LCOV - code coverage report
Current view: top level - source3/smbd - files.c (source / functions) Hit Total Coverage
Test: coverage report for master 93b6db33 Lines: 707 829 85.3 %
Date: 2022-08-03 13:13:09 Functions: 50 51 98.0 %

          Line data    Source code
       1             : /*
       2             :    Unix SMB/CIFS implementation.
       3             :    Files[] structure handling
       4             :    Copyright (C) Andrew Tridgell 1998
       5             : 
       6             :    This program is free software; you can redistribute it and/or modify
       7             :    it under the terms of the GNU General Public License as published by
       8             :    the Free Software Foundation; either version 3 of the License, or
       9             :    (at your option) any later version.
      10             : 
      11             :    This program is distributed in the hope that it will be useful,
      12             :    but WITHOUT ANY WARRANTY; without even the implied warranty of
      13             :    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      14             :    GNU General Public License for more details.
      15             : 
      16             :    You should have received a copy of the GNU General Public License
      17             :    along with this program.  If not, see <http://www.gnu.org/licenses/>.
      18             : */
      19             : 
      20             : #include "includes.h"
      21             : #include "smbd/smbd.h"
      22             : #include "smbd/globals.h"
      23             : #include "smbd/smbXsrv_open.h"
      24             : #include "libcli/security/security.h"
      25             : #include "util_tdb.h"
      26             : #include "lib/util/bitmap.h"
      27             : #include "lib/util/strv.h"
      28             : 
      29             : #define FILE_HANDLE_OFFSET 0x1000
      30             : 
      31             : static NTSTATUS fsp_attach_smb_fname(struct files_struct *fsp,
      32             :                                      struct smb_filename **_smb_fname);
      33             : 
      34             : /**
      35             :  * create new fsp to be used for file_new or a durable handle reconnect
      36             :  */
      37     6685863 : NTSTATUS fsp_new(struct connection_struct *conn, TALLOC_CTX *mem_ctx,
      38             :                  files_struct **result)
      39             : {
      40     6685863 :         NTSTATUS status = NT_STATUS_NO_MEMORY;
      41     6685863 :         files_struct *fsp = NULL;
      42     6685863 :         struct smbd_server_connection *sconn = conn->sconn;
      43             : 
      44     6685863 :         fsp = talloc_zero(mem_ctx, struct files_struct);
      45     6685863 :         if (fsp == NULL) {
      46           0 :                 goto fail;
      47             :         }
      48             : 
      49             :         /*
      50             :          * This can't be a child of fsp because the file_handle can be ref'd
      51             :          * when doing a dos/fcb open, which will then share the file_handle
      52             :          * across multiple fsps.
      53             :          */
      54     6685863 :         fsp->fh = fd_handle_create(mem_ctx);
      55     6685863 :         if (fsp->fh == NULL) {
      56           0 :                 goto fail;
      57             :         }
      58             : 
      59     6685863 :         fsp->fsp_flags.use_ofd_locks = !lp_smbd_force_process_locks(SNUM(conn));
      60             : #ifndef HAVE_OFD_LOCKS
      61             :         fsp->fsp_flags.use_ofd_locks = false;
      62             : #endif
      63             : 
      64     6685863 :         fh_set_refcount(fsp->fh, 1);
      65     6685863 :         fsp_set_fd(fsp, -1);
      66             : 
      67     6685863 :         fsp->fnum = FNUM_FIELD_INVALID;
      68     6685863 :         fsp->conn = conn;
      69     6685863 :         fsp->close_write_time = make_omit_timespec();
      70             : 
      71     6685863 :         DLIST_ADD(sconn->files, fsp);
      72     6685863 :         sconn->num_files += 1;
      73             : 
      74     6685863 :         conn->num_files_open++;
      75             : 
      76     6685863 :         DBG_INFO("allocated files structure (%u used)\n",
      77             :                 (unsigned int)sconn->num_files);
      78             : 
      79     6685863 :         *result = fsp;
      80     6685863 :         return NT_STATUS_OK;
      81             : 
      82           0 : fail:
      83           0 :         if (fsp != NULL) {
      84           0 :                 TALLOC_FREE(fsp->fh);
      85             :         }
      86           0 :         TALLOC_FREE(fsp);
      87             : 
      88           0 :         return status;
      89             : }
      90             : 
      91     5929680 : void fsp_set_gen_id(files_struct *fsp)
      92             : {
      93             :         static uint64_t gen_id = 1;
      94             : 
      95             :         /*
      96             :          * A billion of 64-bit increments per second gives us
      97             :          * more than 500 years of runtime without wrap.
      98             :          */
      99     5929680 :         gen_id++;
     100     5929680 :         fh_set_gen_id(fsp->fh, gen_id);
     101     5929680 : }
     102             : 
     103             : /****************************************************************************
     104             :  Find first available file slot.
     105             : ****************************************************************************/
     106             : 
     107      886413 : NTSTATUS fsp_bind_smb(struct files_struct *fsp, struct smb_request *req)
     108             : {
     109      886413 :         struct smbXsrv_open *op = NULL;
     110             :         NTTIME now;
     111             :         NTSTATUS status;
     112             : 
     113      886413 :         if (req == NULL) {
     114      315923 :                 DBG_DEBUG("INTERNAL_OPEN_ONLY, skipping smbXsrv_open\n");
     115      315923 :                 return NT_STATUS_OK;
     116             :         }
     117             : 
     118      570490 :         now = timeval_to_nttime(&fsp->open_time);
     119             : 
     120      570490 :         status = smbXsrv_open_create(req->xconn,
     121      570490 :                                      fsp->conn->session_info,
     122             :                                      now,
     123             :                                      &op);
     124      570490 :         if (!NT_STATUS_IS_OK(status)) {
     125           2 :                 return status;
     126             :         }
     127      570488 :         fsp->op = op;
     128      570488 :         op->compat = fsp;
     129      570488 :         fsp->fnum = op->local_id;
     130             : 
     131      570488 :         fsp->mid = req->mid;
     132      570488 :         req->chain_fsp = fsp;
     133             : 
     134      570488 :         DBG_DEBUG("fsp [%s] mid [%" PRIu64"]\n",
     135             :                 fsp_str_dbg(fsp), fsp->mid);
     136             : 
     137      570488 :         return NT_STATUS_OK;
     138             : }
     139             : 
     140      596631 : NTSTATUS file_new(struct smb_request *req, connection_struct *conn,
     141             :                   files_struct **result)
     142             : {
     143      596631 :         struct smbd_server_connection *sconn = conn->sconn;
     144             :         files_struct *fsp;
     145             :         NTSTATUS status;
     146             : 
     147      596631 :         status = fsp_new(conn, conn, &fsp);
     148      596631 :         if (!NT_STATUS_IS_OK(status)) {
     149           0 :                 return status;
     150             :         }
     151             : 
     152      596631 :         GetTimeOfDay(&fsp->open_time);
     153             : 
     154      596631 :         status = fsp_bind_smb(fsp, req);
     155      596631 :         if (!NT_STATUS_IS_OK(status)) {
     156           2 :                 file_free(NULL, fsp);
     157           2 :                 return status;
     158             :         }
     159             : 
     160      596629 :         fsp_set_gen_id(fsp);
     161             : 
     162             :         /*
     163             :          * Create an smb_filename with "" for the base_name.  There are very
     164             :          * few NULL checks, so make sure it's initialized with something. to
     165             :          * be safe until an audit can be done.
     166             :          */
     167      596629 :         fsp->fsp_name = synthetic_smb_fname(fsp,
     168             :                                             "",
     169             :                                             NULL,
     170             :                                             NULL,
     171             :                                             0,
     172             :                                             0);
     173      596629 :         if (fsp->fsp_name == NULL) {
     174           0 :                 file_free(NULL, fsp);
     175           0 :                 return NT_STATUS_NO_MEMORY;
     176             :         }
     177             : 
     178      596629 :         DBG_INFO("new file %s\n", fsp_fnum_dbg(fsp));
     179             : 
     180             :         /* A new fsp invalidates the positive and
     181             :           negative fsp_fi_cache as the new fsp is pushed
     182             :           at the start of the list and we search from
     183             :           a cache hit to the *end* of the list. */
     184             : 
     185      596629 :         ZERO_STRUCT(sconn->fsp_fi_cache);
     186             : 
     187      596629 :         *result = fsp;
     188      596629 :         return NT_STATUS_OK;
     189             : }
     190             : 
     191      307964 : NTSTATUS create_internal_fsp(connection_struct *conn,
     192             :                              const struct smb_filename *smb_fname,
     193             :                              struct files_struct **_fsp)
     194             : {
     195      307964 :         struct files_struct *fsp = NULL;
     196             :         NTSTATUS status;
     197             : 
     198      307964 :         status = file_new(NULL, conn, &fsp);
     199      307964 :         if (!NT_STATUS_IS_OK(status)) {
     200           0 :                 return status;
     201             :         }
     202             : 
     203      307964 :         status = fsp_set_smb_fname(fsp, smb_fname);
     204      307964 :         if (!NT_STATUS_IS_OK(status)) {
     205           0 :                 file_free(NULL, fsp);
     206           0 :                 return status;
     207             :         }
     208             : 
     209      307964 :         *_fsp = fsp;
     210      307964 :         return NT_STATUS_OK;
     211             : }
     212             : 
     213             : /*
     214             :  * Create an internal fsp for an *existing* directory.
     215             :  *
     216             :  * This should only be used by callers in the VFS that need to control the
     217             :  * opening of the directory. Otherwise use open_internal_dirfsp_at().
     218             :  */
     219      297630 : NTSTATUS create_internal_dirfsp(connection_struct *conn,
     220             :                                 const struct smb_filename *smb_dname,
     221             :                                 struct files_struct **_fsp)
     222             : {
     223      297630 :         struct files_struct *fsp = NULL;
     224             :         NTSTATUS status;
     225             : 
     226      297630 :         status = create_internal_fsp(conn, smb_dname, &fsp);
     227      297630 :         if (!NT_STATUS_IS_OK(status)) {
     228           0 :                 return status;
     229             :         }
     230             : 
     231      297630 :         fsp->access_mask = FILE_LIST_DIRECTORY;
     232      297630 :         fsp->fsp_flags.is_directory = true;
     233      297630 :         fsp->fsp_flags.is_dirfsp = true;
     234             : 
     235      297630 :         *_fsp = fsp;
     236      297630 :         return NT_STATUS_OK;
     237             : }
     238             : 
     239             : /*
     240             :  * Open an internal fsp for an *existing* directory.
