source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  35 #include "../librpc/gen_ndr/open_files.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "rpc_server/rpc_ncacn_np.h"
  39 #include "libcli/security/security.h"
  40 #include "libsmb/nmblib.h"
  41 #include "auth.h"
  42 #include "smbprofile.h"
  43 #include "../lib/tsocket/tsocket.h"
  44 #include "lib/tevent_wait.h"
  45 #include "libcli/smb/smb_signing.h"
  46 #include "lib/util/sys_rw_data.h"
  47
  48 /****************************************************************************
  49  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  50  path or anything including wildcards.
  51  We're assuming here that '/' is not the second byte in any multibyte char
  52  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  53  set.
  54 ****************************************************************************/
  55
  56 /* Custom version for processing POSIX paths. */
  57 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  58
  59 static NTSTATUS check_path_syntax_internal(char *path,
  60                                            bool posix_path,
  61                                            bool *p_last_component_contains_wcard)
  62 {
  63         char *d = path;
  64         const char *s = path;
  65         NTSTATUS ret = NT_STATUS_OK;
  66         bool start_of_name_component = True;
  67         bool stream_started = false;
  68
  69         *p_last_component_contains_wcard = False;
  70
  71         while (*s) {
  72                 if (stream_started) {
  73                         switch (*s) {
  74                         case '/':
  75                         case '\\':
  76                                 return NT_STATUS_OBJECT_NAME_INVALID;
  77                         case ':':
  78                                 if (s[1] == '\0') {
  79                                         return NT_STATUS_OBJECT_NAME_INVALID;
  80                                 }
  81                                 if (strchr_m(&s[1], ':')) {
  82                                         return NT_STATUS_OBJECT_NAME_INVALID;
  83                                 }
  84                                 break;
  85                         }
  86                 }
  87
  88                 if ((*s == ':') && !posix_path && !stream_started) {
  89                         if (*p_last_component_contains_wcard) {
  90                                 return NT_STATUS_OBJECT_NAME_INVALID;
  91                         }
  92                         /* Stream names allow more characters than file names.
  93                            We're overloading posix_path here to allow a wider
  94                            range of characters. If stream_started is true this
  95                            is still a Windows path even if posix_path is true.
  96                            JRA.
  97                         */
  98                         stream_started = true;
  99                         start_of_name_component = false;
 100                         posix_path = true;
 101
 102                         if (s[1] == '\0') {
 103                                 return NT_STATUS_OBJECT_NAME_INVALID;
 104                         }
 105                 }
 106
 107                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 108                         /*
 109                          * Safe to assume is not the second part of a mb char
 110                          * as this is handled below.
 111                          */
 112                         /* Eat multiple '/' or '\\' */
 113                         while (IS_PATH_SEP(*s,posix_path)) {
 114                                 s++;
 115                         }
 116                         if ((d != path) && (*s != '\0')) {
 117                                 /* We only care about non-leading or trailing '/' or '\\' */
 118                                 *d++ = '/';
 119                         }
 120
 121                         start_of_name_component = True;
 122                         /* New component. */
 123                         *p_last_component_contains_wcard = False;
 124                         continue;
 125                 }
 126
 127                 if (start_of_name_component) {
 128                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 129                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 130
 131                                 /*
 132                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 133                                  */
 134
 135                                 /* If  we just added a '/' - delete it */
 136                                 if ((d > path) && (*(d-1) == '/')) {
 137                                         *(d-1) = '\0';
 138                                         d--;
 139                                 }
 140
 141                                 /* Are we at the start ? Can't go back further if so. */
 142                                 if (d <= path) {
 143                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 144                                         break;
 145                                 }
 146                                 /* Go back one level... */
 147                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 148                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 149                                 /* Decrement d first as d points to the *next* char to write into. */
 150                                 for (d--; d > path; d--) {
 151                                         if (*d == '/')
 152                                                 break;
 153                                 }
 154                                 s += 2; /* Else go past the .. */
 155                                 /* We're still at the start of a name component, just the previous one. */
 156                                 continue;
 157
 158                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 159                                 if (posix_path) {
 160                                         /* Eat the '.' */
 161                                         s++;
 162                                         continue;
 163                                 }
 164                         }
 165
 166                 }
 167
 168                 if (!(*s & 0x80)) {
 169                         if (!posix_path) {
 170                                 if (*s <= 0x1f || *s == '|') {
 171                                         return NT_STATUS_OBJECT_NAME_INVALID;
 172                                 }
 173                                 switch (*s) {
 174                                         case '*':
 175                                         case '?':
 176                                         case '<':
 177                                         case '>':
 178                                         case '"':
 179                                                 *p_last_component_contains_wcard = True;
 180                                                 break;
 181                                         default:
 182                                                 break;
 183                                 }
 184                         }
 185                         *d++ = *s++;
 186                 } else {
 187                         size_t siz;
 188                         /* Get the size of the next MB character. */
 189                         next_codepoint(s,&siz);
 190                         switch(siz) {
 191                                 case 5:
 192                                         *d++ = *s++;
 193                                         /*fall through*/
 194                                 case 4:
 195                                         *d++ = *s++;
 196                                         /*fall through*/
 197                                 case 3:
 198                                         *d++ = *s++;
 199                                         /*fall through*/
 200                                 case 2:
 201                                         *d++ = *s++;
 202                                         /*fall through*/
 203                                 case 1:
 204                                         *d++ = *s++;
 205                                         break;
 206                                 default:
 207                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 208                                         *d = '\0';
 209                                         return NT_STATUS_INVALID_PARAMETER;
 210                         }
 211                 }
 212                 start_of_name_component = False;
 213         }
 214
 215         *d = '\0';
 216
 217         return ret;
 218 }
 219
 220 /****************************************************************************
 221  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 222  No wildcards allowed.
 223 ****************************************************************************/
 224
 225 NTSTATUS check_path_syntax(char *path)
 226 {
 227         bool ignore;
 228         return check_path_syntax_internal(path, False, &ignore);
 229 }
 230
 231 /****************************************************************************
 232  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 233  Wildcards allowed - p_contains_wcard returns true if the last component contained
 234  a wildcard.
 235 ****************************************************************************/
 236
 237 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 238 {
 239         return check_path_syntax_internal(path, False, p_contains_wcard);
 240 }
 241
 242 /****************************************************************************
 243  Check the path for a POSIX client.
 244  We're assuming here that '/' is not the second byte in any multibyte char
 245  set (a safe assumption).
 246 ****************************************************************************/
 247
 248 NTSTATUS check_path_syntax_posix(char *path)
 249 {
 250         bool ignore;
 251         return check_path_syntax_internal(path, True, &ignore);
 252 }
 253
 254 /****************************************************************************
 255  Pull a string and check the path allowing a wilcard - provide for error return.
 256  Passes in posix flag.
 257 ****************************************************************************/
 258
 259 static size_t srvstr_get_path_wcard_internal(TALLOC_CTX *ctx,
 260                         const char *base_ptr,
 261                         uint16_t smb_flags2,
 262                         char **pp_dest,
 263                         const char *src,
 264                         size_t src_len,
 265                         int flags,
 266                         bool posix_pathnames,
 267                         NTSTATUS *err,
 268                         bool *contains_wcard)
 269 {
 270         size_t ret;
 271
 272         *pp_dest = NULL;
 273
 274         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 275                                  src_len, flags);
 276
 277         if (!*pp_dest) {
 278                 *err = NT_STATUS_INVALID_PARAMETER;
 279                 return ret;
 280         }
 281
 282         *contains_wcard = False;
 283
 284         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 285                 /*
 286                  * For a DFS path the function parse_dfs_path()
 287                  * will do the path processing, just make a copy.
 288                  */
 289                 *err = NT_STATUS_OK;
 290                 return ret;
 291         }
 292
 293         if (posix_pathnames) {
 294                 *err = check_path_syntax_posix(*pp_dest);
 295         } else {
 296                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 297         }
 298
 299         return ret;
 300 }
 301
 302 /****************************************************************************
 303  Pull a string and check the path allowing a wilcard - provide for error return.
 304 ****************************************************************************/
 305
 306 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 307                         const char *base_ptr,
 308                         uint16_t smb_flags2,
 309                         char **pp_dest,
 310                         const char *src,
 311                         size_t src_len,
 312                         int flags,
 313                         NTSTATUS *err,
 314                         bool *contains_wcard)
 315 {
 316         return srvstr_get_path_wcard_internal(ctx,
 317                         base_ptr,
 318                         smb_flags2,
 319                         pp_dest,
 320                         src,
 321                         src_len,
 322                         flags,
 323                         false,
 324                         err,
 325                         contains_wcard);
 326 }
 327
 328 /****************************************************************************
 329  Pull a string and check the path allowing a wilcard - provide for error return.
 330  posix_pathnames version.
 331 ****************************************************************************/
 332
 333 size_t srvstr_get_path_wcard_posix(TALLOC_CTX *ctx,
 334                         const char *base_ptr,
 335                         uint16_t smb_flags2,
 336                         char **pp_dest,
 337                         const char *src,
 338                         size_t src_len,
 339                         int flags,
 340                         NTSTATUS *err,
 341                         bool *contains_wcard)
 342 {
 343         return srvstr_get_path_wcard_internal(ctx,
 344                         base_ptr,
 345                         smb_flags2,
 346                         pp_dest,
 347                         src,
 348                         src_len,
 349                         flags,
 350                         true,
 351                         err,
 352                         contains_wcard);
 353 }
 354
 355 /****************************************************************************
 356  Pull a string and check the path - provide for error return.
 357 ****************************************************************************/
 358
 359 size_t srvstr_get_path(TALLOC_CTX *ctx,
 360                         const char *base_ptr,
 361                         uint16_t smb_flags2,
 362                         char **pp_dest,
 363                         const char *src,
 364                         size_t src_len,
 365                         int flags,
 366                         NTSTATUS *err)
 367 {
 368         bool ignore;
 369         return srvstr_get_path_wcard_internal(ctx,
 370                         base_ptr,
 371                         smb_flags2,
 372                         pp_dest,
 373                         src,
 374                         src_len,
 375                         flags,
 376                         false,
 377                         err,
 378                         &ignore);
 379 }
 380
 381 /****************************************************************************
 382  Pull a string and check the path - provide for error return.
 383  posix_pathnames version.
 384 ****************************************************************************/
 385
 386 size_t srvstr_get_path_posix(TALLOC_CTX *ctx,
 387                         const char *base_ptr,
 388                         uint16_t smb_flags2,
 389                         char **pp_dest,
 390                         const char *src,
 391                         size_t src_len,
 392                         int flags,
 393                         NTSTATUS *err)
 394 {
 395         bool ignore;
 396         return srvstr_get_path_wcard_internal(ctx,
 397                         base_ptr,
 398                         smb_flags2,
 399                         pp_dest,
 400                         src,
 401                         src_len,
 402                         flags,
 403                         true,
 404                         err,
 405                         &ignore);
 406 }
 407
 408
 409 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 410                                  char **pp_dest, const char *src, int flags,
 411                                  NTSTATUS *err, bool *contains_wcard)
 412 {
 413         ssize_t bufrem = smbreq_bufrem(req, src);
 414
 415         if (bufrem < 0) {
 416                 *err = NT_STATUS_INVALID_PARAMETER;
 417                 return 0;
 418         }
 419
 420         if (req->posix_pathnames) {
 421                 return srvstr_get_path_wcard_internal(mem_ctx,
 422                                 (const char *)req->inbuf,
 423                                 req->flags2,
 424                                 pp_dest,
 425                                 src,
 426                                 bufrem,
 427                                 flags,
 428                                 true,
 429                                 err,
 430                                 contains_wcard);
 431         } else {
 432                 return srvstr_get_path_wcard_internal(mem_ctx,
 433                                 (const char *)req->inbuf,
 434                                 req->flags2,
 435                                 pp_dest,
 436                                 src,
 437                                 bufrem,
 438                                 flags,
 439                                 false,
 440                                 err,
 441                                 contains_wcard);
 442         }
 443 }
 444
 445 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 446                            char **pp_dest, const char *src, int flags,
 447                            NTSTATUS *err)
 448 {
 449         bool ignore;
 450         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 451                                          flags, err, &ignore);
 452 }
 453
 454 /**
 455  * pull a string from the smb_buf part of a packet. In this case the
 456  * string can either be null terminated or it can be terminated by the
 457  * end of the smbbuf area
 458  */
 459 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
 460                               char **dest, const uint8_t *src, int flags)
 461 {
 462         ssize_t bufrem = smbreq_bufrem(req, src);
 463
 464         if (bufrem < 0) {
 465                 return 0;
 466         }
 467
 468         return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
 469                                   bufrem, flags);
 470 }
 471
 472 /****************************************************************************
 473  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 474 ****************************************************************************/
 475
 476 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 477                     files_struct *fsp)
 478 {
 479         if ((fsp == NULL) || (conn == NULL)) {
 480                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 481                 return False;
 482         }
 483         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 484                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 485                 return False;
 486         }
 487         return True;
 488 }
 489
 490 /****************************************************************************
 491  Check if we have a correct fsp pointing to a file.
 492 ****************************************************************************/
 493
 494 bool check_fsp(connection_struct *conn, struct smb_request *req,
 495                files_struct *fsp)
 496 {
 497         if (!check_fsp_open(conn, req, fsp)) {
 498                 return False;
 499         }
 500         if (fsp->is_directory) {
 501                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 502                 return False;
 503         }
 504         if (fsp->fh->fd == -1) {
 505                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 506                 return False;
 507         }
 508         fsp->num_smb_operations++;
 509         return True;
 510 }
 511
 512 /****************************************************************************
 513  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 514  the CHECK_NTQUOTA_HANDLE_OK macro.
