source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28
  29 /* look in server.c for some explanation of these variables */
  30 extern enum protocol_types Protocol;
  31 extern int max_send;
  32 extern int max_recv;
  33 unsigned int smb_echo_count = 0;
  34 extern uint32 global_client_caps;
  35
  36 extern struct current_user current_user;
  37 extern BOOL global_encrypted_passwords_negotiated;
  38
  39 /****************************************************************************
  40  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  41  path or anything including wildcards.
  42  We're assuming here that '/' is not the second byte in any multibyte char
  43  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  44  set.
  45 ****************************************************************************/
  46
  47 NTSTATUS check_path_syntax_internal(pstring destname,
  48                                     const pstring srcname,
  49                                     BOOL windows_path,
  50                                     BOOL *p_last_component_contains_wcard)
  51 {
  52         char *d = destname;
  53         const char *s = srcname;
  54         NTSTATUS ret = NT_STATUS_OK;
  55         BOOL start_of_name_component = True;
  56
  57         *p_last_component_contains_wcard = False;
  58
  59         while (*s) {
  60                 if (IS_DIRECTORY_SEP(*s)) {
  61                         /*
  62                          * Safe to assume is not the second part of a mb char
  63                          * as this is handled below.
  64                          */
  65                         /* Eat multiple '/' or '\\' */
  66                         while (IS_DIRECTORY_SEP(*s)) {
  67                                 s++;
  68                         }
  69                         if ((d != destname) && (*s != '\0')) {
  70                                 /* We only care about non-leading or trailing '/' or '\\' */
  71                                 *d++ = '/';
  72                         }
  73
  74                         start_of_name_component = True;
  75                         /* New component. */
  76                         *p_last_component_contains_wcard = False;
  77                         continue;
  78                 }
  79
  80                 if (start_of_name_component) {
  81                         if ((s[0] == '.') && (s[1] == '.') && (IS_DIRECTORY_SEP(s[2]) || s[2] == '\0')) {
  82                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
  83
  84                                 /*
  85                                  * No mb char starts with '.' so we're safe checking the directory separator here.
  86                                  */
  87
  88                                 /* If  we just added a '/' - delete it */
  89                                 if ((d > destname) && (*(d-1) == '/')) {
  90                                         *(d-1) = '\0';
  91                                         d--;
  92                                 }
  93
  94                                 /* Are we at the start ? Can't go back further if so. */
  95                                 if (d <= destname) {
  96                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
  97                                         break;
  98                                 }
  99                                 /* Go back one level... */
 100                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 101                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 102                                 /* Decrement d first as d points to the *next* char to write into. */
 103                                 for (d--; d > destname; d--) {
 104                                         if (*d == '/')
 105                                                 break;
 106                                 }
 107                                 s += 2; /* Else go past the .. */
 108                                 /* We're still at the start of a name component, just the previous one. */
 109                                 continue;
 110
 111                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_DIRECTORY_SEP(s[1]))) {
 112                                 if (!windows_path) {
 113                                         /* Eat the '.' */
 114                                         s++;
 115                                         continue;
 116                                 }
 117                         }
 118
 119                 }
 120
 121                 if (!(*s & 0x80)) {
 122                         if (windows_path) {
 123                                 if (*s <= 0x1f) {
 124                                         return NT_STATUS_OBJECT_NAME_INVALID;
 125                                 }
 126                                 switch (*s) {
 127                                         case '*':
 128                                         case '?':
 129                                         case '<':
 130                                         case '>':
 131                                         case '"':
 132                                                 *p_last_component_contains_wcard = True;
 133                                                 break;
 134                                         default:
 135                                                 break;
 136                                 }
 137                         }
 138                         *d++ = *s++;
 139                 } else {
 140                         size_t siz;
 141                         /* Get the size of the next MB character. */
 142                         next_codepoint(s,&siz);
 143                         switch(siz) {
 144                                 case 5:
 145                                         *d++ = *s++;
 146                                         /*fall through*/
 147                                 case 4:
 148                                         *d++ = *s++;
 149                                         /*fall through*/
 150                                 case 3:
 151                                         *d++ = *s++;
 152                                         /*fall through*/
 153                                 case 2:
 154                                         *d++ = *s++;
 155                                         /*fall through*/
 156                                 case 1:
 157                                         *d++ = *s++;
 158                                         break;
 159                                 default:
 160                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 161                                         *d = '\0';
 162                                         return NT_STATUS_INVALID_PARAMETER;
 163                         }
 164                 }
 165                 start_of_name_component = False;
 166         }
 167
 168         *d = '\0';
 169         return ret;
 170 }
 171
 172 /****************************************************************************
 173  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 174  No wildcards allowed.
 175 ****************************************************************************/
 176
 177 NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
 178 {
 179         BOOL ignore;
 180         return check_path_syntax_internal(destname, srcname, True, &ignore);
 181 }
 182
 183 /****************************************************************************
 184  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 185  Wildcards allowed - p_contains_wcard returns true if the last component contained
 186  a wildcard.
 187 ****************************************************************************/
 188
 189 NTSTATUS check_path_syntax_wcard(pstring destname, const pstring srcname, BOOL *p_contains_wcard)
 190 {
 191         return check_path_syntax_internal(destname, srcname, True, p_contains_wcard);
 192 }
 193
 194 /****************************************************************************
 195  Check the path for a POSIX client.
 196  We're assuming here that '/' is not the second byte in any multibyte char
 197  set (a safe assumption).
 198 ****************************************************************************/
 199
 200 static NTSTATUS check_path_syntax_posix(pstring destname, const pstring srcname)
 201 {
 202         BOOL ignore;
 203         return check_path_syntax_internal(destname, srcname, False, &ignore);
 204 }
 205
 206 /****************************************************************************
 207  Pull a string and check the path allowing a wilcard - provide for error return.
 208 ****************************************************************************/
 209
 210 size_t srvstr_get_path_wcard(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags,
 211                                 NTSTATUS *err, BOOL *contains_wcard)
 212 {
 213         pstring tmppath;
 214         char *tmppath_ptr = tmppath;
 215         size_t ret;
 216 #ifdef DEVELOPER
 217         SMB_ASSERT(dest_len == sizeof(pstring));
 218 #endif
 219
 220         if (src_len == 0) {
 221                 ret = srvstr_pull_buf( inbuf, tmppath_ptr, src, dest_len, flags);
 222         } else {
 223                 ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
 224         }
 225
 226         *contains_wcard = False;
 227
 228         if (lp_posix_pathnames()) {
 229                 *err = check_path_syntax_posix(dest, tmppath);
 230         } else {
 231                 *err = check_path_syntax_wcard(dest, tmppath, contains_wcard);
 232         }
 233
 234         return ret;
 235 }
 236
 237 /****************************************************************************
 238  Pull a string and check the path - provide for error return.
 239 ****************************************************************************/
 240
 241 size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags, NTSTATUS *err)
 242 {
 243         pstring tmppath;
 244         char *tmppath_ptr = tmppath;
 245         size_t ret;
 246 #ifdef DEVELOPER
 247         SMB_ASSERT(dest_len == sizeof(pstring));
 248 #endif
 249
 250         if (src_len == 0) {
 251                 ret = srvstr_pull_buf( inbuf, tmppath_ptr, src, dest_len, flags);
 252         } else {
 253                 ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
 254         }
 255         if (lp_posix_pathnames()) {
 256                 *err = check_path_syntax_posix(dest, tmppath);
 257         } else {
 258                 *err = check_path_syntax(dest, tmppath);
 259         }
 260
 261         return ret;
 262 }
 263
 264 /****************************************************************************
 265  Reply to a special message.
 266 ****************************************************************************/
 267
 268 int reply_special(char *inbuf,char *outbuf)
 269 {
 270         int outsize = 4;
 271         int msg_type = CVAL(inbuf,0);
 272         int msg_flags = CVAL(inbuf,1);
 273         fstring name1,name2;
 274         char name_type = 0;
 275
 276         static BOOL already_got_session = False;
 277
 278         *name1 = *name2 = 0;
 279
 280         memset(outbuf,'\0',smb_size);
 281
 282         smb_setlen(outbuf,0);
 283
 284         switch (msg_type) {
 285         case 0x81: /* session request */
 286
 287                 if (already_got_session) {
 288                         exit_server_cleanly("multiple session request not permitted");
 289                 }
 290
 291                 SCVAL(outbuf,0,0x82);
 292                 SCVAL(outbuf,3,0);
 293                 if (name_len(inbuf+4) > 50 ||
 294                     name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
 295                         DEBUG(0,("Invalid name length in session request\n"));
 296                         return(0);
 297                 }
 298                 name_extract(inbuf,4,name1);
 299                 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
 300                 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
 301                          name1,name2));
 302
 303                 set_local_machine_name(name1, True);
 304                 set_remote_machine_name(name2, True);
 305
 306                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 307                          get_local_machine_name(), get_remote_machine_name(),
 308                          name_type));
 309
 310                 if (name_type == 'R') {
 311                         /* We are being asked for a pathworks session ---
 312                            no thanks! */
 313                         SCVAL(outbuf, 0,0x83);
 314                         break;
 315                 }
 316
 317                 /* only add the client's machine name to the list
 318                    of possibly valid usernames if we are operating
 319                    in share mode security */
 320                 if (lp_security() == SEC_SHARE) {
 321                         add_session_user(get_remote_machine_name());
 322                 }
 323
 324                 reload_services(True);
 325                 reopen_logs();
 326
 327                 already_got_session = True;
 328                 break;
 329
 330         case 0x89: /* session keepalive request
 331                       (some old clients produce this?) */
 332                 SCVAL(outbuf,0,SMBkeepalive);
 333                 SCVAL(outbuf,3,0);
 334                 break;
 335
 336         case 0x82: /* positive session response */
 337         case 0x83: /* negative session response */
 338         case 0x84: /* retarget session response */
 339                 DEBUG(0,("Unexpected session response\n"));
 340                 break;
 341
 342         case SMBkeepalive: /* session keepalive */
 343         default:
 344                 return(0);
 345         }
 346
 347         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 348                     msg_type, msg_flags));
 349
 350         return(outsize);
 351 }
 352
 353 /****************************************************************************
 354  Reply to a tcon.
 355  conn POINTER CAN BE NULL HERE !
 356 ****************************************************************************/
 357
 358 int reply_tcon(connection_struct *conn,
 359                char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 360 {
 361         const char *service;
 362         pstring service_buf;
 363         pstring password;
 364         pstring dev;
 365         int outsize = 0;
 366         uint16 vuid = SVAL(inbuf,smb_uid);
 367         int pwlen=0;
 368         NTSTATUS nt_status;
 369         char *p;
 370         DATA_BLOB password_blob;
 371
 372         START_PROFILE(SMBtcon);
 373
 374         *service_buf = *password = *dev = 0;
 375
 376         p = smb_buf(inbuf)+1;
 377         p += srvstr_pull_buf(inbuf, service_buf, p, sizeof(service_buf), STR_TERMINATE) + 1;
 378         pwlen = srvstr_pull_buf(inbuf, password, p, sizeof(password), STR_TERMINATE) + 1;
 379         p += pwlen;
 380         p += srvstr_pull_buf(inbuf, dev, p, sizeof(dev), STR_TERMINATE) + 1;
 381
 382         p = strrchr_m(service_buf,'\\');
 383         if (p) {
 384                 service = p+1;
 385         } else {
 386                 service = service_buf;
 387         }
 388
 389         password_blob = data_blob(password, pwlen+1);
 390
 391         conn = make_connection(service,password_blob,dev,vuid,&nt_status);
 392
 393         data_blob_clear_free(&password_blob);
 394
 395         if (!conn) {
 396                 END_PROFILE(SMBtcon);
 397                 return ERROR_NT(nt_status);
 398         }
 399
 400         outsize = set_message(outbuf,2,0,True);
 401         SSVAL(outbuf,smb_vwv0,max_recv);
 402         SSVAL(outbuf,smb_vwv1,conn->cnum);
 403         SSVAL(outbuf,smb_tid,conn->cnum);
 404
 405         DEBUG(3,("tcon service=%s cnum=%d\n",
 406                  service, conn->cnum));
 407
 408         END_PROFILE(SMBtcon);
 409         return(outsize);
 410 }
 411
 412 /****************************************************************************
 413  Reply to a tcon and X.
 414  conn POINTER CAN BE NULL HERE !
 415 ****************************************************************************/
 416
 417 int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
 418 {
 419         fstring service;
 420         DATA_BLOB password;
 421
 422         /* what the cleint thinks the device is */
 423         fstring client_devicetype;
 424         /* what the server tells the client the share represents */
 425         const char *server_devicetype;
 426         NTSTATUS nt_status;
 427         uint16 vuid = SVAL(inbuf,smb_uid);
 428         int passlen = SVAL(inbuf,smb_vwv3);
 429         pstring path;
 430         char *p, *q;
 431
 432         START_PROFILE(SMBtconX);
 433
 434         *service = *client_devicetype = 0;
 435
 436         /* we might have to close an old one */
 437         if ((SVAL(inbuf,smb_vwv2) & 0x1) && conn) {
 438                 close_cnum(conn,vuid);
 439         }
 440
 441         if (passlen > MAX_PASS_LEN) {
 442                 return ERROR_DOS(ERRDOS,ERRbuftoosmall);
 443         }
 444
 445         if (global_encrypted_passwords_negotiated) {
 446                 password = data_blob(smb_buf(inbuf),passlen);
 447         } else {
 448                 password = data_blob(smb_buf(inbuf),passlen+1);
 449                 /* Ensure correct termination */
 450                 password.data[passlen]=0;
 451         }
 452
 453         p = smb_buf(inbuf) + passlen;
 454         p += srvstr_pull_buf(inbuf, path, p, sizeof(path), STR_TERMINATE);
 455
 456         /*
 457          * the service name can be either: \\server\share
 458          * or share directly like on the DELL PowerVault 705
 459          */
 460         if (*path=='\\') {
 461                 q = strchr_m(path+2,'\\');
 462                 if (!q) {
 463                         END_PROFILE(SMBtconX);
 464                         return(ERROR_DOS(ERRDOS,ERRnosuchshare));
 465                 }
 466                 fstrcpy(service,q+1);
 467         }
 468         else
 469                 fstrcpy(service,path);
 470
 471         p += srvstr_pull(inbuf, client_devicetype, p, sizeof(client_devicetype), 6, STR_ASCII);
 472
 473         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 474
 475         conn = make_connection(service,password,client_devicetype,vuid,&nt_status);
 476
 477         data_blob_clear_free(&password);
 478
 479         if (!conn) {
 480                 END_PROFILE(SMBtconX);
 481                 return ERROR_NT(nt_status);
 482         }
 483
 484         if ( IS_IPC(conn) )
 485                 server_devicetype = "IPC";
 486         else if ( IS_PRINT(conn) )
 487                 server_devicetype = "LPT1:";
 488         else
 489                 server_devicetype = "A:";
 490
 491         if (Protocol < PROTOCOL_NT1) {
 492                 set_message(outbuf,2,0,True);
 493                 p = smb_buf(outbuf);
 494                 p += srvstr_push(outbuf, p, server_devicetype, -1,
 495                                  STR_TERMINATE|STR_ASCII);
 496                 set_message_end(outbuf,p);
 497         } else {
 498                 /* NT sets the fstype of IPC$ to the null string */
 499                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 500
 501                 set_message(outbuf,3,0,True);
 502
 503                 p = smb_buf(outbuf);
 504                 p += srvstr_push(outbuf, p, server_devicetype, -1,
 505                                  STR_TERMINATE|STR_ASCII);
 506                 p += srvstr_push(outbuf, p, fstype, -1,
 507                                  STR_TERMINATE);
 508
 509                 set_message_end(outbuf,p);
 510
 511                 /* what does setting this bit do? It is set by NT4 and
 512                    may affect the ability to autorun mounted cdroms */
 513                 SSVAL(outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 514                                 (lp_csc_policy(SNUM(conn)) << 2));
 515
 516                 init_dfsroot(conn, inbuf, outbuf);
 517         }
 518
 519
 520         DEBUG(3,("tconX service=%s \n",
 521                  service));
 522
 523         /* set the incoming and outgoing tid to the just created one */
 524         SSVAL(inbuf,smb_tid,conn->cnum);
 525         SSVAL(outbuf,smb_tid,conn->cnum);
 526
 527         END_PROFILE(SMBtconX);
 528         return chain_reply(inbuf,outbuf,length,bufsize);
 529 }
 530
 531 /****************************************************************************
 532  Reply to an unknown type.
 533 ****************************************************************************/
 534
 535 int reply_unknown(char *inbuf,char *outbuf)
 536 {
 537         int type;
 538         type = CVAL(inbuf,smb_com);
 539
 540         DEBUG(0,("unknown command type (%s): type=%d (0x%X)\n",
 541                  smb_fn_name(type), type, type));
 542
 543         return(ERROR_DOS(ERRSRV,ERRunknownsmb));
 544 }
 545
 546 /****************************************************************************
 547  Reply to an ioctl.
 548  conn POINTER CAN BE NULL HERE !
 549 ****************************************************************************/
 550
 551 int reply_ioctl(connection_struct *conn,
 552                 char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 553 {
 554         uint16 device     = SVAL(inbuf,smb_vwv1);
 555         uint16 function   = SVAL(inbuf,smb_vwv2);
 556         uint32 ioctl_code = (device << 16) + function;
 557         int replysize, outsize;
 558         char *p;
 559         START_PROFILE(SMBioctl);
 560
 561         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 562
 563         switch (ioctl_code) {
 564             case IOCTL_QUERY_JOB_INFO:
 565                 replysize = 32;
 566                 break;
 567             default:
 568                 END_PROFILE(SMBioctl);
 569                 return(ERROR_DOS(ERRSRV,ERRnosupport));
 570         }
 571
 572         outsize = set_message(outbuf,8,replysize+1,True);
 573         SSVAL(outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 574         SSVAL(outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 575         SSVAL(outbuf,smb_vwv6,52);        /* Offset to data */
 576         p = smb_buf(outbuf) + 1;          /* Allow for alignment */
 577
 578         switch (ioctl_code) {
 579                 case IOCTL_QUERY_JOB_INFO:
 580                 {
 581                         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
 582                         if (!fsp) {
 583                                 END_PROFILE(SMBioctl);
 584                                 return(UNIXERROR(ERRDOS,ERRbadfid));
 585                         }
 586                         SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
 587                         srvstr_push(outbuf, p+2, global_myname(), 15, STR_TERMINATE|STR_ASCII);
 588                         if (conn) {
 589                                 srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII);
 590                         }
 591                         break;
 592                 }
 593         }
 594
 595         END_PROFILE(SMBioctl);
 596         return outsize;
 597 }
 598
 599 /****************************************************************************
 600  Strange checkpath NTSTATUS mapping.
 601 ****************************************************************************/
 602
 603 static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
 604 {
 605         /* Strange DOS error code semantics only for checkpath... */
 606         if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
 607                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 608                         /* We need to map to ERRbadpath */
 609                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 610                 }
 611         }
 612         return status;
 613 }
 614
 615 /****************************************************************************
 616  Reply to a checkpath.
 617 ****************************************************************************/
 618
 619 int reply_checkpath(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 620 {
 621         int outsize = 0;
 622         pstring name;
 623         SMB_STRUCT_STAT sbuf;
 624         NTSTATUS status;
 625
 626         START_PROFILE(SMBcheckpath);
 627
 628         srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status);
 629         if (!NT_STATUS_IS_OK(status)) {
 630                 END_PROFILE(SMBcheckpath);
 631                 status = map_checkpath_error(inbuf, status);
 632                 return ERROR_NT(status);
 633         }
 634
 635         RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
 636
 637         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(inbuf,smb_vwv0)));
 638
 639         status = unix_convert(conn, name, False, NULL, &sbuf);
 640         if (!NT_STATUS_IS_OK(status)) {
 641                 END_PROFILE(SMBcheckpath);
 642                 status = map_checkpath_error(inbuf, status);
 643                 return ERROR_NT(status);
 644         }
 645
 646         if (check_name(name,conn) && (VALID_STAT(sbuf) || SMB_VFS_STAT(conn,name,&sbuf) == 0)) {
 647                 if (!S_ISDIR(sbuf.st_mode)) {
 648                         END_PROFILE(SMBcheckpath);
 649                         return ERROR_BOTH(NT_STATUS_NOT_A_DIRECTORY,ERRDOS,ERRbadpath);
 650                 }
 651         } else {
 652                 /* We special case this - as when a Windows machine
 653                         is parsing a path is steps through the components
 654                         one at a time - if a component fails it expects
 655                         ERRbadpath, not ERRbadfile.
 656                 */
 657                 if(errno == ENOENT) {
 658                         /*
 659                          * Windows returns different error codes if
 660                          * the parent directory is valid but not the
 661                          * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
 662                          * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
 663                          * if the path is invalid.