     241             :  */
     242       12771 : NTSTATUS open_internal_dirfsp(connection_struct *conn,
     243             :                               const struct smb_filename *smb_dname,
     244             :                               int open_flags,
     245             :                               struct files_struct **_fsp)
     246             : {
     247       12771 :         struct files_struct *fsp = NULL;
     248             :         NTSTATUS status;
     249             : 
     250       12771 :         status = create_internal_dirfsp(conn, smb_dname, &fsp);
     251       12771 :         if (!NT_STATUS_IS_OK(status)) {
     252           0 :                 return status;
     253             :         }
     254             : 
     255             : #ifdef O_DIRECTORY
     256       12771 :         open_flags |= O_DIRECTORY;
     257             : #endif
     258       12771 :         status = fd_openat(conn->cwd_fsp, fsp->fsp_name, fsp, open_flags, 0);
     259       12771 :         if (!NT_STATUS_IS_OK(status)) {
     260           0 :                 DBG_INFO("Could not open fd for %s (%s)\n",
     261             :                          smb_fname_str_dbg(smb_dname),
     262             :                          nt_errstr(status));
     263           0 :                 file_free(NULL, fsp);
     264           0 :                 return status;
     265             :         }
     266             : 
     267       12771 :         status = vfs_stat_fsp(fsp);
     268       12771 :         if (!NT_STATUS_IS_OK(status)) {
     269           0 :                 file_free(NULL, fsp);
     270           0 :                 return status;
     271             :         }
     272             : 
     273       12771 :         if (!S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
     274           0 :                 DBG_ERR("%s is not a directory!\n",
     275             :                         smb_fname_str_dbg(smb_dname));
     276           0 :                 file_free(NULL, fsp);
     277           0 :                 return NT_STATUS_NOT_A_DIRECTORY;
     278             :         }
     279             : 
     280       12771 :         fsp->file_id = vfs_file_id_from_sbuf(conn, &fsp->fsp_name->st);
     281             : 
     282       12771 :         *_fsp = fsp;
     283       12771 :         return NT_STATUS_OK;
     284             : }
     285             : 
     286             : /*
     287             :  * Convert a pathref dirfsp into a real fsp. No need to do any cwd
     288             :  * tricks, we just open ".".
     289             :  */
     290      281722 : NTSTATUS openat_internal_dir_from_pathref(
     291             :         struct files_struct *dirfsp,
     292             :         int open_flags,
     293             :         struct files_struct **_fsp)
     294             : {
     295      281722 :         struct connection_struct *conn = dirfsp->conn;
     296      281722 :         struct smb_filename *smb_dname = dirfsp->fsp_name;
     297      281722 :         struct files_struct *fsp = NULL;
     298      281722 :         char dot[] = ".";
     299      747618 :         struct smb_filename smb_dot = {
     300             :                 .base_name = dot,
     301      281722 :                 .flags = smb_dname->flags,
     302      281722 :                 .twrp = smb_dname->twrp,
     303             :         };
     304             :         NTSTATUS status;
     305             : 
     306      281722 :         status = create_internal_dirfsp(conn, smb_dname, &fsp);
     307      281722 :         if (!NT_STATUS_IS_OK(status)) {
     308           0 :                 return status;
     309             :         }
     310             : 
     311             :         /*
     312             :          * Pointless for opening ".", but you never know...
     313             :          */
     314      281722 :         open_flags |= O_NOFOLLOW;
     315             : 
     316      281722 :         status = fd_openat(dirfsp, &smb_dot, fsp, open_flags, 0);
     317      281722 :         if (!NT_STATUS_IS_OK(status)) {
     318           2 :                 DBG_INFO("fd_openat(\"%s\", \".\") failed: %s\n",
     319             :                          fsp_str_dbg(dirfsp),
     320             :                          nt_errstr(status));
     321           2 :                 file_free(NULL, fsp);
     322           2 :                 return status;
     323             :         }
     324             : 
     325      281720 :         fsp->fsp_name->st = smb_dname->st;
     326      281720 :         fsp->file_id = vfs_file_id_from_sbuf(conn, &fsp->fsp_name->st);
     327      281720 :         *_fsp = fsp;
     328      281720 :         return NT_STATUS_OK;
     329             : }
     330             : 
     331             : /*
     332             :  * The "link" in the name doesn't imply link in the filesystem
     333             :  * sense. It's a object that "links" together an fsp and an smb_fname
     334             :  * and the link allocated as talloc child of an fsp.
     335             :  *
     336             :  * The link is created for fsps that openat_pathref_fsp() returns in
     337             :  * smb_fname->fsp. When this fsp is freed by file_free() by some caller
     338             :  * somewhere, the destructor fsp_smb_fname_link_destructor() on the link object
     339             :  * will use the link to reset the reference in smb_fname->fsp that is about to
     340             :  * go away.
     341             :  *
     342             :  * This prevents smb_fname_internal_fsp_destructor() from seeing dangling fsp
     343             :  * pointers.
     344             :  */
     345             : 
     346             : struct fsp_smb_fname_link {
     347             :         struct fsp_smb_fname_link **smb_fname_link;
     348             :         struct files_struct **smb_fname_fsp;
     349             : };
     350             : 
     351     6434077 : static int fsp_smb_fname_link_destructor(struct fsp_smb_fname_link *link)
     352             : {
     353     6434077 :         if (link->smb_fname_link == NULL) {
     354           0 :                 return 0;
     355             :         }
     356             : 
     357     6434077 :         *link->smb_fname_link = NULL;
     358     6434077 :         *link->smb_fname_fsp = NULL;
     359     6434077 :         return 0;
     360             : }
     361             : 
     362    12522525 : static NTSTATUS fsp_smb_fname_link(struct files_struct *fsp,
     363             :                                    struct fsp_smb_fname_link **smb_fname_link,
     364             :                                    struct files_struct **smb_fname_fsp)
     365             : {
     366    12522525 :         struct fsp_smb_fname_link *link = NULL;
     367             : 
     368    12522525 :         SMB_ASSERT(*smb_fname_link == NULL);
     369    12522525 :         SMB_ASSERT(*smb_fname_fsp == NULL);
     370             : 
     371    12522525 :         link = talloc_zero(fsp, struct fsp_smb_fname_link);
     372    12522525 :         if (link == NULL) {
     373           0 :                 return NT_STATUS_NO_MEMORY;
     374             :         }
     375             : 
     376    12522525 :         link->smb_fname_link = smb_fname_link;
     377    12522525 :         link->smb_fname_fsp = smb_fname_fsp;
     378    12522525 :         *smb_fname_link = link;
     379    12522525 :         *smb_fname_fsp = fsp;
     380             : 
     381    12522525 :         talloc_set_destructor(link, fsp_smb_fname_link_destructor);
     382    12522525 :         return NT_STATUS_OK;
     383             : }
     384             : 
     385             : /*
     386             :  * Free a link, carefully avoiding to trigger the link destructor
     387             :  */
     388     7277958 : static void destroy_fsp_smb_fname_link(struct fsp_smb_fname_link **_link)
     389             : {
     390     7277958 :         struct fsp_smb_fname_link *link = *_link;
     391             : 
     392     7277958 :         if (link == NULL) {
     393     1189530 :                 return;
     394             :         }
     395     6088428 :         talloc_set_destructor(link, NULL);
     396     6088428 :         TALLOC_FREE(link);
     397     6088428 :         *_link = NULL;
     398             : }
     399             : 
     400             : /*
     401             :  * Talloc destructor set on an smb_fname set by openat_pathref_fsp() used to
     402             :  * close the embedded smb_fname->fsp.
     403             :  */
     404     4753218 : static int smb_fname_fsp_destructor(struct smb_filename *smb_fname)
     405             : {
     406     4753218 :         struct files_struct *fsp = smb_fname->fsp;
     407             :         NTSTATUS status;
     408     4753218 :         int saved_errno = errno;
     409             : 
     410     4753218 :         destroy_fsp_smb_fname_link(&smb_fname->fsp_link);
     411             : 
     412     4753218 :         if (fsp == NULL) {
     413         143 :                 errno = saved_errno;
     414         143 :                 return 0;
     415             :         }
     416             : 
     417     4753075 :         if (fsp_is_alternate_stream(fsp)) {
     418         717 :                 struct files_struct *tmp_base_fsp = fsp->base_fsp;
     419             : 
     420         717 :                 fsp_set_base_fsp(fsp, NULL);
     421             : 
     422         717 :                 status = fd_close(tmp_base_fsp);
     423         717 :                 if (!NT_STATUS_IS_OK(status)) {
     424           0 :                         DBG_ERR("Closing fd for fsp [%s] failed: %s. "
     425             :                                 "Please check your filesystem!!!\n",
     426             :                                 fsp_str_dbg(fsp), nt_errstr(status));
     427             :                 }
     428         717 :                 file_free(NULL, tmp_base_fsp);
     429             :         }
     430             : 
     431     4753075 :         status = fd_close(fsp);
     432     4753075 :         if (!NT_STATUS_IS_OK(status)) {
     433           0 :                 DBG_ERR("Closing fd for fsp [%s] failed: %s. "
     434             :                         "Please check your filesystem!!!\n",
     435             :                         fsp_str_dbg(fsp), nt_errstr(status));
     436             :         }
     437     4753075 :         file_free(NULL, fsp);
     438     4753075 :         smb_fname->fsp = NULL;
     439             : 
     440     4753075 :         errno = saved_errno;
     441     4753075 :         return 0;
     442             : }
     443             : 
     444     5332913 : static NTSTATUS openat_pathref_fullname(
     445             :         struct connection_struct *conn,
     446             :         const struct files_struct *dirfsp,
     447             :         struct files_struct *basefsp,
     448             :         struct smb_filename **full_fname,
     449             :         struct smb_filename *smb_fname)
     450             : {
     451     5332913 :         struct files_struct *fsp = NULL;
     452     5332913 :         bool have_dirfsp = (dirfsp != NULL);
     453     5332913 :         bool have_basefsp = (basefsp != NULL);
     454             :         NTSTATUS status;
     455             : 
     456     5332913 :         DBG_DEBUG("smb_fname [%s]\n", smb_fname_str_dbg(smb_fname));
     457             : 
     458     5332913 :         SMB_ASSERT(smb_fname->fsp == NULL);
     459     5332913 :         SMB_ASSERT(have_dirfsp != have_basefsp);
     460             : 
     461     5332913 :         status = fsp_new(conn, conn, &fsp);
     462     5332913 :         if (!NT_STATUS_IS_OK(status)) {
     463           0 :                 return status;
     464             :         }
     465             : 
     466     5332913 :         GetTimeOfDay(&fsp->open_time);
     467     5332913 :         fsp_set_gen_id(fsp);
     468     5332913 :         ZERO_STRUCT(conn->sconn->fsp_fi_cache);
     469             : 
     470     5332913 :         fsp->fsp_flags.is_pathref = true;
     471             : 
     472     5332913 :         status = fsp_attach_smb_fname(fsp, full_fname);
     473     5332913 :         if (!NT_STATUS_IS_OK(status)) {
     474           0 :                 goto fail;
     475             :         }
     476     5332913 :         fsp_set_base_fsp(fsp, basefsp);
     477             : 
     478     5332913 :         status = fd_openat(
     479             :                 dirfsp, smb_fname, fsp, O_RDONLY|O_NONBLOCK, 0);
     480     5332913 :         if (!NT_STATUS_IS_OK(status)) {
     481             : 
     482      786774 :                 smb_fname->st = fsp->fsp_name->st;
     483             : 
     484     1437591 :                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND) ||
     485     1436198 :                     NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_PATH_NOT_FOUND) ||
     486      785381 :                     NT_STATUS_EQUAL(status, NT_STATUS_STOPPED_ON_SYMLINK))
     487             :                 {
     488             :                         /*
     489             :                          * streams_xattr return NT_STATUS_NOT_FOUND for
     490             :                          * opens of not yet existing streams.