 515 ****************************************************************************/
 516
 517 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 518                               files_struct *fsp)
 519 {
 520         if (!check_fsp_open(conn, req, fsp)) {
 521                 return false;
 522         }
 523
 524         if (fsp->is_directory) {
 525                 return false;
 526         }
 527
 528         if (fsp->fake_file_handle == NULL) {
 529                 return false;
 530         }
 531
 532         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 533                 return false;
 534         }
 535
 536         if (fsp->fake_file_handle->private_data == NULL) {
 537                 return false;
 538         }
 539
 540         return true;
 541 }
 542
 543 static bool netbios_session_retarget(struct smbXsrv_connection *xconn,
 544                                      const char *name, int name_type)
 545 {
 546         char *trim_name;
 547         char *trim_name_type;
 548         const char *retarget_parm;
 549         char *retarget;
 550         char *p;
 551         int retarget_type = 0x20;
 552         int retarget_port = NBT_SMB_PORT;
 553         struct sockaddr_storage retarget_addr;
 554         struct sockaddr_in *in_addr;
 555         bool ret = false;
 556         uint8_t outbuf[10];
 557
 558         if (get_socket_port(xconn->transport.sock) != NBT_SMB_PORT) {
 559                 return false;
 560         }
 561
 562         trim_name = talloc_strdup(talloc_tos(), name);
 563         if (trim_name == NULL) {
 564                 goto fail;
 565         }
 566         trim_char(trim_name, ' ', ' ');
 567
 568         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 569                                          name_type);
 570         if (trim_name_type == NULL) {
 571                 goto fail;
 572         }
 573
 574         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 575                                              trim_name_type, NULL);
 576         if (retarget_parm == NULL) {
 577                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 578                                                      trim_name, NULL);
 579         }
 580         if (retarget_parm == NULL) {
 581                 goto fail;
 582         }
 583
 584         retarget = talloc_strdup(trim_name, retarget_parm);
 585         if (retarget == NULL) {
 586                 goto fail;
 587         }
 588
 589         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 590
 591         p = strchr(retarget, ':');
 592         if (p != NULL) {
 593                 *p++ = '\0';
 594                 retarget_port = atoi(p);
 595         }
 596
 597         p = strchr_m(retarget, '#');
 598         if (p != NULL) {
 599                 *p++ = '\0';
 600                 if (sscanf(p, "%x", &retarget_type) != 1) {
 601                         goto fail;
 602                 }
 603         }
 604
 605         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 606         if (!ret) {
 607                 DEBUG(10, ("could not resolve %s\n", retarget));
 608                 goto fail;
 609         }
 610
 611         if (retarget_addr.ss_family != AF_INET) {
 612                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 613                 goto fail;
 614         }
 615
 616         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 617
 618         _smb_setlen(outbuf, 6);
 619         SCVAL(outbuf, 0, 0x84);
 620         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 621         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 622
 623         if (!srv_send_smb(xconn, (char *)outbuf, false, 0, false,
 624                           NULL)) {
 625                 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
 626                                     "failed.");
 627         }
 628
 629         ret = true;
 630  fail:
 631         TALLOC_FREE(trim_name);
 632         return ret;
 633 }
 634
 635 static void reply_called_name_not_present(char *outbuf)
 636 {
 637         smb_setlen(outbuf, 1);
 638         SCVAL(outbuf, 0, 0x83);
 639         SCVAL(outbuf, 4, 0x82);
 640 }
 641
 642 /****************************************************************************
 643  Reply to a (netbios-level) special message.
 644 ****************************************************************************/
 645
 646 void reply_special(struct smbXsrv_connection *xconn, char *inbuf, size_t inbuf_size)
 647 {
 648         struct smbd_server_connection *sconn = xconn->client->sconn;
 649         int msg_type = CVAL(inbuf,0);
 650         int msg_flags = CVAL(inbuf,1);
 651         /*
 652          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 653          * calculation & friends (srv_send_smb uses that) we need the full smb
 654          * header.
 655          */
 656         char outbuf[smb_size];
 657
 658         memset(outbuf, '\0', sizeof(outbuf));
 659
 660         smb_setlen(outbuf,0);
 661
 662         switch (msg_type) {
 663         case NBSSrequest: /* session request */
 664         {
 665                 /* inbuf_size is guarenteed to be at least 4. */
 666                 fstring name1,name2;
 667                 int name_type1, name_type2;
 668                 int name_len1, name_len2;
 669
 670                 *name1 = *name2 = 0;
 671
 672                 if (xconn->transport.nbt.got_session) {
 673                         exit_server_cleanly("multiple session request not permitted");
 674                 }
 675
 676                 SCVAL(outbuf,0,NBSSpositive);
 677                 SCVAL(outbuf,3,0);
 678
 679                 /* inbuf_size is guaranteed to be at least 4. */
 680                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 681                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 682                         DEBUG(0,("Invalid name length in session request\n"));
 683                         reply_called_name_not_present(outbuf);
 684                         break;
 685                 }
 686                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 687                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 688                         DEBUG(0,("Invalid name length in session request\n"));
 689                         reply_called_name_not_present(outbuf);
 690                         break;
 691                 }
 692
 693                 name_type1 = name_extract((unsigned char *)inbuf,
 694                                 inbuf_size,(unsigned int)4,name1);
 695                 name_type2 = name_extract((unsigned char *)inbuf,
 696                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 697
 698                 if (name_type1 == -1 || name_type2 == -1) {
 699                         DEBUG(0,("Invalid name type in session request\n"));
 700                         reply_called_name_not_present(outbuf);
 701                         break;
 702                 }
 703
 704                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 705                          name1, name_type1, name2, name_type2));
 706
 707                 if (netbios_session_retarget(xconn, name1, name_type1)) {
 708                         exit_server_cleanly("retargeted client");
 709                 }
 710
 711                 /*
 712                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 713                  * "*SMBSERV" arrggg!!!
 714                  */
 715                 if (strequal(name1, "*SMBSERVER     ")
 716                     || strequal(name1, "*SMBSERV       "))  {
 717                         char *raddr;
 718
 719                         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
 720                                                                  talloc_tos());
 721                         if (raddr == NULL) {
 722                                 exit_server_cleanly("could not allocate raddr");
 723                         }
 724
 725                         fstrcpy(name1, raddr);
 726                 }
 727
 728                 set_local_machine_name(name1, True);
 729                 set_remote_machine_name(name2, True);
 730
 731                 if (is_ipaddress(sconn->remote_hostname)) {
 732                         char *p = discard_const_p(char, sconn->remote_hostname);
 733
 734                         talloc_free(p);
 735
 736                         sconn->remote_hostname = talloc_strdup(sconn,
 737                                                 get_remote_machine_name());
 738                         if (sconn->remote_hostname == NULL) {
 739                                 exit_server_cleanly("could not copy remote name");
 740                         }
 741                         xconn->remote_hostname = sconn->remote_hostname;
 742                 }
 743
 744                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 745                          get_local_machine_name(), get_remote_machine_name(),
 746                          name_type2));
 747
 748                 if (name_type2 == 'R') {
 749                         /* We are being asked for a pathworks session ---
 750                            no thanks! */
 751                         reply_called_name_not_present(outbuf);
 752                         break;
 753                 }
 754
 755                 reload_services(sconn, conn_snum_used, true);
 756                 reopen_logs();
 757
 758                 xconn->transport.nbt.got_session = true;
 759                 break;
 760         }
 761
 762         case 0x89: /* session keepalive request
 763                       (some old clients produce this?) */
 764                 SCVAL(outbuf,0,NBSSkeepalive);
 765                 SCVAL(outbuf,3,0);
 766                 break;
 767
 768         case NBSSpositive: /* positive session response */
 769         case NBSSnegative: /* negative session response */
 770         case NBSSretarget: /* retarget session response */
 771                 DEBUG(0,("Unexpected session response\n"));
 772                 break;
 773
 774         case NBSSkeepalive: /* session keepalive */
 775         default:
 776                 return;
 777         }
 778
 779         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 780                     msg_type, msg_flags));
 781
 782         srv_send_smb(xconn, outbuf, false, 0, false, NULL);
 783
 784         if (CVAL(outbuf, 0) != 0x82) {
 785                 exit_server_cleanly("invalid netbios session");
 786         }
 787         return;
 788 }
 789
 790 /****************************************************************************
 791  Reply to a tcon.
 792  conn POINTER CAN BE NULL HERE !
 793 ****************************************************************************/
 794
 795 void reply_tcon(struct smb_request *req)
 796 {
 797         connection_struct *conn = req->conn;
 798         const char *service;
 799         char *service_buf = NULL;
 800         char *password = NULL;
 801         char *dev = NULL;
 802         int pwlen=0;
 803         NTSTATUS nt_status;
 804         const uint8_t *p;
 805         const char *p2;
 806         TALLOC_CTX *ctx = talloc_tos();
 807         struct smbXsrv_connection *xconn = req->xconn;
 808         NTTIME now = timeval_to_nttime(&req->request_time);
 809
 810         START_PROFILE(SMBtcon);
 811
 812         if (req->buflen < 4) {
 813                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 814                 END_PROFILE(SMBtcon);
 815                 return;
 816         }
 817
 818         p = req->buf + 1;
 819         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 820         p += 1;
 821         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 822         p += pwlen+1;
 823         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 824         p += 1;
 825
 826         if (service_buf == NULL || password == NULL || dev == NULL) {
 827                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 828                 END_PROFILE(SMBtcon);
 829                 return;
 830         }
 831         p2 = strrchr_m(service_buf,'\\');
 832         if (p2) {
 833                 service = p2+1;
 834         } else {
 835                 service = service_buf;
 836         }
 837
 838         conn = make_connection(req, now, service, dev,
 839                                req->vuid,&nt_status);
 840         req->conn = conn;
 841
 842         if (!conn) {
 843                 reply_nterror(req, nt_status);
 844                 END_PROFILE(SMBtcon);
 845                 return;
 846         }
 847
 848         reply_outbuf(req, 2, 0);
 849         SSVAL(req->outbuf,smb_vwv0,xconn->smb1.negprot.max_recv);
 850         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 851         SSVAL(req->outbuf,smb_tid,conn->cnum);
 852
 853         DEBUG(3,("tcon service=%s cnum=%d\n",
 854                  service, conn->cnum));
 855
 856         END_PROFILE(SMBtcon);
 857         return;
 858 }
 859
 860 /****************************************************************************
 861  Reply to a tcon and X.
 862  conn POINTER CAN BE NULL HERE !