 664                          */
 665                         END_PROFILE(SMBcheckpath);
 666                         return ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpath);
 667                 }
 668
 669                 END_PROFILE(SMBcheckpath);
 670                 return(UNIXERROR(ERRDOS,ERRbadpath));
 671         }
 672
 673         outsize = set_message(outbuf,0,0,False);
 674
 675         END_PROFILE(SMBcheckpath);
 676         return outsize;
 677 }
 678
 679 /****************************************************************************
 680  Reply to a getatr.
 681 ****************************************************************************/
 682
 683 int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 684 {
 685         pstring fname;
 686         int outsize = 0;
 687         SMB_STRUCT_STAT sbuf;
 688         int mode=0;
 689         SMB_OFF_T size=0;
 690         time_t mtime=0;
 691         char *p;
 692         NTSTATUS status;
 693
 694         START_PROFILE(SMBgetatr);
 695
 696         p = smb_buf(inbuf) + 1;
 697         p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
 698         if (!NT_STATUS_IS_OK(status)) {
 699                 END_PROFILE(SMBgetatr);
 700                 return ERROR_NT(status);
 701         }
 702
 703         RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 704
 705         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
 706                 under WfWg - weird! */
 707         if (*fname == '\0') {
 708                 mode = aHIDDEN | aDIR;
 709                 if (!CAN_WRITE(conn)) {
 710                         mode |= aRONLY;
 711                 }
 712                 size = 0;
 713                 mtime = 0;
 714         } else {
 715                 status = unix_convert(conn, fname, False, NULL,&sbuf);
 716                 if (!NT_STATUS_IS_OK(status)) {
 717                         END_PROFILE(SMBgetatr);
 718                         return ERROR_NT(status);
 719                 }
 720                 if (check_name(fname,conn) &&
 721                                 (VALID_STAT(sbuf) || SMB_VFS_STAT(conn,fname,&sbuf) == 0)) {
 722                         mode = dos_mode(conn,fname,&sbuf);
 723                         size = sbuf.st_size;
 724                         mtime = sbuf.st_mtime;
 725                         if (mode & aDIR) {
 726                                 size = 0;
 727                         }
 728                 } else {
 729                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
 730                         END_PROFILE(SMBgetatr);
 731                         return UNIXERROR(ERRDOS,ERRbadfile);
 732                 }
 733         }
 734
 735         outsize = set_message(outbuf,10,0,True);
 736
 737         SSVAL(outbuf,smb_vwv0,mode);
 738         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
 739                 srv_put_dos_date3(outbuf,smb_vwv1,mtime & ~1);
 740         } else {
 741                 srv_put_dos_date3(outbuf,smb_vwv1,mtime);
 742         }
 743         SIVAL(outbuf,smb_vwv3,(uint32)size);
 744
 745         if (Protocol >= PROTOCOL_NT1) {
 746                 SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
 747         }
 748
 749         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
 750
 751         END_PROFILE(SMBgetatr);
 752         return(outsize);
 753 }
 754
 755 /****************************************************************************
 756  Reply to a setatr.
 757 ****************************************************************************/
 758
 759 int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 760 {
 761         pstring fname;
 762         int outsize = 0;
 763         int mode;
 764         time_t mtime;
 765         SMB_STRUCT_STAT sbuf;
 766         char *p;
 767         NTSTATUS status;
 768
 769         START_PROFILE(SMBsetatr);
 770
 771         p = smb_buf(inbuf) + 1;
 772         p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
 773         if (!NT_STATUS_IS_OK(status)) {
 774                 END_PROFILE(SMBsetatr);
 775                 return ERROR_NT(status);
 776         }
 777
 778         RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 779
 780         status = unix_convert(conn, fname, False, NULL, &sbuf);
 781         if (!NT_STATUS_IS_OK(status)) {
 782                 END_PROFILE(SMBsetatr);
 783                 return ERROR_NT(status);
 784         }
 785
 786         if (fname[0] == '.' && fname[1] == '\0') {
 787                 /*
 788                  * Not sure here is the right place to catch this
 789                  * condition. Might be moved to somewhere else later -- vl
 790                  */
 791                 END_PROFILE(SMBsetatr);
 792                 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
 793         }
 794
 795         if (!check_name(fname,conn)) {
 796                 END_PROFILE(SMBsetatr);
 797                 return UNIXERROR(ERRDOS, ERRnoaccess);
 798         }
 799
 800         mode = SVAL(inbuf,smb_vwv0);
 801         mtime = srv_make_unix_date3(inbuf+smb_vwv1);
 802
 803         if (mode != FILE_ATTRIBUTE_NORMAL) {
 804                 if (VALID_STAT_OF_DIR(sbuf))
 805                         mode |= aDIR;
 806                 else
 807                         mode &= ~aDIR;
 808
 809                 if (file_set_dosmode(conn,fname,mode,&sbuf,False) != 0) {
 810                         END_PROFILE(SMBsetatr);
 811                         return UNIXERROR(ERRDOS, ERRnoaccess);
 812                 }
 813         }
 814
 815         if (!set_filetime(conn,fname,mtime)) {
 816                 END_PROFILE(SMBsetatr);
 817                 return UNIXERROR(ERRDOS, ERRnoaccess);
 818         }
 819
 820         outsize = set_message(outbuf,0,0,False);
 821
 822         DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
 823
 824         END_PROFILE(SMBsetatr);
 825         return(outsize);
 826 }
 827
 828 /****************************************************************************
 829  Reply to a dskattr.
 830 ****************************************************************************/
 831
 832 int reply_dskattr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 833 {
 834         int outsize = 0;
 835         SMB_BIG_UINT dfree,dsize,bsize;
 836         START_PROFILE(SMBdskattr);
 837
 838         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
 839                 END_PROFILE(SMBdskattr);
 840                 return(UNIXERROR(ERRHRD,ERRgeneral));
 841         }
 842
 843         outsize = set_message(outbuf,5,0,True);
 844
 845         if (Protocol <= PROTOCOL_LANMAN2) {
 846                 double total_space, free_space;
 847                 /* we need to scale this to a number that DOS6 can handle. We
 848                    use floating point so we can handle large drives on systems
 849                    that don't have 64 bit integers
 850
 851                    we end up displaying a maximum of 2G to DOS systems
 852                 */
 853                 total_space = dsize * (double)bsize;
 854                 free_space = dfree * (double)bsize;
 855
 856                 dsize = (total_space+63*512) / (64*512);
 857                 dfree = (free_space+63*512) / (64*512);
 858
 859                 if (dsize > 0xFFFF) dsize = 0xFFFF;
 860                 if (dfree > 0xFFFF) dfree = 0xFFFF;
 861
 862                 SSVAL(outbuf,smb_vwv0,dsize);
 863                 SSVAL(outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
 864                 SSVAL(outbuf,smb_vwv2,512); /* and this must be 512 */
 865                 SSVAL(outbuf,smb_vwv3,dfree);
 866         } else {
 867                 SSVAL(outbuf,smb_vwv0,dsize);
 868                 SSVAL(outbuf,smb_vwv1,bsize/512);
 869                 SSVAL(outbuf,smb_vwv2,512);
 870                 SSVAL(outbuf,smb_vwv3,dfree);
 871         }
 872
 873         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
 874
 875         END_PROFILE(SMBdskattr);
 876         return(outsize);
 877 }
 878
 879 /****************************************************************************
 880  Reply to a search.
 881  Can be called from SMBsearch, SMBffirst or SMBfunique.
 882 ****************************************************************************/
 883
 884 int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 885 {
 886         pstring mask;
 887         pstring directory;
 888         pstring fname;
 889         SMB_OFF_T size;
 890         uint32 mode;
 891         time_t date;
 892         uint32 dirtype;
 893         int outsize = 0;
 894         unsigned int numentries = 0;
 895         unsigned int maxentries = 0;
 896         BOOL finished = False;
 897         char *p;
 898         int status_len;
 899         pstring path;
 900         char status[21];
 901         int dptr_num= -1;
 902         BOOL check_descend = False;
 903         BOOL expect_close = False;
 904         NTSTATUS nt_status;
 905         BOOL mask_contains_wcard = False;
 906         BOOL allow_long_path_components = (SVAL(inbuf,smb_flg2) & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
 907
 908         START_PROFILE(SMBsearch);
 909
 910         if (lp_posix_pathnames()) {
 911                 END_PROFILE(SMBsearch);
 912                 return reply_unknown(inbuf, outbuf);
 913         }
 914
 915         *mask = *directory = *fname = 0;
 916
 917         /* If we were called as SMBffirst then we must expect close. */
 918         if(CVAL(inbuf,smb_com) == SMBffirst) {
 919                 expect_close = True;
 920         }
 921
 922         outsize = set_message(outbuf,1,3,True);
 923         maxentries = SVAL(inbuf,smb_vwv0);
 924         dirtype = SVAL(inbuf,smb_vwv1);
 925         p = smb_buf(inbuf) + 1;
 926         p += srvstr_get_path_wcard(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &nt_status, &mask_contains_wcard);
 927         if (!NT_STATUS_IS_OK(nt_status)) {
 928                 END_PROFILE(SMBsearch);
 929                 return ERROR_NT(nt_status);
 930         }
 931
 932         RESOLVE_DFSPATH_WCARD(path, conn, inbuf, outbuf);
 933
 934         p++;
 935         status_len = SVAL(p, 0);
 936         p += 2;
 937
 938         /* dirtype &= ~aDIR; */
 939
 940         if (status_len == 0) {
 941                 SMB_STRUCT_STAT sbuf;
 942                 pstring dir2;
 943
 944                 pstrcpy(directory,path);
 945                 pstrcpy(dir2,path);
 946                 nt_status = unix_convert(conn, directory, True, NULL, &sbuf);
 947                 if (!NT_STATUS_IS_OK(nt_status)) {
 948                         END_PROFILE(SMBsearch);
 949                         return ERROR_NT(nt_status);
 950                 }
 951                 unix_format(dir2);
 952
 953                 if (!check_name(directory,conn)) {
 954                         END_PROFILE(SMBsearch);
 955                         return UNIXERROR(ERRDOS, ERRnoaccess);
 956                 }
 957
 958                 p = strrchr_m(dir2,'/');
 959                 if (p == NULL) {
 960                         pstrcpy(mask,dir2);
 961                         *dir2 = 0;
 962                 } else {
 963                         *p = 0;
 964                         pstrcpy(mask,p+1);
 965                 }
 966
 967                 p = strrchr_m(directory,'/');
 968                 if (!p) {
 969                         *directory = 0;
 970                 } else {
 971                         *p = 0;
 972                 }
 973
 974                 if (strlen(directory) == 0) {
 975                         pstrcpy(directory,".");
 976                 }
 977                 memset((char *)status,'\0',21);
 978                 SCVAL(status,0,(dirtype & 0x1F));
 979         } else {
 980                 int status_dirtype;
 981
 982                 memcpy(status,p,21);
 983                 status_dirtype = CVAL(status,0) & 0x1F;
 984                 if (status_dirtype != (dirtype & 0x1F)) {
 985                         dirtype = status_dirtype;
 986                 }
 987
 988                 conn->dirptr = dptr_fetch(status+12,&dptr_num);
 989                 if (!conn->dirptr) {
 990                         goto SearchEmpty;
 991                 }
 992                 string_set(&conn->dirpath,dptr_path(dptr_num));
 993                 pstrcpy(mask, dptr_wcard(dptr_num));
 994         }
 995
 996         p = smb_buf(outbuf) + 3;
 997
 998         if (status_len == 0) {
 999                 dptr_num = dptr_create(conn,directory,True,expect_close,SVAL(inbuf,smb_pid), mask, mask_contains_wcard, dirtype);
1000                 if (dptr_num < 0) {
1001                         if(dptr_num == -2) {
1002                                 END_PROFILE(SMBsearch);
1003                                 return UNIXERROR(ERRDOS, ERRnofids);
1004                         }
1005                         END_PROFILE(SMBsearch);
1006                         return ERROR_DOS(ERRDOS,ERRnofids);
1007                 }
1008         } else {
1009                 dirtype = dptr_attr(dptr_num);
1010         }
1011
1012         DEBUG(4,("dptr_num is %d\n",dptr_num));
1013
1014         if ((dirtype&0x1F) == aVOLID) {
1015                 memcpy(p,status,21);
1016                 make_dir_struct(p,"???????????",volume_label(SNUM(conn)),
1017                                 0,aVOLID,0,!allow_long_path_components);
1018                 dptr_fill(p+12,dptr_num);
1019                 if (dptr_zero(p+12) && (status_len==0)) {
1020                         numentries = 1;
1021                 } else {
1022                         numentries = 0;
1023                 }
1024                 p += DIR_STRUCT_SIZE;
1025         } else {
1026                 unsigned int i;
1027                 maxentries = MIN(maxentries, ((BUFFER_SIZE - (p - outbuf))/DIR_STRUCT_SIZE));
1028
1029                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1030                         conn->dirpath,lp_dontdescend(SNUM(conn))));
1031                 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1032                         check_descend = True;
1033                 }
1034
1035                 for (i=numentries;(i<maxentries) && !finished;i++) {
1036                         finished = !get_dir_entry(conn,mask,dirtype,fname,&size,&mode,&date,check_descend);
1037                         if (!finished) {
1038                                 memcpy(p,status,21);
1039                                 make_dir_struct(p,mask,fname,size, mode,date,
1040                                                 !allow_long_path_components);
1041                                 if (!dptr_fill(p+12,dptr_num)) {
1042                                         break;
1043                                 }
1044                                 numentries++;
1045                                 p += DIR_STRUCT_SIZE;
1046                         }
1047                 }
1048         }
1049
1050   SearchEmpty:
1051
1052         /* If we were called as SMBffirst with smb_search_id == NULL
1053                 and no entries were found then return error and close dirptr
1054                 (X/Open spec) */
1055
1056         if (numentries == 0) {
1057                 dptr_close(&dptr_num);
1058         } else if(expect_close && status_len == 0) {
1059                 /* Close the dptr - we know it's gone */
1060                 dptr_close(&dptr_num);
1061         }
1062
1063         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1064         if(dptr_num >= 0 && CVAL(inbuf,smb_com) == SMBfunique) {
1065                 dptr_close(&dptr_num);
1066         }
1067
1068         if ((numentries == 0) && !mask_contains_wcard) {
1069                 return ERROR_BOTH(STATUS_NO_MORE_FILES,ERRDOS,ERRnofiles);
1070         }
1071
1072         SSVAL(outbuf,smb_vwv0,numentries);
1073         SSVAL(outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1074         SCVAL(smb_buf(outbuf),0,5);
1075         SSVAL(smb_buf(outbuf),1,numentries*DIR_STRUCT_SIZE);
1076
1077         /* The replies here are never long name. */
1078         SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1079         if (!allow_long_path_components) {
1080                 SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) & (~FLAGS2_LONG_PATH_COMPONENTS));
1081         }
1082
1083         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1084         SSVAL(outbuf,smb_flg2, (SVAL(outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1085
1086         outsize += DIR_STRUCT_SIZE*numentries;
1087         smb_setlen(outbuf,outsize - 4);
1088
1089         if ((! *directory) && dptr_path(dptr_num))
1090                 slprintf(directory, sizeof(directory)-1, "(%s)",dptr_path(dptr_num));
1091
1092         DEBUG( 4, ( "%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1093                 smb_fn_name(CVAL(inbuf,smb_com)),
1094                 mask, directory, dirtype, numentries, maxentries ) );
1095
1096         END_PROFILE(SMBsearch);
1097         return(outsize);
1098 }
1099
1100 /****************************************************************************
1101  Reply to a fclose (stop directory search).
1102 ****************************************************************************/
1103
1104 int reply_fclose(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1105 {
1106         int outsize = 0;
1107         int status_len;
1108         pstring path;
1109         char status[21];
1110         int dptr_num= -2;
1111         char *p;
1112         NTSTATUS err;
1113         BOOL path_contains_wcard = False;
1114
1115         START_PROFILE(SMBfclose);
1116
1117         if (lp_posix_pathnames()) {
1118                 END_PROFILE(SMBfclose);
1119                 return reply_unknown(inbuf, outbuf);
1120         }
1121
1122         outsize = set_message(outbuf,1,0,True);
1123         p = smb_buf(inbuf) + 1;
1124         p += srvstr_get_path_wcard(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &err, &path_contains_wcard);
1125         if (!NT_STATUS_IS_OK(err)) {
1126                 END_PROFILE(SMBfclose);
1127                 return ERROR_NT(err);
1128         }
1129         p++;
1130         status_len = SVAL(p,0);
1131         p += 2;
1132
1133         if (status_len == 0) {
1134                 END_PROFILE(SMBfclose);
1135                 return ERROR_DOS(ERRSRV,ERRsrverror);
1136         }
1137
1138         memcpy(status,p,21);
1139
1140         if(dptr_fetch(status+12,&dptr_num)) {
1141                 /*  Close the dptr - we know it's gone */
1142                 dptr_close(&dptr_num);
1143         }
1144
1145         SSVAL(outbuf,smb_vwv0,0);
1146
1147         DEBUG(3,("search close\n"));
1148
1149         END_PROFILE(SMBfclose);
1150         return(outsize);
1151 }
1152
1153 /****************************************************************************
1154  Reply to an open.
1155 ****************************************************************************/
1156
1157 int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1158 {
1159         pstring fname;
1160         int outsize = 0;
1161         uint32 fattr=0;
1162         SMB_OFF_T size = 0;
1163         time_t mtime=0;
1164         int info;
1165         SMB_STRUCT_STAT sbuf;
1166         files_struct *fsp;
1167         int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1168         int deny_mode;
1169         uint32 dos_attr = SVAL(inbuf,smb_vwv1);
1170         uint32 access_mask;
1171         uint32 share_mode;
1172         uint32 create_disposition;
1173         uint32 create_options = 0;
1174         NTSTATUS status;
1175         START_PROFILE(SMBopen);
1176
1177         deny_mode = SVAL(inbuf,smb_vwv0);
1178
1179         srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
1180         if (!NT_STATUS_IS_OK(status)) {
1181                 END_PROFILE(SMBopen);
1182                 return ERROR_NT(status);
1183         }
1184
1185         RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1186
1187         status = unix_convert(conn, fname, False, NULL, &sbuf);
1188         if (!NT_STATUS_IS_OK(status)) {
1189                 END_PROFILE(SMBopen);
1190                 return ERROR_NT(status);
1191         }
1192
1193         if (!map_open_params_to_ntcreate(fname, deny_mode, OPENX_FILE_EXISTS_OPEN,
1194                         &access_mask, &share_mode, &create_disposition, &create_options)) {
1195                 END_PROFILE(SMBopen);
1196                 return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1197         }
1198
1199         status = open_file_ntcreate(conn,fname,&sbuf,
1200                         access_mask,
1201                         share_mode,
1202                         create_disposition,
1203                         create_options,
1204                         dos_attr,
1205                         oplock_request,
1206                         &info, &fsp);
1207
1208         if (!NT_STATUS_IS_OK(status)) {
1209                 END_PROFILE(SMBopen);
1210                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1211                         /* We have re-scheduled this call. */
1212                         return -1;
1213                 }
1214                 return ERROR_NT(status);
1215         }
1216
1217         size = sbuf.st_size;
1218         fattr = dos_mode(conn,fname,&sbuf);
1219         mtime = sbuf.st_mtime;
1220
1221         if (fattr & aDIR) {
1222                 DEBUG(3,("attempt to open a directory %s\n",fname));
1223                 close_file(fsp,ERROR_CLOSE);
1224                 END_PROFILE(SMBopen);
1225                 return ERROR_DOS(ERRDOS,ERRnoaccess);
1226         }
1227
1228         outsize = set_message(outbuf,7,0,True);
1229         SSVAL(outbuf,smb_vwv0,fsp->fnum);
1230         SSVAL(outbuf,smb_vwv1,fattr);
1231         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1232                 srv_put_dos_date3(outbuf,smb_vwv2,mtime & ~1);
1233         } else {
1234                 srv_put_dos_date3(outbuf,smb_vwv2,mtime);
1235         }
1236         SIVAL(outbuf,smb_vwv4,(uint32)size);
1237         SSVAL(outbuf,smb_vwv6,deny_mode);
1238
1239         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1240                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1241         }
1242
1243         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1244                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1245         }
1246         END_PROFILE(SMBopen);
1247         return(outsize);
1248 }
1249
1250 /****************************************************************************
1251  Reply to an open and X.
1252 ****************************************************************************/
1253
1254 int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
1255 {
1256         pstring fname;
1257         uint16 open_flags = SVAL(inbuf,smb_vwv2);
1258         int deny_mode = SVAL(inbuf,smb_vwv3);
1259         uint32 smb_attr = SVAL(inbuf,smb_vwv5);
1260         /* Breakout the oplock request bits so we can set the
1261                 reply bits separately. */
1262         int ex_oplock_request = EXTENDED_OPLOCK_REQUEST(inbuf);
1263         int core_oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1264         int oplock_request = ex_oplock_request | core_oplock_request;
1265 #if 0
1266         int smb_sattr = SVAL(inbuf,smb_vwv4);
1267         uint32 smb_time = make_unix_date3(inbuf+smb_vwv6);
1268 #endif
1269         int smb_ofun = SVAL(inbuf,smb_vwv8);
1270         uint32 fattr=0;
1271         int mtime=0;
1272         SMB_STRUCT_STAT sbuf;
1273         int smb_action = 0;
1274         files_struct *fsp;
1275         NTSTATUS status;
1276         SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv9);
1277         ssize_t retval = -1;
1278         uint32 access_mask;
1279         uint32 share_mode;
1280         uint32 create_disposition;
1281         uint32 create_options = 0;
1282
1283         START_PROFILE(SMBopenX);
1284
1285         /* If it's an IPC, pass off the pipe handler. */
1286         if (IS_IPC(conn)) {
1287                 if (lp_nt_pipe_support()) {
1288                         END_PROFILE(SMBopenX);
1289                         return reply_open_pipe_and_X(conn, inbuf,outbuf,length,bufsize);
1290                 } else {
1291                         END_PROFILE(SMBopenX);
1292                         return ERROR_DOS(ERRSRV,ERRaccess);
1293                 }
1294         }
1295
1296         /* XXXX we need to handle passed times, sattr and flags */
1297         srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
1298         if (!NT_STATUS_IS_OK(status)) {
1299                 END_PROFILE(SMBopenX);
1300                 return ERROR_NT(status);
1301         }
1302
1303         RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1304
1305         status = unix_convert(conn, fname, False, NULL, &sbuf);
1306         if (!NT_STATUS_IS_OK(status)) {
1307                 END_PROFILE(SMBopenX);
1308                 return ERROR_NT(status);
1309         }
1310
1311         if (!map_open_params_to_ntcreate(fname, deny_mode, smb_ofun,
1312                                 &access_mask,
1313                                 &share_mode,
1314                                 &create_disposition,
1315                                 &create_options)) {
1316                 END_PROFILE(SMBopenX);
1317                 return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1318         }
1319
1320         status = open_file_ntcreate(conn,fname,&sbuf,
1321                         access_mask,
1322                         share_mode,
1323                         create_disposition,
1324                         create_options,
1325                         smb_attr,
1326                         oplock_request,
1327                         &smb_action, &fsp);
1328
1329         if (!NT_STATUS_IS_OK(status)) {
1330                 END_PROFILE(SMBopenX);
1331                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1332                         /* We have re-scheduled this call. */
1333                         return -1;
1334                 }
1335                 return ERROR_NT(status);
1336         }
1337
1338         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1339            if the file is truncated or created. */
1340         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1341                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1342                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1343                         close_file(fsp,ERROR_CLOSE);
1344                         END_PROFILE(SMBopenX);
1345                         return ERROR_NT(NT_STATUS_DISK_FULL);
1346                 }
1347                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1348                 if (retval < 0) {
1349                         close_file(fsp,ERROR_CLOSE);
1350                         END_PROFILE(SMBopenX);
1351                         return ERROR_NT(NT_STATUS_DISK_FULL);
1352                 }
1353                 sbuf.st_size = get_allocation_size(conn,fsp,&sbuf);
1354         }
1355
1356         fattr = dos_mode(conn,fname,&sbuf);
1357         mtime = sbuf.st_mtime;
1358         if (fattr & aDIR) {
1359                 close_file(fsp,ERROR_CLOSE);
1360                 END_PROFILE(SMBopenX);
1361                 return ERROR_DOS(ERRDOS,ERRnoaccess);
1362         }
1363
1364         /* If the caller set the extended oplock request bit
1365                 and we granted one (by whatever means) - set the
1366                 correct bit for extended oplock reply.
1367         */
1368
1369         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1370                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1371         }
1372
1373         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1374                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1375         }
1376
1377         /* If the caller set the core oplock request bit
1378                 and we granted one (by whatever means) - set the
1379                 correct bit for core oplock reply.
1380         */
1381
1382         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1383                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1384         }
1385
1386         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1387                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1388         }
1389
1390         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1391                 set_message(outbuf,19,0,True);
1392         } else {
1393                 set_message(outbuf,15,0,True);
1394         }
1395         SSVAL(outbuf,smb_vwv2,fsp->fnum);
1396         SSVAL(outbuf,smb_vwv3,fattr);
1397         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1398                 srv_put_dos_date3(outbuf,smb_vwv4,mtime & ~1);
1399         } else {
1400                 srv_put_dos_date3(outbuf,smb_vwv4,mtime);
1401         }
1402         SIVAL(outbuf,smb_vwv6,(uint32)sbuf.st_size);
1403         SSVAL(outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1404         SSVAL(outbuf,smb_vwv11,smb_action);
1405
1406         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1407                 SIVAL(outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1408         }
1409
1410         END_PROFILE(SMBopenX);
1411         return chain_reply(inbuf,outbuf,length,bufsize);
1412 }
1413
1414 /****************************************************************************
1415  Reply to a SMBulogoffX.
1416  conn POINTER CAN BE NULL HERE !