     491             :                          *
     492             :                          * ELOOP maps to NT_STATUS_OBJECT_PATH_NOT_FOUND
     493             :                          * and this will result from a open request from
     494             :                          * a POSIX client on a symlink.
     495             :                          *
     496             :                          * NT_STATUS_OBJECT_NAME_NOT_FOUND is the simple
     497             :                          * ENOENT case.
     498             :                          *
     499             :                          * NT_STATUS_STOPPED_ON_SYMLINK is returned when trying
     500             :                          * to open a symlink, our callers are not interested in
     501             :                          * this.
     502             :                          */
     503        4625 :                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
     504             :                 }
     505      786774 :                 goto fail;
     506             :         }
     507             : 
     508             :         /*
     509             :          * fd_openat() has done an FSTAT on the handle
     510             :          * so update the smb_fname stat info with "truth".
     511             :          * from the handle.
     512             :          */
     513     4546139 :         smb_fname->st = fsp->fsp_name->st;
     514             : 
     515     4546139 :         fsp->fsp_flags.is_directory = S_ISDIR(fsp->fsp_name->st.st_ex_mode);
     516             : 
     517     4546139 :         fsp->file_id = vfs_file_id_from_sbuf(conn, &fsp->fsp_name->st);
     518             : 
     519     4546139 :         status = fsp_smb_fname_link(fsp,
     520             :                                     &smb_fname->fsp_link,
     521             :                                     &smb_fname->fsp);
     522     4546139 :         if (!NT_STATUS_IS_OK(status)) {
     523           0 :                 goto fail;
     524             :         }
     525             : 
     526     4546139 :         DBG_DEBUG("fsp [%s]: OK\n", fsp_str_dbg(fsp));
     527             : 
     528     4546139 :         talloc_set_destructor(smb_fname, smb_fname_fsp_destructor);
     529     4546139 :         return NT_STATUS_OK;
     530             : 
     531      786774 : fail:
     532      786774 :         DBG_DEBUG("Opening pathref for [%s] failed: %s\n",
     533             :                   smb_fname_str_dbg(smb_fname),
     534             :                   nt_errstr(status));
     535             : 
     536      786774 :         fsp_set_base_fsp(fsp, NULL);
     537      786774 :         fd_close(fsp);
     538      786774 :         file_free(NULL, fsp);
     539      786774 :         return status;
     540             : }
     541             : 
     542             : /*
     543             :  * Open an internal O_PATH based fsp for smb_fname. If O_PATH is not
     544             :  * available, open O_RDONLY as root. Both is done in fd_open() ->
     545             :  * non_widelink_open(), triggered by setting fsp->fsp_flags.is_pathref to
     546             :  * true.
     547             :  */
     548     5325502 : NTSTATUS openat_pathref_fsp(const struct files_struct *dirfsp,
     549             :                             struct smb_filename *smb_fname)
     550             : {
     551     5325502 :         connection_struct *conn = dirfsp->conn;
     552     5325502 :         struct smb_filename *full_fname = NULL;
     553     5325502 :         struct smb_filename *base_fname = NULL;
     554             :         NTSTATUS status;
     555             : 
     556     5325502 :         DBG_DEBUG("smb_fname [%s]\n", smb_fname_str_dbg(smb_fname));
     557             : 
     558     5325502 :         if (smb_fname->fsp != NULL) {
     559             :                 /* We already have one for this name. */
     560         420 :                 DBG_DEBUG("smb_fname [%s] already has a pathref fsp.\n",
     561             :                         smb_fname_str_dbg(smb_fname));
     562         420 :                 return NT_STATUS_OK;
     563             :         }
     564             : 
     565     9415276 :         if (!(conn->fs_capabilities & FILE_NAMED_STREAMS) ||
     566     4931117 :             !is_named_stream(smb_fname)) {
     567             :                 /*
     568             :                  * openat_pathref_fullname() will make "full_fname" a
     569             :                  * talloc child of the smb_fname->fsp. Don't use
     570             :                  * talloc_tos() to allocate it to avoid making the
     571             :                  * talloc stackframe pool long-lived.
     572             :                  */
     573     5323306 :                 full_fname = full_path_from_dirfsp_atname(
     574             :                         conn,
     575             :                         dirfsp,
     576             :                         smb_fname);
     577     5323306 :                 if (full_fname == NULL) {
     578           0 :                         status = NT_STATUS_NO_MEMORY;
     579           0 :                         goto fail;
     580             :                 }
     581     5323306 :                 status = openat_pathref_fullname(
     582             :                         conn, dirfsp, NULL, &full_fname, smb_fname);
     583     5323306 :                 TALLOC_FREE(full_fname);
     584     5323306 :                 return status;
     585             :         }
     586             : 
     587             :         /*
     588             :          * stream open
     589             :          */
     590        1776 :         base_fname = cp_smb_filename_nostream(conn, smb_fname);
     591        1776 :         if (base_fname == NULL) {
     592           0 :                 return NT_STATUS_NO_MEMORY;
     593             :         }
     594             : 
     595        1776 :         full_fname = full_path_from_dirfsp_atname(
     596             :                 conn,   /* no talloc_tos(), see comment above */
     597             :                 dirfsp,
     598             :                 base_fname);
     599        1776 :         if (full_fname == NULL) {
     600           0 :                 status = NT_STATUS_NO_MEMORY;
     601           0 :                 goto fail;
     602             :         }
     603             : 
     604        1776 :         status = openat_pathref_fullname(
     605             :                 conn, dirfsp, NULL, &full_fname, base_fname);
     606        1776 :         TALLOC_FREE(full_fname);
     607        1776 :         if (!NT_STATUS_IS_OK(status)) {
     608           0 :                 DBG_DEBUG("openat_pathref_nostream failed: %s\n",
     609             :                           nt_errstr(status));
     610           0 :                 goto fail;
     611             :         }
     612             : 
     613        1776 :         status = open_stream_pathref_fsp(&base_fname->fsp, smb_fname);
     614        1776 :         if (!NT_STATUS_IS_OK(status)) {
     615         258 :                 DBG_DEBUG("open_stream_pathref_fsp failed: %s\n",
     616             :                           nt_errstr(status));
     617         258 :                 goto fail;
     618             :         }
     619             : 
     620        1518 :         smb_fname_fsp_unlink(base_fname);
     621        1776 : fail:
     622        1776 :         TALLOC_FREE(base_fname);
     623        1776 :         return status;
     624             : }
     625             : 
     626             : /*
     627             :  * Open a stream given an already opened base_fsp. Avoid
     628             :  * non_widelink_open: This is only valid for the case where we have a
     629             :  * valid non-cwd_fsp dirfsp that we can pass to SMB_VFS_OPENAT()
     630             :  */
     631        7831 : NTSTATUS open_stream_pathref_fsp(
     632             :         struct files_struct **_base_fsp,
     633             :         struct smb_filename *smb_fname)
     634             : {
     635        7831 :         struct files_struct *base_fsp = *_base_fsp;
     636        7831 :         connection_struct *conn = base_fsp->conn;
     637        7831 :         struct smb_filename *base_fname = base_fsp->fsp_name;
     638        7831 :         struct smb_filename *full_fname = NULL;
     639             :         NTSTATUS status;
     640             : 
     641        7831 :         SMB_ASSERT(smb_fname->fsp == NULL);
     642        7831 :         SMB_ASSERT(is_named_stream(smb_fname));
     643             : 
     644       15662 :         full_fname = synthetic_smb_fname(
     645             :                 conn, /* no talloc_tos(), this will be long-lived */
     646        7831 :                 base_fname->base_name,
     647        7831 :                 smb_fname->stream_name,
     648        7831 :                 &smb_fname->st,
     649             :                 smb_fname->twrp,
     650             :                 smb_fname->flags);
     651        7831 :         if (full_fname == NULL) {
     652           0 :                 return NT_STATUS_NO_MEMORY;
     653             :         }
     654             : 
     655        7831 :         status = openat_pathref_fullname(
     656             :                 conn, NULL, base_fsp, &full_fname, smb_fname);
     657        7831 :         TALLOC_FREE(full_fname);
     658        7831 :         return status;
     659             : }
     660             : 
     661      517686 : static char *path_to_strv(TALLOC_CTX *mem_ctx, const char *path)
     662             : {
     663      517686 :         char *result = talloc_strdup(mem_ctx, path);
     664             : 
     665      517686 :         if (result == NULL) {
     666           0 :                 return NULL;
     667             :         }
     668      517686 :         string_replace(result, '/', '\0');
     669      517686 :         return result;
     670             : }
     671             : 
     672       12325 : static NTSTATUS readlink_talloc(
     673             :         TALLOC_CTX *mem_ctx,
     674             :         struct files_struct *dirfsp,
     675             :         struct smb_filename *smb_relname,
     676             :         char **_substitute)
     677             : {
     678             :         char buf[4096];
     679             :         ssize_t ret;
     680             :         char *substitute;
     681             :         NTSTATUS status;
     682             : 
     683       12325 :         if (_substitute == NULL) {
     684           0 :                 return NT_STATUS_OK;
     685             :         }
     686             : 
     687       12325 :         if (smb_relname == NULL) {
     688             :                 /*
     689             :                  * We have a Linux O_PATH handle in dirfsp and want to
     690             :                  * read its value, essentially a freadlink
     691             :                  */
     692           0 :                 smb_relname = synthetic_smb_fname(
     693             :                         talloc_tos(), "", NULL, NULL, 0, 0);
     694           0 :                 if (smb_relname == NULL) {
     695           0 :                         DBG_DEBUG("synthetic_smb_fname() failed\n");
     696           0 :                         return NT_STATUS_NO_MEMORY;
     697             :                 }
     698             :         }
     699             : 
     700       12325 :         ret = SMB_VFS_READLINKAT(
     701             :                 dirfsp->conn, dirfsp, smb_relname, buf, sizeof(buf));
     702       12325 :         if (ret < 0) {
     703          24 :                 status = map_nt_error_from_unix(errno);
     704          24 :                 DBG_DEBUG("SMB_VFS_READLINKAT() failed: %s\n",
     705             :                           strerror(errno));
     706          24 :                 return status;
     707             :         }
     708             : 
     709       12301 :         if ((size_t)ret == sizeof(buf)) {
     710             :                 /*
     711             :                  * Do we need symlink targets >4k?