 863 ****************************************************************************/
 864
 865 void reply_tcon_and_X(struct smb_request *req)
 866 {
 867         connection_struct *conn = req->conn;
 868         const char *service = NULL;
 869         TALLOC_CTX *ctx = talloc_tos();
 870         /* what the cleint thinks the device is */
 871         char *client_devicetype = NULL;
 872         /* what the server tells the client the share represents */
 873         const char *server_devicetype;
 874         NTSTATUS nt_status;
 875         int passlen;
 876         char *path = NULL;
 877         const uint8_t *p;
 878         const char *q;
 879         uint16_t tcon_flags;
 880         struct smbXsrv_session *session = NULL;
 881         NTTIME now = timeval_to_nttime(&req->request_time);
 882         bool session_key_updated = false;
 883         uint16_t optional_support = 0;
 884         struct smbXsrv_connection *xconn = req->xconn;
 885
 886         START_PROFILE(SMBtconX);
 887
 888         if (req->wct < 4) {
 889                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 890                 END_PROFILE(SMBtconX);
 891                 return;
 892         }
 893
 894         passlen = SVAL(req->vwv+3, 0);
 895         tcon_flags = SVAL(req->vwv+2, 0);
 896
 897         /* we might have to close an old one */
 898         if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
 899                 struct smbXsrv_tcon *tcon;
 900                 NTSTATUS status;
 901
 902                 tcon = conn->tcon;
 903                 req->conn = NULL;
 904                 conn = NULL;
 905
 906                 /*
 907                  * TODO: cancel all outstanding requests on the tcon
 908                  */
 909                 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
 910                 if (!NT_STATUS_IS_OK(status)) {
 911                         DEBUG(0, ("reply_tcon_and_X: "
 912                                   "smbXsrv_tcon_disconnect() failed: %s\n",
 913                                   nt_errstr(status)));
 914                         /*
 915                          * If we hit this case, there is something completely
 916                          * wrong, so we better disconnect the transport connection.
 917                          */
 918                         END_PROFILE(SMBtconX);
 919                         exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
 920                         return;
 921                 }
 922
 923                 TALLOC_FREE(tcon);
 924         }
 925
 926         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 927                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 928                 END_PROFILE(SMBtconX);
 929                 return;
 930         }
 931
 932         if (xconn->smb1.negprot.encrypted_passwords) {
 933                 p = req->buf + passlen;
 934         } else {
 935                 p = req->buf + passlen + 1;
 936         }
 937
 938         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 939
 940         if (path == NULL) {
 941                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 942                 END_PROFILE(SMBtconX);
 943                 return;
 944         }
 945
 946         /*
 947          * the service name can be either: \\server\share
 948          * or share directly like on the DELL PowerVault 705
 949          */
 950         if (*path=='\\') {
 951                 q = strchr_m(path+2,'\\');
 952                 if (!q) {
 953                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 954                         END_PROFILE(SMBtconX);
 955                         return;
 956                 }
 957                 service = q+1;
 958         } else {
 959                 service = path;
 960         }
 961
 962         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 963                                 &client_devicetype, p,
 964                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 965
 966         if (client_devicetype == NULL) {
 967                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 968                 END_PROFILE(SMBtconX);
 969                 return;
 970         }
 971
 972         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 973
 974         nt_status = smb1srv_session_lookup(xconn,
 975                                            req->vuid, now, &session);
 976         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
 977                 reply_force_doserror(req, ERRSRV, ERRbaduid);
 978                 END_PROFILE(SMBtconX);
 979                 return;
 980         }
 981         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 982                 reply_nterror(req, nt_status);
 983                 END_PROFILE(SMBtconX);
 984                 return;
 985         }
 986         if (!NT_STATUS_IS_OK(nt_status)) {
 987                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 988                 END_PROFILE(SMBtconX);
 989                 return;
 990         }
 991
 992         if (session->global->auth_session_info == NULL) {
 993                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 994                 END_PROFILE(SMBtconX);
 995                 return;
 996         }
 997
 998         /*
 999          * If there is no application key defined yet
1000          * we create one.
1001          *
1002          * This means we setup the application key on the
1003          * first tcon that happens via the given session.
1004          *
1005          * Once the application key is defined, it does not
1006          * change any more.
1007          */
1008         if (session->global->application_key.length == 0 &&
1009             session->global->signing_key.length > 0)
1010         {
1011                 struct smbXsrv_session *x = session;
1012                 struct auth_session_info *session_info =
1013                         session->global->auth_session_info;
1014                 uint8_t session_key[16];
1015
1016                 ZERO_STRUCT(session_key);
1017                 memcpy(session_key, x->global->signing_key.data,
1018                        MIN(x->global->signing_key.length, sizeof(session_key)));
1019
1020                 /*
1021                  * The application key is truncated/padded to 16 bytes
1022                  */
1023                 x->global->application_key = data_blob_talloc(x->global,
1024                                                              session_key,
1025                                                              sizeof(session_key));
1026                 ZERO_STRUCT(session_key);
1027                 if (x->global->application_key.data == NULL) {
1028                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1029                         END_PROFILE(SMBtconX);
1030                         return;
1031                 }
1032
1033                 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
1034                         smb_key_derivation(x->global->application_key.data,
1035                                            x->global->application_key.length,
1036                                            x->global->application_key.data);
1037                         optional_support |= SMB_EXTENDED_SIGNATURES;
1038                 }
1039
1040                 /*
1041                  * Place the application key into the session_info
1042                  */
1043                 data_blob_clear_free(&session_info->session_key);
1044                 session_info->session_key = data_blob_dup_talloc(session_info,
1045                                                 x->global->application_key);
1046                 if (session_info->session_key.data == NULL) {
1047                         data_blob_clear_free(&x->global->application_key);
1048                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1049                         END_PROFILE(SMBtconX);
1050                         return;
1051                 }
1052                 session_key_updated = true;
1053         }
1054
1055         conn = make_connection(req, now, service, client_devicetype,
1056                                req->vuid, &nt_status);
1057         req->conn =conn;
1058
1059         if (!conn) {
1060                 if (session_key_updated) {
1061                         struct smbXsrv_session *x = session;
1062                         struct auth_session_info *session_info =
1063                                 session->global->auth_session_info;
1064                         data_blob_clear_free(&x->global->application_key);
1065                         data_blob_clear_free(&session_info->session_key);
1066                 }
1067                 reply_nterror(req, nt_status);
1068                 END_PROFILE(SMBtconX);
1069                 return;
1070         }
1071
1072         if ( IS_IPC(conn) )
1073                 server_devicetype = "IPC";
1074         else if ( IS_PRINT(conn) )
1075                 server_devicetype = "LPT1:";
1076         else
1077                 server_devicetype = "A:";
1078
1079         if (get_Protocol() < PROTOCOL_NT1) {
1080                 reply_outbuf(req, 2, 0);
1081                 if (message_push_string(&req->outbuf, server_devicetype,
1082                                         STR_TERMINATE|STR_ASCII) == -1) {
1083                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1084                         END_PROFILE(SMBtconX);
1085                         return;
1086                 }
1087         } else {
1088                 /* NT sets the fstype of IPC$ to the null string */
1089                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
1090
1091                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
1092                         /* Return permissions. */
1093                         uint32_t perm1 = 0;
1094                         uint32_t perm2 = 0;
1095
1096                         reply_outbuf(req, 7, 0);
1097
1098                         if (IS_IPC(conn)) {
1099                                 perm1 = FILE_ALL_ACCESS;
1100                                 perm2 = FILE_ALL_ACCESS;
1101                         } else {
1102                                 perm1 = conn->share_access;
1103                         }
1104
1105                         SIVAL(req->outbuf, smb_vwv3, perm1);
1106                         SIVAL(req->outbuf, smb_vwv5, perm2);
1107                 } else {
1108                         reply_outbuf(req, 3, 0);
1109                 }
1110
1111                 if ((message_push_string(&req->outbuf, server_devicetype,
1112                                          STR_TERMINATE|STR_ASCII) == -1)
1113                     || (message_push_string(&req->outbuf, fstype,
1114                                             STR_TERMINATE) == -1)) {
1115                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1116                         END_PROFILE(SMBtconX);
1117                         return;
1118                 }
1119
1120                 /* what does setting this bit do? It is set by NT4 and
1121                    may affect the ability to autorun mounted cdroms */
1122                 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1123                 optional_support |=
1124                         (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1125
1126                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1127                         DEBUG(2,("Serving %s as a Dfs root\n",
1128                                  lp_servicename(ctx, SNUM(conn)) ));
1129                         optional_support |= SMB_SHARE_IN_DFS;
1130                 }
1131
1132                 SSVAL(req->outbuf, smb_vwv2, optional_support);
1133         }
1134
1135         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1136         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
1137
1138         DEBUG(3,("tconX service=%s \n",
1139                  service));
1140
1141         /* set the incoming and outgoing tid to the just created one */
1142         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1143         SSVAL(req->outbuf,smb_tid,conn->cnum);
1144
1145         END_PROFILE(SMBtconX);
1146
1147         req->tid = conn->cnum;
1148 }
1149
1150 /****************************************************************************
1151  Reply to an unknown type.
1152 ****************************************************************************/
1153
1154 void reply_unknown_new(struct smb_request *req, uint8_t type)
1155 {
1156         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1157                   smb_fn_name(type), type, type));
1158         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1159         return;
1160 }
1161
1162 /****************************************************************************
1163  Reply to an ioctl.
1164  conn POINTER CAN BE NULL HERE !
1165 ****************************************************************************/
1166
1167 void reply_ioctl(struct smb_request *req)
1168 {
1169         connection_struct *conn = req->conn;
1170         uint16_t device;
1171         uint16_t function;
1172         uint32_t ioctl_code;
1173         int replysize;
1174         char *p;
1175
1176         START_PROFILE(SMBioctl);
1177
1178         if (req->wct < 3) {
1179                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1180                 END_PROFILE(SMBioctl);
1181                 return;
1182         }
1183
1184         device     = SVAL(req->vwv+1, 0);
1185         function   = SVAL(req->vwv+2, 0);
1186         ioctl_code = (device << 16) + function;
1187
1188         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1189
1190         switch (ioctl_code) {
1191             case IOCTL_QUERY_JOB_INFO:
1192                     replysize = 32;
1193                     break;
1194             default:
1195                     reply_force_doserror(req, ERRSRV, ERRnosupport);
1196                     END_PROFILE(SMBioctl);
1197                     return;
1198         }
1199
1200         reply_outbuf(req, 8, replysize+1);
1201         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1202         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1203         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
1204         p = smb_buf(req->outbuf);
1205         memset(p, '\0', replysize+1); /* valgrind-safe. */
1206         p += 1;          /* Allow for alignment */
1207
1208         switch (ioctl_code) {
1209                 case IOCTL_QUERY_JOB_INFO:
1210                 {
1211                         NTSTATUS status;
1212                         size_t len = 0;
1213                         files_struct *fsp = file_fsp(
1214                                 req, SVAL(req->vwv+0, 0));
1215                         if (!fsp) {
1216                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1217                                 END_PROFILE(SMBioctl);
1218                                 return;
1219                         }
1220                         /* Job number */
1221                         SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1222
1223                         status = srvstr_push((char *)req->outbuf, req->flags2, p+2,
1224                                     lp_netbios_name(), 15,
1225                                     STR_TERMINATE|STR_ASCII, &len);
1226                         if (!NT_STATUS_IS_OK(status)) {
1227                                 reply_nterror(req, status);
1228                                 END_PROFILE(SMBioctl);
1229                                 return;
1230                         }
1231                         if (conn) {
1232                                 status = srvstr_push((char *)req->outbuf, req->flags2,
1233                                             p+18,
1234                                             lp_servicename(talloc_tos(),
1235                                                            SNUM(conn)),
1236                                             13, STR_TERMINATE|STR_ASCII, &len);
1237                                 if (!NT_STATUS_IS_OK(status)) {
1238                                         reply_nterror(req, status);
1239                                         END_PROFILE(SMBioctl);
1240                                         return;
1241                                 }
1242                         } else {
1243                                 memset(p+18, 0, 13);
1244                         }
1245                         break;
1246                 }
1247         }
1248
1249         END_PROFILE(SMBioctl);
1250         return;
1251 }
1252
1253 /****************************************************************************
1254  Strange checkpath NTSTATUS mapping.
1255 ****************************************************************************/
1256
1257 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1258 {
1259         /* Strange DOS error code semantics only for checkpath... */
1260         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1261                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1262                         /* We need to map to ERRbadpath */
1263                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1264                 }
1265         }
1266         return status;
1267 }
1268
1269 /****************************************************************************
1270  Reply to a checkpath.
1271 ****************************************************************************/
1272
1273 void reply_checkpath(struct smb_request *req)
1274 {
1275         connection_struct *conn = req->conn;
1276         struct smb_filename *smb_fname = NULL;
1277         char *name = NULL;
1278         NTSTATUS status;
1279         uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
1280         TALLOC_CTX *ctx = talloc_tos();
1281
1282         START_PROFILE(SMBcheckpath);
1283
1284         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1285                             STR_TERMINATE, &status);
1286
1287         if (!NT_STATUS_IS_OK(status)) {
1288                 status = map_checkpath_error(req->flags2, status);
1289                 reply_nterror(req, status);
1290                 END_PROFILE(SMBcheckpath);
1291                 return;
1292         }
1293
1294         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1295
1296         status = filename_convert(ctx,
1297                                 conn,
1298                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1299                                 name,
1300                                 ucf_flags,
1301                                 NULL,
1302                                 &smb_fname);
1303
1304         if (!NT_STATUS_IS_OK(status)) {
1305                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1306                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1307                                         ERRSRV, ERRbadpath);
1308                         END_PROFILE(SMBcheckpath);
1309                         return;
1310                 }
1311                 goto path_err;
1312         }
1313
1314         if (!VALID_STAT(smb_fname->st) &&
1315             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1316                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1317                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1318                 status = map_nt_error_from_unix(errno);
1319                 goto path_err;
1320         }
1321
1322         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1323                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1324                                 ERRDOS, ERRbadpath);
1325                 goto out;
1326         }
1327
1328         reply_outbuf(req, 0, 0);
1329
1330  path_err:
1331         /* We special case this - as when a Windows machine
1332                 is parsing a path is steps through the components
1333                 one at a time - if a component fails it expects
1334                 ERRbadpath, not ERRbadfile.
1335         */
1336         status = map_checkpath_error(req->flags2, status);
1337         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1338                 /*
1339                  * Windows returns different error codes if
1340                  * the parent directory is valid but not the
1341                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1342                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1343                  * if the path is invalid.