1417 ****************************************************************************/
1418
1419 int reply_ulogoffX(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
1420 {
1421         uint16 vuid = SVAL(inbuf,smb_uid);
1422         user_struct *vuser = get_valid_user_struct(vuid);
1423         START_PROFILE(SMBulogoffX);
1424
1425         if(vuser == 0)
1426                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n", vuid));
1427
1428         /* in user level security we are supposed to close any files
1429                 open by this user */
1430         if ((vuser != 0) && (lp_security() != SEC_SHARE))
1431                 file_close_user(vuid);
1432
1433         invalidate_vuid(vuid);
1434
1435         set_message(outbuf,2,0,True);
1436
1437         DEBUG( 3, ( "ulogoffX vuid=%d\n", vuid ) );
1438
1439         END_PROFILE(SMBulogoffX);
1440         return chain_reply(inbuf,outbuf,length,bufsize);
1441 }
1442
1443 /****************************************************************************
1444  Reply to a mknew or a create.
1445 ****************************************************************************/
1446
1447 int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1448 {
1449         pstring fname;
1450         int com;
1451         int outsize = 0;
1452         uint32 fattr = SVAL(inbuf,smb_vwv0);
1453         struct utimbuf times;
1454         files_struct *fsp;
1455         int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1456         SMB_STRUCT_STAT sbuf;
1457         NTSTATUS status;
1458         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1459         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1460         uint32 create_disposition;
1461         uint32 create_options = 0;
1462
1463         START_PROFILE(SMBcreate);
1464
1465         com = SVAL(inbuf,smb_com);
1466
1467         times.modtime = srv_make_unix_date3(inbuf + smb_vwv1);
1468
1469         srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), 0, STR_TERMINATE, &status);
1470         if (!NT_STATUS_IS_OK(status)) {
1471                 END_PROFILE(SMBcreate);
1472                 return ERROR_NT(status);
1473         }
1474
1475         RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1476
1477         status = unix_convert(conn, fname, False, NULL, &sbuf);
1478         if (!NT_STATUS_IS_OK(status)) {
1479                 END_PROFILE(SMBcreate);
1480                 return ERROR_NT(status);
1481         }
1482
1483         if (fattr & aVOLID) {
1484                 DEBUG(0,("Attempt to create file (%s) with volid set - please report this\n",fname));
1485         }
1486
1487         if(com == SMBmknew) {
1488                 /* We should fail if file exists. */
1489                 create_disposition = FILE_CREATE;
1490         } else {
1491                 /* Create if file doesn't exist, truncate if it does. */
1492                 create_disposition = FILE_OVERWRITE_IF;
1493         }
1494
1495         /* Open file using ntcreate. */
1496         status = open_file_ntcreate(conn,fname,&sbuf,
1497                                 access_mask,
1498                                 share_mode,
1499                                 create_disposition,
1500                                 create_options,
1501                                 fattr,
1502                                 oplock_request,
1503                                 NULL, &fsp);
1504
1505         if (!NT_STATUS_IS_OK(status)) {
1506                 END_PROFILE(SMBcreate);
1507                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1508                         /* We have re-scheduled this call. */
1509                         return -1;
1510                 }
1511                 return ERROR_NT(status);
1512         }
1513
1514         times.actime = sbuf.st_atime;
1515         file_utime(conn, fname, &times);
1516
1517         outsize = set_message(outbuf,1,0,True);
1518         SSVAL(outbuf,smb_vwv0,fsp->fnum);
1519
1520         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1521                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1522         }
1523
1524         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1525                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1526         }
1527
1528         DEBUG( 2, ( "reply_mknew: file %s\n", fname ) );
1529         DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n", fname, fsp->fh->fd, (unsigned int)fattr ) );
1530
1531         END_PROFILE(SMBcreate);
1532         return(outsize);
1533 }
1534
1535 /****************************************************************************
1536  Reply to a create temporary file.
1537 ****************************************************************************/
1538
1539 int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1540 {
1541         pstring fname;
1542         int outsize = 0;
1543         uint32 fattr = SVAL(inbuf,smb_vwv0);
1544         files_struct *fsp;
1545         int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1546         int tmpfd;
1547         SMB_STRUCT_STAT sbuf;
1548         char *p, *s;
1549         NTSTATUS status;
1550         unsigned int namelen;
1551
1552         START_PROFILE(SMBctemp);
1553
1554         srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
1555         if (!NT_STATUS_IS_OK(status)) {
1556                 END_PROFILE(SMBctemp);
1557                 return ERROR_NT(status);
1558         }
1559         if (*fname) {
1560                 pstrcat(fname,"/TMXXXXXX");
1561         } else {
1562                 pstrcat(fname,"TMXXXXXX");
1563         }
1564
1565         RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
1566
1567         status = unix_convert(conn, fname, False, NULL, &sbuf);
1568         if (!NT_STATUS_IS_OK(status)) {
1569                 END_PROFILE(SMBctemp);
1570                 return ERROR_NT(status);
1571         }
1572
1573         tmpfd = smb_mkstemp(fname);
1574         if (tmpfd == -1) {
1575                 END_PROFILE(SMBctemp);
1576                 return(UNIXERROR(ERRDOS,ERRnoaccess));
1577         }
1578
1579         SMB_VFS_STAT(conn,fname,&sbuf);
1580
1581         /* We should fail if file does not exist. */
1582         status = open_file_ntcreate(conn,fname,&sbuf,
1583                                 FILE_GENERIC_READ | FILE_GENERIC_WRITE,
1584                                 FILE_SHARE_READ|FILE_SHARE_WRITE,
1585                                 FILE_OPEN,
1586                                 0,
1587                                 fattr,
1588                                 oplock_request,
1589                                 NULL, &fsp);
1590
1591         /* close fd from smb_mkstemp() */
1592         close(tmpfd);
1593
1594         if (!NT_STATUS_IS_OK(status)) {
1595                 END_PROFILE(SMBctemp);
1596                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1597                         /* We have re-scheduled this call. */
1598                         return -1;
1599                 }
1600                 return ERROR_NT(status);
1601         }
1602
1603         outsize = set_message(outbuf,1,0,True);
1604         SSVAL(outbuf,smb_vwv0,fsp->fnum);
1605
1606         /* the returned filename is relative to the directory */
1607         s = strrchr_m(fname, '/');
1608         if (!s) {
1609                 s = fname;
1610         } else {
1611                 s++;
1612         }
1613
1614         p = smb_buf(outbuf);
1615 #if 0
1616         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
1617            thing in the byte section. JRA */
1618         SSVALS(p, 0, -1); /* what is this? not in spec */
1619 #endif
1620         namelen = srvstr_push(outbuf, p, s, -1, STR_ASCII|STR_TERMINATE);
1621         p += namelen;
1622         outsize = set_message_end(outbuf, p);
1623
1624         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1625                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1626         }
1627
1628         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1629                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1630         }
1631
1632         DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fname ) );
1633         DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fname, fsp->fh->fd,
1634                         (unsigned int)sbuf.st_mode ) );
1635
1636         END_PROFILE(SMBctemp);
1637         return(outsize);
1638 }
1639
1640 /*******************************************************************
1641  Check if a user is allowed to rename a file.
1642 ********************************************************************/
1643
1644 static NTSTATUS can_rename(connection_struct *conn, char *fname, uint16 dirtype, SMB_STRUCT_STAT *pst)
1645 {
1646         files_struct *fsp;
1647         uint32 fmode;
1648         NTSTATUS status;
1649
1650         if (!CAN_WRITE(conn)) {
1651                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1652         }
1653
1654         fmode = dos_mode(conn,fname,pst);
1655         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
1656                 return NT_STATUS_NO_SUCH_FILE;
1657         }
1658
1659         if (S_ISDIR(pst->st_mode)) {
1660                 return NT_STATUS_OK;
1661         }
1662
1663         status = open_file_ntcreate(conn, fname, pst,
1664                                 DELETE_ACCESS,
1665                                 FILE_SHARE_READ|FILE_SHARE_WRITE,
1666                                 FILE_OPEN,
1667                                 0,
1668                                 FILE_ATTRIBUTE_NORMAL,
1669                                 0,
1670                                 NULL, &fsp);
1671
1672         if (!NT_STATUS_IS_OK(status)) {
1673                 return status;
1674         }
1675         close_file(fsp,NORMAL_CLOSE);
1676         return NT_STATUS_OK;
1677 }
1678
1679 /*******************************************************************
1680  Check if a user is allowed to delete a file.
1681 ********************************************************************/
1682
1683 static NTSTATUS can_delete(connection_struct *conn, char *fname,
1684                            uint32 dirtype, BOOL can_defer)
1685 {
1686         SMB_STRUCT_STAT sbuf;
1687         uint32 fattr;
1688         files_struct *fsp;
1689         uint32 dirtype_orig = dirtype;
1690         NTSTATUS status;
1691
1692         DEBUG(10,("can_delete: %s, dirtype = %d\n", fname, dirtype ));
1693
1694         if (!CAN_WRITE(conn)) {
1695                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1696         }
1697
1698         if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
1699                 return map_nt_error_from_unix(errno);
1700         }
1701
1702         fattr = dos_mode(conn,fname,&sbuf);
1703
1704         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
1705                 dirtype = aDIR|aARCH|aRONLY;
1706         }
1707
1708         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
1709         if (!dirtype) {
1710                 return NT_STATUS_NO_SUCH_FILE;
1711         }
1712
1713         if (!dir_check_ftype(conn, fattr, dirtype)) {
1714                 if (fattr & aDIR) {
1715                         return NT_STATUS_FILE_IS_A_DIRECTORY;
1716                 }
1717                 return NT_STATUS_NO_SUCH_FILE;
1718         }
1719
1720         if (dirtype_orig & 0x8000) {
1721                 /* These will never be set for POSIX. */
1722                 return NT_STATUS_NO_SUCH_FILE;
1723         }
1724
1725 #if 0
1726         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
1727                 return NT_STATUS_FILE_IS_A_DIRECTORY;
1728         }
1729
1730         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
1731                 return NT_STATUS_NO_SUCH_FILE;
1732         }
1733
1734         if (dirtype & 0xFF00) {
1735                 /* These will never be set for POSIX. */
1736                 return NT_STATUS_NO_SUCH_FILE;
1737         }
1738
1739         dirtype &= 0xFF;
1740         if (!dirtype) {
1741                 return NT_STATUS_NO_SUCH_FILE;
1742         }
1743
1744         /* Can't delete a directory. */
1745         if (fattr & aDIR) {
1746                 return NT_STATUS_FILE_IS_A_DIRECTORY;
1747         }
1748 #endif
1749
1750 #if 0 /* JRATEST */
1751         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
1752                 return NT_STATUS_OBJECT_NAME_INVALID;
1753 #endif /* JRATEST */
1754
1755         /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
1756
1757           On a Windows share, a file with read-only dosmode can be opened with
1758           DELETE_ACCESS. But on a Samba share (delete readonly = no), it
1759           fails with NT_STATUS_CANNOT_DELETE error.
1760
1761           This semantic causes a problem that a user can not
1762           rename a file with read-only dosmode on a Samba share
1763           from a Windows command prompt (i.e. cmd.exe, but can rename
1764           from Windows Explorer).
1765         */
1766
1767         if (!lp_delete_readonly(SNUM(conn))) {
1768                 if (fattr & aRONLY) {
1769                         return NT_STATUS_CANNOT_DELETE;
1770                 }
1771         }
1772
1773         /* On open checks the open itself will check the share mode, so
1774            don't do it here as we'll get it wrong. */
1775
1776         status = open_file_ntcreate(conn, fname, &sbuf,
1777                                     DELETE_ACCESS,
1778                                     FILE_SHARE_NONE,
1779                                     FILE_OPEN,
1780                                     0,
1781                                     FILE_ATTRIBUTE_NORMAL,
1782                                     can_defer ? 0 : INTERNAL_OPEN_ONLY,
1783                                     NULL, &fsp);
1784
1785         if (NT_STATUS_IS_OK(status)) {
1786                 close_file(fsp,NORMAL_CLOSE);
1787         }
1788         return status;
1789 }
1790
1791 /****************************************************************************
1792  The guts of the unlink command, split out so it may be called by the NT SMB
1793  code.
1794 ****************************************************************************/
1795
1796 NTSTATUS unlink_internals(connection_struct *conn, uint32 dirtype,
1797                           char *name, BOOL has_wild, BOOL can_defer)
1798 {
1799         pstring directory;
1800         pstring mask;
1801         char *p;
1802         int count=0;
1803         NTSTATUS status = NT_STATUS_OK;
1804         SMB_STRUCT_STAT sbuf;
1805
1806         *directory = *mask = 0;
1807
1808         status = unix_convert(conn, name, has_wild, NULL, &sbuf);
1809         if (!NT_STATUS_IS_OK(status)) {
1810                 return status;
1811         }
1812
1813         p = strrchr_m(name,'/');
1814         if (!p) {
1815                 pstrcpy(directory,".");
1816                 pstrcpy(mask,name);
1817         } else {
1818                 *p = 0;
1819                 pstrcpy(directory,name);
1820                 pstrcpy(mask,p+1);
1821         }
1822
1823         /*
1824          * We should only check the mangled cache
1825          * here if unix_convert failed. This means
1826          * that the path in 'mask' doesn't exist
1827          * on the file system and so we need to look
1828          * for a possible mangle. This patch from
1829          * Tine Smukavec <valentin.smukavec@hermes.si>.
1830          */
1831
1832         if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params))
1833                 mangle_check_cache( mask, sizeof(pstring)-1, conn->params );
1834
1835         if (!has_wild) {
1836                 pstrcat(directory,"/");
1837                 pstrcat(directory,mask);
1838                 if (dirtype == 0) {
1839                         dirtype = FILE_ATTRIBUTE_NORMAL;
1840                 }
1841                 status = can_delete(conn,directory,dirtype,can_defer);
1842                 if (!NT_STATUS_IS_OK(status))
1843                         return status;
1844
1845                 if (SMB_VFS_UNLINK(conn,directory) == 0) {
1846                         count++;
1847                 }
1848         } else {
1849                 struct smb_Dir *dir_hnd = NULL;
1850                 const char *dname;
1851
1852                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
1853                         return NT_STATUS_OBJECT_NAME_INVALID;
1854                 }
1855
1856                 if (strequal(mask,"????????.???"))
1857                         pstrcpy(mask,"*");
1858
1859                 if (check_name(directory,conn))
1860                         dir_hnd = OpenDir(conn, directory, mask, dirtype);
1861
1862                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
1863                    the pattern matches against the long name, otherwise the short name
1864                    We don't implement this yet XXXX
1865                 */
1866
1867                 if (dir_hnd) {
1868                         long offset = 0;
1869                         status = NT_STATUS_NO_SUCH_FILE;
1870
1871                         while ((dname = ReadDirName(dir_hnd, &offset))) {
1872                                 SMB_STRUCT_STAT st;
1873                                 pstring fname;
1874                                 pstrcpy(fname,dname);
1875
1876                                 if (!is_visible_file(conn, directory, dname, &st, True)) {
1877                                         continue;
1878                                 }
1879
1880                                 /* Quick check for "." and ".." */
1881                                 if (fname[0] == '.') {
1882                                         if (!fname[1] || (fname[1] == '.' && !fname[2])) {
1883                                                 continue;
1884                                         }
1885                                 }
1886
1887                                 if(!mask_match(fname, mask, conn->case_sensitive))
1888                                         continue;
1889
1890                                 slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
1891                                 status = can_delete(conn, fname, dirtype,
1892                                                     can_defer);
1893                                 if (!NT_STATUS_IS_OK(status)) {
1894                                         continue;
1895                                 }
1896                                 if (SMB_VFS_UNLINK(conn,fname) == 0)
1897                                         count++;
1898                                 DEBUG(3,("unlink_internals: succesful unlink [%s]\n",fname));
1899                         }
1900                         CloseDir(dir_hnd);
1901                 }
1902         }
1903
1904         if (count == 0 && NT_STATUS_IS_OK(status)) {
1905                 status = map_nt_error_from_unix(errno);
1906         }
1907
1908         return status;
1909 }
1910
1911 /****************************************************************************
1912  Reply to a unlink
1913 ****************************************************************************/
1914
1915 int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
1916                  int dum_buffsize)
1917 {
1918         int outsize = 0;
1919         pstring name;
1920         uint32 dirtype;
1921         NTSTATUS status;
1922         BOOL path_contains_wcard = False;
1923
1924         START_PROFILE(SMBunlink);
1925
1926         dirtype = SVAL(inbuf,smb_vwv0);
1927
1928         srvstr_get_path_wcard(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, &path_contains_wcard);
1929         if (!NT_STATUS_IS_OK(status)) {
1930                 END_PROFILE(SMBunlink);
1931                 return ERROR_NT(status);
1932         }
1933
1934         RESOLVE_DFSPATH_WCARD(name, conn, inbuf, outbuf);
1935
1936         DEBUG(3,("reply_unlink : %s\n",name));
1937
1938         status = unlink_internals(conn, dirtype, name, path_contains_wcard,
1939                                   True);
1940         if (!NT_STATUS_IS_OK(status)) {
1941                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1942                         /* We have re-scheduled this call. */
1943                         return -1;
1944                 }
1945                 return ERROR_NT(status);
1946         }
1947
1948         /*
1949          * Win2k needs a changenotify request response before it will
1950          * update after a rename..
1951          */
1952         process_pending_change_notify_queue((time_t)0);
1953
1954         outsize = set_message(outbuf,0,0,False);
1955
1956         END_PROFILE(SMBunlink);
1957         return outsize;
1958 }
1959
1960 /****************************************************************************
1961  Fail for readbraw.
1962 ****************************************************************************/
1963
1964 static void fail_readraw(void)
1965 {
1966         pstring errstr;
1967         slprintf(errstr, sizeof(errstr)-1, "FAIL ! reply_readbraw: socket write fail (%s)",
1968                 strerror(errno) );
1969         exit_server_cleanly(errstr);
1970 }
1971
1972 #if defined(WITH_SENDFILE)
1973 /****************************************************************************
1974  Fake (read/write) sendfile. Returns -1 on read or write fail.
1975 ****************************************************************************/
1976
1977 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread, char *buf, int bufsize)
1978 {
1979         ssize_t ret=0;
1980
1981         /* Paranioa check... */
1982         if (nread > bufsize) {
1983                 fail_readraw();
1984         }
1985
1986         if (nread > 0) {
1987                 ret = read_file(fsp,buf,startpos,nread);
1988                 if (ret == -1) {
1989                         return -1;
1990                 }
1991         }
1992
1993         /* If we had a short read, fill with zeros. */
1994         if (ret < nread) {
1995                 memset(buf, '\0', nread - ret);
1996         }
1997
1998         if (write_data(smbd_server_fd(),buf,nread) != nread) {
1999                 return -1;
2000         }
2001
2002         return (ssize_t)nread;
2003 }
2004 #endif
2005
2006 /****************************************************************************
2007  Use sendfile in readbraw.
2008 ****************************************************************************/
2009
2010 void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T startpos, size_t nread,
2011                 ssize_t mincount, char *outbuf, int out_buffsize)
2012 {
2013         ssize_t ret=0;
2014
2015 #if defined(WITH_SENDFILE)
2016         /*
2017          * We can only use sendfile on a non-chained packet
2018          * but we can use on a non-oplocked file. tridge proved this
2019          * on a train in Germany :-). JRA.
2020          * reply_readbraw has already checked the length.
2021          */
2022
2023         if ( (chain_size == 0) && (nread > 0) &&
2024             (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2025                 DATA_BLOB header;
2026
2027                 _smb_setlen(outbuf,nread);
2028                 header.data = (uint8 *)outbuf;
2029                 header.length = 4;
2030                 header.free = NULL;
2031
2032                 if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fh->fd, &header, startpos, nread) == -1) {
2033                         /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
2034                         if (errno == ENOSYS) {
2035                                 goto normal_readbraw;
2036                         }
2037
2038                         /*
2039                          * Special hack for broken Linux with no working sendfile. If we
2040                          * return EINTR we sent the header but not the rest of the data.
2041                          * Fake this up by doing read/write calls.
2042                          */
2043                         if (errno == EINTR) {
2044                                 /* Ensure we don't do this again. */
2045                                 set_use_sendfile(SNUM(conn), False);
2046                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2047
2048                                 if (fake_sendfile(fsp, startpos, nread, outbuf + 4, out_buffsize - 4) == -1) {
2049                                         DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2050                                                 fsp->fsp_name, strerror(errno) ));
2051                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2052                                 }
2053                                 return;
2054                         }
2055
2056                         DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2057                                 fsp->fsp_name, strerror(errno) ));
2058                         exit_server_cleanly("send_file_readbraw sendfile failed");
2059                 }
2060
2061         }
2062
2063   normal_readbraw:
2064
2065 #endif
2066
2067         if (nread > 0) {
2068                 ret = read_file(fsp,outbuf+4,startpos,nread);
2069 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2070                 if (ret < mincount)
2071                         ret = 0;
2072 #else
2073                 if (ret < nread)
2074                         ret = 0;
2075 #endif
2076         }
2077
2078         _smb_setlen(outbuf,ret);
2079         if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2080                 fail_readraw();
2081 }
2082
2083 /****************************************************************************
2084  Reply to a readbraw (core+ protocol).
2085 ****************************************************************************/
2086
2087 int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int out_buffsize)
2088 {
2089         ssize_t maxcount,mincount;
2090         size_t nread = 0;
2091         SMB_OFF_T startpos;
2092         char *header = outbuf;
2093         files_struct *fsp;
2094         START_PROFILE(SMBreadbraw);
2095
2096         if (srv_is_signing_active()) {
2097                 exit_server_cleanly("reply_readbraw: SMB signing is active - raw reads/writes are disallowed.");
2098         }
2099
2100         /*
2101          * Special check if an oplock break has been issued
2102          * and the readraw request croses on the wire, we must
2103          * return a zero length response here.
2104          */
2105
2106         fsp = file_fsp(inbuf,smb_vwv0);
2107
2108         if (!FNUM_OK(fsp,conn) || !fsp->can_read) {
2109                 /*
2110                  * fsp could be NULL here so use the value from the packet. JRA.
2111                  */
2112                 DEBUG(3,("fnum %d not open in readbraw - cache prime?\n",(int)SVAL(inbuf,smb_vwv0)));
2113                 _smb_setlen(header,0);
2114                 if (write_data(smbd_server_fd(),header,4) != 4)
2115                         fail_readraw();
2116                 END_PROFILE(SMBreadbraw);
2117                 return(-1);
2118         }
2119
2120         CHECK_FSP(fsp,conn);
2121
2122         flush_write_cache(fsp, READRAW_FLUSH);
2123
2124         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv1);
2125         if(CVAL(inbuf,smb_wct) == 10) {
2126                 /*
2127                  * This is a large offset (64 bit) read.
2128                  */
2129 #ifdef LARGE_SMB_OFF_T
2130
2131                 startpos |= (((SMB_OFF_T)IVAL(inbuf,smb_vwv8)) << 32);
2132
2133 #else /* !LARGE_SMB_OFF_T */
2134
2135                 /*
2136                  * Ensure we haven't been sent a >32 bit offset.
