigned)state->total_data, (unsigned)dscnt,
3027 (unsigned)state->max_data_return,
3028 (unsigned)psoff, (unsigned)dsoff));
3029
3030 /*
3031 * All nttrans messages we handle have smb_wct == 19 +
3032 * state->setup_count. Ensure this is so as a sanity check.
3033 */
3034
3035 if(req->wct != 19 + (state->setup_count/2)) {
3036 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
3037 req->wct, 19 + (state->setup_count/2)));
3038 goto bad_param;
3039 }
3040
3041 /* Don't allow more than 128mb for each value. */
3042 if ((state->total_data > (1024*1024*128)) ||
3043 (state->total_param > (1024*1024*128))) {
3044 reply_nterror(req, NT_STATUS_NO_MEMORY);
3045 END_PROFILE(SMBnttrans);
3046 return;
3047 }
3048
3049 if ((dscnt > state->total_data) || (pscnt > state->total_param))
3050 goto bad_param;
3051
3052 if (state->total_data) {
3053
3054 if (trans_oob(state->total_data, 0, dscnt)
3055 || trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
3056 goto bad_param;
3057 }
3058
3059 /* Can't use talloc here, the core routines do realloc on the
3060 * params and data. */
3061 if ((state->data = (char *)SMB_MALLOC(state->total_data)) == NULL) {
3062 DEBUG(0,("reply_nttrans: data malloc fail for %u "
3063 "bytes !\n", (unsigned int)state->total_data));
3064 TALLOC_FREE(state);
3065 reply_nterror(req, NT_STATUS_NO_MEMORY);
3066 END_PROFILE(SMBnttrans);
3067 return;
3068 }
3069
3070 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
3071 }
3072
3073 if (state->total_param) {
3074
3075 if (trans_oob(state->total_param, 0, pscnt)
3076 || trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
3077 goto bad_param;
3078 }
3079
3080 /* Can't use talloc here, the core routines do realloc on the
3081 * params and data. */
3082 if ((state->param = (char *)SMB_MALLOC(state->total_param)) == NULL) {
3083 DEBUG(0,("reply_nttrans: param malloc fail for %u "
3084 "bytes !\n", (unsigned int)state->total_param));
3085 SAFE_FREE(state->data);
3086 TALLOC_FREE(state);
3087 reply_nterror(req, NT_STATUS_NO_MEMORY);
3088 END_PROFILE(SMBnttrans);
3089 return;
3090 }
3091
3092 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
3093 }
3094
3095 state->received_data = dscnt;
3096 state->received_param = pscnt;
3097
3098 if(state->setup_count > 0) {
3099 DEBUG(10,("reply_nttrans: state->setup_count = %d\n",
3100 state->setup_count));
3101
3102 /*
3103 * No overflow possible here, state->setup_count is an
3104 * unsigned int, being filled by a single byte from
3105 * CVAL(req->vwv+13, 0) above. The cast in the comparison
3106 * below is not necessary, it's here to clarify things. The
3107 * validity of req->vwv and req->wct has been checked in
3108 * init_smb_request already.