1344                  */
1345                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1346                                 ERRDOS, ERRbadpath);
1347                 goto out;
1348         }
1349
1350         reply_nterror(req, status);
1351
1352  out:
1353         TALLOC_FREE(smb_fname);
1354         END_PROFILE(SMBcheckpath);
1355         return;
1356 }
1357
1358 /****************************************************************************
1359  Reply to a getatr.
1360 ****************************************************************************/
1361
1362 void reply_getatr(struct smb_request *req)
1363 {
1364         connection_struct *conn = req->conn;
1365         struct smb_filename *smb_fname = NULL;
1366         char *fname = NULL;
1367         int mode=0;
1368         off_t size=0;
1369         time_t mtime=0;
1370         const char *p;
1371         NTSTATUS status;
1372         TALLOC_CTX *ctx = talloc_tos();
1373         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1374
1375         START_PROFILE(SMBgetatr);
1376
1377         p = (const char *)req->buf + 1;
1378         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1379         if (!NT_STATUS_IS_OK(status)) {
1380                 reply_nterror(req, status);
1381                 goto out;
1382         }
1383
1384         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1385                 under WfWg - weird! */
1386         if (*fname == '\0') {
1387                 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1388                 if (!CAN_WRITE(conn)) {
1389                         mode |= FILE_ATTRIBUTE_READONLY;
1390                 }
1391                 size = 0;
1392                 mtime = 0;
1393         } else {
1394                 uint32_t ucf_flags = (req->posix_pathnames ?
1395                                 UCF_POSIX_PATHNAMES : 0);
1396                 status = filename_convert(ctx,
1397                                 conn,
1398                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1399                                 fname,
1400                                 ucf_flags,
1401                                 NULL,
1402                                 &smb_fname);
1403                 if (!NT_STATUS_IS_OK(status)) {
1404                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1405                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1406                                                 ERRSRV, ERRbadpath);
1407                                 goto out;
1408                         }
1409                         reply_nterror(req, status);
1410                         goto out;
1411                 }
1412                 if (!VALID_STAT(smb_fname->st) &&
1413                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1414                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1415                                  smb_fname_str_dbg(smb_fname),
1416                                  strerror(errno)));
1417                         reply_nterror(req,  map_nt_error_from_unix(errno));
1418                         goto out;
1419                 }
1420
1421                 mode = dos_mode(conn, smb_fname);
1422                 size = smb_fname->st.st_ex_size;
1423
1424                 if (ask_sharemode) {
1425                         struct timespec write_time_ts;
1426                         struct file_id fileid;
1427
1428                         ZERO_STRUCT(write_time_ts);
1429                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1430                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1431                         if (!null_timespec(write_time_ts)) {
1432                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1433                         }
1434                 }
1435
1436                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1437                 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1438                         size = 0;
1439                 }
1440         }
1441
1442         reply_outbuf(req, 10, 0);
1443
1444         SSVAL(req->outbuf,smb_vwv0,mode);
1445         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1446                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1447         } else {
1448                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1449         }
1450         SIVAL(req->outbuf,smb_vwv3,(uint32_t)size);
1451
1452         if (get_Protocol() >= PROTOCOL_NT1) {
1453                 SSVAL(req->outbuf, smb_flg2,
1454                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1455         }
1456
1457         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1458                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1459
1460  out:
1461         TALLOC_FREE(smb_fname);
1462         TALLOC_FREE(fname);
1463         END_PROFILE(SMBgetatr);
1464         return;
1465 }
1466
1467 /****************************************************************************
1468  Reply to a setatr.
1469 ****************************************************************************/
1470
1471 void reply_setatr(struct smb_request *req)
1472 {
1473         struct smb_file_time ft;
1474         connection_struct *conn = req->conn;
1475         struct smb_filename *smb_fname = NULL;
1476         char *fname = NULL;
1477         int mode;
1478         time_t mtime;
1479         const char *p;
1480         NTSTATUS status;
1481         uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
1482         TALLOC_CTX *ctx = talloc_tos();
1483
1484         START_PROFILE(SMBsetatr);
1485
1486         ZERO_STRUCT(ft);
1487
1488         if (req->wct < 2) {
1489                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1490                 goto out;
1491         }
1492
1493         p = (const char *)req->buf + 1;
1494         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1495         if (!NT_STATUS_IS_OK(status)) {
1496                 reply_nterror(req, status);
1497                 goto out;
1498         }
1499
1500         status = filename_convert(ctx,
1501                                 conn,
1502                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1503                                 fname,
1504                                 ucf_flags,
1505                                 NULL,
1506                                 &smb_fname);
1507         if (!NT_STATUS_IS_OK(status)) {
1508                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1509                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1510                                         ERRSRV, ERRbadpath);
1511                         goto out;
1512                 }
1513                 reply_nterror(req, status);
1514                 goto out;
1515         }
1516
1517         if (smb_fname->base_name[0] == '.' &&
1518             smb_fname->base_name[1] == '\0') {
1519                 /*
1520                  * Not sure here is the right place to catch this
1521                  * condition. Might be moved to somewhere else later -- vl
1522                  */
1523                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1524                 goto out;
1525         }
1526
1527         mode = SVAL(req->vwv+0, 0);
1528         mtime = srv_make_unix_date3(req->vwv+1);
1529
1530         if (mode != FILE_ATTRIBUTE_NORMAL) {
1531                 if (VALID_STAT_OF_DIR(smb_fname->st))
1532                         mode |= FILE_ATTRIBUTE_DIRECTORY;
1533                 else
1534                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1535
1536                 status = check_access(conn, NULL, smb_fname,
1537                                         FILE_WRITE_ATTRIBUTES);
1538                 if (!NT_STATUS_IS_OK(status)) {
1539                         reply_nterror(req, status);
1540                         goto out;
1541                 }
1542
1543                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1544                                      false) != 0) {
1545                         reply_nterror(req, map_nt_error_from_unix(errno));
1546                         goto out;
1547                 }
1548         }
1549
1550         ft.mtime = convert_time_t_to_timespec(mtime);
1551         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1552         if (!NT_STATUS_IS_OK(status)) {
1553                 reply_nterror(req, status);
1554                 goto out;
1555         }
1556
1557         reply_outbuf(req, 0, 0);
1558
1559         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1560                  mode));
1561  out:
1562         TALLOC_FREE(smb_fname);
1563         END_PROFILE(SMBsetatr);
1564         return;
1565 }
1566
1567 /****************************************************************************
1568  Reply to a dskattr.
1569 ****************************************************************************/
1570
1571 void reply_dskattr(struct smb_request *req)
1572 {
1573         connection_struct *conn = req->conn;
1574         uint64_t ret;
1575         uint64_t dfree,dsize,bsize;
1576         struct smb_filename smb_fname;
1577         START_PROFILE(SMBdskattr);
1578
1579         ZERO_STRUCT(smb_fname);
1580         smb_fname.base_name = discard_const_p(char, ".");
1581
1582         if (SMB_VFS_STAT(conn, &smb_fname) != 0) {
1583                 reply_nterror(req, map_nt_error_from_unix(errno));
1584                 DBG_WARNING("stat of . failed (%s)\n", strerror(errno));
1585                 END_PROFILE(SMBdskattr);
1586                 return;
1587         }
1588
1589         ret = get_dfree_info(conn, &smb_fname, &bsize, &dfree, &dsize);
1590         if (ret == (uint64_t)-1) {
1591                 reply_nterror(req, map_nt_error_from_unix(errno));
1592                 END_PROFILE(SMBdskattr);
1593                 return;
1594         }
1595
1596         /*
1597          * Force max to fit in 16 bit fields.
1598          */
1599         while (dfree > WORDMAX || dsize > WORDMAX || bsize < 512) {
1600                 dfree /= 2;
1601                 dsize /= 2;
1602                 bsize *= 2;
1603                 if (bsize > (WORDMAX*512)) {
1604                         bsize = (WORDMAX*512);
1605                         if (dsize > WORDMAX)
1606                                 dsize = WORDMAX;
1607                         if (dfree >  WORDMAX)
1608                                 dfree = WORDMAX;
1609                         break;
1610                 }
1611         }
1612
1613         reply_outbuf(req, 5, 0);
1614
1615         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1616                 double total_space, free_space;
1617                 /* we need to scale this to a number that DOS6 can handle. We
1618                    use floating point so we can handle large drives on systems
1619                    that don't have 64 bit integers
1620
1621                    we end up displaying a maximum of 2G to DOS systems
1622                 */
1623                 total_space = dsize * (double)bsize;
1624                 free_space = dfree * (double)bsize;
1625
1626                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1627                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1628
1629                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1630                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1631
1632                 SSVAL(req->outbuf,smb_vwv0,dsize);
1633                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1634                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1635                 SSVAL(req->outbuf,smb_vwv3,dfree);
1636         } else {
1637                 SSVAL(req->outbuf,smb_vwv0,dsize);
1638                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1639                 SSVAL(req->outbuf,smb_vwv2,512);
1640                 SSVAL(req->outbuf,smb_vwv3,dfree);
1641         }
1642
1643         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1644
1645         END_PROFILE(SMBdskattr);
1646         return;
1647 }
1648
1649 /*
1650  * Utility function to split the filename from the directory.
1651  */
1652 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1653                                      char **fname_dir_out,
1654                                      char **fname_mask_out)
1655 {
1656         const char *p = NULL;
1657         char *fname_dir = NULL;
1658         char *fname_mask = NULL;
1659
1660         p = strrchr_m(fname_in, '/');
1661         if (!p) {
1662                 fname_dir = talloc_strdup(ctx, ".");
1663                 fname_mask = talloc_strdup(ctx, fname_in);
1664         } else {
1665                 fname_dir = talloc_strndup(ctx, fname_in,
1666                     PTR_DIFF(p, fname_in));
1667                 fname_mask = talloc_strdup(ctx, p+1);
1668         }
1669
1670         if (!fname_dir || !fname_mask) {
1671                 TALLOC_FREE(fname_dir);
1672                 TALLOC_FREE(fname_mask);
1673                 return NT_STATUS_NO_MEMORY;
1674         }
1675
1676         *fname_dir_out = fname_dir;
1677         *fname_mask_out = fname_mask;
1678         return NT_STATUS_OK;
1679 }
1680
1681 /****************************************************************************
1682  Make a dir struct.
1683 ****************************************************************************/
1684
1685 static bool make_dir_struct(TALLOC_CTX *ctx,
1686                             char *buf,
1687                             const char *mask,
1688                             const char *fname,
1689                             off_t size,
1690                             uint32_t mode,
1691                             time_t date,
1692                             bool uc)
1693 {
1694         char *p;
1695         char *mask2 = talloc_strdup(ctx, mask);
1696
1697         if (!mask2) {
1698                 return False;
1699         }
1700
1701         if ((mode & FILE_ATTRIBUTE_DIRECTORY) != 0) {
1702                 size = 0;
1703         }
1704
1705         memset(buf+1,' ',11);
1706         if ((p = strchr_m(mask2,'.')) != NULL) {
1707                 *p = 0;
1708                 push_ascii(buf+1,mask2,8, 0);
1709                 push_ascii(buf+9,p+1,3, 0);
1710                 *p = '.';
1711         } else {
1712                 push_ascii(buf+1,mask2,11, 0);
1713         }
1714
1715         memset(buf+21,'\0',DIR_STRUCT_SIZE-21);
1716         SCVAL(buf,21,mode);
1717         srv_put_dos_date(buf,22,date);
1718         SSVAL(buf,26,size & 0xFFFF);
1719         SSVAL(buf,28,(size >> 16)&0xFFFF);
1720         /* We only uppercase if FLAGS2_LONG_PATH_COMPONENTS is zero in the input buf.