2137                  */
2138
2139                 if(IVAL(inbuf,smb_vwv8) != 0) {
2140                         DEBUG(0,("readbraw - large offset (%x << 32) used and we don't support \
2141 64 bit offsets.\n", (unsigned int)IVAL(inbuf,smb_vwv8) ));
2142                         _smb_setlen(header,0);
2143                         if (write_data(smbd_server_fd(),header,4) != 4)
2144                                 fail_readraw();
2145                         END_PROFILE(SMBreadbraw);
2146                         return(-1);
2147                 }
2148
2149 #endif /* LARGE_SMB_OFF_T */
2150
2151                 if(startpos < 0) {
2152                         DEBUG(0,("readbraw - negative 64 bit readraw offset (%.0f) !\n", (double)startpos ));
2153                         _smb_setlen(header,0);
2154                         if (write_data(smbd_server_fd(),header,4) != 4)
2155                                 fail_readraw();
2156                         END_PROFILE(SMBreadbraw);
2157                         return(-1);
2158                 }
2159         }
2160         maxcount = (SVAL(inbuf,smb_vwv3) & 0xFFFF);
2161         mincount = (SVAL(inbuf,smb_vwv4) & 0xFFFF);
2162
2163         /* ensure we don't overrun the packet size */
2164         maxcount = MIN(65535,maxcount);
2165
2166         if (!is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
2167                 SMB_STRUCT_STAT st;
2168                 SMB_OFF_T size = 0;
2169
2170                 if (SMB_VFS_FSTAT(fsp,fsp->fh->fd,&st) == 0) {
2171                         size = st.st_size;
2172                 }
2173
2174                 if (startpos >= size) {
2175                         nread = 0;
2176                 } else {
2177                         nread = MIN(maxcount,(size - startpos));
2178                 }
2179         }
2180
2181 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2182         if (nread < mincount)
2183                 nread = 0;
2184 #endif
2185
2186         DEBUG( 3, ( "readbraw fnum=%d start=%.0f max=%lu min=%lu nread=%lu\n", fsp->fnum, (double)startpos,
2187                                 (unsigned long)maxcount, (unsigned long)mincount, (unsigned long)nread ) );
2188
2189         send_file_readbraw(conn, fsp, startpos, nread, mincount, outbuf, out_buffsize);
2190
2191         DEBUG(5,("readbraw finished\n"));
2192         END_PROFILE(SMBreadbraw);
2193         return -1;
2194 }
2195
2196 #undef DBGC_CLASS
2197 #define DBGC_CLASS DBGC_LOCKING
2198
2199 /****************************************************************************
2200  Reply to a lockread (core+ protocol).
2201 ****************************************************************************/
2202
2203 int reply_lockread(connection_struct *conn, char *inbuf,char *outbuf, int length, int dum_buffsiz)
2204 {
2205         ssize_t nread = -1;
2206         char *data;
2207         int outsize = 0;
2208         SMB_OFF_T startpos;
2209         size_t numtoread;
2210         NTSTATUS status;
2211         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2212         struct byte_range_lock *br_lck = NULL;
2213         START_PROFILE(SMBlockread);
2214
2215         CHECK_FSP(fsp,conn);
2216         if (!CHECK_READ(fsp,inbuf)) {
2217                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2218         }
2219
2220         release_level_2_oplocks_on_change(fsp);
2221
2222         numtoread = SVAL(inbuf,smb_vwv1);
2223         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
2224
2225         outsize = set_message(outbuf,5,3,True);
2226         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
2227         data = smb_buf(outbuf) + 3;
2228
2229         /*
2230          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
2231          * protocol request that predates the read/write lock concept.
2232          * Thus instead of asking for a read lock here we need to ask
2233          * for a write lock. JRA.
2234          * Note that the requested lock size is unaffected by max_recv.
2235          */
2236
2237         br_lck = do_lock(fsp,
2238                         (uint32)SVAL(inbuf,smb_pid),
2239                         (SMB_BIG_UINT)numtoread,
2240                         (SMB_BIG_UINT)startpos,
2241                         WRITE_LOCK,
2242                         WINDOWS_LOCK,
2243                         False, /* Non-blocking lock. */
2244                         &status);
2245         TALLOC_FREE(br_lck);
2246
2247         if (NT_STATUS_V(status)) {
2248                 END_PROFILE(SMBlockread);
2249                 return ERROR_NT(status);
2250         }
2251
2252         /*
2253          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
2254          */
2255
2256         if (numtoread > max_recv) {
2257                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
2258 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
2259                         (unsigned int)numtoread, (unsigned int)max_recv ));
2260                 numtoread = MIN(numtoread,max_recv);
2261         }
2262         nread = read_file(fsp,data,startpos,numtoread);
2263
2264         if (nread < 0) {
2265                 END_PROFILE(SMBlockread);
2266                 return(UNIXERROR(ERRDOS,ERRnoaccess));
2267         }
2268
2269         outsize += nread;
2270         SSVAL(outbuf,smb_vwv0,nread);
2271         SSVAL(outbuf,smb_vwv5,nread+3);
2272         SSVAL(smb_buf(outbuf),1,nread);
2273
2274         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
2275                  fsp->fnum, (int)numtoread, (int)nread));
2276
2277         END_PROFILE(SMBlockread);
2278         return(outsize);
2279 }
2280
2281 #undef DBGC_CLASS
2282 #define DBGC_CLASS DBGC_ALL
2283
2284 /****************************************************************************
2285  Reply to a read.
2286 ****************************************************************************/
2287
2288 int reply_read(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
2289 {
2290         size_t numtoread;
2291         ssize_t nread = 0;
2292         char *data;
2293         SMB_OFF_T startpos;
2294         int outsize = 0;
2295         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2296         START_PROFILE(SMBread);
2297
2298         CHECK_FSP(fsp,conn);
2299         if (!CHECK_READ(fsp,inbuf)) {
2300                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2301         }
2302
2303         numtoread = SVAL(inbuf,smb_vwv1);
2304         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
2305
2306         outsize = set_message(outbuf,5,3,True);
2307         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
2308         /*
2309          * The requested read size cannot be greater than max_recv. JRA.
2310          */
2311         if (numtoread > max_recv) {
2312                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
2313 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
2314                         (unsigned int)numtoread, (unsigned int)max_recv ));
2315                 numtoread = MIN(numtoread,max_recv);
2316         }
2317
2318         data = smb_buf(outbuf) + 3;
2319
2320         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK)) {
2321                 END_PROFILE(SMBread);
2322                 return ERROR_DOS(ERRDOS,ERRlock);
2323         }
2324
2325         if (numtoread > 0)
2326                 nread = read_file(fsp,data,startpos,numtoread);
2327
2328         if (nread < 0) {
2329                 END_PROFILE(SMBread);
2330                 return(UNIXERROR(ERRDOS,ERRnoaccess));
2331         }
2332
2333         outsize += nread;
2334         SSVAL(outbuf,smb_vwv0,nread);
2335         SSVAL(outbuf,smb_vwv5,nread+3);
2336         SCVAL(smb_buf(outbuf),0,1);
2337         SSVAL(smb_buf(outbuf),1,nread);
2338
2339         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
2340                 fsp->fnum, (int)numtoread, (int)nread ) );
2341
2342         END_PROFILE(SMBread);
2343         return(outsize);
2344 }
2345
2346 /****************************************************************************
2347  Reply to a read and X - possibly using sendfile.
2348 ****************************************************************************/
2349
2350 int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length, int len_outbuf,
2351                 files_struct *fsp, SMB_OFF_T startpos, size_t smb_maxcnt)
2352 {
2353         int outsize = 0;
2354         ssize_t nread = -1;
2355         char *data = smb_buf(outbuf);
2356
2357 #if defined(WITH_SENDFILE)
2358         /*
2359          * We can only use sendfile on a non-chained packet
2360          * but we can use on a non-oplocked file. tridge proved this
2361          * on a train in Germany :-). JRA.
2362          */
2363
2364         if ((chain_size == 0) && (CVAL(inbuf,smb_vwv0) == 0xFF) &&
2365             lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
2366                 SMB_STRUCT_STAT sbuf;
2367                 DATA_BLOB header;
2368
2369                 if(SMB_VFS_FSTAT(fsp,fsp->fh->fd, &sbuf) == -1)
2370                         return(UNIXERROR(ERRDOS,ERRnoaccess));
2371
2372                 if (startpos > sbuf.st_size)
2373                         goto normal_read;
2374
2375                 if (smb_maxcnt > (sbuf.st_size - startpos))
2376                         smb_maxcnt = (sbuf.st_size - startpos);
2377
2378                 if (smb_maxcnt == 0)
2379                         goto normal_read;
2380
2381                 /*
2382                  * Set up the packet header before send. We
2383                  * assume here the sendfile will work (get the
2384                  * correct amount of data).
2385                  */
2386
2387                 SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
2388                 SSVAL(outbuf,smb_vwv5,smb_maxcnt);
2389                 SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
2390                 SSVAL(outbuf,smb_vwv7,((smb_maxcnt >> 16) & 1));
2391                 SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
2392                 SCVAL(outbuf,smb_vwv0,0xFF);
2393                 set_message(outbuf,12,smb_maxcnt,False);
2394                 header.data = (uint8 *)outbuf;
2395                 header.length = data - outbuf;
2396                 header.free = NULL;
2397
2398                 if ((nread = SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fh->fd, &header, startpos, smb_maxcnt)) == -1) {
2399                         /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
2400                         if (errno == ENOSYS) {
2401                                 goto normal_read;
2402                         }
2403
2404                         /*
2405                          * Special hack for broken Linux with no working sendfile. If we
2406                          * return EINTR we sent the header but not the rest of the data.
2407                          * Fake this up by doing read/write calls.
2408                          */
2409
2410                         if (errno == EINTR) {
2411                                 /* Ensure we don't do this again. */
2412                                 set_use_sendfile(SNUM(conn), False);
2413                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
2414
2415                                 if ((nread = fake_sendfile(fsp, startpos, smb_maxcnt, data,
2416                                                         len_outbuf - (data-outbuf))) == -1) {
2417                                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
2418                                                 fsp->fsp_name, strerror(errno) ));
2419                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
2420                                 }
2421                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
2422                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
2423                                 /* Returning -1 here means successful sendfile. */
2424                                 return -1;
2425                         }
2426
2427                         DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
2428                                 fsp->fsp_name, strerror(errno) ));
2429                         exit_server_cleanly("send_file_readX sendfile failed");
2430                 }
2431
2432                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
2433                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
2434                 /* Returning -1 here means successful sendfile. */
2435                 return -1;
2436         }
2437
2438   normal_read:
2439
2440 #endif
2441
2442         nread = read_file(fsp,data,startpos,smb_maxcnt);
2443
2444         if (nread < 0) {
2445                 return(UNIXERROR(ERRDOS,ERRnoaccess));
2446         }
2447
2448         outsize = set_message(outbuf,12,nread,False);
2449         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
2450         SSVAL(outbuf,smb_vwv5,nread);
2451         SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
2452         SSVAL(outbuf,smb_vwv7,((nread >> 16) & 1));
2453         SSVAL(smb_buf(outbuf),-2,nread);
2454
2455         DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
2456                 fsp->fnum, (int)smb_maxcnt, (int)nread ) );
2457
2458         /* Returning the number of bytes we want to send back - including header. */
2459         return outsize;
2460 }
2461
2462 /****************************************************************************
2463  Reply to a read and X.
2464 ****************************************************************************/
2465
2466 int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
2467 {
2468         files_struct *fsp = file_fsp(inbuf,smb_vwv2);
2469         SMB_OFF_T startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
2470         ssize_t nread = -1;
2471         size_t smb_maxcnt = SVAL(inbuf,smb_vwv5);
2472 #if 0
2473         size_t smb_mincnt = SVAL(inbuf,smb_vwv6);
2474 #endif
2475
2476         START_PROFILE(SMBreadX);
2477
2478         /* If it's an IPC, pass off the pipe handler. */
2479         if (IS_IPC(conn)) {
2480                 END_PROFILE(SMBreadX);
2481                 return reply_pipe_read_and_X(inbuf,outbuf,length,bufsize);
2482         }
2483
2484         CHECK_FSP(fsp,conn);
2485         if (!CHECK_READ(fsp,inbuf)) {
2486                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2487         }
2488
2489         set_message(outbuf,12,0,True);
2490
2491         if (global_client_caps & CAP_LARGE_READX) {
2492                 if (SVAL(inbuf,smb_vwv7) == 1) {
2493                         smb_maxcnt |= (1<<16);
2494                 }
2495                 if (smb_maxcnt > BUFFER_SIZE) {
2496                         DEBUG(0,("reply_read_and_X - read too large (%u) for reply buffer %u\n",
2497                                 (unsigned int)smb_maxcnt, (unsigned int)BUFFER_SIZE));
2498                         END_PROFILE(SMBreadX);
2499                         return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2500                 }
2501         }
2502
2503         if(CVAL(inbuf,smb_wct) == 12) {
2504 #ifdef LARGE_SMB_OFF_T
2505                 /*
2506                  * This is a large offset (64 bit) read.
2507                  */
2508                 startpos |= (((SMB_OFF_T)IVAL(inbuf,smb_vwv10)) << 32);
2509
2510 #else /* !LARGE_SMB_OFF_T */
2511
2512                 /*
2513                  * Ensure we haven't been sent a >32 bit offset.
2514                  */
2515
2516                 if(IVAL(inbuf,smb_vwv10) != 0) {
2517                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) used and we don't support \
2518 64 bit offsets.\n", (unsigned int)IVAL(inbuf,smb_vwv10) ));
2519                         END_PROFILE(SMBreadX);
2520                         return ERROR_DOS(ERRDOS,ERRbadaccess);
2521                 }
2522
2523 #endif /* LARGE_SMB_OFF_T */
2524
2525         }
2526
2527         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK)) {
2528                 END_PROFILE(SMBreadX);
2529                 return ERROR_DOS(ERRDOS,ERRlock);
2530         }
2531
2532         if (schedule_aio_read_and_X(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt)) {
2533                 END_PROFILE(SMBreadX);
2534                 return -1;
2535         }
2536
2537         nread = send_file_readX(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt);
2538         if (nread != -1)
2539                 nread = chain_reply(inbuf,outbuf,length,bufsize);
2540
2541         END_PROFILE(SMBreadX);
2542         return nread;
2543 }
2544
2545 /****************************************************************************
2546  Reply to a writebraw (core+ or LANMAN1.0 protocol).
2547 ****************************************************************************/
2548
2549 int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
2550 {
2551         ssize_t nwritten=0;
2552         ssize_t total_written=0;
2553         size_t numtowrite=0;
2554         size_t tcount;
2555         SMB_OFF_T startpos;
2556         char *data=NULL;
2557         BOOL write_through;
2558         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2559         int outsize = 0;
2560         START_PROFILE(SMBwritebraw);
2561
2562         if (srv_is_signing_active()) {
2563                 exit_server_cleanly("reply_writebraw: SMB signing is active - raw reads/writes are disallowed.");
2564         }
2565
2566         CHECK_FSP(fsp,conn);
2567         if (!CHECK_WRITE(fsp)) {
2568                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2569         }
2570
2571         tcount = IVAL(inbuf,smb_vwv1);
2572         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
2573         write_through = BITSETW(inbuf+smb_vwv7,0);
2574
2575         /* We have to deal with slightly different formats depending
2576                 on whether we are using the core+ or lanman1.0 protocol */
2577
2578         if(Protocol <= PROTOCOL_COREPLUS) {
2579                 numtowrite = SVAL(smb_buf(inbuf),-2);
2580                 data = smb_buf(inbuf);
2581         } else {
2582                 numtowrite = SVAL(inbuf,smb_vwv10);
2583                 data = smb_base(inbuf) + SVAL(inbuf, smb_vwv11);
2584         }
2585
2586         /* force the error type */
2587         SCVAL(inbuf,smb_com,SMBwritec);
2588         SCVAL(outbuf,smb_com,SMBwritec);
2589
2590         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
2591                 END_PROFILE(SMBwritebraw);
2592                 return(ERROR_DOS(ERRDOS,ERRlock));
2593         }
2594
2595         if (numtowrite>0)
2596                 nwritten = write_file(fsp,data,startpos,numtowrite);
2597
2598         DEBUG(3,("writebraw1 fnum=%d start=%.0f num=%d wrote=%d sync=%d\n",
2599                 fsp->fnum, (double)startpos, (int)numtowrite, (int)nwritten, (int)write_through));
2600
2601         if (nwritten < (ssize_t)numtowrite)  {
2602                 END_PROFILE(SMBwritebraw);
2603                 return(UNIXERROR(ERRHRD,ERRdiskfull));
2604         }
2605
2606         total_written = nwritten;
2607
2608         /* Return a message to the redirector to tell it to send more bytes */
2609         SCVAL(outbuf,smb_com,SMBwritebraw);
2610         SSVALS(outbuf,smb_vwv0,-1);
2611         outsize = set_message(outbuf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
2612         show_msg(outbuf);
2613         if (!send_smb(smbd_server_fd(),outbuf))
2614                 exit_server_cleanly("reply_writebraw: send_smb failed.");
2615
2616         /* Now read the raw data into the buffer and write it */
2617         if (read_smb_length(smbd_server_fd(),inbuf,SMB_SECONDARY_WAIT) == -1) {
2618                 exit_server_cleanly("secondary writebraw failed");
2619         }
2620
2621         /* Even though this is not an smb message, smb_len returns the generic length of an smb message */
2622         numtowrite = smb_len(inbuf);
2623
2624         /* Set up outbuf to return the correct return */
2625         outsize = set_message(outbuf,1,0,True);
2626         SCVAL(outbuf,smb_com,SMBwritec);
2627
2628         if (numtowrite != 0) {
2629
2630                 if (numtowrite > BUFFER_SIZE) {
2631                         DEBUG(0,("reply_writebraw: Oversize secondary write raw requested (%u). Terminating\n",
2632                                 (unsigned int)numtowrite ));
2633                         exit_server_cleanly("secondary writebraw failed");
2634                 }
2635
2636                 if (tcount > nwritten+numtowrite) {
2637                         DEBUG(3,("Client overestimated the write %d %d %d\n",
2638                                 (int)tcount,(int)nwritten,(int)numtowrite));
2639                 }
2640
2641                 if (read_data( smbd_server_fd(), inbuf+4, numtowrite) != numtowrite ) {
2642                         DEBUG(0,("reply_writebraw: Oversize secondary write raw read failed (%s). Terminating\n",
2643                                 strerror(errno) ));
2644                         exit_server_cleanly("secondary writebraw failed");
2645                 }
2646
2647                 nwritten = write_file(fsp,inbuf+4,startpos+nwritten,numtowrite);
2648                 if (nwritten == -1) {
2649                         END_PROFILE(SMBwritebraw);
2650                         return(UNIXERROR(ERRHRD,ERRdiskfull));
2651                 }
2652
2653                 if (nwritten < (ssize_t)numtowrite) {
2654                         SCVAL(outbuf,smb_rcls,ERRHRD);
2655                         SSVAL(outbuf,smb_err,ERRdiskfull);
2656                 }
2657
2658                 if (nwritten > 0)
2659                         total_written += nwritten;
2660         }
2661
2662         SSVAL(outbuf,smb_vwv0,total_written);
2663
2664         sync_file(conn, fsp, write_through);
2665
2666         DEBUG(3,("writebraw2 fnum=%d start=%.0f num=%d wrote=%d\n",
2667                 fsp->fnum, (double)startpos, (int)numtowrite,(int)total_written));
2668
2669         /* we won't return a status if write through is not selected - this follows what WfWg does */
2670         END_PROFILE(SMBwritebraw);
2671         if (!write_through && total_written==tcount) {
2672
2673 #if RABBIT_PELLET_FIX
2674                 /*
2675                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
2676                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this. JRA.
2677                  */
2678                 if (!send_keepalive(smbd_server_fd()))
2679                         exit_server_cleanly("reply_writebraw: send of keepalive failed");
2680 #endif
2681                 return(-1);
2682         }
2683
2684         return(outsize);
2685 }
2686
2687 #undef DBGC_CLASS
2688 #define DBGC_CLASS DBGC_LOCKING
2689
2690 /****************************************************************************
2691  Reply to a writeunlock (core+).
2692 ****************************************************************************/
2693
2694 int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
2695                       int size, int dum_buffsize)
2696 {
2697         ssize_t nwritten = -1;
2698         size_t numtowrite;
2699         SMB_OFF_T startpos;
2700         char *data;
2701         NTSTATUS status = NT_STATUS_OK;
2702         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2703         int outsize = 0;
2704         START_PROFILE(SMBwriteunlock);
2705
2706         CHECK_FSP(fsp,conn);
2707         if (!CHECK_WRITE(fsp)) {
2708                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2709         }
2710
2711         numtowrite = SVAL(inbuf,smb_vwv1);
2712         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
2713         data = smb_buf(inbuf) + 3;
2714
2715         if (numtowrite && is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
2716                 END_PROFILE(SMBwriteunlock);
2717                 return ERROR_DOS(ERRDOS,ERRlock);
2718         }
2719
2720         /* The special X/Open SMB protocol handling of
2721            zero length writes is *NOT* done for
2722            this call */
2723         if(numtowrite == 0) {
2724                 nwritten = 0;
2725         } else {
2726                 nwritten = write_file(fsp,data,startpos,numtowrite);
2727         }
2728
2729         sync_file(conn, fsp, False /* write through */);
2730
2731         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
2732                 END_PROFILE(SMBwriteunlock);
2733                 return(UNIXERROR(ERRHRD,ERRdiskfull));
2734         }
2735
2736         if (numtowrite) {
2737                 status = do_unlock(fsp,
2738                                 (uint32)SVAL(inbuf,smb_pid),
2739                                 (SMB_BIG_UINT)numtowrite,
2740                                 (SMB_BIG_UINT)startpos,
2741                                 WINDOWS_LOCK);
2742
2743                 if (NT_STATUS_V(status)) {
2744                         END_PROFILE(SMBwriteunlock);
2745                         return ERROR_NT(status);
2746                 }
2747         }
2748
2749         outsize = set_message(outbuf,1,0,True);
2750
2751         SSVAL(outbuf,smb_vwv0,nwritten);
2752
2753         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
2754                  fsp->fnum, (int)numtowrite, (int)nwritten));
2755
2756         END_PROFILE(SMBwriteunlock);
2757         return outsize;
2758 }
2759
2760 #undef DBGC_CLASS
2761 #define DBGC_CLASS DBGC_ALL
2762
2763 /****************************************************************************
2764  Reply to a write.
2765 ****************************************************************************/
2766
2767 int reply_write(connection_struct *conn, char *inbuf,char *outbuf,int size,int dum_buffsize)
2768 {
2769         size_t numtowrite;
2770         ssize_t nwritten = -1;
2771         SMB_OFF_T startpos;
2772         char *data;
2773         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2774         int outsize = 0;
2775         START_PROFILE(SMBwrite);
2776
2777         /* If it's an IPC, pass off the pipe handler. */
2778         if (IS_IPC(conn)) {
2779                 END_PROFILE(SMBwrite);
2780                 return reply_pipe_write(inbuf,outbuf,size,dum_buffsize);
2781         }
2782
2783         CHECK_FSP(fsp,conn);
2784         if (!CHECK_WRITE(fsp)) {
2785                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2786         }
2787
2788         numtowrite = SVAL(inbuf,smb_vwv1);
2789         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
2790         data = smb_buf(inbuf) + 3;
2791
2792         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
2793                 END_PROFILE(SMBwrite);
2794                 return ERROR_DOS(ERRDOS,ERRlock);
2795         }
2796
2797         /*
2798          * X/Open SMB protocol says that if smb_vwv1 is
2799          * zero then the file size should be extended or
2800          * truncated to the size given in smb_vwv[2-3].
2801          */
2802
2803         if(numtowrite == 0) {
2804                 /*
2805                  * This is actually an allocate call, and set EOF. JRA.