3109 */
3110 if ((state->setup_count/2) + 19 > (unsigned int)req->wct) {
3111 goto bad_param;
3112 }
3113
3114 state->setup = (uint16_t *)TALLOC(state, state->setup_count);
3115 if (state->setup == NULL) {
3116 DEBUG(0,("reply_nttrans : Out of memory\n"));
3117 SAFE_FREE(state->data);
3118 SAFE_FREE(state->param);
3119 TALLOC_FREE(state);
3120 reply_nterror(req, NT_STATUS_NO_MEMORY);
3121 END_PROFILE(SMBnttrans);
3122 return;
3123 }
3124
3125 memcpy(state->setup, req->vwv+19, state->setup_count);
3126 dump_data(10, (uint8_t *)state->setup, state->setup_count);
3127 }
3128
3129 if ((state->received_data == state->total_data) &&
3130 (state->received_param == state->total_param)) {
3131 handle_nttrans(conn, state, req);
3132 SAFE_FREE(state->param);
3133 SAFE_FREE(state->data);
3134 TALLOC_FREE(state);
3135 END_PROFILE(SMBnttrans);
3136 return;
3137 }
3138
3139 DLIST_ADD(conn->pending_trans, state);
3140
3141 /* We need to send an interim response then receive the rest
3142 of the parameter/data bytes */
3143 reply_outbuf(req, 0, 0);
3144 show_msg((char *)req->outbuf);
3145 END_PROFILE(SMBnttrans);
3146 return;
3147
3148 bad_param:
3149
3150 DEBUG(0,("reply_nttrans: invalid trans parameters\n"));
3151 SAFE_FREE(state->data);
3152 SAFE_FREE(state->param);
3153 TALLOC_FREE(state);
3154 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3155 END_PROFILE(SMBnttrans);
3156 return;
3157 }
3158
3159 /****************************************************************************
3160 Reply to a SMBnttranss
3161 ****************************************************************************/
3162
reply_nttranss(struct smb_request * req)3163 void reply_nttranss(struct smb_request *req)
3164 {
3165 connection_struct *conn = req->conn;
3166 uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
3167 struct trans_state *state;
3168
3169 START_PROFILE(SMBnttranss);
3170
3171 show_msg((const char *)req->inbuf);
3172
3173 /* Windows clients expect all replies to
3174 an NT transact secondary (SMBnttranss 0xA1)
3175 to have a command code of NT transact
3176 (SMBnttrans 0xA0). See bug #8989 for details. */
3177 req->cmd = SMBnttrans;
3178
3179 if (req->wct < 18) {
3180 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3181 END_PROFILE(SMBnttranss);
3182 return;
3183 }
3184
3185 for (state = conn->pending_trans; state != NULL;
3186 state = state->next) {
3187 if (state->mid == req->mid) {
3188 break;
3189 }
3190 }
3191
3192 if ((state == NULL) || (state->cmd != SMBnttrans)) {
3193 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3194 END_PROFILE(SMBnttranss);
3195 return;
3196 }
3197
3198 /* Revise state->total_param and state->total_data in case they have
3199 changed downwards */
3200 if (IVAL(req->vwv+1, 1) < state->total_param) {
3201 state->total_param = IVAL(req->vwv+1, 1);
3202 }
3203 if (IVAL(req->vwv+3, 1) < state->total_data) {
3204 state->total_data = IVAL(req->vwv+3, 1);
3205 }
3206
3207 pcnt = IVAL(req->vwv+5, 1);
3208 poff = IVAL(req->vwv+7, 1);
3209 pdisp = IVAL(req->vwv+9, 1);
3210
3211 dcnt = IVAL(req->vwv+11, 1);
3212 doff = IVAL(req->vwv+13, 1);
3213 ddisp = IVAL(req->vwv+15, 1);
3214
3215 state->received_param += pcnt;
3216 state->received_data += dcnt;
3217
3218 if ((state->received_data > state->total_data) ||
3219 (state->received_param > state->total_param))
3220 goto bad_param;
3221
3222 if (pcnt) {
3223 if (trans_oob(state->total_param, pdisp, pcnt)
3224 || trans_oob(smb_len(req->inbuf), poff, pcnt)) {
3225 goto bad_param;
3226 }
3227 memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,pcnt);
3228 }
3229
3230 if (dcnt) {
3231 if (trans_oob(state->total_data, ddisp, dcnt)
3232 || trans_oob(smb_len(req->inbuf), doff, dcnt)) {
3233 goto bad_param;
3234 }
3235 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
3236 }
3237
3238 if ((state->received_param < state->total_param) ||
3239 (state->received_data < state->total_data)) {
3240 END_PROFILE(SMBnttranss);
3241 return;
3242 }
3243
3244 handle_nttrans(conn, state, req);
3245
3246 DLIST_REMOVE(conn->pending_trans, state);
3247 SAFE_FREE(state->data);
3248 SAFE_FREE(state->param);
3249 TALLOC_FREE(state);
3250 END_PROFILE(SMBnttranss);
3251 return;
3252
3253 bad_param:
3254
3255 DEBUG(0,("reply_nttranss: invalid trans parameters\n"));
3256 DLIST_REMOVE(conn->pending_trans, state);
3257 SAFE_FREE(state->data);
3258 SAFE_FREE(state->param);
3259 TALLOC_FREE(state);
3260 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3261 END_PROFILE(SMBnttranss);
3262 return;
3263 }
3264