1721            Strange, but verified on W2K3. Needed for OS/2. JRA. */
1722         push_ascii(buf+30,fname,12, uc ? STR_UPPER : 0);
1723         DEBUG(8,("put name [%s] from [%s] into dir struct\n",buf+30, fname));
1724         return True;
1725 }
1726
1727 /****************************************************************************
1728  Reply to a search.
1729  Can be called from SMBsearch, SMBffirst or SMBfunique.
1730 ****************************************************************************/
1731
1732 void reply_search(struct smb_request *req)
1733 {
1734         connection_struct *conn = req->conn;
1735         char *path = NULL;
1736         char *mask = NULL;
1737         char *directory = NULL;
1738         struct smb_filename *smb_fname = NULL;
1739         char *fname = NULL;
1740         off_t size;
1741         uint32_t mode;
1742         struct timespec date;
1743         uint32_t dirtype;
1744         unsigned int numentries = 0;
1745         unsigned int maxentries = 0;
1746         bool finished = False;
1747         const char *p;
1748         int status_len;
1749         char status[21];
1750         int dptr_num= -1;
1751         bool check_descend = False;
1752         bool expect_close = False;
1753         NTSTATUS nt_status;
1754         bool mask_contains_wcard = False;
1755         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1756         TALLOC_CTX *ctx = talloc_tos();
1757         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1758         struct dptr_struct *dirptr = NULL;
1759         struct smbXsrv_connection *xconn = req->xconn;
1760         struct smbd_server_connection *sconn = req->sconn;
1761
1762         START_PROFILE(SMBsearch);
1763
1764         if (req->wct < 2) {
1765                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1766                 goto out;
1767         }
1768
1769         if (req->posix_pathnames) {
1770                 reply_unknown_new(req, req->cmd);
1771                 goto out;
1772         }
1773
1774         /* If we were called as SMBffirst then we must expect close. */
1775         if(req->cmd == SMBffirst) {
1776                 expect_close = True;
1777         }
1778
1779         reply_outbuf(req, 1, 3);
1780         maxentries = SVAL(req->vwv+0, 0);
1781         dirtype = SVAL(req->vwv+1, 0);
1782         p = (const char *)req->buf + 1;
1783         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1784                                        &nt_status, &mask_contains_wcard);
1785         if (!NT_STATUS_IS_OK(nt_status)) {
1786                 reply_nterror(req, nt_status);
1787                 goto out;
1788         }
1789
1790         p++;
1791         status_len = SVAL(p, 0);
1792         p += 2;
1793
1794         /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1795
1796         if (status_len == 0) {
1797                 struct smb_filename *smb_dname = NULL;
1798                 uint32_t ucf_flags = UCF_ALWAYS_ALLOW_WCARD_LCOMP |
1799                         (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
1800                 nt_status = filename_convert(ctx, conn,
1801                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1802                                              path,
1803                                              ucf_flags,
1804                                              &mask_contains_wcard,
1805                                              &smb_fname);
1806                 if (!NT_STATUS_IS_OK(nt_status)) {
1807                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1808                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1809                                                 ERRSRV, ERRbadpath);
1810                                 goto out;
1811                         }
1812                         reply_nterror(req, nt_status);
1813                         goto out;
1814                 }
1815
1816                 directory = smb_fname->base_name;
1817
1818                 p = strrchr_m(directory,'/');
1819                 if ((p != NULL) && (*directory != '/')) {
1820                         mask = talloc_strdup(ctx, p + 1);
1821                         directory = talloc_strndup(ctx, directory,
1822                                                    PTR_DIFF(p, directory));
1823                 } else {
1824                         mask = talloc_strdup(ctx, directory);
1825                         directory = talloc_strdup(ctx,".");
1826                 }
1827
1828                 if (!directory) {
1829                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1830                         goto out;
1831                 }
1832
1833                 memset((char *)status,'\0',21);
1834                 SCVAL(status,0,(dirtype & 0x1F));
1835
1836                 smb_dname = synthetic_smb_fname(talloc_tos(),
1837                                         directory,
1838                                         NULL,
1839                                         NULL,
1840                                         smb_fname->flags);
1841                 if (smb_dname == NULL) {
1842                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1843                         goto out;
1844                 }
1845
1846                 nt_status = dptr_create(conn,
1847                                         NULL, /* req */
1848                                         NULL, /* fsp */
1849                                         smb_dname,
1850                                         True,
1851                                         expect_close,
1852                                         req->smbpid,
1853                                         mask,
1854                                         mask_contains_wcard,
1855                                         dirtype,
1856                                         &dirptr);
1857
1858                 TALLOC_FREE(smb_dname);
1859
1860                 if (!NT_STATUS_IS_OK(nt_status)) {
1861                         reply_nterror(req, nt_status);
1862                         goto out;
1863                 }
1864                 dptr_num = dptr_dnum(dirptr);
1865         } else {
1866                 int status_dirtype;
1867                 const char *dirpath;
1868
1869                 memcpy(status,p,21);
1870                 status_dirtype = CVAL(status,0) & 0x1F;
1871                 if (status_dirtype != (dirtype & 0x1F)) {
1872                         dirtype = status_dirtype;
1873                 }
1874
1875                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1876                 if (!dirptr) {
1877                         goto SearchEmpty;
1878                 }
1879                 dirpath = dptr_path(sconn, dptr_num);
1880                 directory = talloc_strdup(ctx, dirpath);
1881                 if (!directory) {
1882                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1883                         goto out;
1884                 }
1885
1886                 mask = talloc_strdup(ctx, dptr_wcard(sconn, dptr_num));
1887                 if (!mask) {
1888                         goto SearchEmpty;
1889                 }
1890                 /*
1891                  * For a 'continue' search we have no string. So
1892                  * check from the initial saved string.
1893                  */
1894                 if (!req->posix_pathnames) {
1895                         mask_contains_wcard = ms_has_wild(mask);
1896                 }
1897                 dirtype = dptr_attr(sconn, dptr_num);
1898         }
1899
1900         DEBUG(4,("dptr_num is %d\n",dptr_num));
1901
1902         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1903         dptr_init_search_op(dirptr);
1904
1905         if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1906                 char buf[DIR_STRUCT_SIZE];
1907                 memcpy(buf,status,21);
1908                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1909                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1910                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1911                         goto out;
1912                 }
1913                 dptr_fill(sconn, buf+12,dptr_num);
1914                 if (dptr_zero(buf+12) && (status_len==0)) {
1915                         numentries = 1;
1916                 } else {
1917                         numentries = 0;
1918                 }
1919                 if (message_push_blob(&req->outbuf,
1920                                       data_blob_const(buf, sizeof(buf)))
1921                     == -1) {
1922                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1923                         goto out;
1924                 }
1925         } else {
1926                 unsigned int i;
1927                 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1928                 size_t available_space = xconn->smb1.sessions.max_send - hdr_size;
1929
1930                 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1931
1932                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1933                          directory,lp_dont_descend(ctx, SNUM(conn))));
1934                 if (in_list(directory, lp_dont_descend(ctx, SNUM(conn)),True)) {
1935                         check_descend = True;
1936                 }
1937
1938                 for (i=numentries;(i<maxentries) && !finished;i++) {
1939                         finished = !get_dir_entry(ctx,
1940                                                   dirptr,
1941                                                   mask,
1942                                                   dirtype,
1943                                                   &fname,
1944                                                   &size,
1945                                                   &mode,
1946                                                   &date,
1947                                                   check_descend,
1948                                                   ask_sharemode);
1949                         if (!finished) {
1950                                 char buf[DIR_STRUCT_SIZE];
1951                                 memcpy(buf,status,21);
1952                                 if (!make_dir_struct(ctx,
1953                                                 buf,
1954                                                 mask,
1955                                                 fname,
1956                                                 size,
1957                                                 mode,
1958                                                 convert_timespec_to_time_t(date),
1959                                                 !allow_long_path_components)) {
1960                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1961                                         goto out;
1962                                 }
1963                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1964                                         break;
1965                                 }
1966                                 if (message_push_blob(&req->outbuf,
1967                                                       data_blob_const(buf, sizeof(buf)))
1968                                     == -1) {
1969                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1970                                         goto out;
1971                                 }
1972                                 numentries++;
1973                         }
1974                 }
1975         }
1976
1977   SearchEmpty:
1978
1979         /* If we were called as SMBffirst with smb_search_id == NULL
1980                 and no entries were found then return error and close dirptr
1981                 (X/Open spec) */
1982
1983         if (numentries == 0) {
1984                 dptr_close(sconn, &dptr_num);
1985         } else if(expect_close && status_len == 0) {
1986                 /* Close the dptr - we know it's gone */
1987                 dptr_close(sconn, &dptr_num);
1988         }
1989
1990         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1991         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1992                 dptr_close(sconn, &dptr_num);
1993         }
1994
1995         if ((numentries == 0) && !mask_contains_wcard) {
1996                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1997                 goto out;
1998         }
1999
2000         SSVAL(req->outbuf,smb_vwv0,numentries);
2001         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
2002         SCVAL(smb_buf(req->outbuf),0,5);
2003         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
2004
2005         /* The replies here are never long name. */
2006         SSVAL(req->outbuf, smb_flg2,
2007               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
2008         if (!allow_long_path_components) {
2009                 SSVAL(req->outbuf, smb_flg2,
2010                       SVAL(req->outbuf, smb_flg2)
2011                       & (~FLAGS2_LONG_PATH_COMPONENTS));
2012         }
2013
2014         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
2015         SSVAL(req->outbuf, smb_flg2,
2016               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
2017
2018         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
2019                 smb_fn_name(req->cmd),
2020                 mask,
2021                 directory,
2022                 dirtype,
2023                 numentries,
2024                 maxentries ));
2025  out:
2026         TALLOC_FREE(directory);
2027         TALLOC_FREE(mask);
2028         TALLOC_FREE(smb_fname);
2029         END_PROFILE(SMBsearch);
2030         return;
2031 }
2032
2033 /****************************************************************************
2034  Reply to a fclose (stop directory search).
2035 ****************************************************************************/
2036
2037 void reply_fclose(struct smb_request *req)
2038 {
2039         int status_len;
2040         char status[21];
2041         int dptr_num= -2;
2042         const char *p;
2043         char *path = NULL;
2044         NTSTATUS err;
2045         bool path_contains_wcard = False;
2046         TALLOC_CTX *ctx = talloc_tos();
2047         struct smbd_server_connection *sconn = req->sconn;
2048
2049         START_PROFILE(SMBfclose);
2050
2051         if (req->posix_pathnames) {
2052                 reply_unknown_new(req, req->cmd);
2053                 END_PROFILE(SMBfclose);
2054                 return;
2055         }
2056
2057         p = (const char *)req->buf + 1;
2058         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
2059                                        &err, &path_contains_wcard);
2060         if (!NT_STATUS_IS_OK(err)) {
2061                 reply_nterror(req, err);
2062                 END_PROFILE(SMBfclose);
2063                 return;
2064         }
2065         p++;
2066         status_len = SVAL(p,0);
2067         p += 2;
2068
2069         if (status_len == 0) {
2070                 reply_force_doserror(req, ERRSRV, ERRsrverror);
2071                 END_PROFILE(SMBfclose);
2072                 return;
2073         }
2074
2075         memcpy(status,p,21);
2076
2077         if(dptr_fetch(sconn, status+12,&dptr_num)) {
2078                 /*  Close the dptr - we know it's gone */
2079                 dptr_close(sconn, &dptr_num);
2080         }
2081
2082         reply_outbuf(req, 1, 0);
2083         SSVAL(req->outbuf,smb_vwv0,0);
2084
2085         DEBUG(3,("search close\n"));
2086
2087         END_PROFILE(SMBfclose);
2088         return;
2089 }
2090
2091 /****************************************************************************