     712             :                  */
     713           0 :                 DBG_DEBUG("Got full %zu bytes from readlink, too long\n",
     714             :                           sizeof(buf));
     715           0 :                 return NT_STATUS_BUFFER_OVERFLOW;
     716             :         }
     717             : 
     718       12301 :         substitute = talloc_strndup(mem_ctx, buf, ret);
     719       12301 :         if (substitute == NULL) {
     720           0 :                 DBG_DEBUG("talloc_strndup() failed\n");
     721           0 :                 return NT_STATUS_NO_MEMORY;
     722             :         }
     723             : 
     724       12301 :         *_substitute = substitute;
     725       12301 :         return NT_STATUS_OK;
     726             : }
     727             : 
     728      517686 : NTSTATUS openat_pathref_dirfsp_nosymlink(
     729             :         TALLOC_CTX *mem_ctx,
     730             :         struct connection_struct *conn,
     731             :         const char *path_in,
     732             :         NTTIME twrp,
     733             :         struct smb_filename **_smb_fname,
     734             :         size_t *unparsed,
     735             :         char **substitute)
     736             : {
     737      517686 :         struct files_struct *dirfsp = conn->cwd_fsp;
     738      517686 :         struct smb_filename full_fname = {
     739             :                 .base_name = NULL,
     740             :                 .twrp = twrp,
     741             :         };
     742      517686 :         struct smb_filename rel_fname = {
     743             :                 .base_name = NULL,
     744             :                 .twrp = twrp,
     745             :         };
     746      517686 :         struct smb_filename *result = NULL;
     747      517686 :         struct files_struct *fsp = NULL;
     748      517686 :         char *path = NULL, *next = NULL;
     749      517686 :         int flags = O_NOFOLLOW|O_DIRECTORY;
     750             :         int fd;
     751             :         NTSTATUS status;
     752             : 
     753      517686 :         DBG_DEBUG("path_in=%s\n", path_in);
     754             : 
     755      517686 :         status = fsp_new(conn, conn, &fsp);
     756      517686 :         if (!NT_STATUS_IS_OK(status)) {
     757           0 :                 DBG_DEBUG("fsp_new() failed: %s\n", nt_errstr(status));
     758           0 :                 goto fail;
     759             :         }
     760      517686 :         fsp->fsp_name = &full_fname;
     761             : 
     762             : #ifdef O_PATH
     763             :         /*
     764             :          * Add O_PATH manually, doing this by setting
     765             :          * fsp->fsp_flags.is_pathref will make us become_root(), which
     766             :          * would cause a security problem.
     767             :          */
     768      362084 :         flags |= O_PATH;
     769             : #else
     770             : #ifdef O_SEARCH
     771             :         /*
     772             :          * O_SEARCH just checks for the "x" bit. We are traversing
     773             :          * directories, so we don't need the implicit O_RDONLY ("r"
     774             :          * permissions) but only the "x"-permissions requested by
     775             :          * O_SEARCH. We need either O_PATH or O_SEARCH to correctly
     776             :          * function, without either we will incorrectly require also
     777             :          * the "r" bit when traversing the directory hierarchy.
     778             :          */
     779             :         flags |= O_SEARCH;
     780             : #endif
     781             : #endif
     782             : 
     783      517686 :         full_fname.base_name = talloc_strdup(talloc_tos(), "");
     784      517686 :         if (full_fname.base_name == NULL) {
     785           0 :                 DBG_DEBUG("talloc_strdup() failed\n");
     786           0 :                 goto nomem;
     787             :         }
     788             : 
     789      517686 :         path = path_to_strv(talloc_tos(), path_in);
     790      517686 :         if (path == NULL) {
     791           0 :                 DBG_DEBUG("path_to_strv() failed\n");
     792           0 :                 goto nomem;
     793             :         }
     794      517686 :         rel_fname.base_name = path;
     795             : 
     796      792139 : next:
     797      792139 :         next = strv_next(path, rel_fname.base_name);
     798             : 
     799      792139 :         if (ISDOT(rel_fname.base_name) || ISDOTDOT(rel_fname.base_name)) {
     800         108 :                 DBG_DEBUG("%s contains a dot\n", path_in);
     801         108 :                 status = NT_STATUS_OBJECT_NAME_INVALID;
     802         108 :                 goto fail;
     803             :         }
     804             : 
     805      792031 :         fd = SMB_VFS_OPENAT(
     806             :                 conn,
     807             :                 dirfsp,
     808             :                 &rel_fname,
     809             :                 fsp,
     810             :                 flags,
     811             :                 0);
     812             : 
     813      792031 :         if ((fd == -1) && (errno == ENOENT)) {
     814        3817 :                 status = get_real_filename_at(
     815             :                         dirfsp,
     816        2068 :                         rel_fname.base_name,
     817             :                         talloc_tos(),
     818             :                         &rel_fname.base_name);
     819             : 
     820        2068 :                 if (!NT_STATUS_IS_OK(status)) {
     821         939 :                         DBG_DEBUG("get_real_filename_at failed: %s\n",
     822             :                                   nt_errstr(status));
     823         939 :                         goto fail;
     824             :                 }
     825             : 
     826        1129 :                 fd = SMB_VFS_OPENAT(
     827             :                         conn,
     828             :                         dirfsp,
     829             :                         &rel_fname,
     830             :                         fsp,
     831             :                         flags,
     832             :                         0);
     833             :         }
     834             : 
     835      791092 :         if ((fd == -1) && (errno == ENOTDIR)) {
     836       12325 :                 status = readlink_talloc(
     837             :                         mem_ctx, dirfsp, &rel_fname, substitute);
     838             : 
     839       12325 :                 if (NT_STATUS_IS_OK(status)) {
     840             :                         /*
     841             :                          * readlink_talloc() found a symlink
     842             :                          */
     843       12301 :                         status = NT_STATUS_STOPPED_ON_SYMLINK;
     844             : 
     845       12301 :                         if (unparsed != NULL) {
     846       12301 :                                 if (next == NULL) {
     847         797 :                                         *unparsed = 0;
     848             :                                 } else {
     849       11504 :                                         size_t parsed = next - path;
     850       11504 :                                         size_t len = talloc_get_size(path);
     851       11504 :                                         *unparsed = len - parsed;
     852             :                                 }
     853             :                         }
     854             :                 } else {
     855             : 
     856          24 :                         DBG_DEBUG("readlink_talloc failed: %s\n",
     857             :                                   nt_errstr(status));
     858             :                         /*
     859             :                          * Restore the error status from SMB_VFS_OPENAT()
     860             :                          */
     861          24 :                         status = NT_STATUS_NOT_A_DIRECTORY;
     862             :                 }
     863       12325 :                 goto fail;
     864             :         }
     865             : 
     866      778767 :         if (fd == -1) {
     867           8 :                 status = map_nt_error_from_unix(errno);
     868           8 :                 DBG_DEBUG("SMB_VFS_OPENAT() failed: %s\n",
     869             :                           strerror(errno));
     870           8 :                 goto fail;
     871             :         }
     872      778759 :         fsp_set_fd(fsp, fd);
     873             : 
     874      778759 :         fsp->fsp_flags.is_directory = true; /* See O_DIRECTORY above */
     875             : 
     876     1416742 :         full_fname.base_name = talloc_asprintf_append_buffer(
     877             :                         full_fname.base_name,
     878             :                         "%s%s",
     879      778759 :                         full_fname.base_name[0] == '\0' ? "" : "/",
     880             :                         rel_fname.base_name);
     881             : 
     882      778759 :         if (full_fname.base_name == NULL) {
     883           0 :                 DBG_DEBUG("talloc_asprintf_append_buffer() failed\n");
     884           0 :                 goto nomem;
     885             :         }
     886             : 
     887      778759 :         if (next != NULL) {
     888      274453 :                 struct files_struct *tmp = NULL;
     889             : 
     890      274453 :                 if (dirfsp != conn->cwd_fsp) {
     891       35958 :                         fd_close(dirfsp);
     892             :                 }
     893             : 
     894      274453 :                 tmp = dirfsp;
     895      274453 :                 dirfsp = fsp;
     896             : 
     897      274453 :                 if (tmp == conn->cwd_fsp) {
     898      238495 :                         status = fsp_new(conn, conn, &fsp);
     899      238495 :                         if (!NT_STATUS_IS_OK(status)) {
     900           0 :                                 DBG_DEBUG("fsp_new() failed: %s\n",
     901             :                                           nt_errstr(status));
     902           0 :                                 goto fail;
     903             :                         }
     904      238495 :                         fsp->fsp_flags.is_pathref = true;
     905      238495 :                         fsp->fsp_name = &full_fname;
     906             :                 } else {
     907       35958 :                         fsp = tmp;
     908             :                 }
     909             : 
     910      274453 :                 rel_fname.base_name = next;
     911             : 
     912      274453 :                 goto next;
     913             :         }
     914             : 
     915      504306 :         if (dirfsp != conn->cwd_fsp) {
     916      226163 :                 dirfsp->fsp_name = NULL;
     917      226163 :                 SMB_ASSERT(fsp_get_pathref_fd(dirfsp) != -1);
     918      226163 :                 fd_close(dirfsp);
     919      226163 :                 file_free(NULL, dirfsp);
     920      226163 :                 dirfsp = NULL;
     921             :         }
     922             : 
     923      504306 :         fsp->fsp_flags.is_pathref = true;
     924      504306 :         fsp->fsp_name = NULL;
     925             : 
     926      504306 :         status = fsp_set_smb_fname(fsp, &full_fname);
     927      504306 :         if (!NT_STATUS_IS_OK(status)) {
     928           0 :                 DBG_DEBUG("fsp_set_smb_fname() failed: %s\n",
     929             :                           nt_errstr(status));
     930           0 :                 goto fail;
     931             :         }
     932             : 
     933      504306 :         status = vfs_stat_fsp(fsp);
     934      504306 :         if (!NT_STATUS_IS_OK(status)) {
     935           0 :                 DBG_DEBUG("vfs_stat_fsp(%s) failed: %s\n",
     936             :                           fsp_str_dbg(fsp),
     937             :                           nt_errstr(status));
     938           0 :                 goto fail;
     939             :         }
     940             :         /*
     941             :          * We must correctly set fsp->file_id as code inside
     942             :          * open.c will use this to check if delete_on_close
     943             :          * has been set on the dirfsp.
     944             :          */
     945      504306 :         fsp->file_id = vfs_file_id_from_sbuf(conn, &fsp->fsp_name->st);
     946             : 
     947      504306 :         result = cp_smb_filename(mem_ctx, fsp->fsp_name);
     948      504306 :         if (result == NULL) {
     949           0 :                 DBG_DEBUG("cp_smb_filename() failed\n");
     950           0 :                 goto nomem;
     951             :         }
     952             : 
     953      504306 :         status = fsp_smb_fname_link(fsp,
     954             :                                         &result->fsp_link,
     955             :                                         &result->fsp);
     956      504306 :         if (!NT_STATUS_IS_OK(status)) {
     957           0 :                 goto fail;
     958             :         }
     959      504306 :         talloc_set_destructor(result, smb_fname_fsp_destructor);
     960             : 
     961      504306 :         *_smb_fname = result;
     962             : 
     963      504306 :         DBG_DEBUG("returning %s\n", smb_fname_str_dbg(result));
     964             : 
     965      504306 :         return NT_STATUS_OK;
     966             : 
     967           0 : nomem:
     968           0 :         status = NT_STATUS_NO_MEMORY;
     969       13380 : fail:
     970       13380 :         if (fsp != NULL) {
     971       13380 :                 if (fsp_get_pathref_fd(fsp) != -1) {
     972           0 :                         fd_close(fsp);
     973             :                 }
     974       13380 :                 file_free(NULL, fsp);
     975       13380 :                 fsp = NULL;
     976             :         }
     977             : 
     978       13380 :         if ((dirfsp != NULL) && (dirfsp != conn->cwd_fsp)) {
     979       12332 :                 dirfsp->fsp_name = NULL;
     980       12332 :                 SMB_ASSERT(fsp_get_pathref_fd(dirfsp) != -1);
     981       12332 :                 fd_close(dirfsp);
     982       12332 :                 file_free(NULL, dirfsp);
     983       12332 :                 dirfsp = NULL;
     984             :         }
     985             : 
     986       13380 :         TALLOC_FREE(path);
     987       13380 :         return status;
     988             : }
     989             : 
     990     2349688 : void smb_fname_fsp_unlink(struct smb_filename *smb_fname)
     991             : {
     992     2349688 :         talloc_set_destructor(smb_fname, NULL);
     993     2349688 :         smb_fname->fsp = NULL;
     994     2349688 :         destroy_fsp_smb_fname_link(&smb_fname->fsp_link);
     995     2349688 : }
     996             : 
     997             : /*
     998             :  * Move any existing embedded fsp refs from the src name to the
     999             :  * destination. It's safe to call this on src smb_fname's that have no embedded
    1000             :  * pathref fsp.