2806                  */
2807                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
2808                 if (nwritten < 0) {
2809                         END_PROFILE(SMBwrite);
2810                         return ERROR_NT(NT_STATUS_DISK_FULL);
2811                 }
2812                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
2813                 if (nwritten < 0) {
2814                         END_PROFILE(SMBwrite);
2815                         return ERROR_NT(NT_STATUS_DISK_FULL);
2816                 }
2817         } else
2818                 nwritten = write_file(fsp,data,startpos,numtowrite);
2819
2820         sync_file(conn, fsp, False);
2821
2822         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
2823                 END_PROFILE(SMBwrite);
2824                 return(UNIXERROR(ERRHRD,ERRdiskfull));
2825         }
2826
2827         outsize = set_message(outbuf,1,0,True);
2828
2829         SSVAL(outbuf,smb_vwv0,nwritten);
2830
2831         if (nwritten < (ssize_t)numtowrite) {
2832                 SCVAL(outbuf,smb_rcls,ERRHRD);
2833                 SSVAL(outbuf,smb_err,ERRdiskfull);
2834         }
2835
2836         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
2837
2838         END_PROFILE(SMBwrite);
2839         return(outsize);
2840 }
2841
2842 /****************************************************************************
2843  Reply to a write and X.
2844 ****************************************************************************/
2845
2846 int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
2847 {
2848         files_struct *fsp = file_fsp(inbuf,smb_vwv2);
2849         SMB_OFF_T startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
2850         size_t numtowrite = SVAL(inbuf,smb_vwv10);
2851         BOOL write_through = BITSETW(inbuf+smb_vwv7,0);
2852         ssize_t nwritten = -1;
2853         unsigned int smb_doff = SVAL(inbuf,smb_vwv11);
2854         unsigned int smblen = smb_len(inbuf);
2855         char *data;
2856         BOOL large_writeX = ((CVAL(inbuf,smb_wct) == 14) && (smblen > 0xFFFF));
2857         START_PROFILE(SMBwriteX);
2858
2859         /* If it's an IPC, pass off the pipe handler. */
2860         if (IS_IPC(conn)) {
2861                 END_PROFILE(SMBwriteX);
2862                 return reply_pipe_write_and_X(inbuf,outbuf,length,bufsize);
2863         }
2864
2865         CHECK_FSP(fsp,conn);
2866         if (!CHECK_WRITE(fsp)) {
2867                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2868         }
2869
2870         set_message(outbuf,6,0,True);
2871
2872         /* Deal with possible LARGE_WRITEX */
2873         if (large_writeX) {
2874                 numtowrite |= ((((size_t)SVAL(inbuf,smb_vwv9)) & 1 )<<16);
2875         }
2876
2877         if(smb_doff > smblen || (smb_doff + numtowrite > smblen)) {
2878                 END_PROFILE(SMBwriteX);
2879                 return ERROR_DOS(ERRDOS,ERRbadmem);
2880         }
2881
2882         data = smb_base(inbuf) + smb_doff;
2883
2884         if(CVAL(inbuf,smb_wct) == 14) {
2885 #ifdef LARGE_SMB_OFF_T
2886                 /*
2887                  * This is a large offset (64 bit) write.
2888                  */
2889                 startpos |= (((SMB_OFF_T)IVAL(inbuf,smb_vwv12)) << 32);
2890
2891 #else /* !LARGE_SMB_OFF_T */
2892
2893                 /*
2894                  * Ensure we haven't been sent a >32 bit offset.
2895                  */
2896
2897                 if(IVAL(inbuf,smb_vwv12) != 0) {
2898                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) used and we don't support \
2899 64 bit offsets.\n", (unsigned int)IVAL(inbuf,smb_vwv12) ));
2900                         END_PROFILE(SMBwriteX);
2901                         return ERROR_DOS(ERRDOS,ERRbadaccess);
2902                 }
2903
2904 #endif /* LARGE_SMB_OFF_T */
2905         }
2906
2907         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
2908                 END_PROFILE(SMBwriteX);
2909                 return ERROR_DOS(ERRDOS,ERRlock);
2910         }
2911
2912         /* X/Open SMB protocol says that, unlike SMBwrite
2913         if the length is zero then NO truncation is
2914         done, just a write of zero. To truncate a file,
2915         use SMBwrite. */
2916
2917         if(numtowrite == 0) {
2918                 nwritten = 0;
2919         } else {
2920
2921                 if (schedule_aio_write_and_X(conn, inbuf, outbuf, length, bufsize,
2922                                         fsp,data,startpos,numtowrite)) {
2923                         END_PROFILE(SMBwriteX);
2924                         return -1;
2925                 }
2926
2927                 nwritten = write_file(fsp,data,startpos,numtowrite);
2928         }
2929
2930         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
2931                 END_PROFILE(SMBwriteX);
2932                 return(UNIXERROR(ERRHRD,ERRdiskfull));
2933         }
2934
2935         SSVAL(outbuf,smb_vwv2,nwritten);
2936         if (large_writeX)
2937                 SSVAL(outbuf,smb_vwv4,(nwritten>>16)&1);
2938
2939         if (nwritten < (ssize_t)numtowrite) {
2940                 SCVAL(outbuf,smb_rcls,ERRHRD);
2941                 SSVAL(outbuf,smb_err,ERRdiskfull);
2942         }
2943
2944         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
2945                 fsp->fnum, (int)numtowrite, (int)nwritten));
2946
2947         sync_file(conn, fsp, write_through);
2948
2949         END_PROFILE(SMBwriteX);
2950         return chain_reply(inbuf,outbuf,length,bufsize);
2951 }
2952
2953 /****************************************************************************
2954  Reply to a lseek.
2955 ****************************************************************************/
2956
2957 int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
2958 {
2959         SMB_OFF_T startpos;
2960         SMB_OFF_T res= -1;
2961         int mode,umode;
2962         int outsize = 0;
2963         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2964         START_PROFILE(SMBlseek);
2965
2966         CHECK_FSP(fsp,conn);
2967
2968         flush_write_cache(fsp, SEEK_FLUSH);
2969
2970         mode = SVAL(inbuf,smb_vwv1) & 3;
2971         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
2972         startpos = (SMB_OFF_T)IVALS(inbuf,smb_vwv2);
2973
2974         switch (mode) {
2975                 case 0:
2976                         umode = SEEK_SET;
2977                         res = startpos;
2978                         break;
2979                 case 1:
2980                         umode = SEEK_CUR;
2981                         res = fsp->fh->pos + startpos;
2982                         break;
2983                 case 2:
2984                         umode = SEEK_END;
2985                         break;
2986                 default:
2987                         umode = SEEK_SET;
2988                         res = startpos;
2989                         break;
2990         }
2991
2992         if (umode == SEEK_END) {
2993                 if((res = SMB_VFS_LSEEK(fsp,fsp->fh->fd,startpos,umode)) == -1) {
2994                         if(errno == EINVAL) {
2995                                 SMB_OFF_T current_pos = startpos;
2996                                 SMB_STRUCT_STAT sbuf;
2997
2998                                 if(SMB_VFS_FSTAT(fsp,fsp->fh->fd, &sbuf) == -1) {
2999                                         END_PROFILE(SMBlseek);
3000                                         return(UNIXERROR(ERRDOS,ERRnoaccess));
3001                                 }
3002
3003                                 current_pos += sbuf.st_size;
3004                                 if(current_pos < 0)
3005                                         res = SMB_VFS_LSEEK(fsp,fsp->fh->fd,0,SEEK_SET);
3006                         }
3007                 }
3008
3009                 if(res == -1) {
3010                         END_PROFILE(SMBlseek);
3011                         return(UNIXERROR(ERRDOS,ERRnoaccess));
3012                 }
3013         }
3014
3015         fsp->fh->pos = res;
3016
3017         outsize = set_message(outbuf,2,0,True);
3018         SIVAL(outbuf,smb_vwv0,res);
3019
3020         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
3021                 fsp->fnum, (double)startpos, (double)res, mode));
3022
3023         END_PROFILE(SMBlseek);
3024         return(outsize);
3025 }
3026
3027 /****************************************************************************
3028  Reply to a flush.
3029 ****************************************************************************/
3030
3031 int reply_flush(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
3032 {
3033         int outsize = set_message(outbuf,0,0,False);
3034         uint16 fnum = SVAL(inbuf,smb_vwv0);
3035         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3036         START_PROFILE(SMBflush);
3037
3038         if (fnum != 0xFFFF)
3039                 CHECK_FSP(fsp,conn);
3040
3041         if (!fsp) {
3042                 file_sync_all(conn);
3043         } else {
3044                 sync_file(conn,fsp, True);
3045         }
3046
3047         DEBUG(3,("flush\n"));
3048         END_PROFILE(SMBflush);
3049         return(outsize);
3050 }
3051
3052 /****************************************************************************
3053  Reply to a exit.
3054  conn POINTER CAN BE NULL HERE !
3055 ****************************************************************************/
3056
3057 int reply_exit(connection_struct *conn,
3058                char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3059 {
3060         int outsize;
3061         START_PROFILE(SMBexit);
3062
3063         file_close_pid(SVAL(inbuf,smb_pid),SVAL(inbuf,smb_uid));
3064
3065         outsize = set_message(outbuf,0,0,False);
3066
3067         DEBUG(3,("exit\n"));
3068
3069         END_PROFILE(SMBexit);
3070         return(outsize);
3071 }
3072
3073 /****************************************************************************
3074  Reply to a close - has to deal with closing a directory opened by NT SMB's.
3075 ****************************************************************************/
3076
3077 int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
3078                 int dum_buffsize)
3079 {
3080         int outsize = 0;
3081         time_t mtime;
3082         int32 eclass = 0, err = 0;
3083         files_struct *fsp = NULL;
3084         START_PROFILE(SMBclose);
3085
3086         outsize = set_message(outbuf,0,0,False);
3087
3088         /* If it's an IPC, pass off to the pipe handler. */
3089         if (IS_IPC(conn)) {
3090                 END_PROFILE(SMBclose);
3091                 return reply_pipe_close(conn, inbuf,outbuf);
3092         }
3093
3094         fsp = file_fsp(inbuf,smb_vwv0);
3095
3096         /*
3097          * We can only use CHECK_FSP if we know it's not a directory.
3098          */
3099
3100         if(!fsp || (fsp->conn != conn) || (fsp->vuid != current_user.vuid)) {
3101                 END_PROFILE(SMBclose);
3102                 return ERROR_DOS(ERRDOS,ERRbadfid);
3103         }
3104
3105         if(fsp->is_directory) {
3106                 /*
3107                  * Special case - close NT SMB directory handle.
3108                  */
3109                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
3110                 close_file(fsp,NORMAL_CLOSE);
3111         } else {
3112                 /*
3113                  * Close ordinary file.
3114                  */
3115                 int close_err;
3116
3117                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
3118                          fsp->fh->fd, fsp->fnum,
3119                          conn->num_files_open));
3120
3121                 /*
3122                  * Take care of any time sent in the close.
3123                  */
3124
3125                 mtime = srv_make_unix_date3(inbuf+smb_vwv1);
3126                 fsp_set_pending_modtime(fsp, mtime);
3127
3128                 /*
3129                  * close_file() returns the unix errno if an error
3130                  * was detected on close - normally this is due to
3131                  * a disk full error. If not then it was probably an I/O error.
3132                  */
3133
3134                 if((close_err = close_file(fsp,NORMAL_CLOSE)) != 0) {
3135                         errno = close_err;
3136                         END_PROFILE(SMBclose);
3137                         return (UNIXERROR(ERRHRD,ERRgeneral));
3138                 }
3139         }
3140
3141         /* We have a cached error */
3142         if(eclass || err) {
3143                 END_PROFILE(SMBclose);
3144                 return ERROR_DOS(eclass,err);
3145         }
3146
3147         END_PROFILE(SMBclose);
3148         return(outsize);
3149 }
3150
3151 /****************************************************************************
3152  Reply to a writeclose (Core+ protocol).
3153 ****************************************************************************/
3154
3155 int reply_writeclose(connection_struct *conn,
3156                      char *inbuf,char *outbuf, int size, int dum_buffsize)
3157 {
3158         size_t numtowrite;
3159         ssize_t nwritten = -1;
3160         int outsize = 0;
3161         int close_err = 0;
3162         SMB_OFF_T startpos;
3163         char *data;
3164         time_t mtime;
3165         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3166         START_PROFILE(SMBwriteclose);
3167
3168         CHECK_FSP(fsp,conn);
3169         if (!CHECK_WRITE(fsp)) {
3170                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
3171         }
3172
3173         numtowrite = SVAL(inbuf,smb_vwv1);
3174         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
3175         mtime = srv_make_unix_date3(inbuf+smb_vwv4);
3176         data = smb_buf(inbuf) + 1;
3177
3178         if (numtowrite && is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3179                 END_PROFILE(SMBwriteclose);
3180                 return ERROR_DOS(ERRDOS,ERRlock);
3181         }
3182
3183         nwritten = write_file(fsp,data,startpos,numtowrite);
3184
3185         set_filetime(conn, fsp->fsp_name,mtime);
3186
3187         /*
3188          * More insanity. W2K only closes the file if writelen > 0.
3189          * JRA.
3190          */
3191
3192         if (numtowrite) {
3193                 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
3194                         fsp->fsp_name ));
3195                 close_err = close_file(fsp,NORMAL_CLOSE);
3196         }
3197
3198         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
3199                  fsp->fnum, (int)numtowrite, (int)nwritten,
3200                  conn->num_files_open));
3201
3202         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3203                 END_PROFILE(SMBwriteclose);
3204                 return(UNIXERROR(ERRHRD,ERRdiskfull));
3205         }
3206
3207         if(close_err != 0) {
3208                 errno = close_err;
3209                 END_PROFILE(SMBwriteclose);
3210                 return(UNIXERROR(ERRHRD,ERRgeneral));
3211         }
3212
3213         outsize = set_message(outbuf,1,0,True);
3214
3215         SSVAL(outbuf,smb_vwv0,nwritten);
3216         END_PROFILE(SMBwriteclose);
3217         return(outsize);
3218 }
3219
3220 #undef DBGC_CLASS
3221 #define DBGC_CLASS DBGC_LOCKING
3222
3223 /****************************************************************************
3224  Reply to a lock.
3225 ****************************************************************************/
3226
3227 int reply_lock(connection_struct *conn,
3228                char *inbuf,char *outbuf, int length, int dum_buffsize)
3229 {
3230         int outsize = set_message(outbuf,0,0,False);
3231         SMB_BIG_UINT count,offset;
3232         NTSTATUS status;
3233         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3234         struct byte_range_lock *br_lck = NULL;
3235
3236         START_PROFILE(SMBlock);
3237
3238         CHECK_FSP(fsp,conn);
3239
3240         release_level_2_oplocks_on_change(fsp);
3241
3242         count = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv1);
3243         offset = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv3);
3244
3245         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
3246                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
3247
3248         br_lck = do_lock(fsp,
3249                         (uint32)SVAL(inbuf,smb_pid),
3250                         count,
3251                         offset,
3252                         WRITE_LOCK,
3253                         WINDOWS_LOCK,
3254                         False, /* Non-blocking lock. */
3255                         &status);
3256
3257         TALLOC_FREE(br_lck);
3258
3259         if (NT_STATUS_V(status)) {
3260                 END_PROFILE(SMBlock);
3261                 return ERROR_NT(status);
3262         }
3263
3264         END_PROFILE(SMBlock);
3265         return(outsize);
3266 }
3267
3268 /****************************************************************************
3269  Reply to a unlock.
3270 ****************************************************************************/
3271
3272 int reply_unlock(connection_struct *conn, char *inbuf,char *outbuf, int size,
3273                  int dum_buffsize)
3274 {
3275         int outsize = set_message(outbuf,0,0,False);
3276         SMB_BIG_UINT count,offset;
3277         NTSTATUS status;
3278         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3279         START_PROFILE(SMBunlock);
3280
3281         CHECK_FSP(fsp,conn);
3282
3283         count = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv1);
3284         offset = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv3);
3285
3286         status = do_unlock(fsp,
3287                         (uint32)SVAL(inbuf,smb_pid),
3288                         count,
3289                         offset,
3290                         WINDOWS_LOCK);
3291
3292         if (NT_STATUS_V(status)) {
3293                 END_PROFILE(SMBunlock);
3294                 return ERROR_NT(status);
3295         }
3296
3297         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
3298                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
3299
3300         END_PROFILE(SMBunlock);
3301         return(outsize);
3302 }
3303
3304 #undef DBGC_CLASS
3305 #define DBGC_CLASS DBGC_ALL
3306
3307 /****************************************************************************
3308  Reply to a tdis.
3309  conn POINTER CAN BE NULL HERE !
3310 ****************************************************************************/
3311
3312 int reply_tdis(connection_struct *conn,
3313                char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3314 {
3315         int outsize = set_message(outbuf,0,0,False);
3316         uint16 vuid;
3317         START_PROFILE(SMBtdis);
3318
3319         vuid = SVAL(inbuf,smb_uid);
3320
3321         if (!conn) {
3322                 DEBUG(4,("Invalid connection in tdis\n"));
3323                 END_PROFILE(SMBtdis);
3324                 return ERROR_DOS(ERRSRV,ERRinvnid);
3325         }
3326
3327         conn->used = False;
3328
3329         close_cnum(conn,vuid);
3330
3331         END_PROFILE(SMBtdis);
3332         return outsize;
3333 }
3334
3335 /****************************************************************************
3336  Reply to a echo.
3337  conn POINTER CAN BE NULL HERE !
3338 ****************************************************************************/
3339
3340 int reply_echo(connection_struct *conn,
3341                char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3342 {
3343         int smb_reverb = SVAL(inbuf,smb_vwv0);
3344         int seq_num;
3345         unsigned int data_len = smb_buflen(inbuf);
3346         int outsize = set_message(outbuf,1,data_len,True);
3347         START_PROFILE(SMBecho);
3348
3349         if (data_len > BUFFER_SIZE) {
3350                 DEBUG(0,("reply_echo: data_len too large.\n"));
3351                 END_PROFILE(SMBecho);
3352                 return -1;
3353         }
3354
3355         /* copy any incoming data back out */
3356         if (data_len > 0)
3357                 memcpy(smb_buf(outbuf),smb_buf(inbuf),data_len);
3358
3359         if (smb_reverb > 100) {
3360                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
3361                 smb_reverb = 100;
3362         }
3363
3364         for (seq_num =1 ; seq_num <= smb_reverb ; seq_num++) {
3365                 SSVAL(outbuf,smb_vwv0,seq_num);
3366
3367                 smb_setlen(outbuf,outsize - 4);
3368
3369                 show_msg(outbuf);
3370                 if (!send_smb(smbd_server_fd(),outbuf))
3371                         exit_server_cleanly("reply_echo: send_smb failed.");
3372         }
3373
3374         DEBUG(3,("echo %d times\n", smb_reverb));
3375
3376         smb_echo_count++;
3377
3378         END_PROFILE(SMBecho);
3379         return -1;
3380 }
3381
3382 /****************************************************************************
3383  Reply to a printopen.
3384 ****************************************************************************/
3385
3386 int reply_printopen(connection_struct *conn,
3387                     char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3388 {
3389         int outsize = 0;
3390         files_struct *fsp;
3391         NTSTATUS status;
3392
3393         START_PROFILE(SMBsplopen);
3394
3395         if (!CAN_PRINT(conn)) {
3396                 END_PROFILE(SMBsplopen);
3397                 return ERROR_DOS(ERRDOS,ERRnoaccess);
3398         }
3399
3400         /* Open for exclusive use, write only. */
3401         status = print_fsp_open(conn, NULL, &fsp);
3402
3403         if (!NT_STATUS_IS_OK(status)) {
3404                 END_PROFILE(SMBsplopen);
3405                 return(ERROR_NT(status));
3406         }
3407
3408         outsize = set_message(outbuf,1,0,True);
3409         SSVAL(outbuf,smb_vwv0,fsp->fnum);
3410
3411         DEBUG(3,("openprint fd=%d fnum=%d\n",
3412                  fsp->fh->fd, fsp->fnum));
3413
3414         END_PROFILE(SMBsplopen);
3415         return(outsize);
3416 }
3417
3418 /****************************************************************************
3419  Reply to a printclose.
3420 ****************************************************************************/
3421
3422 int reply_printclose(connection_struct *conn,
3423                      char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3424 {
3425         int outsize = set_message(outbuf,0,0,False);
3426         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3427         int close_err = 0;
3428         START_PROFILE(SMBsplclose);
3429
3430         CHECK_FSP(fsp,conn);
3431
3432         if (!CAN_PRINT(conn)) {
3433                 END_PROFILE(SMBsplclose);
3434                 return ERROR_NT(NT_STATUS_DOS(ERRSRV, ERRerror));
3435         }
3436
3437         DEBUG(3,("printclose fd=%d fnum=%d\n",
3438                  fsp->fh->fd,fsp->fnum));
3439
3440         close_err = close_file(fsp,NORMAL_CLOSE);
3441
3442         if(close_err != 0) {
3443                 errno = close_err;
3444                 END_PROFILE(SMBsplclose);
3445                 return(UNIXERROR(ERRHRD,ERRgeneral));
3446         }
3447
3448         END_PROFILE(SMBsplclose);
3449         return(outsize);
3450 }
3451
3452 /****************************************************************************
3453  Reply to a printqueue.
3454 ****************************************************************************/
3455
3456 int reply_printqueue(connection_struct *conn,
3457                      char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3458 {
3459         int outsize = set_message(outbuf,2,3,True);
3460         int max_count = SVAL(inbuf,smb_vwv0);
3461         int start_index = SVAL(inbuf,smb_vwv1);
3462         START_PROFILE(SMBsplretq);
3463
3464         /* we used to allow the client to get the cnum wrong, but that
3465            is really quite gross and only worked when there was only
3466            one printer - I think we should now only accept it if they
3467            get it right (tridge) */
3468         if (!CAN_PRINT(conn)) {
3469                 END_PROFILE(SMBsplretq);
3470                 return ERROR_DOS(ERRDOS,ERRnoaccess);
3471         }
3472
3473         SSVAL(outbuf,smb_vwv0,0);
3474         SSVAL(outbuf,smb_vwv1,0);
3475         SCVAL(smb_buf(outbuf),0,1);
3476         SSVAL(smb_buf(outbuf),1,0);
3477
3478         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
3479                  start_index, max_count));
3480
3481         {
3482                 print_queue_struct *queue = NULL;
3483                 print_status_struct status;
3484                 char *p = smb_buf(outbuf) + 3;
3485                 int count = print_queue_status(SNUM(conn), &queue, &status);
3486                 int num_to_get = ABS(max_count);
3487                 int first = (max_count>0?start_index:start_index+max_count+1);
3488                 int i;
3489
3490                 if (first >= count)
3491                         num_to_get = 0;
3492                 else
3493                         num_to_get = MIN(num_to_get,count-first);
3494
3495
3496                 for (i=first;i<first+num_to_get;i++) {
3497                         srv_put_dos_date2(p,0,queue[i].time);
3498                         SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
3499                         SSVAL(p,5, queue[i].job);
3500                         SIVAL(p,7,queue[i].size);
3501                         SCVAL(p,11,0);
3502                         srvstr_push(outbuf, p+12, queue[i].fs_user, 16, STR_ASCII);
3503                         p += 28;
3504                 }
3505
3506                 if (count > 0) {
3507                         outsize = set_message(outbuf,2,28*count+3,False);
3508                         SSVAL(outbuf,smb_vwv0,count);
3509                         SSVAL(outbuf,smb_vwv1,(max_count>0?first+count:first-1));
3510                         SCVAL(smb_buf(outbuf),0,1);
3511                         SSVAL(smb_buf(outbuf),1,28*count);
3512                 }
3513
3514                 SAFE_FREE(queue);
3515
3516                 DEBUG(3,("%d entries returned in queue\n",count));
3517         }
3518
3519         END_PROFILE(SMBsplretq);
3520         return(outsize);
3521 }
3522
3523 /****************************************************************************
3524  Reply to a printwrite.
3525 ****************************************************************************/
3526
3527 int reply_printwrite(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3528 {
3529         int numtowrite;
3530         int outsize = set_message(outbuf,0,0,False);
3531         char *data;
3532         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3533
3534         START_PROFILE(SMBsplwr);
3535
3536         if (!CAN_PRINT(conn)) {
3537                 END_PROFILE(SMBsplwr);
3538                 return ERROR_DOS(ERRDOS,ERRnoaccess);
3539         }
3540
3541         CHECK_FSP(fsp,conn);
3542         if (!CHECK_WRITE(fsp)) {
3543                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
3544         }
3545
3546         numtowrite = SVAL(smb_buf(inbuf),1);
3547         data = smb_buf(inbuf) + 3;
3548
3549         if (write_file(fsp,data,-1,numtowrite) != numtowrite) {
3550                 END_PROFILE(SMBsplwr);
3551                 return(UNIXERROR(ERRHRD,ERRdiskfull));
3552         }
3553
3554         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
3555
3556         END_PROFILE(SMBsplwr);
3557         return(outsize);
3558 }
3559
3560 /****************************************************************************
3561  Reply to a mkdir.
3562 ****************************************************************************/
3563
3564 int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3565 {
3566         pstring directory;
3567         int outsize;
3568         NTSTATUS status;
3569         SMB_STRUCT_STAT sbuf;
3570
3571         START_PROFILE(SMBmkdir);
3572
3573         srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status);
3574         if (!NT_STATUS_IS_OK(status)) {
3575                 END_PROFILE(SMBmkdir);
3576                 return ERROR_NT(status);
3577         }
3578
3579         RESOLVE_DFSPATH(directory, conn, inbuf, outbuf);
3580
3581         status = unix_convert(conn, directory, False, NULL, &sbuf);
3582         if (!NT_STATUS_IS_OK(status)) {
3583                 END_PROFILE(SMBmkdir);
3584                 return ERROR_NT(status);
3585         }
3586
3587         status = create_directory(conn, directory);
3588
3589         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
3590
3591         if (!NT_STATUS_IS_OK(status)) {
3592
3593                 if (!use_nt_status()
3594                     && NT_STATUS_EQUAL(status,
3595                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
3596                         /*
3597                          * Yes, in the DOS error code case we get a
3598                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
3599                          * samba4 torture test.