2092  Reply to an open.
2093 ****************************************************************************/
2094
2095 void reply_open(struct smb_request *req)
2096 {
2097         connection_struct *conn = req->conn;
2098         struct smb_filename *smb_fname = NULL;
2099         char *fname = NULL;
2100         uint32_t fattr=0;
2101         off_t size = 0;
2102         time_t mtime=0;
2103         int info;
2104         files_struct *fsp;
2105         int oplock_request;
2106         int deny_mode;
2107         uint32_t dos_attr;
2108         uint32_t access_mask;
2109         uint32_t share_mode;
2110         uint32_t create_disposition;
2111         uint32_t create_options = 0;
2112         uint32_t private_flags = 0;
2113         NTSTATUS status;
2114         uint32_t ucf_flags;
2115         TALLOC_CTX *ctx = talloc_tos();
2116
2117         START_PROFILE(SMBopen);
2118
2119         if (req->wct < 2) {
2120                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2121                 goto out;
2122         }
2123
2124         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2125         deny_mode = SVAL(req->vwv+0, 0);
2126         dos_attr = SVAL(req->vwv+1, 0);
2127
2128         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2129                             STR_TERMINATE, &status);
2130         if (!NT_STATUS_IS_OK(status)) {
2131                 reply_nterror(req, status);
2132                 goto out;
2133         }
2134
2135         if (!map_open_params_to_ntcreate(fname, deny_mode,
2136                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
2137                                          &share_mode, &create_disposition,
2138                                          &create_options, &private_flags)) {
2139                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2140                 goto out;
2141         }
2142
2143         ucf_flags = filename_create_ucf_flags(req, create_disposition);
2144
2145         status = filename_convert(ctx,
2146                                 conn,
2147                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2148                                 fname,
2149                                 ucf_flags,
2150                                 NULL,
2151                                 &smb_fname);
2152         if (!NT_STATUS_IS_OK(status)) {
2153                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2154                         reply_botherror(req,
2155                                         NT_STATUS_PATH_NOT_COVERED,
2156                                         ERRSRV, ERRbadpath);
2157                         goto out;
2158                 }
2159                 reply_nterror(req, status);
2160                 goto out;
2161         }
2162
2163         status = SMB_VFS_CREATE_FILE(
2164                 conn,                                   /* conn */
2165                 req,                                    /* req */
2166                 0,                                      /* root_dir_fid */
2167                 smb_fname,                              /* fname */
2168                 access_mask,                            /* access_mask */
2169                 share_mode,                             /* share_access */
2170                 create_disposition,                     /* create_disposition*/
2171                 create_options,                         /* create_options */
2172                 dos_attr,                               /* file_attributes */
2173                 oplock_request,                         /* oplock_request */
2174                 NULL,                                   /* lease */
2175                 0,                                      /* allocation_size */
2176                 private_flags,
2177                 NULL,                                   /* sd */
2178                 NULL,                                   /* ea_list */
2179                 &fsp,                                   /* result */
2180                 &info,                                  /* pinfo */
2181                 NULL, NULL);                            /* create context */
2182
2183         if (!NT_STATUS_IS_OK(status)) {
2184                 if (open_was_deferred(req->xconn, req->mid)) {
2185                         /* We have re-scheduled this call. */
2186                         goto out;
2187                 }
2188                 reply_openerror(req, status);
2189                 goto out;
2190         }
2191
2192         /* Ensure we're pointing at the correct stat struct. */
2193         TALLOC_FREE(smb_fname);
2194         smb_fname = fsp->fsp_name;
2195
2196         size = smb_fname->st.st_ex_size;
2197         fattr = dos_mode(conn, smb_fname);
2198
2199         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
2200
2201         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2202                 DEBUG(3,("attempt to open a directory %s\n",
2203                          fsp_str_dbg(fsp)));
2204                 close_file(req, fsp, ERROR_CLOSE);
2205                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
2206                         ERRDOS, ERRnoaccess);
2207                 goto out;
2208         }
2209
2210         reply_outbuf(req, 7, 0);
2211         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2212         SSVAL(req->outbuf,smb_vwv1,fattr);
2213         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2214                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
2215         } else {
2216                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
2217         }
2218         SIVAL(req->outbuf,smb_vwv4,(uint32_t)size);
2219         SSVAL(req->outbuf,smb_vwv6,deny_mode);
2220
2221         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2222                 SCVAL(req->outbuf,smb_flg,
2223                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2224         }
2225
2226         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2227                 SCVAL(req->outbuf,smb_flg,
2228                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2229         }
2230  out:
2231         END_PROFILE(SMBopen);
2232         return;
2233 }
2234
2235 /****************************************************************************
2236  Reply to an open and X.
2237 ****************************************************************************/
2238
2239 void reply_open_and_X(struct smb_request *req)
2240 {
2241         connection_struct *conn = req->conn;
2242         struct smb_filename *smb_fname = NULL;
2243         char *fname = NULL;
2244         uint16_t open_flags;
2245         int deny_mode;
2246         uint32_t smb_attr;
2247         /* Breakout the oplock request bits so we can set the
2248                 reply bits separately. */
2249         int ex_oplock_request;
2250         int core_oplock_request;
2251         int oplock_request;
2252 #if 0
2253         int smb_sattr = SVAL(req->vwv+4, 0);
2254         uint32_t smb_time = make_unix_date3(req->vwv+6);
2255 #endif
2256         int smb_ofun;
2257         uint32_t fattr=0;
2258         int mtime=0;
2259         int smb_action = 0;
2260         files_struct *fsp;
2261         NTSTATUS status;
2262         uint64_t allocation_size;
2263         ssize_t retval = -1;
2264         uint32_t access_mask;
2265         uint32_t share_mode;
2266         uint32_t create_disposition;
2267         uint32_t create_options = 0;
2268         uint32_t private_flags = 0;
2269         uint32_t ucf_flags;
2270         TALLOC_CTX *ctx = talloc_tos();
2271
2272         START_PROFILE(SMBopenX);
2273
2274         if (req->wct < 15) {
2275                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2276                 goto out;
2277         }
2278
2279         open_flags = SVAL(req->vwv+2, 0);
2280         deny_mode = SVAL(req->vwv+3, 0);
2281         smb_attr = SVAL(req->vwv+5, 0);
2282         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2283         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2284         oplock_request = ex_oplock_request | core_oplock_request;
2285         smb_ofun = SVAL(req->vwv+8, 0);
2286         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2287
2288         /* If it's an IPC, pass off the pipe handler. */
2289         if (IS_IPC(conn)) {
2290                 if (lp_nt_pipe_support()) {
2291                         reply_open_pipe_and_X(conn, req);
2292                 } else {
2293                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2294                 }
2295                 goto out;
2296         }
2297
2298         /* XXXX we need to handle passed times, sattr and flags */
2299         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2300                         STR_TERMINATE, &status);
2301         if (!NT_STATUS_IS_OK(status)) {
2302                 reply_nterror(req, status);
2303                 goto out;
2304         }
2305
2306         if (!map_open_params_to_ntcreate(fname, deny_mode,
2307                                          smb_ofun,
2308                                          &access_mask, &share_mode,
2309                                          &create_disposition,
2310                                          &create_options,
2311                                          &private_flags)) {
2312                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2313                 goto out;
2314         }
2315
2316         ucf_flags = filename_create_ucf_flags(req, create_disposition);
2317
2318         status = filename_convert(ctx,
2319                                 conn,
2320                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2321                                 fname,
2322                                 ucf_flags,
2323                                 NULL,
2324                                 &smb_fname);
2325         if (!NT_STATUS_IS_OK(status)) {
2326                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2327                         reply_botherror(req,
2328                                         NT_STATUS_PATH_NOT_COVERED,
2329                                         ERRSRV, ERRbadpath);
2330                         goto out;
2331                 }
2332                 reply_nterror(req, status);
2333                 goto out;
2334         }
2335
2336         status = SMB_VFS_CREATE_FILE(
2337                 conn,                                   /* conn */
2338                 req,                                    /* req */
2339                 0,                                      /* root_dir_fid */
2340                 smb_fname,                              /* fname */
2341                 access_mask,                            /* access_mask */
2342                 share_mode,                             /* share_access */
2343                 create_disposition,                     /* create_disposition*/
2344                 create_options,                         /* create_options */
2345                 smb_attr,                               /* file_attributes */
2346                 oplock_request,                         /* oplock_request */
2347                 NULL,                                   /* lease */
2348                 0,                                      /* allocation_size */
2349                 private_flags,
2350                 NULL,                                   /* sd */
2351                 NULL,                                   /* ea_list */
2352                 &fsp,                                   /* result */
2353                 &smb_action,                            /* pinfo */
2354                 NULL, NULL);                            /* create context */
2355
2356         if (!NT_STATUS_IS_OK(status)) {
2357                 if (open_was_deferred(req->xconn, req->mid)) {
2358                         /* We have re-scheduled this call. */
2359                         goto out;
2360                 }
2361                 reply_openerror(req, status);
2362                 goto out;
2363         }
2364
2365         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2366            if the file is truncated or created. */
2367         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2368                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2369                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2370                         close_file(req, fsp, ERROR_CLOSE);
2371                         reply_nterror(req, NT_STATUS_DISK_FULL);
2372                         goto out;
2373                 }
2374                 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2375                 if (retval < 0) {
2376                         close_file(req, fsp, ERROR_CLOSE);
2377                         reply_nterror(req, NT_STATUS_DISK_FULL);
2378                         goto out;
2379                 }
2380                 status = vfs_stat_fsp(fsp);
2381                 if (!NT_STATUS_IS_OK(status)) {
2382                         close_file(req, fsp, ERROR_CLOSE);
2383                         reply_nterror(req, status);
2384                         goto out;
2385                 }
2386         }
2387
2388         fattr = dos_mode(conn, fsp->fsp_name);
2389         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2390         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2391                 close_file(req, fsp, ERROR_CLOSE);
2392                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2393                 goto out;
2394         }
2395
2396         /* If the caller set the extended oplock request bit
2397                 and we granted one (by whatever means) - set the
2398                 correct bit for extended oplock reply.
2399         */
2400
2401         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2402                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2403         }
2404
2405         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2406                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2407         }
2408
2409         /* If the caller set the core oplock request bit
2410                 and we granted one (by whatever means) - set the
2411                 correct bit for core oplock reply.
2412         */
2413
2414         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2415                 reply_outbuf(req, 19, 0);
2416         } else {
2417                 reply_outbuf(req, 15, 0);
2418         }
2419
2420         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2421         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2422
2423         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2424                 SCVAL(req->outbuf, smb_flg,
2425                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2426         }
2427
2428         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2429                 SCVAL(req->outbuf, smb_flg,
2430                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2431         }
2432
2433         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2434         SSVAL(req->outbuf,smb_vwv3,fattr);
2435         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2436                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2437         } else {
2438                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2439         }
2440         SIVAL(req->outbuf,smb_vwv6,(uint32_t)fsp->fsp_name->st.st_ex_size);
2441         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2442         SSVAL(req->outbuf,smb_vwv11,smb_action);
2443
2444         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2445                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2446         }
2447
2448  out:
2449         TALLOC_FREE(smb_fname);
2450         END_PROFILE(SMBopenX);
2451         return;
2452 }
2453
2454 /****************************************************************************
2455  Reply to a SMBulogoffX.
2456 ****************************************************************************/
2457
2458 void reply_ulogoffX(struct smb_request *req)
2459 {
2460         struct smbd_server_connection *sconn = req->sconn;
2461         struct user_struct *vuser;
2462         struct smbXsrv_session *session = NULL;
2463         NTSTATUS status;
2464
2465         START_PROFILE(SMBulogoffX);
2466
2467         vuser = get_valid_user_struct(sconn, req->vuid);
2468
2469         if(vuser == NULL) {
2470                 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2471                          (unsigned long long)req->vuid));
2472
2473                 req->vuid = UID_FIELD_INVALID;
2474                 reply_force_doserror(req, ERRSRV, ERRbaduid);
2475                 END_PROFILE(SMBulogoffX);
2476                 return;
2477         }
2478
2479         session = vuser->session;
2480         vuser = NULL;
2481
2482         /*
2483          * TODO: cancel all outstanding requests on the session
2484          */
2485         status = smbXsrv_session_logoff(session);
2486         if (!NT_STATUS_IS_OK(status)) {
2487                 DEBUG(0, ("reply_ulogoff: "
2488                           "smbXsrv_session_logoff() failed: %s\n",
2489                           nt_errstr(status)));
2490                 /*
2491                  * If we hit this case, there is something completely
2492                  * wrong, so we better disconnect the transport connection.