    1001             :  */
    1002      852367 : NTSTATUS move_smb_fname_fsp_link(struct smb_filename *smb_fname_dst,
    1003             :                                  struct smb_filename *smb_fname_src)
    1004             : {
    1005             :         NTSTATUS status;
    1006             : 
    1007             :         /*
    1008             :          * The target should always not be linked yet!
    1009             :          */
    1010      852367 :         SMB_ASSERT(smb_fname_dst->fsp == NULL);
    1011      852367 :         SMB_ASSERT(smb_fname_dst->fsp_link == NULL);
    1012             : 
    1013      852367 :         if (smb_fname_src->fsp == NULL) {
    1014        1027 :                 return NT_STATUS_OK;
    1015             :         }
    1016             : 
    1017      851340 :         status = fsp_smb_fname_link(smb_fname_src->fsp,
    1018             :                                     &smb_fname_dst->fsp_link,
    1019             :                                     &smb_fname_dst->fsp);
    1020      851340 :         if (!NT_STATUS_IS_OK(status)) {
    1021           0 :                 return status;
    1022             :         }
    1023             : 
    1024      851340 :         talloc_set_destructor(smb_fname_dst, smb_fname_fsp_destructor);
    1025             : 
    1026      851340 :         smb_fname_fsp_unlink(smb_fname_src);
    1027             : 
    1028      851340 :         return NT_STATUS_OK;
    1029             : }
    1030             : 
    1031             : /**
    1032             :  * Create an smb_fname and open smb_fname->fsp pathref
    1033             :  **/
    1034      330267 : NTSTATUS synthetic_pathref(TALLOC_CTX *mem_ctx,
    1035             :                            struct files_struct *dirfsp,
    1036             :                            const char *base_name,
    1037             :                            const char *stream_name,
    1038             :                            const SMB_STRUCT_STAT *psbuf,
    1039             :                            NTTIME twrp,
    1040             :                            uint32_t flags,
    1041             :                            struct smb_filename **_smb_fname)
    1042             : {
    1043      330267 :         struct smb_filename *smb_fname = NULL;
    1044             :         NTSTATUS status;
    1045             : 
    1046      330267 :         smb_fname = synthetic_smb_fname(mem_ctx,
    1047             :                                         base_name,
    1048             :                                         stream_name,
    1049             :                                         psbuf,
    1050             :                                         twrp,
    1051             :                                         flags);
    1052      330267 :         if (smb_fname == NULL) {
    1053           0 :                 return NT_STATUS_NO_MEMORY;
    1054             :         }
    1055             : 
    1056      330267 :         status = openat_pathref_fsp(dirfsp, smb_fname);
    1057      330267 :         if (!NT_STATUS_IS_OK(status)) {
    1058      209428 :                 DBG_ERR("opening [%s] failed\n",
    1059             :                         smb_fname_str_dbg(smb_fname));
    1060      209428 :                 TALLOC_FREE(smb_fname);
    1061      209428 :                 return status;
    1062             :         }
    1063             : 
    1064      120839 :         *_smb_fname = smb_fname;
    1065      120839 :         return NT_STATUS_OK;
    1066             : }
    1067             : 
    1068      175052 : static int atname_destructor(struct smb_filename *smb_fname)
    1069             : {
    1070      175052 :         destroy_fsp_smb_fname_link(&smb_fname->fsp_link);
    1071      175052 :         return 0;
    1072             : }
    1073             : 
    1074             : /**
    1075             :  * Turn a path into a parent pathref and atname
    1076             :  *
    1077             :  * This returns the parent pathref in _parent and the name relative to it. If
    1078             :  * smb_fname was a pathref (ie smb_fname->fsp != NULL), then _atname will be a
    1079             :  * pathref as well, ie _atname->fsp will point at the same fsp as
    1080             :  * smb_fname->fsp.
    1081             :  **/
    1082      309062 : NTSTATUS parent_pathref(TALLOC_CTX *mem_ctx,
    1083             :                         struct files_struct *dirfsp,
    1084             :                         const struct smb_filename *smb_fname,
    1085             :                         struct smb_filename **_parent,
    1086             :                         struct smb_filename **_atname)
    1087             : {
    1088      309062 :         struct smb_filename *parent = NULL;
    1089      309062 :         struct smb_filename *atname = NULL;
    1090             :         NTSTATUS status;
    1091             : 
    1092      309062 :         status = SMB_VFS_PARENT_PATHNAME(dirfsp->conn,
    1093             :                                          mem_ctx,
    1094             :                                          smb_fname,
    1095             :                                          &parent,
    1096             :                                          &atname);
    1097      309062 :         if (!NT_STATUS_IS_OK(status)) {
    1098           0 :                 return status;
    1099             :         }
    1100             : 
    1101             :         /*
    1102             :          * We know that the parent name must
    1103             :          * exist, and the name has been canonicalized
    1104             :          * even if this was a POSIX pathname.
    1105             :          * Ensure that we follow symlinks for
    1106             :          * the parent. See the torture test
    1107             :          * POSIX-SYMLINK-PARENT for details.
    1108             :          */
    1109      309062 :         parent->flags &= ~SMB_FILENAME_POSIX_PATH;
    1110             : 
    1111      309062 :         status = openat_pathref_fsp(dirfsp, parent);
    1112      309062 :         if (!NT_STATUS_IS_OK(status)) {
    1113       83754 :                 TALLOC_FREE(parent);
    1114       83754 :                 return status;
    1115             :         }
    1116             : 
    1117      225308 :         if (smb_fname->fsp != NULL) {
    1118      322628 :                 status = fsp_smb_fname_link(smb_fname->fsp,
    1119      175052 :                                             &atname->fsp_link,
    1120      175052 :                                             &atname->fsp);
    1121      175052 :                 if (!NT_STATUS_IS_OK(status)) {
    1122           0 :                         TALLOC_FREE(parent);
    1123           0 :                         return status;
    1124             :                 }
    1125      175052 :                 talloc_set_destructor(atname, atname_destructor);
    1126             :         }
    1127      225308 :         *_parent = parent;
    1128      225308 :         *_atname = atname;
    1129      225308 :         return NT_STATUS_OK;
    1130             : }
    1131             : 
    1132        5771 : static bool close_file_in_loop(struct files_struct *fsp)
    1133             : {
    1134        5771 :         if (fsp_is_alternate_stream(fsp)) {
    1135             :                 /*
    1136             :                  * This is a stream, it can't be a base
    1137             :                  */
    1138          72 :                 SMB_ASSERT(fsp->stream_fsp == NULL);
    1139          72 :                 SMB_ASSERT(fsp->base_fsp->stream_fsp == fsp);
    1140             : 
    1141             :                 /*
    1142             :                  * Remove the base<->stream link so that
    1143             :                  * close_file_free() does not close fsp->base_fsp as
    1144             :                  * well. This would destroy walking the linked list of
    1145             :                  * fsps.
    1146             :                  */
    1147          72 :                 fsp->base_fsp->stream_fsp = NULL;
    1148          72 :                 fsp->base_fsp = NULL;
    1149             : 
    1150          72 :                 close_file_free(NULL, &fsp, SHUTDOWN_CLOSE);
    1151          72 :                 return NULL;
    1152             :         }
    1153             : 
    1154        5699 :         if (fsp->stream_fsp != NULL) {
    1155             :                 /*
    1156             :                  * This is the base of a stream.
    1157             :                  */
    1158           0 :                 SMB_ASSERT(fsp->stream_fsp->base_fsp == fsp);
    1159             : 
    1160             :                 /*
    1161             :                  * Remove the base<->stream link. This will make fsp
    1162             :                  * look like a normal fsp for the next round.
    1163             :                  */
    1164           0 :                 fsp->stream_fsp->base_fsp = NULL;
    1165           0 :                 fsp->stream_fsp = NULL;
    1166             : 
    1167             :                 /*
    1168             :                  * Have us called back a second time. In the second
    1169             :                  * round, "fsp" now looks like a normal fsp.
    1170             :                  */
    1171           0 :                 return false;
    1172             :         }
    1173             : 
    1174        5699 :         close_file_free(NULL, &fsp, SHUTDOWN_CLOSE);
    1175        5699 :         return true;
    1176             : }
    1177             : 
    1178             : /****************************************************************************
    1179             :  Close all open files for a connection.
    1180             : ****************************************************************************/
    1181             : 
    1182             : struct file_close_conn_state {
    1183             :         struct connection_struct *conn;
    1184             :         bool fsp_left_behind;
    1185             : };
    1186             : 
    1187        5299 : static struct files_struct *file_close_conn_fn(
    1188             :         struct files_struct *fsp,
    1189             :         void *private_data)
    1190             : {
    1191        5299 :         struct file_close_conn_state *state = private_data;
    1192             :         bool did_close;
    1193             : 
    1194        5299 :         if (fsp->conn != state->conn) {
    1195        1114 :                 return NULL;
    1196             :         }
    1197             : 
    1198        4185 :         if (fsp->op != NULL && fsp->op->global->durable) {
    1199             :                 /*
    1200             :                  * A tree disconnect closes a durable handle
    1201             :                  */
    1202           4 :                 fsp->op->global->durable = false;
    1203             :         }
    1204             : 
    1205        4185 :         did_close = close_file_in_loop(fsp);
    1206        4185 :         if (!did_close) {
    1207           0 :                 state->fsp_left_behind = true;
    1208             :         }
    1209             : 
    1210        4185 :         return NULL;
    1211             : }
    1212             : 
    1213       53322 : void file_close_conn(connection_struct *conn)
    1214             : {
    1215       53322 :         struct file_close_conn_state state = { .conn = conn };
    1216             : 
    1217       53322 :         files_forall(conn->sconn, file_close_conn_fn, &state);
    1218             : 
    1219       53322 :         if (state.fsp_left_behind) {
    1220           0 :                 state.fsp_left_behind = false;
    1221           0 :                 files_forall(conn->sconn, file_close_conn_fn, &state);
    1222           0 :                 SMB_ASSERT(!state.fsp_left_behind);
    1223             :         }
    1224       53322 : }
    1225             : 
    1226             : /****************************************************************************
    1227             :  Initialise file structures.
    1228             : ****************************************************************************/
    1229             : 
    1230             : static int files_max_open_fds;
    1231             : 
    1232       31540 : bool file_init_global(void)
    1233             : {
    1234       31540 :         int request_max = lp_max_open_files();
    1235             :         int real_lim;
    1236             :         int real_max;
    1237             : 
    1238       31540 :         if (files_max_open_fds != 0) {
    1239       31463 :                 return true;
    1240             :         }
    1241             : 
    1242             :         /*
    1243             :          * Set the max_open files to be the requested
    1244             :          * max plus a fudgefactor to allow for the extra
    1245             :          * fd's we need such as log files etc...
