diff options
| -rw-r--r-- | source3/include/smb.h | 15 | ||||
| -rw-r--r-- | source3/smbd/nttrans.c | 12 | ||||
| -rw-r--r-- | source3/smbd/open.c | 5 |
3 files changed, 28 insertions, 4 deletions
diff --git a/source3/include/smb.h b/source3/include/smb.h index b8ff34f831..c8c4f8c3cc 100644 --- a/source3/include/smb.h +++ b/source3/include/smb.h @@ -1330,12 +1330,19 @@ struct bitmap { #define FILE_DELETE_ON_CLOSE 0x1000 #define FILE_OPEN_BY_FILE_ID 0x2000 -/* Private create options used by the ntcreatex processing code. From Samba4. */ -#define NTCREATEX_OPTIONS_PRIVATE_DENY_DOS 0x01000000 -#define NTCREATEX_OPTIONS_PRIVATE_DENY_FCB 0x02000000 +#define NTCREATEX_OPTIONS_MUST_IGNORE_MASK (0x008F0480) + +#define NTCREATEX_OPTIONS_INVALID_PARAM_MASK (0xFF100030) + +/* + * Private create options used by the ntcreatex processing code. From Samba4. + * We reuse some ignored flags for private use. + */ +#define NTCREATEX_OPTIONS_PRIVATE_DENY_DOS 0x00010000 +#define NTCREATEX_OPTIONS_PRIVATE_DENY_FCB 0x00020000 /* Private options for streams support */ -#define NTCREATEX_OPTIONS_PRIVATE_STREAM_DELETE 0x04000000 +#define NTCREATEX_OPTIONS_PRIVATE_STREAM_DELETE 0x00040000 /* Responses when opening a file. */ #define FILE_WAS_SUPERSEDED 0 diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c index 149e6ecbd9..b6951272d7 100644 --- a/source3/smbd/nttrans.c +++ b/source3/smbd/nttrans.c @@ -455,6 +455,12 @@ void reply_ntcreate_and_X(struct smb_request *req) fname)); /* + * we need to remove ignored bits when they come directly from the client + * because we reuse some of them for internal stuff + */ + create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK; + + /* * If it's an IPC, use the pipe handler. */ @@ -858,6 +864,12 @@ static void call_nt_transact_create(connection_struct *conn, allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32); #endif + /* + * we need to remove ignored bits when they come directly from the client + * because we reuse some of them for internal stuff + */ + create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK; + /* Ensure the data_len is correct for the sd and ea values given. */ if ((ea_len + sd_len > data_count) || (ea_len > data_count) || (sd_len > data_count) diff --git a/source3/smbd/open.c b/source3/smbd/open.c index 03efd09f06..8b32907a4b 100644 --- a/source3/smbd/open.c +++ b/source3/smbd/open.c @@ -2560,6 +2560,11 @@ NTSTATUS create_file_unixpath(connection_struct *conn, goto fail; } + if (create_options & NTCREATEX_OPTIONS_INVALID_PARAM_MASK) { + status = NT_STATUS_INVALID_PARAMETER; + goto fail; + } + if (req == NULL) { oplock_request |= INTERNAL_OPEN_ONLY; } |