3600                          */
3601                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
3602                 }
3603
3604                 END_PROFILE(SMBmkdir);
3605                 return ERROR_NT(status);
3606         }
3607
3608         outsize = set_message(outbuf,0,0,False);
3609
3610         DEBUG( 3, ( "mkdir %s ret=%d\n", directory, outsize ) );
3611
3612         END_PROFILE(SMBmkdir);
3613         return(outsize);
3614 }
3615
3616 /****************************************************************************
3617  Static function used by reply_rmdir to delete an entire directory
3618  tree recursively. Return True on ok, False on fail.
3619 ****************************************************************************/
3620
3621 static BOOL recursive_rmdir(connection_struct *conn, char *directory)
3622 {
3623         const char *dname = NULL;
3624         BOOL ret = True;
3625         long offset = 0;
3626         struct smb_Dir *dir_hnd = OpenDir(conn, directory, NULL, 0);
3627
3628         if(dir_hnd == NULL)
3629                 return False;
3630
3631         while((dname = ReadDirName(dir_hnd, &offset))) {
3632                 pstring fullname;
3633                 SMB_STRUCT_STAT st;
3634
3635                 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
3636                         continue;
3637
3638                 if (!is_visible_file(conn, directory, dname, &st, False))
3639                         continue;
3640
3641                 /* Construct the full name. */
3642                 if(strlen(directory) + strlen(dname) + 1 >= sizeof(fullname)) {
3643                         errno = ENOMEM;
3644                         ret = False;
3645                         break;
3646                 }
3647
3648                 pstrcpy(fullname, directory);
3649                 pstrcat(fullname, "/");
3650                 pstrcat(fullname, dname);
3651
3652                 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
3653                         ret = False;
3654                         break;
3655                 }
3656
3657                 if(st.st_mode & S_IFDIR) {
3658                         if(!recursive_rmdir(conn, fullname)) {
3659                                 ret = False;
3660                                 break;
3661                         }
3662                         if(SMB_VFS_RMDIR(conn,fullname) != 0) {
3663                                 ret = False;
3664                                 break;
3665                         }
3666                 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
3667                         ret = False;
3668                         break;
3669                 }
3670         }
3671         CloseDir(dir_hnd);
3672         return ret;
3673 }
3674
3675 /****************************************************************************
3676  The internals of the rmdir code - called elsewhere.
3677 ****************************************************************************/
3678
3679 BOOL rmdir_internals(connection_struct *conn, const char *directory)
3680 {
3681         int ret;
3682         SMB_STRUCT_STAT st;
3683
3684         ret = SMB_VFS_RMDIR(conn,directory);
3685         if (ret == 0) {
3686                 return True;
3687         }
3688
3689         if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
3690                 /*
3691                  * Check to see if the only thing in this directory are
3692                  * vetoed files/directories. If so then delete them and
3693                  * retry. If we fail to delete any of them (and we *don't*
3694                  * do a recursive delete) then fail the rmdir.
3695                  */
3696                 const char *dname;
3697                 long dirpos = 0;
3698                 struct smb_Dir *dir_hnd = OpenDir(conn, directory, NULL, 0);
3699
3700                 if(dir_hnd == NULL) {
3701                         errno = ENOTEMPTY;
3702                         goto err;
3703                 }
3704
3705                 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
3706                         if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
3707                                 continue;
3708                         if (!is_visible_file(conn, directory, dname, &st, False))
3709                                 continue;
3710                         if(!IS_VETO_PATH(conn, dname)) {
3711                                 CloseDir(dir_hnd);
3712                                 errno = ENOTEMPTY;
3713                                 goto err;
3714                         }
3715                 }
3716
3717                 /* We only have veto files/directories. Recursive delete. */
3718
3719                 RewindDir(dir_hnd,&dirpos);
3720                 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
3721                         pstring fullname;
3722
3723                         if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
3724                                 continue;
3725                         if (!is_visible_file(conn, directory, dname, &st, False))
3726                                 continue;
3727
3728                         /* Construct the full name. */
3729                         if(strlen(directory) + strlen(dname) + 1 >= sizeof(fullname)) {
3730                                 errno = ENOMEM;
3731                                 break;
3732                         }
3733
3734                         pstrcpy(fullname, directory);
3735                         pstrcat(fullname, "/");
3736                         pstrcat(fullname, dname);
3737
3738                         if(SMB_VFS_LSTAT(conn,fullname, &st) != 0)
3739                                 break;
3740                         if(st.st_mode & S_IFDIR) {
3741                                 if(lp_recursive_veto_delete(SNUM(conn))) {
3742                                         if(!recursive_rmdir(conn, fullname))
3743                                                 break;
3744                                 }
3745                                 if(SMB_VFS_RMDIR(conn,fullname) != 0)
3746                                         break;
3747                         } else if(SMB_VFS_UNLINK(conn,fullname) != 0)
3748                                 break;
3749                 }
3750                 CloseDir(dir_hnd);
3751                 /* Retry the rmdir */
3752                 ret = SMB_VFS_RMDIR(conn,directory);
3753         }
3754
3755   err:
3756
3757         if (ret != 0) {
3758                 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
3759                          "%s\n", directory,strerror(errno)));
3760                 return False;
3761         }
3762
3763         return True;
3764 }
3765
3766 /****************************************************************************
3767  Reply to a rmdir.
3768 ****************************************************************************/
3769
3770 int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3771 {
3772         pstring directory;
3773         int outsize = 0;
3774         SMB_STRUCT_STAT sbuf;
3775         NTSTATUS status;
3776         START_PROFILE(SMBrmdir);
3777
3778         srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status);
3779         if (!NT_STATUS_IS_OK(status)) {
3780                 END_PROFILE(SMBrmdir);
3781                 return ERROR_NT(status);
3782         }
3783
3784         RESOLVE_DFSPATH(directory, conn, inbuf, outbuf)
3785
3786         status = unix_convert(conn, directory, False, NULL, &sbuf);
3787         if (!NT_STATUS_IS_OK(status)) {
3788                 END_PROFILE(SMBrmdir);
3789                 return ERROR_NT(status);
3790         }
3791
3792         if (!check_name(directory,conn)) {
3793                 END_PROFILE(SMBrmdir);
3794                 return UNIXERROR(ERRDOS, ERRbadpath);
3795         }
3796
3797         dptr_closepath(directory,SVAL(inbuf,smb_pid));
3798         if (!rmdir_internals(conn, directory)) {
3799                 END_PROFILE(SMBrmdir);
3800                 return UNIXERROR(ERRDOS, ERRbadpath);
3801         }
3802
3803         outsize = set_message(outbuf,0,0,False);
3804
3805         DEBUG( 3, ( "rmdir %s\n", directory ) );
3806
3807         END_PROFILE(SMBrmdir);
3808         return(outsize);
3809 }
3810
3811 /*******************************************************************
3812  Resolve wildcards in a filename rename.
3813  Note that name is in UNIX charset and thus potentially can be more
3814  than fstring buffer (255 bytes) especially in default UTF-8 case.
3815  Therefore, we use pstring inside and all calls should ensure that
3816  name2 is at least pstring-long (they do already)
3817 ********************************************************************/
3818
3819 static BOOL resolve_wildcards(const char *name1, char *name2)
3820 {
3821         pstring root1,root2;
3822         pstring ext1,ext2;
3823         char *p,*p2, *pname1, *pname2;
3824         int available_space, actual_space;
3825
3826
3827         pname1 = strrchr_m(name1,'/');
3828         pname2 = strrchr_m(name2,'/');
3829
3830         if (!pname1 || !pname2)
3831                 return(False);
3832
3833         pstrcpy(root1,pname1);
3834         pstrcpy(root2,pname2);
3835         p = strrchr_m(root1,'.');
3836         if (p) {
3837                 *p = 0;
3838                 pstrcpy(ext1,p+1);
3839         } else {
3840                 pstrcpy(ext1,"");
3841         }
3842         p = strrchr_m(root2,'.');
3843         if (p) {
3844                 *p = 0;
3845                 pstrcpy(ext2,p+1);
3846         } else {
3847                 pstrcpy(ext2,"");
3848         }
3849
3850         p = root1;
3851         p2 = root2;
3852         while (*p2) {
3853                 if (*p2 == '?') {
3854                         *p2 = *p;
3855                         p2++;
3856                 } else if (*p2 == '*') {
3857                         pstrcpy(p2, p);
3858                         break;
3859                 } else {
3860                         p2++;
3861                 }
3862                 if (*p)
3863                         p++;
3864         }
3865
3866         p = ext1;
3867         p2 = ext2;
3868         while (*p2) {
3869                 if (*p2 == '?') {
3870                         *p2 = *p;
3871                         p2++;
3872                 } else if (*p2 == '*') {
3873                         pstrcpy(p2, p);
3874                         break;
3875                 } else {
3876                         p2++;
3877                 }
3878                 if (*p)
3879                         p++;
3880         }
3881
3882         available_space = sizeof(pstring) - PTR_DIFF(pname2, name2);
3883
3884         if (ext2[0]) {
3885                 actual_space = snprintf(pname2, available_space - 1, "%s.%s", root2, ext2);
3886                 if (actual_space >= available_space - 1) {
3887                         DEBUG(1,("resolve_wildcards: can't fit resolved name into specified buffer (overrun by %d bytes)\n",
3888                                 actual_space - available_space));
3889                 }
3890         } else {
3891                 pstrcpy_base(pname2, root2, name2);
3892         }
3893
3894         return(True);
3895 }
3896
3897 /****************************************************************************
3898  Ensure open files have their names updated. Updated to notify other smbd's
3899  asynchronously.
3900 ****************************************************************************/
3901
3902 static void rename_open_files(connection_struct *conn, struct share_mode_lock *lck,
3903                                 SMB_DEV_T dev, SMB_INO_T inode, const char *newname)
3904 {
3905         files_struct *fsp;
3906         BOOL did_rename = False;
3907
3908         for(fsp = file_find_di_first(dev, inode); fsp; fsp = file_find_di_next(fsp)) {
3909                 /* fsp_name is a relative path under the fsp. To change this for other
3910                    sharepaths we need to manipulate relative paths. */
3911                 /* TODO - create the absolute path and manipulate the newname
3912                    relative to the sharepath. */
3913                 if (fsp->conn != conn) {
3914                         continue;
3915                 }
3916                 DEBUG(10,("rename_open_files: renaming file fnum %d (dev = %x, inode = %.0f) from %s -> %s\n",
3917                         fsp->fnum, (unsigned int)fsp->dev, (double)fsp->inode,
3918                         fsp->fsp_name, newname ));
3919                 string_set(&fsp->fsp_name, newname);
3920                 did_rename = True;
3921         }
3922
3923         if (!did_rename) {
3924                 DEBUG(10,("rename_open_files: no open files on dev %x, inode %.0f for %s\n",
3925                         (unsigned int)dev, (double)inode, newname ));
3926         }
3927
3928         /* Send messages to all smbd's (not ourself) that the name has changed. */
3929         rename_share_filename(lck, conn->connectpath, newname);
3930 }
3931
3932 /****************************************************************************
3933  We need to check if the source path is a parent directory of the destination
3934  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
3935  refuse the rename with a sharing violation. Under UNIX the above call can
3936  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
3937  probably need to check that the client is a Windows one before disallowing
3938  this as a UNIX client (one with UNIX extensions) can know the source is a
3939  symlink and make this decision intelligently. Found by an excellent bug
3940  report from <AndyLiebman@aol.com>.
3941 ****************************************************************************/
3942
3943 static BOOL rename_path_prefix_equal(const char *src, const char *dest)
3944 {
3945         const char *psrc = src;
3946         const char *pdst = dest;
3947         size_t slen;
3948
3949         if (psrc[0] == '.' && psrc[1] == '/') {
3950                 psrc += 2;
3951         }
3952         if (pdst[0] == '.' && pdst[1] == '/') {
3953                 pdst += 2;
3954         }
3955         if ((slen = strlen(psrc)) > strlen(pdst)) {
3956                 return False;
3957         }
3958         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
3959 }
3960
3961 /****************************************************************************
3962  Rename an open file - given an fsp.
3963 ****************************************************************************/
3964
3965 NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, uint32 attrs, BOOL replace_if_exists)
3966 {
3967         SMB_STRUCT_STAT sbuf;
3968         pstring newname_last_component;
3969         NTSTATUS status = NT_STATUS_OK;
3970         BOOL dest_exists;
3971         struct share_mode_lock *lck = NULL;
3972
3973         ZERO_STRUCT(sbuf);
3974
3975         status = unix_convert(conn, newname, False, newname_last_component, &sbuf);
3976         if (!NT_STATUS_IS_OK(status)) {
3977                 return status;
3978         }
3979
3980         /* Ensure newname contains a '/' */
3981         if(strrchr_m(newname,'/') == 0) {
3982                 pstring tmpstr;
3983
3984                 pstrcpy(tmpstr, "./");
3985                 pstrcat(tmpstr, newname);
3986                 pstrcpy(newname, tmpstr);
3987         }
3988
3989         /*
3990          * Check for special case with case preserving and not
3991          * case sensitive. If the old last component differs from the original
3992          * last component only by case, then we should allow
3993          * the rename (user is trying to change the case of the
3994          * filename).
3995          */
3996
3997         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
3998                         strequal(newname, fsp->fsp_name)) {
3999                 char *p;
4000                 pstring newname_modified_last_component;
4001
4002                 /*
4003                  * Get the last component of the modified name.
4004                  * Note that we guarantee that newname contains a '/'
4005                  * character above.
4006                  */
4007                 p = strrchr_m(newname,'/');
4008                 pstrcpy(newname_modified_last_component,p+1);
4009
4010                 if(strcsequal(newname_modified_last_component,
4011                               newname_last_component) == False) {
4012                         /*
4013                          * Replace the modified last component with
4014                          * the original.
4015                          */
4016                         pstrcpy(p+1, newname_last_component);
4017                 }
4018         }
4019
4020         /*
4021          * If the src and dest names are identical - including case,
4022          * don't do the rename, just return success.
4023          */
4024
4025         if (strcsequal(fsp->fsp_name, newname)) {
4026                 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
4027                         newname));
4028                 return NT_STATUS_OK;
4029         }
4030
4031         dest_exists = vfs_object_exist(conn,newname,NULL);
4032
4033         if(!replace_if_exists && dest_exists) {
4034                 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
4035                         fsp->fsp_name,newname));
4036                 return NT_STATUS_OBJECT_NAME_COLLISION;
4037         }
4038
4039         status = can_rename(conn,newname,attrs,&sbuf);
4040
4041         if (dest_exists && !NT_STATUS_IS_OK(status)) {
4042                 DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
4043                         nt_errstr(status), fsp->fsp_name,newname));
4044                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
4045                         status = NT_STATUS_ACCESS_DENIED;
4046                 return status;
4047         }
4048
4049         if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
4050                 return NT_STATUS_ACCESS_DENIED;
4051         }
4052
4053         lck = get_share_mode_lock(NULL, fsp->dev, fsp->inode, NULL, NULL);
4054
4055         if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
4056                 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
4057                         fsp->fsp_name,newname));
4058                 rename_open_files(conn, lck, fsp->dev, fsp->inode, newname);
4059                 TALLOC_FREE(lck);
4060                 return NT_STATUS_OK;
4061         }
4062
4063         TALLOC_FREE(lck);
4064
4065         if (errno == ENOTDIR || errno == EISDIR) {
4066                 status = NT_STATUS_OBJECT_NAME_COLLISION;
4067         } else {
4068                 status = map_nt_error_from_unix(errno);
4069         }
4070
4071         DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
4072                 nt_errstr(status), fsp->fsp_name,newname));
4073
4074         return status;
4075 }
4076
4077 /****************************************************************************
4078  The guts of the rename command, split out so it may be called by the NT SMB
4079  code.
4080 ****************************************************************************/
4081
4082 NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, uint32 attrs, BOOL replace_if_exists, BOOL has_wild)
4083 {
4084         pstring directory;
4085         pstring mask;
4086         pstring last_component_src;
4087         pstring last_component_dest;
4088         char *p;
4089         int count=0;
4090         NTSTATUS status = NT_STATUS_OK;
4091         SMB_STRUCT_STAT sbuf1, sbuf2;
4092         struct share_mode_lock *lck = NULL;
4093
4094         *directory = *mask = 0;
4095
4096         ZERO_STRUCT(sbuf1);
4097         ZERO_STRUCT(sbuf2);
4098
4099         status = unix_convert(conn, name, has_wild, last_component_src, &sbuf1);
4100         if (!NT_STATUS_IS_OK(status)) {
4101                 return status;
4102         }
4103
4104         status = unix_convert(conn, newname, True, last_component_dest, &sbuf2);
4105         if (!NT_STATUS_IS_OK(status)) {
4106                 return status;
4107         }
4108
4109         /*
4110          * Split the old name into directory and last component
4111          * strings. Note that unix_convert may have stripped off a
4112          * leading ./ from both name and newname if the rename is
4113          * at the root of the share. We need to make sure either both
4114          * name and newname contain a / character or neither of them do
4115          * as this is checked in resolve_wildcards().
4116          */
4117
4118         p = strrchr_m(name,'/');
4119         if (!p) {
4120                 pstrcpy(directory,".");
4121                 pstrcpy(mask,name);
4122         } else {
4123                 *p = 0;
4124                 pstrcpy(directory,name);
4125                 pstrcpy(mask,p+1);
4126                 *p = '/'; /* Replace needed for exceptional test below. */
4127         }
4128
4129         /*
4130          * We should only check the mangled cache
4131          * here if unix_convert failed. This means
4132          * that the path in 'mask' doesn't exist
4133          * on the file system and so we need to look
4134          * for a possible mangle. This patch from
4135          * Tine Smukavec <valentin.smukavec@hermes.si>.
4136          */
4137
4138         if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params))
4139                 mangle_check_cache( mask, sizeof(pstring)-1, conn->params );
4140
4141         if (!has_wild) {
4142                 /*
4143                  * No wildcards - just process the one file.
4144                  */
4145                 BOOL is_short_name = mangle_is_8_3(name, True, conn->params);
4146
4147                 /* Add a terminating '/' to the directory name. */
4148                 pstrcat(directory,"/");
4149                 pstrcat(directory,mask);
4150
4151                 /* Ensure newname contains a '/' also */
4152                 if(strrchr_m(newname,'/') == 0) {
4153                         pstring tmpstr;
4154
4155                         pstrcpy(tmpstr, "./");
4156                         pstrcat(tmpstr, newname);
4157                         pstrcpy(newname, tmpstr);
4158                 }
4159
4160                 DEBUG(3,("rename_internals: case_sensitive = %d, case_preserve = %d, short case preserve = %d, \
4161 directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
4162                          conn->case_sensitive, conn->case_preserve, conn->short_case_preserve, directory,
4163                          newname, last_component_dest, is_short_name));
4164
4165                 /*
4166                  * Check for special case with case preserving and not
4167                  * case sensitive, if directory and newname are identical,
4168                  * and the old last component differs from the original
4169                  * last component only by case, then we should allow
4170                  * the rename (user is trying to change the case of the
4171                  * filename).
4172                  */
4173                 if((conn->case_sensitive == False) &&
4174                    (((conn->case_preserve == True) &&
4175                      (is_short_name == False)) ||
4176                     ((conn->short_case_preserve == True) &&
4177                      (is_short_name == True))) &&
4178                    strcsequal(directory, newname)) {
4179                         pstring modified_last_component;
4180
4181                         /*
4182                          * Get the last component of the modified name.
4183                          * Note that we guarantee that newname contains a '/'
4184                          * character above.
4185                          */
4186                         p = strrchr_m(newname,'/');
4187                         pstrcpy(modified_last_component,p+1);
4188
4189                         if(strcsequal(modified_last_component,
4190                                       last_component_dest) == False) {
4191                                 /*
4192                                  * Replace the modified last component with
4193                                  * the original.
4194                                  */
4195                                 pstrcpy(p+1, last_component_dest);
4196                         }
4197                 }
4198
4199                 resolve_wildcards(directory,newname);
4200
4201                 /*
4202                  * The source object must exist.
4203                  */
4204
4205                 if (!vfs_object_exist(conn, directory, &sbuf1)) {
4206                         DEBUG(3,("rename_internals: source doesn't exist doing rename %s -> %s\n",
4207                                 directory,newname));
4208
4209                         if (errno == ENOTDIR || errno == EISDIR || errno == ENOENT) {
4210                                 /*
4211                                  * Must return different errors depending on whether the parent
4212                                  * directory existed or not.
4213                                  */
4214
4215                                 p = strrchr_m(directory, '/');
4216                                 if (!p)
4217                                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4218                                 *p = '\0';
4219                                 if (vfs_object_exist(conn, directory, NULL))
4220                                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4221                                 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
4222                         }
4223                         status = map_nt_error_from_unix(errno);
4224                         DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
4225                                 nt_errstr(status), directory,newname));
4226
4227                         return status;
4228                 }
4229
4230                 status = can_rename(conn,directory,attrs,&sbuf1);
4231
4232                 if (!NT_STATUS_IS_OK(status)) {
4233                         DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
4234                                 nt_errstr(status), directory,newname));
4235                         return status;
4236                 }
4237
4238                 /*
4239                  * If the src and dest names are identical - including case,
4240                  * don't do the rename, just return success.
4241                  */
4242
4243                 if (strcsequal(directory, newname)) {
4244                         rename_open_files(conn, NULL, sbuf1.st_dev, sbuf1.st_ino, newname);
4245                         DEBUG(3,("rename_internals: identical names in rename %s - returning success\n", directory));
4246                         return NT_STATUS_OK;
4247                 }
4248
4249                 if(!replace_if_exists && vfs_object_exist(conn,newname,NULL)) {
4250                         DEBUG(3,("rename_internals: dest exists doing rename %s -> %s\n",
4251                                 directory,newname));
4252                         return NT_STATUS_OBJECT_NAME_COLLISION;
4253                 }
4254
4255                 if (rename_path_prefix_equal(directory, newname)) {
4256                         return NT_STATUS_SHARING_VIOLATION;
4257                 }
4258
4259                 lck = get_share_mode_lock(NULL, sbuf1.st_dev, sbuf1.st_ino, NULL, NULL);
4260
4261                 if(SMB_VFS_RENAME(conn,directory, newname) == 0) {
4262                         DEBUG(3,("rename_internals: succeeded doing rename on %s -> %s\n",
4263                                 directory,newname));
4264                         rename_open_files(conn, lck, sbuf1.st_dev, sbuf1.st_ino, newname);
4265                         TALLOC_FREE(lck);
4266                         return NT_STATUS_OK;
4267                 }
4268
4269                 TALLOC_FREE(lck);
4270                 if (errno == ENOTDIR || errno == EISDIR)
4271                         status = NT_STATUS_OBJECT_NAME_COLLISION;
4272                 else
4273                         status = map_nt_error_from_unix(errno);
4274
4275                 DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
4276                         nt_errstr(status), directory,newname));
4277
4278                 return status;
4279         } else {
4280                 /*
4281                  * Wildcards - process each file that matches.