    1246             :          */
    1247          77 :         real_lim = set_maxfiles(request_max + MAX_OPEN_FUDGEFACTOR);
    1248             : 
    1249          77 :         real_max = real_lim - MAX_OPEN_FUDGEFACTOR;
    1250             : 
    1251          77 :         if (real_max + FILE_HANDLE_OFFSET + MAX_OPEN_PIPES > 65536) {
    1252           0 :                 real_max = 65536 - FILE_HANDLE_OFFSET - MAX_OPEN_PIPES;
    1253             :         }
    1254             : 
    1255          77 :         if (real_max != request_max) {
    1256           0 :                 DEBUG(1, ("file_init_global: Information only: requested %d "
    1257             :                           "open files, %d are available.\n",
    1258             :                           request_max, real_max));
    1259             :         }
    1260             : 
    1261          77 :         SMB_ASSERT(real_max > 100);
    1262             : 
    1263          77 :         files_max_open_fds = real_max;
    1264          77 :         return true;
    1265             : }
    1266             : 
    1267       31481 : bool file_init(struct smbd_server_connection *sconn)
    1268             : {
    1269             :         bool ok;
    1270             : 
    1271       31481 :         ok = file_init_global();
    1272       31481 :         if (!ok) {
    1273           0 :                 return false;
    1274             :         }
    1275             : 
    1276       31481 :         sconn->real_max_open_files = files_max_open_fds;
    1277             : 
    1278       31481 :         return true;
    1279             : }
    1280             : 
    1281             : /****************************************************************************
    1282             :  Close files open by a specified vuid.
    1283             : ****************************************************************************/
    1284             : 
    1285             : struct file_close_user_state {
    1286             :         uint64_t vuid;
    1287             :         bool fsp_left_behind;
    1288             : };
    1289             : 
    1290        5002 : static struct files_struct *file_close_user_fn(
    1291             :         struct files_struct *fsp,
    1292             :         void *private_data)
    1293             : {
    1294        5002 :         struct file_close_user_state *state = private_data;
    1295             :         bool did_close;
    1296             : 
    1297        5002 :         if (fsp->vuid != state->vuid) {
    1298        3416 :                 return NULL;
    1299             :         }
    1300             : 
    1301        1586 :         did_close = close_file_in_loop(fsp);
    1302        1586 :         if (!did_close) {
    1303          72 :                 state->fsp_left_behind = true;
    1304             :         }
    1305             : 
    1306        1586 :         return NULL;
    1307             : }
    1308             : 
    1309       31322 : void file_close_user(struct smbd_server_connection *sconn, uint64_t vuid)
    1310             : {
    1311       31322 :         struct file_close_user_state state = { .vuid = vuid };
    1312             : 
    1313       31322 :         files_forall(sconn, file_close_user_fn, &state);
    1314             : 
    1315       31322 :         if (state.fsp_left_behind) {
    1316          36 :                 state.fsp_left_behind = false;
    1317          36 :                 files_forall(sconn, file_close_user_fn, &state);
    1318          36 :                 SMB_ASSERT(!state.fsp_left_behind);
    1319             :         }
    1320       31322 : }
    1321             : 
    1322             : /*
    1323             :  * Walk the files table until "fn" returns non-NULL
    1324             :  */
    1325             : 
    1326      241862 : struct files_struct *files_forall(
    1327             :         struct smbd_server_connection *sconn,
    1328             :         struct files_struct *(*fn)(struct files_struct *fsp,
    1329             :                                    void *private_data),
    1330             :         void *private_data)
    1331             : {
    1332             :         struct files_struct *fsp, *next;
    1333             : 
    1334      487171 :         for (fsp = sconn->files; fsp; fsp = next) {
    1335             :                 struct files_struct *ret;
    1336      247261 :                 next = fsp->next;
    1337      247261 :                 ret = fn(fsp, private_data);
    1338      247261 :                 if (ret != NULL) {
    1339        1952 :                         return ret;
    1340             :                 }
    1341             :         }
    1342      239910 :         return NULL;
    1343             : }
    1344             : 
    1345             : /****************************************************************************
    1346             :  Find a fsp given a file descriptor.
    1347             : ****************************************************************************/
    1348             : 
    1349           0 : files_struct *file_find_fd(struct smbd_server_connection *sconn, int fd)
    1350             : {
    1351           0 :         int count=0;
    1352             :         files_struct *fsp;
    1353             : 
    1354           0 :         for (fsp=sconn->files; fsp; fsp=fsp->next,count++) {
    1355           0 :                 if (fsp_get_pathref_fd(fsp) == fd) {
    1356           0 :                         if (count > 10) {
    1357           0 :                                 DLIST_PROMOTE(sconn->files, fsp);
    1358             :                         }
    1359           0 :                         return fsp;
    1360             :                 }
    1361             :         }
    1362             : 
    1363           0 :         return NULL;
    1364             : }
    1365             : 
    1366             : /****************************************************************************
    1367             :  Find a fsp given a device, inode and file_id.
    1368             : ****************************************************************************/
    1369             : 
    1370       14666 : files_struct *file_find_dif(struct smbd_server_connection *sconn,
    1371             :                             struct file_id id, unsigned long gen_id)
    1372             : {
    1373       14666 :         int count=0;
    1374             :         files_struct *fsp;
    1375             : 
    1376       14666 :         if (gen_id == 0) {
    1377           0 :                 return NULL;
    1378             :         }
    1379             : 
    1380      212066 :         for (fsp = sconn->files; fsp; fsp = fsp->next,count++) {
    1381             :                 /*
    1382             :                  * We can have a fsp->fh->fd == -1 here as it could be a stat
    1383             :                  * open.
    1384             :                  */
    1385      212066 :                 if (!file_id_equal(&fsp->file_id, &id)) {
    1386       18312 :                         continue;
    1387             :                 }
    1388      193754 :                 if (!fsp->fsp_flags.is_fsa) {
    1389       22564 :                         continue;
    1390             :                 }
    1391      171190 :                 if (fh_get_gen_id(fsp->fh) != gen_id) {
    1392      156524 :                         continue;
    1393             :                 }
    1394       14666 :                 if (count > 10) {
    1395        4822 :                         DLIST_PROMOTE(sconn->files, fsp);
    1396             :                 }
    1397             :                 /* Paranoia check. */
    1398       14666 :                 if ((fsp_get_pathref_fd(fsp) == -1) &&
    1399           0 :                     (fsp->oplock_type != NO_OPLOCK &&
    1400           0 :                      fsp->oplock_type != LEASE_OPLOCK))
    1401             :                 {
    1402             :                         struct file_id_buf idbuf;
    1403             : 
    1404           0 :                         DBG_ERR("file %s file_id = "
    1405             :                                 "%s, gen = %u oplock_type = %u is a "
    1406             :                                 "stat open with oplock type !\n",
    1407             :                                 fsp_str_dbg(fsp),
    1408             :                                 file_id_str_buf(fsp->file_id, &idbuf),
    1409             :                                 (unsigned int)fh_get_gen_id(fsp->fh),
    1410             :                                 (unsigned int)fsp->oplock_type);
    1411           0 :                         smb_panic("file_find_dif");
    1412             :                 }
    1413       14666 :                 return fsp;
    1414             :         }
    1415             : 
    1416           0 :         return NULL;
    1417             : }
    1418             : 
    1419             : /****************************************************************************
    1420             :  Find the first fsp given a device and inode.
    1421             :  We use a singleton cache here to speed up searching from getfilepathinfo
    1422             :  calls.
    1423             : ****************************************************************************/
    1424             : 
    1425       10751 : files_struct *file_find_di_first(struct smbd_server_connection *sconn,
    1426             :                                  struct file_id id,
    1427             :                                  bool need_fsa)
    1428             : {
    1429             :         files_struct *fsp;
    1430             : 
    1431       10751 :         if (file_id_equal(&sconn->fsp_fi_cache.id, &id)) {
    1432             :                 /* Positive or negative cache hit. */
    1433           0 :                 return sconn->fsp_fi_cache.fsp;
    1434             :         }
    1435             : 
    1436       10751 :         sconn->fsp_fi_cache.id = id;
    1437             : 
    1438       34457 :         for (fsp=sconn->files;fsp;fsp=fsp->next) {
    1439       26467 :                 if (need_fsa && !fsp->fsp_flags.is_fsa) {
    1440       18609 :                         continue;
    1441             :                 }
    1442        7858 :                 if (file_id_equal(&fsp->file_id, &id)) {
    1443             :                         /* Setup positive cache. */
    1444        2761 :                         sconn->fsp_fi_cache.fsp = fsp;
    1445        2761 :                         return fsp;
    1446             :                 }
    1447             :         }
    1448             : 
    1449             :         /* Setup negative cache. */
    1450        7990 :         sconn->fsp_fi_cache.fsp = NULL;
    1451        7990 :         return NULL;
    1452             : }
    1453             : 
    1454             : /****************************************************************************
    1455             :  Find the next fsp having the same device and inode.
    1456             : ****************************************************************************/
    1457             : 
    1458        1270 : files_struct *file_find_di_next(files_struct *start_fsp,
    1459             :                                 bool need_fsa)
    1460             : {
    1461             :         files_struct *fsp;
    1462             : 
    1463        1783 :         for (fsp = start_fsp->next;fsp;fsp=fsp->next) {
    1464         668 :                 if (need_fsa && !fsp->fsp_flags.is_fsa) {
    1465           0 :                         continue;
    1466             :                 }
    1467         668 :                 if (file_id_equal(&fsp->file_id, &start_fsp->file_id)) {
    1468         155 :                         return fsp;
    1469             :                 }
    1470             :         }
    1471             : 
    1472        1115 :         return NULL;
    1473             : }
    1474             : 
    1475           4 : struct files_struct *file_find_one_fsp_from_lease_key(
    1476             :         struct smbd_server_connection *sconn,
    1477             :         const struct smb2_lease_key *lease_key)
    1478             : {
    1479             :         struct files_struct *fsp;
    1480             : 
    1481           6 :         for (fsp = sconn->files; fsp; fsp=fsp->next) {
    1482          10 :                 if ((fsp->lease != NULL) &&
    1483           4 :                     (fsp->lease->lease.lease_key.data[0] ==
    1484           8 :                      lease_key->data[0]) &&
    1485           4 :                     (fsp->lease->lease.lease_key.data[1] ==
    1486           4 :                      lease_key->data[1])) {
    1487           4 :                         return fsp;
    1488             :                 }
    1489             :         }
    1490           0 :         return NULL;
    1491             : }
    1492             : 
    1493             : /****************************************************************************
    1494             :  Find any fsp open with a pathname below that of an already open path.