2493                  */
2494                 END_PROFILE(SMBulogoffX);
2495                 exit_server(__location__ ": smbXsrv_session_logoff failed");
2496                 return;
2497         }
2498
2499         TALLOC_FREE(session);
2500
2501         reply_outbuf(req, 2, 0);
2502         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2503         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2504
2505         DEBUG(3, ("ulogoffX vuid=%llu\n",
2506                   (unsigned long long)req->vuid));
2507
2508         END_PROFILE(SMBulogoffX);
2509         req->vuid = UID_FIELD_INVALID;
2510 }
2511
2512 /****************************************************************************
2513  Reply to a mknew or a create.
2514 ****************************************************************************/
2515
2516 void reply_mknew(struct smb_request *req)
2517 {
2518         connection_struct *conn = req->conn;
2519         struct smb_filename *smb_fname = NULL;
2520         char *fname = NULL;
2521         uint32_t fattr = 0;
2522         struct smb_file_time ft;
2523         files_struct *fsp;
2524         int oplock_request = 0;
2525         NTSTATUS status;
2526         uint32_t access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2527         uint32_t share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2528         uint32_t create_disposition;
2529         uint32_t create_options = 0;
2530         uint32_t ucf_flags;
2531         TALLOC_CTX *ctx = talloc_tos();
2532
2533         START_PROFILE(SMBcreate);
2534         ZERO_STRUCT(ft);
2535
2536         if (req->wct < 3) {
2537                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2538                 goto out;
2539         }
2540
2541         fattr = SVAL(req->vwv+0, 0);
2542         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2543
2544         if (req->cmd == SMBmknew) {
2545                 /* We should fail if file exists. */
2546                 create_disposition = FILE_CREATE;
2547         } else {
2548                 /* Create if file doesn't exist, truncate if it does. */
2549                 create_disposition = FILE_OVERWRITE_IF;
2550         }
2551
2552         /* mtime. */
2553         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2554
2555         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2556                             STR_TERMINATE, &status);
2557         if (!NT_STATUS_IS_OK(status)) {
2558                 reply_nterror(req, status);
2559                 goto out;
2560         }
2561
2562         ucf_flags = filename_create_ucf_flags(req, create_disposition);
2563         status = filename_convert(ctx,
2564                                 conn,
2565                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2566                                 fname,
2567                                 ucf_flags,
2568                                 NULL,
2569                                 &smb_fname);
2570         if (!NT_STATUS_IS_OK(status)) {
2571                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2572                         reply_botherror(req,
2573                                         NT_STATUS_PATH_NOT_COVERED,
2574                                         ERRSRV, ERRbadpath);
2575                         goto out;
2576                 }
2577                 reply_nterror(req, status);
2578                 goto out;
2579         }
2580
2581         if (fattr & FILE_ATTRIBUTE_VOLUME) {
2582                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2583                          "please report this\n",
2584                          smb_fname_str_dbg(smb_fname)));
2585         }
2586
2587         status = SMB_VFS_CREATE_FILE(
2588                 conn,                                   /* conn */
2589                 req,                                    /* req */
2590                 0,                                      /* root_dir_fid */
2591                 smb_fname,                              /* fname */
2592                 access_mask,                            /* access_mask */
2593                 share_mode,                             /* share_access */
2594                 create_disposition,                     /* create_disposition*/
2595                 create_options,                         /* create_options */
2596                 fattr,                                  /* file_attributes */
2597                 oplock_request,                         /* oplock_request */
2598                 NULL,                                   /* lease */
2599                 0,                                      /* allocation_size */
2600                 0,                                      /* private_flags */
2601                 NULL,                                   /* sd */
2602                 NULL,                                   /* ea_list */
2603                 &fsp,                                   /* result */
2604                 NULL,                                   /* pinfo */
2605                 NULL, NULL);                            /* create context */
2606
2607         if (!NT_STATUS_IS_OK(status)) {
2608                 if (open_was_deferred(req->xconn, req->mid)) {
2609                         /* We have re-scheduled this call. */
2610                         goto out;
2611                 }
2612                 reply_openerror(req, status);
2613                 goto out;
2614         }
2615
2616         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2617         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2618         if (!NT_STATUS_IS_OK(status)) {
2619                 END_PROFILE(SMBcreate);
2620                 goto out;
2621         }
2622
2623         reply_outbuf(req, 1, 0);
2624         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2625
2626         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2627                 SCVAL(req->outbuf,smb_flg,
2628                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2629         }
2630
2631         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2632                 SCVAL(req->outbuf,smb_flg,
2633                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2634         }
2635
2636         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2637         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2638                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2639                   (unsigned int)fattr));
2640
2641  out:
2642         TALLOC_FREE(smb_fname);
2643         END_PROFILE(SMBcreate);
2644         return;
2645 }
2646
2647 /****************************************************************************
2648  Reply to a create temporary file.
2649 ****************************************************************************/
2650
2651 void reply_ctemp(struct smb_request *req)
2652 {
2653         connection_struct *conn = req->conn;
2654         struct smb_filename *smb_fname = NULL;
2655         char *wire_name = NULL;
2656         char *fname = NULL;
2657         uint32_t fattr;
2658         files_struct *fsp;
2659         int oplock_request;
2660         char *s;
2661         NTSTATUS status;
2662         int i;
2663         uint32_t ucf_flags;
2664         TALLOC_CTX *ctx = talloc_tos();
2665
2666         START_PROFILE(SMBctemp);
2667
2668         if (req->wct < 3) {
2669                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2670                 goto out;
2671         }
2672
2673         fattr = SVAL(req->vwv+0, 0);
2674         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2675
2676         srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2677                             STR_TERMINATE, &status);
2678         if (!NT_STATUS_IS_OK(status)) {
2679                 reply_nterror(req, status);
2680                 goto out;
2681         }
2682
2683         for (i = 0; i < 10; i++) {
2684                 if (*wire_name) {
2685                         fname = talloc_asprintf(ctx,
2686                                         "%s/TMP%s",
2687                                         wire_name,
2688                                         generate_random_str_list(ctx, 5, "0123456789"));
2689                 } else {
2690                         fname = talloc_asprintf(ctx,
2691                                         "TMP%s",
2692                                         generate_random_str_list(ctx, 5, "0123456789"));
2693                 }
2694
2695                 if (!fname) {
2696                         reply_nterror(req, NT_STATUS_NO_MEMORY);
2697                         goto out;
2698                 }
2699
2700                 ucf_flags = filename_create_ucf_flags(req, FILE_CREATE);
2701                 status = filename_convert(ctx, conn,
2702                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2703                                 fname,
2704                                 ucf_flags,
2705                                 NULL,
2706                                 &smb_fname);
2707                 if (!NT_STATUS_IS_OK(status)) {
2708                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2709                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2710                                         ERRSRV, ERRbadpath);
2711                                 goto out;
2712                         }
2713                         reply_nterror(req, status);
2714                         goto out;
2715                 }
2716
2717                 /* Create the file. */
2718                 status = SMB_VFS_CREATE_FILE(
2719                         conn,                                   /* conn */
2720                         req,                                    /* req */
2721                         0,                                      /* root_dir_fid */
2722                         smb_fname,                              /* fname */
2723                         FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2724                         FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2725                         FILE_CREATE,                            /* create_disposition*/
2726                         0,                                      /* create_options */
2727                         fattr,                                  /* file_attributes */
2728                         oplock_request,                         /* oplock_request */
2729                         NULL,                                   /* lease */
2730                         0,                                      /* allocation_size */
2731                         0,                                      /* private_flags */
2732                         NULL,                                   /* sd */
2733                         NULL,                                   /* ea_list */
2734                         &fsp,                                   /* result */
2735                         NULL,                                   /* pinfo */
2736                         NULL, NULL);                            /* create context */
2737
2738                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2739                         TALLOC_FREE(fname);
2740                         TALLOC_FREE(smb_fname);
2741                         continue;
2742                 }
2743
2744                 if (!NT_STATUS_IS_OK(status)) {
2745                         if (open_was_deferred(req->xconn, req->mid)) {
2746                                 /* We have re-scheduled this call. */
2747                                 goto out;
2748                         }
2749                         reply_openerror(req, status);
2750                         goto out;
2751                 }
2752
2753                 break;
2754         }
2755
2756         if (i == 10) {
2757                 /* Collision after 10 times... */
2758                 reply_nterror(req, status);
2759                 goto out;
2760         }
2761
2762         reply_outbuf(req, 1, 0);
2763         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2764
2765         /* the returned filename is relative to the directory */
2766         s = strrchr_m(fsp->fsp_name->base_name, '/');
2767         if (!s) {
2768                 s = fsp->fsp_name->base_name;
2769         } else {
2770                 s++;
2771         }
2772
2773 #if 0
2774         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2775            thing in the byte section. JRA */
2776         SSVALS(p, 0, -1); /* what is this? not in spec */
2777 #endif
2778         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2779             == -1) {
2780                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2781                 goto out;
2782         }
2783
2784         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2785                 SCVAL(req->outbuf, smb_flg,
2786                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2787         }
2788
2789         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2790                 SCVAL(req->outbuf, smb_flg,
2791                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2792         }
2793
2794         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2795         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2796                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2797  out:
2798         TALLOC_FREE(smb_fname);
2799         TALLOC_FREE(wire_name);
2800         END_PROFILE(SMBctemp);
2801         return;
2802 }
2803
2804 /*******************************************************************
2805  Check if a user is allowed to rename a file.
2806 ********************************************************************/
2807
2808 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2809                         uint16_t dirtype)
2810 {
2811         if (!CAN_WRITE(conn)) {
2812                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2813         }
2814
2815         if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2816                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2817                 /* Only bother to read the DOS attribute if we might deny the
2818                    rename on the grounds of attribute mismatch. */
2819                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2820                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2821                         return NT_STATUS_NO_SUCH_FILE;
2822                 }
2823         }
2824
2825         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2826                 if (fsp->posix_flags & FSP_POSIX_FLAGS_RENAME) {
2827                         return NT_STATUS_OK;
2828                 }
2829
2830                 /* If no pathnames are open below this
2831                    directory, allow the rename. */
2832
2833                 if (lp_strict_rename(SNUM(conn))) {
2834                         /*
2835                          * Strict rename, check open file db.
2836                          */
2837                         if (have_file_open_below(fsp->conn, fsp->fsp_name)) {
2838                                 return NT_STATUS_ACCESS_DENIED;
2839                         }
2840                 } else if (file_find_subpath(fsp)) {
2841                         /*
2842                          * No strict rename, just look in local process.