4282                  */
4283                 struct smb_Dir *dir_hnd = NULL;
4284                 const char *dname;
4285                 pstring destname;
4286
4287                 if (strequal(mask,"????????.???"))
4288                         pstrcpy(mask,"*");
4289
4290                 if (check_name(directory,conn))
4291                         dir_hnd = OpenDir(conn, directory, mask, attrs);
4292
4293                 if (dir_hnd) {
4294                         long offset = 0;
4295                         status = NT_STATUS_NO_SUCH_FILE;
4296 /*                      Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND; - gentest fix. JRA */
4297
4298                         while ((dname = ReadDirName(dir_hnd, &offset))) {
4299                                 pstring fname;
4300                                 BOOL sysdir_entry = False;
4301
4302                                 pstrcpy(fname,dname);
4303
4304                                 /* Quick check for "." and ".." */
4305                                 if (fname[0] == '.') {
4306                                         if (!fname[1] || (fname[1] == '.' && !fname[2])) {
4307                                                 if (attrs & aDIR) {
4308                                                         sysdir_entry = True;
4309                                                 } else {
4310                                                         continue;
4311                                                 }
4312                                         }
4313                                 }
4314
4315                                 if (!is_visible_file(conn, directory, dname, &sbuf1, False))
4316                                         continue;
4317
4318                                 if(!mask_match(fname, mask, conn->case_sensitive))
4319                                         continue;
4320
4321                                 if (sysdir_entry) {
4322                                         status = NT_STATUS_OBJECT_NAME_INVALID;
4323                                         break;
4324                                 }
4325
4326                                 status = NT_STATUS_ACCESS_DENIED;
4327                                 slprintf(fname,sizeof(fname)-1,"%s/%s",directory,dname);
4328                                 if (!vfs_object_exist(conn, fname, &sbuf1)) {
4329                                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
4330                                         DEBUG(6,("rename %s failed. Error %s\n", fname, nt_errstr(status)));
4331                                         continue;
4332                                 }
4333                                 status = can_rename(conn,fname,attrs,&sbuf1);
4334                                 if (!NT_STATUS_IS_OK(status)) {
4335                                         DEBUG(6,("rename %s refused\n", fname));
4336                                         continue;
4337                                 }
4338                                 pstrcpy(destname,newname);
4339
4340                                 if (!resolve_wildcards(fname,destname)) {
4341                                         DEBUG(6,("resolve_wildcards %s %s failed\n",
4342                                                  fname, destname));
4343                                         continue;
4344                                 }
4345
4346                                 if (strcsequal(fname,destname)) {
4347                                         rename_open_files(conn, NULL, sbuf1.st_dev, sbuf1.st_ino, newname);
4348                                         DEBUG(3,("rename_internals: identical names in wildcard rename %s - success\n", fname));
4349                                         count++;
4350                                         status = NT_STATUS_OK;
4351                                         continue;
4352                                 }
4353
4354                                 if (!replace_if_exists &&
4355                                     vfs_file_exist(conn,destname, NULL)) {
4356                                         DEBUG(6,("file_exist %s\n", destname));
4357                                         status = NT_STATUS_OBJECT_NAME_COLLISION;
4358                                         continue;
4359                                 }
4360
4361                                 if (rename_path_prefix_equal(fname, destname)) {
4362                                         return NT_STATUS_SHARING_VIOLATION;
4363                                 }
4364
4365                                 lck = get_share_mode_lock(NULL, sbuf1.st_dev, sbuf1.st_ino, NULL, NULL);
4366
4367                                 if (!SMB_VFS_RENAME(conn,fname,destname)) {
4368                                         rename_open_files(conn, lck, sbuf1.st_dev, sbuf1.st_ino, newname);
4369                                         count++;
4370                                         status = NT_STATUS_OK;
4371                                 }
4372                                 TALLOC_FREE(lck);
4373                                 DEBUG(3,("rename_internals: doing rename on %s -> %s\n",fname,destname));
4374                         }
4375                         CloseDir(dir_hnd);
4376                 }
4377
4378 #if 0
4379         /* Don't think needed any more - JRA. */
4380                 if (!NT_STATUS_EQUAL(error,NT_STATUS_NO_SUCH_FILE)) {
4381                         if (!rcdest && bad_path_dest) {
4382                                 if (ms_has_wild(last_component_dest))
4383                                         return NT_STATUS_OBJECT_NAME_INVALID;
4384                                 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
4385                         }
4386                 }
4387 #endif
4388
4389         }
4390
4391         if (count == 0 && NT_STATUS_IS_OK(status)) {
4392                 status = map_nt_error_from_unix(errno);
4393         }
4394
4395         return status;
4396 }
4397
4398 /****************************************************************************
4399  Reply to a mv.
4400 ****************************************************************************/
4401
4402 int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
4403              int dum_buffsize)
4404 {
4405         int outsize = 0;
4406         pstring name;
4407         pstring newname;
4408         char *p;
4409         uint32 attrs = SVAL(inbuf,smb_vwv0);
4410         NTSTATUS status;
4411         BOOL path1_contains_wcard = False;
4412         BOOL path2_contains_wcard = False;
4413
4414         START_PROFILE(SMBmv);
4415
4416         p = smb_buf(inbuf) + 1;
4417         p += srvstr_get_path_wcard(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, &path1_contains_wcard);
4418         if (!NT_STATUS_IS_OK(status)) {
4419                 END_PROFILE(SMBmv);
4420                 return ERROR_NT(status);
4421         }
4422         p++;
4423         p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &path2_contains_wcard);
4424         if (!NT_STATUS_IS_OK(status)) {
4425                 END_PROFILE(SMBmv);
4426                 return ERROR_NT(status);
4427         }
4428
4429         RESOLVE_DFSPATH_WCARD(name, conn, inbuf, outbuf);
4430         RESOLVE_DFSPATH_WCARD(newname, conn, inbuf, outbuf);
4431
4432         DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
4433
4434         status = rename_internals(conn, name, newname, attrs, False, path1_contains_wcard);
4435         if (!NT_STATUS_IS_OK(status)) {
4436                 END_PROFILE(SMBmv);
4437                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
4438                         /* We have re-scheduled this call. */
4439                         return -1;
4440                 }
4441                 return ERROR_NT(status);
4442         }
4443
4444         /*
4445          * Win2k needs a changenotify request response before it will
4446          * update after a rename..
4447          */
4448         process_pending_change_notify_queue((time_t)0);
4449         outsize = set_message(outbuf,0,0,False);
4450
4451         END_PROFILE(SMBmv);
4452         return(outsize);
4453 }
4454
4455 /*******************************************************************
4456  Copy a file as part of a reply_copy.
4457 ******************************************************************/
4458
4459 /*
4460  * TODO: check error codes on all callers
4461  */
4462
4463 NTSTATUS copy_file(char *src, char *dest1,connection_struct *conn, int ofun,
4464                    int count, BOOL target_is_directory)
4465 {
4466         SMB_STRUCT_STAT src_sbuf, sbuf2;
4467         SMB_OFF_T ret=-1;
4468         files_struct *fsp1,*fsp2;
4469         pstring dest;
4470         uint32 dosattrs;
4471         uint32 new_create_disposition;
4472         NTSTATUS status;
4473         int close_err;
4474
4475         pstrcpy(dest,dest1);
4476         if (target_is_directory) {
4477                 char *p = strrchr_m(src,'/');
4478                 if (p) {
4479                         p++;
4480                 } else {
4481                         p = src;
4482                 }
4483                 pstrcat(dest,"/");
4484                 pstrcat(dest,p);
4485         }
4486
4487         if (!vfs_file_exist(conn,src,&src_sbuf)) {
4488                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4489         }
4490
4491         if (!target_is_directory && count) {
4492                 new_create_disposition = FILE_OPEN;
4493         } else {
4494                 if (!map_open_params_to_ntcreate(dest1,0,ofun,
4495                                 NULL, NULL, &new_create_disposition, NULL)) {
4496                         return NT_STATUS_INVALID_PARAMETER;
4497                 }
4498         }
4499
4500         status = open_file_ntcreate(conn,src,&src_sbuf,
4501                         FILE_GENERIC_READ,
4502                         FILE_SHARE_READ|FILE_SHARE_WRITE,
4503                         FILE_OPEN,
4504                         0,
4505                         FILE_ATTRIBUTE_NORMAL,
4506                         INTERNAL_OPEN_ONLY,
4507                         NULL, &fsp1);
4508
4509         if (!NT_STATUS_IS_OK(status)) {
4510                 return status;
4511         }
4512
4513         dosattrs = dos_mode(conn, src, &src_sbuf);
4514         if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
4515                 ZERO_STRUCTP(&sbuf2);
4516         }
4517
4518         status = open_file_ntcreate(conn,dest,&sbuf2,
4519                         FILE_GENERIC_WRITE,
4520                         FILE_SHARE_READ|FILE_SHARE_WRITE,
4521                         new_create_disposition,
4522                         0,
4523                         dosattrs,
4524                         INTERNAL_OPEN_ONLY,
4525                         NULL, &fsp2);
4526
4527         if (!NT_STATUS_IS_OK(status)) {
4528                 close_file(fsp1,ERROR_CLOSE);
4529                 return status;
4530         }
4531
4532         if ((ofun&3) == 1) {
4533                 if(SMB_VFS_LSEEK(fsp2,fsp2->fh->fd,0,SEEK_END) == -1) {
4534                         DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
4535                         /*
4536                          * Stop the copy from occurring.
4537                          */
4538                         ret = -1;
4539                         src_sbuf.st_size = 0;
4540                 }
4541         }
4542
4543         if (src_sbuf.st_size) {
4544                 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
4545         }
4546
4547         close_file(fsp1,NORMAL_CLOSE);
4548
4549         /* Ensure the modtime is set correctly on the destination file. */
4550         fsp_set_pending_modtime( fsp2, src_sbuf.st_mtime);
4551
4552         /*
4553          * As we are opening fsp1 read-only we only expect
4554          * an error on close on fsp2 if we are out of space.
4555          * Thus we don't look at the error return from the
4556          * close of fsp1.
4557          */
4558         close_err = close_file(fsp2,NORMAL_CLOSE);
4559
4560         if (close_err != 0) {
4561                 return map_nt_error_from_unix(close_err);
4562         }
4563
4564         if (ret != (SMB_OFF_T)src_sbuf.st_size) {
4565                 return NT_STATUS_DISK_FULL;
4566         }
4567
4568         return NT_STATUS_OK;
4569 }
4570
4571 /****************************************************************************
4572  Reply to a file copy.
4573 ****************************************************************************/
4574
4575 int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
4576 {
4577         int outsize = 0;
4578         pstring name;
4579         pstring directory;
4580         pstring mask,newname;
4581         char *p;
4582         int count=0;
4583         int error = ERRnoaccess;
4584         int err = 0;
4585         BOOL has_wild;
4586         BOOL exists=False;
4587         int tid2 = SVAL(inbuf,smb_vwv0);
4588         int ofun = SVAL(inbuf,smb_vwv1);
4589         int flags = SVAL(inbuf,smb_vwv2);
4590         BOOL target_is_directory=False;
4591         BOOL path_contains_wcard1 = False;
4592         BOOL path_contains_wcard2 = False;
4593         SMB_STRUCT_STAT sbuf1, sbuf2;
4594         NTSTATUS status;
4595         START_PROFILE(SMBcopy);
4596
4597         *directory = *mask = 0;
4598
4599         p = smb_buf(inbuf);
4600         p += srvstr_get_path_wcard(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, &path_contains_wcard1);
4601         if (!NT_STATUS_IS_OK(status)) {
4602                 END_PROFILE(SMBcopy);
4603                 return ERROR_NT(status);
4604         }
4605         p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &path_contains_wcard2);
4606         if (!NT_STATUS_IS_OK(status)) {
4607                 END_PROFILE(SMBcopy);
4608                 return ERROR_NT(status);
4609         }
4610
4611         DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
4612
4613         if (tid2 != conn->cnum) {
4614                 /* can't currently handle inter share copies XXXX */
4615                 DEBUG(3,("Rejecting inter-share copy\n"));
4616                 END_PROFILE(SMBcopy);
4617                 return ERROR_DOS(ERRSRV,ERRinvdevice);
4618         }
4619
4620         RESOLVE_DFSPATH_WCARD(name, conn, inbuf, outbuf);
4621         RESOLVE_DFSPATH_WCARD(newname, conn, inbuf, outbuf);
4622
4623         status = unix_convert(conn, name, path_contains_wcard1, NULL, &sbuf1);
4624         if (!NT_STATUS_IS_OK(status)) {
4625                 END_PROFILE(SMBcopy);
4626                 return ERROR_NT(status);
4627         }
4628
4629         status = unix_convert(conn, newname, path_contains_wcard2, NULL, &sbuf2);
4630         if (!NT_STATUS_IS_OK(status)) {
4631                 END_PROFILE(SMBcopy);
4632                 return ERROR_NT(status);
4633         }
4634
4635         target_is_directory = VALID_STAT_OF_DIR(sbuf2);
4636
4637         if ((flags&1) && target_is_directory) {
4638                 END_PROFILE(SMBcopy);
4639                 return ERROR_DOS(ERRDOS,ERRbadfile);
4640         }
4641
4642         if ((flags&2) && !target_is_directory) {
4643                 END_PROFILE(SMBcopy);
4644                 return ERROR_DOS(ERRDOS,ERRbadpath);
4645         }
4646
4647         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
4648                 /* wants a tree copy! XXXX */
4649                 DEBUG(3,("Rejecting tree copy\n"));
4650                 END_PROFILE(SMBcopy);
4651                 return ERROR_DOS(ERRSRV,ERRerror);
4652         }
4653
4654         p = strrchr_m(name,'/');
4655         if (!p) {
4656                 pstrcpy(directory,"./");
4657                 pstrcpy(mask,name);
4658         } else {
4659                 *p = 0;
4660                 pstrcpy(directory,name);
4661                 pstrcpy(mask,p+1);
4662         }
4663
4664         /*
4665          * We should only check the mangled cache
4666          * here if unix_convert failed. This means
4667          * that the path in 'mask' doesn't exist
4668          * on the file system and so we need to look
4669          * for a possible mangle. This patch from
4670          * Tine Smukavec <valentin.smukavec@hermes.si>.
4671          */
4672
4673         if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params))
4674                 mangle_check_cache( mask, sizeof(pstring)-1, conn->params );
4675
4676         has_wild = path_contains_wcard1;
4677
4678         if (!has_wild) {
4679                 pstrcat(directory,"/");
4680                 pstrcat(directory,mask);
4681                 if (resolve_wildcards(directory,newname)
4682                     && NT_STATUS_IS_OK(status = copy_file(
4683                                                directory,newname,conn,ofun,
4684                                                count,target_is_directory)))
4685                         count++;
4686                 if(!count && !NT_STATUS_IS_OK(status)) {
4687                         END_PROFILE(SMBcopy);
4688                         return ERROR_NT(status);
4689                 }
4690                 if (!count) {
4691                         exists = vfs_file_exist(conn,directory,NULL);
4692                 }
4693         } else {
4694                 struct smb_Dir *dir_hnd = NULL;
4695                 const char *dname;
4696                 pstring destname;
4697
4698                 if (strequal(mask,"????????.???"))
4699                         pstrcpy(mask,"*");
4700
4701                 if (check_name(directory,conn))
4702                         dir_hnd = OpenDir(conn, directory, mask, 0);
4703
4704                 if (dir_hnd) {
4705                         long offset = 0;
4706                         error = ERRbadfile;
4707
4708                         while ((dname = ReadDirName(dir_hnd, &offset))) {
4709                                 pstring fname;
4710                                 pstrcpy(fname,dname);
4711
4712                                 if (!is_visible_file(conn, directory, dname, &sbuf1, False))
4713                                         continue;
4714
4715                                 if(!mask_match(fname, mask, conn->case_sensitive))
4716                                         continue;
4717
4718                                 error = ERRnoaccess;
4719                                 slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
4720                                 pstrcpy(destname,newname);
4721                                 if (resolve_wildcards(fname,destname)
4722                                     && NT_STATUS_IS_OK(status = copy_file(
4723                                                                fname,destname,conn,ofun,
4724                                                                count,target_is_directory)))
4725                                         count++;
4726                                 DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname,destname));
4727                         }
4728                         CloseDir(dir_hnd);
4729                 }
4730         }
4731
4732         if (count == 0) {
4733                 if(err) {
4734                         /* Error on close... */
4735                         errno = err;
4736                         END_PROFILE(SMBcopy);
4737                         return(UNIXERROR(ERRHRD,ERRgeneral));
4738                 }
4739
4740                 END_PROFILE(SMBcopy);
4741                 return ERROR_DOS(ERRDOS,error);
4742         }
4743
4744         outsize = set_message(outbuf,1,0,True);
4745         SSVAL(outbuf,smb_vwv0,count);
4746
4747         END_PROFILE(SMBcopy);
4748         return(outsize);
4749 }
4750
4751 /****************************************************************************
4752  Reply to a setdir.
4753 ****************************************************************************/
4754
4755 int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
4756 {
4757         int snum;
4758         int outsize = 0;
4759         pstring newdir;
4760         NTSTATUS status;
4761
4762         START_PROFILE(pathworks_setdir);
4763
4764         snum = SNUM(conn);
4765         if (!CAN_SETDIR(snum)) {
4766                 END_PROFILE(pathworks_setdir);
4767                 return ERROR_DOS(ERRDOS,ERRnoaccess);
4768         }
4769
4770         srvstr_get_path(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), 0, STR_TERMINATE, &status);
4771         if (!NT_STATUS_IS_OK(status)) {
4772                 END_PROFILE(pathworks_setdir);
4773                 return ERROR_NT(status);
4774         }
4775
4776         RESOLVE_DFSPATH(newdir, conn, inbuf, outbuf);
4777
4778         if (strlen(newdir) != 0) {
4779                 if (!vfs_directory_exist(conn,newdir,NULL)) {
4780                         END_PROFILE(pathworks_setdir);
4781                         return ERROR_DOS(ERRDOS,ERRbadpath);
4782                 }
4783                 set_conn_connectpath(conn,newdir);
4784         }
4785
4786         outsize = set_message(outbuf,0,0,False);
4787         SCVAL(outbuf,smb_reh,CVAL(inbuf,smb_reh));
4788
4789         DEBUG(3,("setdir %s\n", newdir));
4790
4791         END_PROFILE(pathworks_setdir);
4792         return(outsize);
4793 }
4794
4795 #undef DBGC_CLASS
4796 #define DBGC_CLASS DBGC_LOCKING
4797
4798 /****************************************************************************
4799  Get a lock pid, dealing with large count requests.
4800 ****************************************************************************/
4801
4802 uint32 get_lock_pid( char *data, int data_offset, BOOL large_file_format)
4803 {
4804         if(!large_file_format)
4805                 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
4806         else
4807                 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
4808 }
4809
4810 /****************************************************************************
4811  Get a lock count, dealing with large count requests.
4812 ****************************************************************************/
4813
4814 SMB_BIG_UINT get_lock_count( char *data, int data_offset, BOOL large_file_format)
4815 {
4816         SMB_BIG_UINT count = 0;
4817
4818         if(!large_file_format) {
4819                 count = (SMB_BIG_UINT)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
4820         } else {
4821
4822 #if defined(HAVE_LONGLONG)
4823                 count = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
4824                         ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
4825 #else /* HAVE_LONGLONG */
4826
4827                 /*
4828                  * NT4.x seems to be broken in that it sends large file (64 bit)
4829                  * lockingX calls even if the CAP_LARGE_FILES was *not*
4830                  * negotiated. For boxes without large unsigned ints truncate the
4831                  * lock count by dropping the top 32 bits.
4832                  */
4833
4834                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
4835                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
4836                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
4837                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
4838                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
4839                 }
4840
4841                 count = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
4842 #endif /* HAVE_LONGLONG */
4843         }
4844
4845         return count;
4846 }
4847
4848 #if !defined(HAVE_LONGLONG)
4849 /****************************************************************************
4850  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
4851 ****************************************************************************/
4852
4853 static uint32 map_lock_offset(uint32 high, uint32 low)
4854 {
4855         unsigned int i;
4856         uint32 mask = 0;
4857         uint32 highcopy = high;
4858
4859         /*
4860          * Try and find out how many significant bits there are in high.
4861          */
4862
4863         for(i = 0; highcopy; i++)
4864                 highcopy >>= 1;
4865
4866         /*
4867          * We use 31 bits not 32 here as POSIX
4868          * lock offsets may not be negative.
4869          */
4870
4871         mask = (~0) << (31 - i);
4872
4873         if(low & mask)
4874                 return 0; /* Fail. */
4875
4876         high <<= (31 - i);
4877
4878         return (high|low);
4879 }
4880 #endif /* !defined(HAVE_LONGLONG) */
4881
4882 /****************************************************************************
4883  Get a lock offset, dealing with large offset requests.
4884 ****************************************************************************/
4885
4886 SMB_BIG_UINT get_lock_offset( char *data, int data_offset, BOOL large_file_format, BOOL *err)
4887 {
4888         SMB_BIG_UINT offset = 0;
4889
4890         *err = False;
4891
4892         if(!large_file_format) {
4893                 offset = (SMB_BIG_UINT)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
4894         } else {
4895
4896 #if defined(HAVE_LONGLONG)
4897                 offset = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
4898                                 ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
4899 #else /* HAVE_LONGLONG */
4900
4901                 /*
4902                  * NT4.x seems to be broken in that it sends large file (64 bit)
4903                  * lockingX calls even if the CAP_LARGE_FILES was *not*
4904                  * negotiated. For boxes without large unsigned ints mangle the
4905                  * lock offset by mapping the top 32 bits onto the lower 32.
4906                  */
4907
4908                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
4909                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
4910                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
4911                         uint32 new_low = 0;
4912
4913                         if((new_low = map_lock_offset(high, low)) == 0) {
4914                                 *err = True;
4915                                 return (SMB_BIG_UINT)-1;
4916                         }
4917
4918                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
4919                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
4920                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
4921                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
4922                 }
4923
4924                 offset = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
4925 #endif /* HAVE_LONGLONG */
4926         }
4927
4928         return offset;
4929 }
4930
4931 /****************************************************************************
4932  Reply to a lockingX request.
4933 ****************************************************************************/
4934
4935 int reply_lockingX(connection_struct *conn, char *inbuf, char *outbuf,
4936                    int length, int bufsize)
4937 {
4938         files_struct *fsp = file_fsp(inbuf,smb_vwv2);
4939         unsigned char locktype = CVAL(inbuf,smb_vwv3);
4940         unsigned char oplocklevel = CVAL(inbuf,smb_vwv3+1);
4941         uint16 num_ulocks = SVAL(inbuf,smb_vwv6);
4942         uint16 num_locks = SVAL(inbuf,smb_vwv7);
4943         SMB_BIG_UINT count = 0, offset = 0;
4944         uint32 lock_pid;
4945         int32 lock_timeout = IVAL(inbuf,smb_vwv4);
4946         int i;
4947         char *data;
4948         BOOL large_file_format =
4949                 (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
4950         BOOL err;
4951         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
4952
4953         START_PROFILE(SMBlockingX);
4954
4955         CHECK_FSP(fsp,conn);
4956
4957         data = smb_buf(inbuf);
4958
4959         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
4960                 /* we don't support these - and CANCEL_LOCK makes w2k
4961                    and XP reboot so I don't really want to be
4962                    compatible! (tridge) */
4963                 return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
4964         }
4965
4966         /* Check if this is an oplock break on a file
4967            we have granted an oplock on.