    1495             : ****************************************************************************/
    1496             : 
    1497          12 : bool file_find_subpath(files_struct *dir_fsp)
    1498             : {
    1499             :         files_struct *fsp;
    1500             :         size_t dlen;
    1501          12 :         char *d_fullname = NULL;
    1502             : 
    1503          18 :         d_fullname = talloc_asprintf(talloc_tos(), "%s/%s",
    1504          12 :                                      dir_fsp->conn->connectpath,
    1505          12 :                                      dir_fsp->fsp_name->base_name);
    1506             : 
    1507          12 :         if (!d_fullname) {
    1508           0 :                 return false;
    1509             :         }
    1510             : 
    1511          12 :         dlen = strlen(d_fullname);
    1512             : 
    1513          58 :         for (fsp=dir_fsp->conn->sconn->files; fsp; fsp=fsp->next) {
    1514             :                 char *d1_fullname;
    1515             : 
    1516          48 :                 if (fsp == dir_fsp) {
    1517          12 :                         continue;
    1518             :                 }
    1519             : 
    1520          54 :                 d1_fullname = talloc_asprintf(talloc_tos(),
    1521             :                                         "%s/%s",
    1522          36 :                                         fsp->conn->connectpath,
    1523          36 :                                         fsp->fsp_name->base_name);
    1524             : 
    1525             :                 /*
    1526             :                  * If the open file has a path that is a longer
    1527             :                  * component, then it's a subpath.
    1528             :                  */
    1529          42 :                 if (strnequal(d_fullname, d1_fullname, dlen) &&
    1530          12 :                                 (d1_fullname[dlen] == '/')) {
    1531           2 :                         TALLOC_FREE(d1_fullname);
    1532           2 :                         TALLOC_FREE(d_fullname);
    1533           2 :                         return true;
    1534             :                 }
    1535          34 :                 TALLOC_FREE(d1_fullname);
    1536             :         }
    1537             : 
    1538          10 :         TALLOC_FREE(d_fullname);
    1539          10 :         return false;
    1540             : }
    1541             : 
    1542             : /****************************************************************************
    1543             :  Free up a fsp.
    1544             : ****************************************************************************/
    1545             : 
    1546     6685845 : static void fsp_free(files_struct *fsp)
    1547             : {
    1548     6685845 :         struct smbd_server_connection *sconn = fsp->conn->sconn;
    1549             : 
    1550     6685845 :         if (fsp == sconn->fsp_fi_cache.fsp) {
    1551         474 :                 ZERO_STRUCT(sconn->fsp_fi_cache);
    1552             :         }
    1553             : 
    1554     6685845 :         DLIST_REMOVE(sconn->files, fsp);
    1555     6685845 :         SMB_ASSERT(sconn->num_files > 0);
    1556     6685845 :         sconn->num_files--;
    1557             : 
    1558     6685845 :         TALLOC_FREE(fsp->fake_file_handle);
    1559             : 
    1560     6685845 :         if (fh_get_refcount(fsp->fh) == 1) {
    1561     6685733 :                 TALLOC_FREE(fsp->fh);
    1562             :         } else {
    1563         112 :                 size_t new_refcount = fh_get_refcount(fsp->fh) - 1;
    1564         112 :                 fh_set_refcount(fsp->fh, new_refcount);
    1565             :         }
    1566             : 
    1567     6685845 :         if (fsp->lease != NULL) {
    1568        1016 :                 if (fsp->lease->ref_count == 1) {
    1569         804 :                         TALLOC_FREE(fsp->lease);
    1570             :                 } else {
    1571         212 :                         fsp->lease->ref_count--;
    1572             :                 }
    1573             :         }
    1574             : 
    1575     6685845 :         fsp->conn->num_files_open--;
    1576             : 
    1577    12087109 :         if (fsp->fsp_name != NULL &&
    1578     6447340 :             fsp->fsp_name->fsp_link != NULL)
    1579             :         {
    1580             :                 /*
    1581             :                  * Free fsp_link of fsp->fsp_name. To do this in the correct
    1582             :                  * talloc destructor order we have to do it here. The
    1583             :                  * talloc_free() of the link should set the fsp pointer to NULL.
    1584             :                  */
    1585     6433932 :                 TALLOC_FREE(fsp->fsp_name->fsp_link);
    1586     6433932 :                 SMB_ASSERT(fsp->fsp_name->fsp == NULL);
    1587             :         }
    1588             : 
    1589             :         /* this is paranoia, just in case someone tries to reuse the
    1590             :            information */
    1591     6685845 :         ZERO_STRUCTP(fsp);
    1592             : 
    1593             :         /* fsp->fsp_name is a talloc child and is free'd automatically. */
    1594     6685845 :         TALLOC_FREE(fsp);
    1595     6685845 : }
    1596             : 
    1597             : /*
    1598             :  * Rundown of all smb-related sub-structures of an fsp
    1599             :  */
    1600     7268166 : void fsp_unbind_smb(struct smb_request *req, files_struct *fsp)
    1601             : {
    1602     7268166 :         if (fsp == fsp->conn->cwd_fsp) {
    1603           0 :                 return;
    1604             :         }
    1605             : 
    1606     7268166 :         if (fsp->notify) {
    1607        1851 :                 size_t len = fsp_fullbasepath(fsp, NULL, 0);
    1608        1851 :                 char fullpath[len+1];
    1609             : 
    1610        1851 :                 fsp_fullbasepath(fsp, fullpath, sizeof(fullpath));
    1611             : 
    1612             :                 /*
    1613             :                  * Avoid /. at the end of the path name. notify can't
    1614             :                  * deal with it.
    1615             :                  */
    1616        1903 :                 if (len > 1 && fullpath[len-1] == '.' &&
    1617          80 :                     fullpath[len-2] == '/') {
    1618          80 :                         fullpath[len-2] = '\0';
    1619             :                 }
    1620             : 
    1621        1851 :                 notify_remove(fsp->conn->sconn->notify_ctx, fsp, fullpath);
    1622        1851 :                 TALLOC_FREE(fsp->notify);
    1623             :         }
    1624             : 
    1625             :         /* Ensure this event will never fire. */
    1626     7268166 :         TALLOC_FREE(fsp->update_write_time_event);
    1627             : 
    1628     7268166 :         if (fsp->op != NULL) {
    1629      570602 :                 fsp->op->compat = NULL;
    1630             :         }
    1631     7268166 :         TALLOC_FREE(fsp->op);
    1632             : 
    1633     7268166 :         if ((req != NULL) && (fsp == req->chain_fsp)) {
    1634      560117 :                 req->chain_fsp = NULL;
    1635             :         }
    1636             : 
    1637             :         /*
    1638             :          * Clear all possible chained fsp
    1639             :          * pointers in the SMB2 request queue.
    1640             :          */
    1641     7268166 :         remove_smb2_chained_fsp(fsp);
    1642             : }
    1643             : 
    1644     6685845 : void file_free(struct smb_request *req, files_struct *fsp)
    1645             : {
    1646     6685845 :         struct smbd_server_connection *sconn = fsp->conn->sconn;
    1647     6685845 :         uint64_t fnum = fsp->fnum;
    1648             : 
    1649     6685845 :         fsp_unbind_smb(req, fsp);
    1650             : 
    1651             :         /* Drop all remaining extensions. */
    1652     6685845 :         vfs_remove_all_fsp_extensions(fsp);
    1653             : 
    1654     6685845 :         fsp_free(fsp);
    1655             : 
    1656     6685845 :         DBG_INFO("freed files structure %"PRIu64" (%zu used)\n",
    1657             :                  fnum,
    1658             :                  sconn->num_files);
    1659     6685845 : }
    1660             : 
    1661             : /****************************************************************************
    1662             :  Get an fsp from a packet given a 16 bit fnum.
    1663             : ****************************************************************************/
    1664             : 
    1665      210218 : files_struct *file_fsp(struct smb_request *req, uint16_t fid)
    1666             : {
    1667             :         struct smbXsrv_open *op;
    1668             :         NTSTATUS status;
    1669      210218 :         NTTIME now = 0;
    1670             :         files_struct *fsp;
    1671             : 
    1672      210218 :         if (req == NULL) {
    1673             :                 /*
    1674             :                  * We should never get here. req==NULL could in theory
    1675             :                  * only happen from internal opens with a non-zero
    1676             :                  * root_dir_fid. Internal opens just don't do that, at
    1677             :                  * least they are not supposed to do so. And if they
    1678             :                  * start to do so, they better fake up a smb_request
    1679             :                  * from which we get the right smbd_server_conn. While
    1680             :                  * this should never happen, let's return NULL here.
    1681             :                  */
    1682           0 :                 return NULL;
    1683             :         }
    1684             : 
    1685      210218 :         if (req->chain_fsp != NULL) {
    1686          88 :                 if (req->chain_fsp->fsp_flags.closing) {
    1687           0 :                         return NULL;
    1688             :                 }
    1689          88 :                 return req->chain_fsp;
    1690             :         }
    1691             : 
    1692      210130 :         if (req->xconn == NULL) {
    1693           0 :                 return NULL;
    1694             :         }
    1695             : 
    1696      210130 :         now = timeval_to_nttime(&req->request_time);
    1697             : 
    1698      210130 :         status = smb1srv_open_lookup(req->xconn,
    1699             :                                      fid, now, &op);
    1700      210130 :         if (!NT_STATUS_IS_OK(status)) {
    1701        2686 :                 return NULL;
    1702             :         }
    1703             : 
    1704      207444 :         fsp = op->compat;
    1705      207444 :         if (fsp == NULL) {
    1706           0 :                 return NULL;
    1707             :         }
    1708             : 
    1709      207444 :         if (fsp->fsp_flags.closing) {
    1710           0 :                 return NULL;
    1711             :         }
    1712             : 
    1713      207444 :         req->chain_fsp = fsp;
    1714      207444 :         return fsp;
    1715             : }
    1716             : 
    1717      816203 : struct files_struct *file_fsp_get(struct smbd_smb2_request *smb2req,
    1718             :                                   uint64_t persistent_id,
    1719             :                                   uint64_t volatile_id)
    1720             : {
    1721             :         struct smbXsrv_open *op;
    1722             :         NTSTATUS status;
    1723      816203 :         NTTIME now = 0;
    1724             :         struct files_struct *fsp;
    1725             : 
    1726      816203 :         now = timeval_to_nttime(&smb2req->request_time);
    1727             : 
    1728      816203 :         status = smb2srv_open_lookup(smb2req->xconn,
    1729             :                                      persistent_id, volatile_id,
    1730             :                                      now, &op);
    1731      816203 :         if (!NT_STATUS_IS_OK(status)) {
    1732       15424 :                 return NULL;
    1733             :         }
    1734             : 
    1735      800779 :         fsp = op->compat;
    1736      800779 :         if (fsp == NULL) {
    1737           0 :                 return NULL;
    1738             :         }
    1739             : 
    1740      800779 :         if (smb2req->tcon == NULL) {
    1741           0 :                 return NULL;
    1742             :         }
    1743             : 
    1744      800779 :         if (smb2req->tcon->compat != fsp->conn) {
    1745           4 :                 return NULL;
    1746             :         }
    1747             : 
    1748      800775 :         if (smb2req->session == NULL) {
    1749           0 :                 return NULL;
    1750             :         }
    1751             : 
    1752      800775 :         if (smb2req->session->global->session_wire_id != fsp->vuid) {
    1753           0 :                 return NULL;
    1754             :         }
    1755             : 
    1756      800775 :         if (fsp->fsp_flags.closing) {
    1757           0 :                 return NULL;
    1758             :         }
    1759             : 
    1760      800775 :         return fsp;
    1761             : }
    1762             : 
    1763     1616844 : struct files_struct *file_fsp_smb2(struct smbd_smb2_request *smb2req,
    1764             :                                    uint64_t persistent_id,
    1765             :                                    uint64_t volatile_id)
    1766             : {
    1767             :         struct files_struct *fsp;
    1768             : 
    1769     1616844 :         if (smb2req->compat_chain_fsp != NULL) {
    1770      800641 :                 if (smb2req->compat_chain_fsp->fsp_flags.closing) {
    1771           0 :                         return NULL;
    1772             :                 }
    1773      800641 :                 return smb2req->compat_chain_fsp;
    1774             :         }
    1775             : 
    1776      816203 :         fsp = file_fsp_get(smb2req, persistent_id, volatile_id);
    1777      816203 :         if (fsp == NULL) {
    1778       15428 :                 return NULL;
    1779             :         }
    1780             : 
    1781      800775 :         smb2req->compat_chain_fsp = fsp;
    1782      800775 :         return fsp;
    1783             : }
    1784             : 
    1785             : /****************************************************************************
    1786             :  Duplicate the file handle part for a DOS or FCB open.