4968         */
4969         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
4970                 /* Client can insist on breaking to none. */
4971                 BOOL break_to_none = (oplocklevel == 0);
4972                 BOOL result;
4973
4974                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
4975                          "for fnum = %d\n", (unsigned int)oplocklevel,
4976                          fsp->fnum ));
4977
4978                 /*
4979                  * Make sure we have granted an exclusive or batch oplock on
4980                  * this file.
4981                  */
4982
4983                 if (fsp->oplock_type == 0) {
4984
4985                         /* The Samba4 nbench simulator doesn't understand
4986                            the difference between break to level2 and break
4987                            to none from level2 - it sends oplock break
4988                            replies in both cases. Don't keep logging an error
4989                            message here - just ignore it. JRA. */
4990
4991                         DEBUG(5,("reply_lockingX: Error : oplock break from "
4992                                  "client for fnum = %d (oplock=%d) and no "
4993                                  "oplock granted on this file (%s).\n",
4994                                  fsp->fnum, fsp->oplock_type, fsp->fsp_name));
4995
4996                         /* if this is a pure oplock break request then don't
4997                          * send a reply */
4998                         if (num_locks == 0 && num_ulocks == 0) {
4999                                 END_PROFILE(SMBlockingX);
5000                                 return -1;
5001                         } else {
5002                                 END_PROFILE(SMBlockingX);
5003                                 return ERROR_DOS(ERRDOS,ERRlock);
5004                         }
5005                 }
5006
5007                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
5008                     (break_to_none)) {
5009                         result = remove_oplock(fsp);
5010                 } else {
5011                         result = downgrade_oplock(fsp);
5012                 }
5013
5014                 if (!result) {
5015                         DEBUG(0, ("reply_lockingX: error in removing "
5016                                   "oplock on file %s\n", fsp->fsp_name));
5017                         /* Hmmm. Is this panic justified? */
5018                         smb_panic("internal tdb error");
5019                 }
5020
5021                 reply_to_oplock_break_requests(fsp);
5022
5023                 /* if this is a pure oplock break request then don't send a
5024                  * reply */
5025                 if (num_locks == 0 && num_ulocks == 0) {
5026                         /* Sanity check - ensure a pure oplock break is not a
5027                            chained request. */
5028                         if(CVAL(inbuf,smb_vwv0) != 0xff)
5029                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
5030                                          "break is a chained %d request !\n",
5031                                          (unsigned int)CVAL(inbuf,smb_vwv0) ));
5032                         END_PROFILE(SMBlockingX);
5033                         return -1;
5034                 }
5035         }
5036
5037         /*
5038          * We do this check *after* we have checked this is not a oplock break
5039          * response message. JRA.
5040          */
5041
5042         release_level_2_oplocks_on_change(fsp);
5043
5044         /* Data now points at the beginning of the list
5045            of smb_unlkrng structs */
5046         for(i = 0; i < (int)num_ulocks; i++) {
5047                 lock_pid = get_lock_pid( data, i, large_file_format);
5048                 count = get_lock_count( data, i, large_file_format);
5049                 offset = get_lock_offset( data, i, large_file_format, &err);
5050
5051                 /*
5052                  * There is no error code marked "stupid client bug".... :-).
5053                  */
5054                 if(err) {
5055                         END_PROFILE(SMBlockingX);
5056                         return ERROR_DOS(ERRDOS,ERRnoaccess);
5057                 }
5058
5059                 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
5060                           "pid %u, file %s\n", (double)offset, (double)count,
5061                           (unsigned int)lock_pid, fsp->fsp_name ));
5062
5063                 status = do_unlock(fsp,
5064                                 lock_pid,
5065                                 count,
5066                                 offset,
5067                                 WINDOWS_LOCK);
5068
5069                 if (NT_STATUS_V(status)) {
5070                         END_PROFILE(SMBlockingX);
5071                         return ERROR_NT(status);
5072                 }
5073         }
5074
5075         /* Setup the timeout in seconds. */
5076
5077         if (!lp_blocking_locks(SNUM(conn))) {
5078                 lock_timeout = 0;
5079         }
5080
5081         /* Now do any requested locks */
5082         data += ((large_file_format ? 20 : 10)*num_ulocks);
5083
5084         /* Data now points at the beginning of the list
5085            of smb_lkrng structs */
5086
5087         for(i = 0; i < (int)num_locks; i++) {
5088                 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
5089                                 READ_LOCK:WRITE_LOCK);
5090                 lock_pid = get_lock_pid( data, i, large_file_format);
5091                 count = get_lock_count( data, i, large_file_format);
5092                 offset = get_lock_offset( data, i, large_file_format, &err);
5093
5094                 /*
5095                  * There is no error code marked "stupid client bug".... :-).
5096                  */
5097                 if(err) {
5098                         END_PROFILE(SMBlockingX);
5099                         return ERROR_DOS(ERRDOS,ERRnoaccess);
5100                 }
5101
5102                 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
5103                           "%u, file %s timeout = %d\n", (double)offset,
5104                           (double)count, (unsigned int)lock_pid,
5105                           fsp->fsp_name, (int)lock_timeout ));
5106
5107                 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
5108                         if (lp_blocking_locks(SNUM(conn))) {
5109
5110                                 /* Schedule a message to ourselves to
5111                                    remove the blocking lock record and
5112                                    return the right error. */
5113
5114                                 if (!blocking_lock_cancel(fsp,
5115                                                 lock_pid,
5116                                                 offset,
5117                                                 count,
5118                                                 WINDOWS_LOCK,
5119                                                 locktype,
5120                                                 NT_STATUS_FILE_LOCK_CONFLICT)) {
5121                                         END_PROFILE(SMBlockingX);
5122                                         return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRcancelviolation));
5123                                 }
5124                         }
5125                         /* Remove a matching pending lock. */
5126                         status = do_lock_cancel(fsp,
5127                                                 lock_pid,
5128                                                 count,
5129                                                 offset,
5130                                                 WINDOWS_LOCK);
5131                 } else {
5132                         BOOL blocking_lock = lock_timeout ? True : False;
5133                         BOOL defer_lock = False;
5134                         struct byte_range_lock *br_lck;
5135
5136                         br_lck = do_lock(fsp,
5137                                         lock_pid,
5138                                         count,
5139                                         offset,
5140                                         lock_type,
5141                                         WINDOWS_LOCK,
5142                                         blocking_lock,
5143                                         &status);
5144
5145                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
5146                                 /* Windows internal resolution for blocking locks seems
5147                                    to be about 200ms... Don't wait for less than that. JRA. */
5148                                 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
5149                                         lock_timeout = lp_lock_spin_time();
5150                                 }
5151                                 defer_lock = True;
5152                         }
5153
5154                         /* This heuristic seems to match W2K3 very well. If a
5155                            lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
5156                            it pretends we asked for a timeout of between 150 - 300 milliseconds as
5157                            far as I can tell. Replacement for do_lock_spin(). JRA. */
5158
5159                         if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
5160                                         NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
5161                                 defer_lock = True;
5162                                 lock_timeout = lp_lock_spin_time();
5163                         }
5164
5165                         if (br_lck && defer_lock) {
5166                                 /*
5167                                  * A blocking lock was requested. Package up
5168                                  * this smb into a queued request and push it
5169                                  * onto the blocking lock queue.
5170                                  */
5171                                 if(push_blocking_lock_request(br_lck,
5172                                                         inbuf, length,
5173                                                         fsp,
5174                                                         lock_timeout,
5175                                                         i,
5176                                                         lock_pid,
5177                                                         lock_type,
5178                                                         WINDOWS_LOCK,
5179                                                         offset,
5180                                                         count)) {
5181                                         TALLOC_FREE(br_lck);
5182                                         END_PROFILE(SMBlockingX);
5183                                         return -1;
5184                                 }
5185                         }
5186
5187                         TALLOC_FREE(br_lck);
5188                 }
5189
5190                 if (NT_STATUS_V(status)) {
5191                         END_PROFILE(SMBlockingX);
5192                         return ERROR_NT(status);
5193                 }
5194         }
5195
5196         /* If any of the above locks failed, then we must unlock
5197            all of the previous locks (X/Open spec). */
5198
5199         if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
5200                         (i != num_locks) &&
5201                         (num_locks != 0)) {
5202                 /*
5203                  * Ensure we don't do a remove on the lock that just failed,
5204                  * as under POSIX rules, if we have a lock already there, we
5205                  * will delete it (and we shouldn't) .....
5206                  */
5207                 for(i--; i >= 0; i--) {
5208                         lock_pid = get_lock_pid( data, i, large_file_format);
5209                         count = get_lock_count( data, i, large_file_format);
5210                         offset = get_lock_offset( data, i, large_file_format,
5211                                                   &err);
5212
5213                         /*
5214                          * There is no error code marked "stupid client
5215                          * bug".... :-).
5216                          */
5217                         if(err) {
5218                                 END_PROFILE(SMBlockingX);
5219                                 return ERROR_DOS(ERRDOS,ERRnoaccess);
5220                         }
5221
5222                         do_unlock(fsp,
5223                                 lock_pid,
5224                                 count,
5225                                 offset,
5226                                 WINDOWS_LOCK);
5227                 }
5228                 END_PROFILE(SMBlockingX);
5229                 return ERROR_NT(status);
5230         }
5231
5232         set_message(outbuf,2,0,True);
5233
5234         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
5235                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
5236
5237         END_PROFILE(SMBlockingX);
5238         return chain_reply(inbuf,outbuf,length,bufsize);
5239 }
5240
5241 #undef DBGC_CLASS
5242 #define DBGC_CLASS DBGC_ALL
5243
5244 /****************************************************************************
5245  Reply to a SMBreadbmpx (read block multiplex) request.
5246 ****************************************************************************/
5247
5248 int reply_readbmpx(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
5249 {
5250         ssize_t nread = -1;
5251         ssize_t total_read;
5252         char *data;
5253         SMB_OFF_T startpos;
5254         int outsize;
5255         size_t maxcount;
5256         int max_per_packet;
5257         size_t tcount;
5258         int pad;
5259         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
5260         START_PROFILE(SMBreadBmpx);
5261
5262         /* this function doesn't seem to work - disable by default */
5263         if (!lp_readbmpx()) {
5264                 END_PROFILE(SMBreadBmpx);
5265                 return ERROR_DOS(ERRSRV,ERRuseSTD);
5266         }
5267
5268         outsize = set_message(outbuf,8,0,True);
5269
5270         CHECK_FSP(fsp,conn);
5271         if (!CHECK_READ(fsp,inbuf)) {
5272                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
5273         }
5274
5275         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv1);
5276         maxcount = SVAL(inbuf,smb_vwv3);
5277
5278         data = smb_buf(outbuf);
5279         pad = ((long)data)%4;
5280         if (pad)
5281                 pad = 4 - pad;
5282         data += pad;
5283
5284         max_per_packet = bufsize-(outsize+pad);
5285         tcount = maxcount;
5286         total_read = 0;
5287
5288         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
5289                 END_PROFILE(SMBreadBmpx);
5290                 return ERROR_DOS(ERRDOS,ERRlock);
5291         }
5292
5293         do {
5294                 size_t N = MIN(max_per_packet,tcount-total_read);
5295
5296                 nread = read_file(fsp,data,startpos,N);
5297
5298                 if (nread <= 0)
5299                         nread = 0;
5300
5301                 if (nread < (ssize_t)N)
5302                         tcount = total_read + nread;
5303
5304                 set_message(outbuf,8,nread+pad,False);
5305                 SIVAL(outbuf,smb_vwv0,startpos);
5306                 SSVAL(outbuf,smb_vwv2,tcount);
5307                 SSVAL(outbuf,smb_vwv6,nread);
5308                 SSVAL(outbuf,smb_vwv7,smb_offset(data,outbuf));
5309
5310                 show_msg(outbuf);
5311                 if (!send_smb(smbd_server_fd(),outbuf))
5312                         exit_server_cleanly("reply_readbmpx: send_smb failed.");
5313
5314                 total_read += nread;
5315                 startpos += nread;
5316         } while (total_read < (ssize_t)tcount);
5317
5318         END_PROFILE(SMBreadBmpx);
5319         return(-1);
5320 }
5321
5322 /****************************************************************************
5323  Reply to a SMBsetattrE.
5324 ****************************************************************************/
5325
5326 int reply_setattrE(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
5327 {
5328         struct utimbuf unix_times;
5329         int outsize = 0;
5330         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
5331         START_PROFILE(SMBsetattrE);
5332
5333         outsize = set_message(outbuf,0,0,False);
5334
5335         if(!fsp || (fsp->conn != conn)) {
5336                 END_PROFILE(SMBsetattrE);
5337                 return ERROR_DOS(ERRDOS,ERRbadfid);
5338         }
5339
5340         /*
5341          * Convert the DOS times into unix times. Ignore create
5342          * time as UNIX can't set this.
5343          */
5344
5345         unix_times.actime = srv_make_unix_date2(inbuf+smb_vwv3);
5346         unix_times.modtime = srv_make_unix_date2(inbuf+smb_vwv5);
5347
5348         /*
5349          * Patch from Ray Frush <frush@engr.colostate.edu>
5350          * Sometimes times are sent as zero - ignore them.
5351          */
5352
5353         if (null_mtime(unix_times.actime) && null_mtime(unix_times.modtime)) {
5354                 /* Ignore request */
5355                 if( DEBUGLVL( 3 ) ) {
5356                         dbgtext( "reply_setattrE fnum=%d ", fsp->fnum);
5357                         dbgtext( "ignoring zero request - not setting timestamps of 0\n" );
5358                 }
5359                 END_PROFILE(SMBsetattrE);
5360                 return(outsize);
5361         } else if (!null_mtime(unix_times.actime) && null_mtime(unix_times.modtime)) {
5362                 /* set modify time = to access time if modify time was unset */
5363                 unix_times.modtime = unix_times.actime;
5364         }
5365
5366         /* Set the date on this file */
5367         /* Should we set pending modtime here ? JRA */
5368         if(file_utime(conn, fsp->fsp_name, &unix_times)) {
5369                 END_PROFILE(SMBsetattrE);
5370                 return ERROR_DOS(ERRDOS,ERRnoaccess);
5371         }
5372
5373         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%d modtime=%d\n",
5374                 fsp->fnum, (int)unix_times.actime, (int)unix_times.modtime ) );
5375
5376         END_PROFILE(SMBsetattrE);
5377         return(outsize);
5378 }
5379
5380
5381 /* Back from the dead for OS/2..... JRA. */
5382
5383 /****************************************************************************
5384  Reply to a SMBwritebmpx (write block multiplex primary) request.
5385 ****************************************************************************/
5386
5387 int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
5388 {
5389         size_t numtowrite;
5390         ssize_t nwritten = -1;
5391         int outsize = 0;
5392         SMB_OFF_T startpos;
5393         size_t tcount;
5394         BOOL write_through;
5395         int smb_doff;
5396         char *data;
5397         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
5398         START_PROFILE(SMBwriteBmpx);
5399
5400         CHECK_FSP(fsp,conn);
5401         if (!CHECK_WRITE(fsp)) {
5402                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
5403         }
5404         if (HAS_CACHED_ERROR(fsp)) {
5405                 return(CACHED_ERROR(fsp));
5406         }
5407
5408         tcount = SVAL(inbuf,smb_vwv1);
5409         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
5410         write_through = BITSETW(inbuf+smb_vwv7,0);
5411         numtowrite = SVAL(inbuf,smb_vwv10);
5412         smb_doff = SVAL(inbuf,smb_vwv11);
5413
5414         data = smb_base(inbuf) + smb_doff;
5415
5416         /* If this fails we need to send an SMBwriteC response,
5417                 not an SMBwritebmpx - set this up now so we don't forget */
5418         SCVAL(outbuf,smb_com,SMBwritec);
5419
5420         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos,WRITE_LOCK)) {
5421                 END_PROFILE(SMBwriteBmpx);
5422                 return(ERROR_DOS(ERRDOS,ERRlock));
5423         }
5424
5425         nwritten = write_file(fsp,data,startpos,numtowrite);
5426
5427         sync_file(conn, fsp, write_through);
5428
5429         if(nwritten < (ssize_t)numtowrite) {
5430                 END_PROFILE(SMBwriteBmpx);
5431                 return(UNIXERROR(ERRHRD,ERRdiskfull));
5432         }
5433
5434         /* If the maximum to be written to this file
5435                 is greater than what we just wrote then set
5436                 up a secondary struct to be attached to this
5437                 fd, we will use this to cache error messages etc. */
5438
5439         if((ssize_t)tcount > nwritten) {
5440                 write_bmpx_struct *wbms;
5441                 if(fsp->wbmpx_ptr != NULL)
5442                         wbms = fsp->wbmpx_ptr; /* Use an existing struct */
5443                 else
5444                         wbms = SMB_MALLOC_P(write_bmpx_struct);
5445                 if(!wbms) {
5446                         DEBUG(0,("Out of memory in reply_readmpx\n"));
5447                         END_PROFILE(SMBwriteBmpx);
5448                         return(ERROR_DOS(ERRSRV,ERRnoresource));
5449                 }
5450                 wbms->wr_mode = write_through;
5451                 wbms->wr_discard = False; /* No errors yet */
5452                 wbms->wr_total_written = nwritten;
5453                 wbms->wr_errclass = 0;
5454                 wbms->wr_error = 0;
5455                 fsp->wbmpx_ptr = wbms;
5456         }
5457
5458         /* We are returning successfully, set the message type back to
5459                 SMBwritebmpx */
5460         SCVAL(outbuf,smb_com,SMBwriteBmpx);
5461
5462         outsize = set_message(outbuf,1,0,True);
5463
5464         SSVALS(outbuf,smb_vwv0,-1); /* We don't support smb_remaining */
5465
5466         DEBUG( 3, ( "writebmpx fnum=%d num=%d wrote=%d\n",
5467                         fsp->fnum, (int)numtowrite, (int)nwritten ) );
5468
5469         if (write_through && tcount==nwritten) {
5470                 /* We need to send both a primary and a secondary response */
5471                 smb_setlen(outbuf,outsize - 4);
5472                 show_msg(outbuf);
5473                 if (!send_smb(smbd_server_fd(),outbuf))
5474                         exit_server_cleanly("reply_writebmpx: send_smb failed.");
5475
5476                 /* Now the secondary */
5477                 outsize = set_message(outbuf,1,0,True);
5478                 SCVAL(outbuf,smb_com,SMBwritec);
5479                 SSVAL(outbuf,smb_vwv0,nwritten);
5480         }
5481
5482         END_PROFILE(SMBwriteBmpx);
5483         return(outsize);
5484 }
5485
5486 /****************************************************************************
5487  Reply to a SMBwritebs (write block multiplex secondary) request.
5488 ****************************************************************************/
5489
5490 int reply_writebs(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
5491 {
5492         size_t numtowrite;
5493         ssize_t nwritten = -1;
5494         int outsize = 0;
5495         SMB_OFF_T startpos;
5496         size_t tcount;
5497         BOOL write_through;
5498         int smb_doff;
5499         char *data;
5500         write_bmpx_struct *wbms;
5501         BOOL send_response = False;
5502         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
5503         START_PROFILE(SMBwriteBs);
5504
5505         CHECK_FSP(fsp,conn);
5506         if (!CHECK_WRITE(fsp)) {
5507                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
5508         }
5509
5510         tcount = SVAL(inbuf,smb_vwv1);
5511         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
5512         numtowrite = SVAL(inbuf,smb_vwv6);
5513         smb_doff = SVAL(inbuf,smb_vwv7);
5514
5515         data = smb_base(inbuf) + smb_doff;
5516
5517         /* We need to send an SMBwriteC response, not an SMBwritebs */
5518         SCVAL(outbuf,smb_com,SMBwritec);
5519
5520         /* This fd should have an auxiliary struct attached,
5521                 check that it does */
5522         wbms = fsp->wbmpx_ptr;
5523         if(!wbms) {
5524                 END_PROFILE(SMBwriteBs);
5525                 return(-1);
5526         }
5527
5528         /* If write through is set we can return errors, else we must cache them */
5529         write_through = wbms->wr_mode;
5530
5531         /* Check for an earlier error */
5532         if(wbms->wr_discard) {
5533                 END_PROFILE(SMBwriteBs);
5534                 return -1; /* Just discard the packet */
5535         }
5536
5537         nwritten = write_file(fsp,data,startpos,numtowrite);
5538
5539         sync_file(conn, fsp, write_through);
5540
5541         if (nwritten < (ssize_t)numtowrite) {
5542                 if(write_through) {
5543                         /* We are returning an error - we can delete the aux struct */
5544                         if (wbms)
5545                                 free((char *)wbms);
5546                         fsp->wbmpx_ptr = NULL;
5547                         END_PROFILE(SMBwriteBs);
5548                         return(ERROR_DOS(ERRHRD,ERRdiskfull));
5549                 }
5550                 wbms->wr_errclass = ERRHRD;
5551                 wbms->wr_error = ERRdiskfull;
5552                 wbms->wr_status = NT_STATUS_DISK_FULL;
5553                 wbms->wr_discard = True;
5554                 END_PROFILE(SMBwriteBs);
5555                 return -1;
5556         }
5557
5558         /* Increment the total written, if this matches tcount
5559                 we can discard the auxiliary struct (hurrah !) and return a writeC */
5560         wbms->wr_total_written += nwritten;
5561         if(wbms->wr_total_written >= tcount) {
5562                 if (write_through) {
5563                         outsize = set_message(outbuf,1,0,True);
5564                         SSVAL(outbuf,smb_vwv0,wbms->wr_total_written);
5565                         send_response = True;
5566                 }
5567
5568                 free((char *)wbms);
5569                 fsp->wbmpx_ptr = NULL;
5570         }
5571
5572         if(send_response) {
5573                 END_PROFILE(SMBwriteBs);
5574                 return(outsize);
5575         }
5576
5577         END_PROFILE(SMBwriteBs);
5578         return(-1);
5579 }
5580
5581 /****************************************************************************
5582  Reply to a SMBgetattrE.
5583 ****************************************************************************/
5584
5585 int reply_getattrE(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
5586 {
5587         SMB_STRUCT_STAT sbuf;
5588         int outsize = 0;
5589         int mode;
5590         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
5591         START_PROFILE(SMBgetattrE);
5592
5593         outsize = set_message(outbuf,11,0,True);
5594
5595         if(!fsp || (fsp->conn != conn)) {
5596                 END_PROFILE(SMBgetattrE);
5597                 return ERROR_DOS(ERRDOS,ERRbadfid);
5598         }
5599
5600         /* Do an fstat on this file */
5601         if(fsp_stat(fsp, &sbuf)) {
5602                 END_PROFILE(SMBgetattrE);
5603                 return(UNIXERROR(ERRDOS,ERRnoaccess));
5604         }
5605
5606         mode = dos_mode(conn,fsp->fsp_name,&sbuf);
5607
5608         /*
5609          * Convert the times into dos times. Set create
5610          * date to be last modify date as UNIX doesn't save
5611          * this.
5612          */
5613
5614         srv_put_dos_date2(outbuf,smb_vwv0,get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn))));
5615         srv_put_dos_date2(outbuf,smb_vwv2,sbuf.st_atime);
5616         /* Should we check pending modtime here ? JRA */
5617         srv_put_dos_date2(outbuf,smb_vwv4,sbuf.st_mtime);
5618
5619         if (mode & aDIR) {
5620                 SIVAL(outbuf,smb_vwv6,0);
5621                 SIVAL(outbuf,smb_vwv8,0);
5622         } else {
5623                 uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
5624                 SIVAL(outbuf,smb_vwv6,(uint32)sbuf.st_size);
5625                 SIVAL(outbuf,smb_vwv8,allocation_size);
5626         }
5627         SSVAL(outbuf,smb_vwv10, mode);
5628
5629         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
5630
5631         END_PROFILE(SMBgetattrE);
5632         return(outsize);
5633 }