    1787             : ****************************************************************************/
    1788             : 
    1789         112 : NTSTATUS dup_file_fsp(
    1790             :         files_struct *from,
    1791             :         uint32_t access_mask,
    1792             :         files_struct *to)
    1793             : {
    1794             :         size_t new_refcount;
    1795             : 
    1796             :         /* this can never happen for print files */
    1797         112 :         SMB_ASSERT(from->print_file == NULL);
    1798             : 
    1799         112 :         TALLOC_FREE(to->fh);
    1800             : 
    1801         112 :         to->fh = from->fh;
    1802         112 :         new_refcount = fh_get_refcount(to->fh) + 1;
    1803         112 :         fh_set_refcount(to->fh, new_refcount);
    1804             : 
    1805         112 :         to->file_id = from->file_id;
    1806         112 :         to->initial_allocation_size = from->initial_allocation_size;
    1807         112 :         to->file_pid = from->file_pid;
    1808         112 :         to->vuid = from->vuid;
    1809         112 :         to->open_time = from->open_time;
    1810         112 :         to->access_mask = access_mask;
    1811         112 :         to->oplock_type = from->oplock_type;
    1812         112 :         to->fsp_flags.can_lock = from->fsp_flags.can_lock;
    1813         112 :         to->fsp_flags.can_read = ((access_mask & FILE_READ_DATA) != 0);
    1814         112 :         to->fsp_flags.can_write =
    1815         224 :                 CAN_WRITE(from->conn) &&
    1816         112 :                 ((access_mask & (FILE_WRITE_DATA | FILE_APPEND_DATA)) != 0);
    1817         112 :         to->fsp_flags.modified = from->fsp_flags.modified;
    1818         112 :         to->fsp_flags.is_directory = from->fsp_flags.is_directory;
    1819         112 :         to->fsp_flags.aio_write_behind = from->fsp_flags.aio_write_behind;
    1820         112 :         to->fsp_flags.is_fsa = from->fsp_flags.is_fsa;
    1821         112 :         to->fsp_flags.is_pathref = from->fsp_flags.is_pathref;
    1822         112 :         to->fsp_flags.have_proc_fds = from->fsp_flags.have_proc_fds;
    1823         112 :         to->fsp_flags.is_dirfsp = from->fsp_flags.is_dirfsp;
    1824             : 
    1825         112 :         return fsp_set_smb_fname(to, from->fsp_name);
    1826             : }
    1827             : 
    1828             : /**
    1829             :  * Return a jenkins hash of a pathname on a connection.
    1830             :  */
    1831             : 
    1832     6573699 : NTSTATUS file_name_hash(connection_struct *conn,
    1833             :                         const char *name, uint32_t *p_name_hash)
    1834             : {
    1835             :         char tmpbuf[PATH_MAX];
    1836             :         char *fullpath, *to_free;
    1837             :         ssize_t len;
    1838             :         TDB_DATA key;
    1839             : 
    1840             :         /* Set the hash of the full pathname. */
    1841             : 
    1842     6573699 :         if (name[0] == '/') {
    1843     1707865 :                 strlcpy(tmpbuf, name, sizeof(tmpbuf));
    1844     1707865 :                 fullpath = tmpbuf;
    1845     1707865 :                 len = strlen(fullpath);
    1846     1707865 :                 to_free = NULL;
    1847             :         } else {
    1848     4865834 :                 len = full_path_tos(conn->connectpath,
    1849             :                                     name,
    1850             :                                     tmpbuf,
    1851             :                                     sizeof(tmpbuf),
    1852             :                                     &fullpath,
    1853             :                                     &to_free);
    1854             :         }
    1855     6573699 :         if (len == -1) {
    1856           0 :                 return NT_STATUS_NO_MEMORY;
    1857             :         }
    1858     6573699 :         key = (TDB_DATA) { .dptr = (uint8_t *)fullpath, .dsize = len+1 };
    1859     6573699 :         *p_name_hash = tdb_jenkins_hash(&key);
    1860             : 
    1861     6573699 :         DEBUG(10,("file_name_hash: %s hash 0x%x\n",
    1862             :                   fullpath,
    1863             :                 (unsigned int)*p_name_hash ));
    1864             : 
    1865     6573699 :         TALLOC_FREE(to_free);
    1866     6573699 :         return NT_STATUS_OK;
    1867             : }
    1868             : 
    1869     6445688 : static NTSTATUS fsp_attach_smb_fname(struct files_struct *fsp,
    1870             :                                      struct smb_filename **_smb_fname)
    1871             : {
    1872     6445688 :         struct smb_filename *smb_fname_new = talloc_move(fsp, _smb_fname);
    1873     6445688 :         const char *name_str = NULL;
    1874     6445688 :         uint32_t name_hash = 0;
    1875             :         NTSTATUS status;
    1876             : 
    1877     6445688 :         name_str = smb_fname_str_dbg(smb_fname_new);
    1878     6445688 :         if (name_str == NULL) {
    1879           0 :                 return NT_STATUS_NO_MEMORY;
    1880             :         }
    1881             : 
    1882     6445688 :         status = file_name_hash(fsp->conn,
    1883             :                                 name_str,
    1884             :                                 &name_hash);
    1885     6445688 :         if (!NT_STATUS_IS_OK(status)) {
    1886           0 :                 return status;
    1887             :         }
    1888             : 
    1889     6445688 :         status = fsp_smb_fname_link(fsp,
    1890             :                                     &smb_fname_new->fsp_link,
    1891             :                                     &smb_fname_new->fsp);
    1892     6445688 :         if (!NT_STATUS_IS_OK(status)) {
    1893           0 :                 return status;
    1894             :         }
    1895             : 
    1896     6445688 :         fsp->name_hash = name_hash;
    1897     6445688 :         fsp->fsp_name = smb_fname_new;
    1898     6445688 :         *_smb_fname = NULL;
    1899     6445688 :         return NT_STATUS_OK;
    1900             : }
    1901             : 
    1902             : /**
    1903             :  * The only way that the fsp->fsp_name field should ever be set.
    1904             :  */
    1905     1112775 : NTSTATUS fsp_set_smb_fname(struct files_struct *fsp,
    1906             :                            const struct smb_filename *smb_fname_in)
    1907             : {
    1908     1112775 :         struct smb_filename *smb_fname_old = fsp->fsp_name;
    1909     1112775 :         struct smb_filename *smb_fname_new = NULL;
    1910             :         NTSTATUS status;
    1911             : 
    1912     1112775 :         smb_fname_new = cp_smb_filename(fsp, smb_fname_in);
    1913     1112775 :         if (smb_fname_new == NULL) {
    1914           0 :                 return NT_STATUS_NO_MEMORY;
    1915             :         }
    1916             : 
    1917     1112775 :         status = fsp_attach_smb_fname(fsp, &smb_fname_new);
    1918     1112775 :         if (!NT_STATUS_IS_OK(status)) {
    1919           0 :                 TALLOC_FREE(smb_fname_new);
    1920           0 :                 return status;
    1921             :         }
    1922             : 
    1923     1112775 :         if (smb_fname_old != NULL) {
    1924      608339 :                 smb_fname_fsp_unlink(smb_fname_old);
    1925      608339 :                 TALLOC_FREE(smb_fname_old);
    1926             :         }
    1927             : 
    1928     1112775 :         return NT_STATUS_OK;
    1929             : }
    1930             : 
    1931        7406 : size_t fsp_fullbasepath(struct files_struct *fsp, char *buf, size_t buflen)
    1932             : {
    1933        7406 :         int len = 0;
    1934        7406 :         char tmp_buf[1] = {'\0'};
    1935             : 
    1936             :         /*
    1937             :          * Don't pass NULL buffer to snprintf (to satisfy static checker)
    1938             :          * Some callers will call this function with NULL for buf and
    1939             :          * 0 for buflen in order to get length of fullbasepath (without
    1940             :          * needing to allocate or write to buf)
    1941             :          */
    1942        7406 :         if (buf == NULL) {
    1943        3704 :                 buf = tmp_buf;
    1944        3704 :                 SMB_ASSERT(buflen==0);
    1945             :         }
    1946             : 
    1947        7406 :         len = snprintf(buf, buflen, "%s/%s", fsp->conn->connectpath,
    1948        7406 :                        fsp->fsp_name->base_name);
    1949        7406 :         SMB_ASSERT(len>0);
    1950             : 
    1951        7406 :         return len;
    1952             : }
    1953             : 
    1954     6130431 : void fsp_set_base_fsp(struct files_struct *fsp, struct files_struct *base_fsp)
    1955             : {
    1956     6130431 :         SMB_ASSERT(fsp->stream_fsp == NULL);
    1957     6130431 :         if (base_fsp != NULL) {
    1958       14819 :                 SMB_ASSERT(base_fsp->base_fsp == NULL);
    1959       14819 :                 SMB_ASSERT(base_fsp->stream_fsp == NULL);
    1960             :         }
    1961             : 
    1962     6130431 :         if (fsp->base_fsp != NULL) {
    1963        7831 :                 SMB_ASSERT(fsp->base_fsp->stream_fsp == fsp);
    1964        7831 :                 fsp->base_fsp->stream_fsp = NULL;
    1965             :         }
    1966             : 
    1967     6130431 :         fsp->base_fsp = base_fsp;
    1968     6130431 :         if (fsp->base_fsp != NULL) {
    1969       14819 :                 fsp->base_fsp->stream_fsp = fsp;
    1970             :         }
    1971     6130431 : }
    1972             : 
    1973    19293148 : bool fsp_is_alternate_stream(const struct files_struct *fsp)
    1974             : {
    1975    19293148 :         return (fsp->base_fsp != NULL);
    1976             : }
    1977             : 
    1978      460670 : struct files_struct *metadata_fsp(struct files_struct *fsp)
    1979             : {
    1980      460670 :         if (fsp_is_alternate_stream(fsp)) {
    1981        2145 :                 return fsp->base_fsp;
    1982             :         }
    1983      458525 :         return fsp;
    1984             : }

Generated by: LCOV version 1.13