2843                          */
2844                         return NT_STATUS_ACCESS_DENIED;
2845                 }
2846                 return NT_STATUS_OK;
2847         }
2848
2849         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2850                 return NT_STATUS_OK;
2851         }
2852
2853         return NT_STATUS_ACCESS_DENIED;
2854 }
2855
2856 /*******************************************************************
2857  * unlink a file with all relevant access checks
2858  *******************************************************************/
2859
2860 static NTSTATUS do_unlink(connection_struct *conn,
2861                         struct smb_request *req,
2862                         struct smb_filename *smb_fname,
2863                         uint32_t dirtype)
2864 {
2865         uint32_t fattr;
2866         files_struct *fsp;
2867         uint32_t dirtype_orig = dirtype;
2868         NTSTATUS status;
2869         int ret;
2870         bool posix_paths = (req != NULL && req->posix_pathnames);
2871
2872         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2873                   smb_fname_str_dbg(smb_fname),
2874                   dirtype));
2875
2876         if (!CAN_WRITE(conn)) {
2877                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2878         }
2879
2880         if (posix_paths) {
2881                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2882         } else {
2883                 ret = SMB_VFS_STAT(conn, smb_fname);
2884         }
2885         if (ret != 0) {
2886                 return map_nt_error_from_unix(errno);
2887         }
2888
2889         fattr = dos_mode(conn, smb_fname);
2890
2891         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2892                 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2893         }
2894
2895         dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2896         if (!dirtype) {
2897                 return NT_STATUS_NO_SUCH_FILE;
2898         }
2899
2900         if (!dir_check_ftype(fattr, dirtype)) {
2901                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2902                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2903                 }
2904                 return NT_STATUS_NO_SUCH_FILE;
2905         }
2906
2907         if (dirtype_orig & 0x8000) {
2908                 /* These will never be set for POSIX. */
2909                 return NT_STATUS_NO_SUCH_FILE;
2910         }
2911
2912 #if 0
2913         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2914                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2915         }
2916
2917         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2918                 return NT_STATUS_NO_SUCH_FILE;
2919         }
2920
2921         if (dirtype & 0xFF00) {
2922                 /* These will never be set for POSIX. */
2923                 return NT_STATUS_NO_SUCH_FILE;
2924         }
2925
2926         dirtype &= 0xFF;
2927         if (!dirtype) {
2928                 return NT_STATUS_NO_SUCH_FILE;
2929         }
2930
2931         /* Can't delete a directory. */
2932         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2933                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2934         }
2935 #endif
2936
2937 #if 0 /* JRATEST */
2938         else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2939                 return NT_STATUS_OBJECT_NAME_INVALID;
2940 #endif /* JRATEST */
2941
2942         /* On open checks the open itself will check the share mode, so
2943            don't do it here as we'll get it wrong. */
2944
2945         status = SMB_VFS_CREATE_FILE
2946                 (conn,                  /* conn */
2947                  req,                   /* req */
2948                  0,                     /* root_dir_fid */
2949                  smb_fname,             /* fname */
2950                  DELETE_ACCESS,         /* access_mask */
2951                  FILE_SHARE_NONE,       /* share_access */
2952                  FILE_OPEN,             /* create_disposition*/
2953                  FILE_NON_DIRECTORY_FILE, /* create_options */
2954                                         /* file_attributes */
2955                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2956                                 FILE_ATTRIBUTE_NORMAL,
2957                  0,                     /* oplock_request */
2958                  NULL,                  /* lease */
2959                  0,                     /* allocation_size */
2960                  0,                     /* private_flags */
2961                  NULL,                  /* sd */
2962                  NULL,                  /* ea_list */
2963                  &fsp,                  /* result */
2964                  NULL,                  /* pinfo */
2965                  NULL, NULL);           /* create context */
2966
2967         if (!NT_STATUS_IS_OK(status)) {
2968                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2969                            nt_errstr(status)));
2970                 return status;
2971         }
2972
2973         status = can_set_delete_on_close(fsp, fattr);
2974         if (!NT_STATUS_IS_OK(status)) {
2975                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2976                         "(%s)\n",
2977                         smb_fname_str_dbg(smb_fname),
2978                         nt_errstr(status)));
2979                 close_file(req, fsp, NORMAL_CLOSE);
2980                 return status;
2981         }
2982
2983         /* The set is across all open files on this dev/inode pair. */
2984         if (!set_delete_on_close(fsp, True,
2985                                 conn->session_info->security_token,
2986                                 conn->session_info->unix_token)) {
2987                 close_file(req, fsp, NORMAL_CLOSE);
2988                 return NT_STATUS_ACCESS_DENIED;
2989         }
2990
2991         return close_file(req, fsp, NORMAL_CLOSE);
2992 }
2993
2994 /****************************************************************************
2995  The guts of the unlink command, split out so it may be called by the NT SMB
2996  code.
2997 ****************************************************************************/
2998
2999 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
3000                           uint32_t dirtype, struct smb_filename *smb_fname,
3001                           bool has_wild)
3002 {
3003         char *fname_dir = NULL;
3004         char *fname_mask = NULL;
3005         int count=0;
3006         NTSTATUS status = NT_STATUS_OK;
3007         struct smb_filename *smb_fname_dir = NULL;
3008         TALLOC_CTX *ctx = talloc_tos();
3009
3010         /* Split up the directory from the filename/mask. */
3011         status = split_fname_dir_mask(ctx, smb_fname->base_name,
3012                                       &fname_dir, &fname_mask);
3013         if (!NT_STATUS_IS_OK(status)) {
3014                 goto out;
3015         }
3016
3017         /*
3018          * We should only check the mangled cache
3019          * here if unix_convert failed. This means
3020          * that the path in 'mask' doesn't exist
3021          * on the file system and so we need to look
3022          * for a possible mangle. This patch from
3023          * Tine Smukavec <valentin.smukavec@hermes.si>.
3024          */
3025
3026         if (!VALID_STAT(smb_fname->st) &&
3027             mangle_is_mangled(fname_mask, conn->params)) {
3028                 char *new_mask = NULL;
3029                 mangle_lookup_name_from_8_3(ctx, fname_mask,
3030                                             &new_mask, conn->params);
3031                 if (new_mask) {
3032                         TALLOC_FREE(fname_mask);
3033                         fname_mask = new_mask;
3034                 }
3035         }
3036
3037         if (!has_wild) {
3038
3039                 /*
3040                  * Only one file needs to be unlinked. Append the mask back
3041                  * onto the directory.
3042                  */
3043                 TALLOC_FREE(smb_fname->base_name);
3044                 if (ISDOT(fname_dir)) {
3045                         /* Ensure we use canonical names on open. */
3046                         smb_fname->base_name = talloc_asprintf(smb_fname,
3047                                                         "%s",
3048                                                         fname_mask);
3049                 } else {
3050                         smb_fname->base_name = talloc_asprintf(smb_fname,
3051                                                         "%s/%s",
3052                                                         fname_dir,
3053                                                         fname_mask);
3054                 }
3055                 if (!smb_fname->base_name) {
3056                         status = NT_STATUS_NO_MEMORY;
3057                         goto out;
3058                 }
3059                 if (dirtype == 0) {
3060                         dirtype = FILE_ATTRIBUTE_NORMAL;
3061                 }
3062
3063                 status = check_name(conn, smb_fname->base_name);
3064                 if (!NT_STATUS_IS_OK(status)) {
3065                         goto out;
3066                 }
3067
3068                 status = do_unlink(conn, req, smb_fname, dirtype);
3069                 if (!NT_STATUS_IS_OK(status)) {
3070                         goto out;
3071                 }
3072
3073                 count++;
3074         } else {
3075                 struct smb_Dir *dir_hnd = NULL;
3076                 long offset = 0;
3077                 const char *dname = NULL;
3078                 char *talloced = NULL;
3079
3080                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
3081                         status = NT_STATUS_OBJECT_NAME_INVALID;
3082                         goto out;
3083                 }
3084                 if (dirtype == 0) {
3085                         dirtype = FILE_ATTRIBUTE_NORMAL;
3086                 }
3087
3088                 if (strequal(fname_mask,"????????.???")) {
3089                         TALLOC_FREE(fname_mask);
3090                         fname_mask = talloc_strdup(ctx, "*");
3091                         if (!fname_mask) {
3092                                 status = NT_STATUS_NO_MEMORY;
3093                                 goto out;
3094                         }
3095                 }
3096
3097                 status = check_name(conn, fname_dir);
3098                 if (!NT_STATUS_IS_OK(status)) {
3099                         goto out;
3100                 }
3101
3102                 smb_fname_dir = synthetic_smb_fname(talloc_tos(),
3103                                         fname_dir,
3104                                         NULL,
3105                                         NULL,
3106                                         smb_fname->flags);
3107                 if (smb_fname_dir == NULL) {
3108                         status = NT_STATUS_NO_MEMORY;
3109                         goto out;
3110                 }
3111
3112                 dir_hnd = OpenDir(talloc_tos(), conn, smb_fname_dir, fname_mask,
3113                                   dirtype);
3114                 if (dir_hnd == NULL) {
3115                         status = map_nt_error_from_unix(errno);
3116                         goto out;
3117                 }
3118
3119                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
3120                    the pattern matches against the long name, otherwise the short name
3121                    We don't implement this yet XXXX
3122                 */
3123
3124                 status = NT_STATUS_NO_SUCH_FILE;
3125
3126                 while ((dname = ReadDirName(dir_hnd, &offset,
3127                                             &smb_fname->st, &talloced))) {
3128                         TALLOC_CTX *frame = talloc_stackframe();
3129
3130                         if (!is_visible_file(conn, fname_dir, dname,
3131                                              &smb_fname->st, true)) {
3132                                 TALLOC_FREE(frame);
3133                                 TALLOC_FREE(talloced);
3134                                 continue;
3135                         }
3136
3137                         /* Quick check for "." and ".." */
3138                         if (ISDOT(dname) || ISDOTDOT(dname)) {
3139                                 TALLOC_FREE(frame);
3140                                 TALLOC_FREE(talloced);
3141                                 continue;
3142                         }
3143
3144                         if(!mask_match(dname, fname_mask,
3145                                        conn->case_sensitive)) {
3146                                 TALLOC_FREE(frame);
3147                                 TALLOC_FREE(talloced);
3148                                 continue;
3149                         }
3150
3151                         TALLOC_FREE(smb_fname->base_name);
3152                         if (ISDOT(fname_dir)) {
3153                                 /* Ensure we use canonical names on open. */
3154                                 smb_fname->base_name =
3155                                         talloc_asprintf(smb_fname, "%s",
3156                                                 dname);
3157                         } else {
3158                                 smb_fname->base_name =
3159                                         talloc_asprintf(smb_fname, "%s/%s",
3160                                                 fname_dir, dname);
3161                         }
3162
3163                         if (!smb_fname->base_name) {
3164                                 TALLOC_FREE(dir_hnd);
3165                                 status = NT_STATUS_NO_MEMORY;
3166                                 TALLOC_FREE(frame);
3167                                 TALLOC_FREE(talloced);
3168                                 goto out;
3169                         }
3170
3171                         status = check_name(conn, smb_fname->base_name);
3172                         if (!NT_STATUS_IS_OK(status)) {
3173                                 TALLOC_FREE(dir_hnd);
3174                                 TALLOC_FREE(frame);
3175                                 TALLOC_FREE(talloced);
3176                                 goto out;
3177                         }
3178
3179                         status = do_unlink(conn, req, smb_fname, dirtype);
3180                         if (!NT_STATUS_IS_OK(status)) {
3181                                 TALLOC_FREE(dir_hnd);
3182                                 TALLOC_FREE(frame);
3183                                 TALLOC_FREE(talloced);
3184                                 goto out;
3185                         }
3186
3187                         count++;
3188                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
3189                                  smb_fname->base_name));
3190
3191                         TALLOC_FREE(frame);
3192                         TALLOC_FREE(talloced);
3193                 }
3194                 TALLOC_FREE(dir_hnd);
3195         }
3196
3197         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
3198                 status = map_nt_error_from_unix(errno);
3199         }
3200
3201  out:
3202         TALLOC_FREE(smb_fname_dir);
3203         TALLOC_FREE(fname_dir);
3204         TALLOC_FREE(fname_mask);
3205         return status;
3206 }
3207
3208 /****************************************************************************
3209  Reply to a unlink
3210 ****************************************************************************/
3211
3212 void reply_unlink(struct smb_request *req)
3213 {
3214         connection_struct *conn = req->conn;
3215         char *name = NULL;
3216         struct smb_filename *smb_fname = NULL;
3217         uint32_t dirtype;
3218         NTSTATUS status;
3219         bool path_contains_wcard = False;
3220         uint32_t ucf_flags = UCF_COND_ALLOW_WCARD_LCOMP |
3221                         (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
3222         TALLOC_CTX *ctx = talloc_tos();
3223
3224         START_PROFILE(SMBunlink);
3225
3226         if (req->wct < 1) {
3227                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3228                 goto out;
3229         }
3230
3231         dirtype = SVAL(req->vwv+0, 0);
3232
3233         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
3234                                   STR_TERMINATE, &status,
3235                                   &path_contains_wcard);
3236         if (!NT_STATUS_IS_OK(status)) {
3237                 reply_nterror(req, status);
3238                 goto out;
3239         }
3240
3241         status = filename_convert(ctx, conn,
3242                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
3243                                   name,
3244                                   ucf_flags,
3245                                   &path_contains_wcard,
3246                                   &smb_fname);
3247         if (!NT_STATUS_IS_OK(status)) {
3248                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
3249                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
3250                                         ERRSRV, ERRbadpath);
3251                         goto out;
3252                 }
3253                 reply_nterror(req, status);
3254                 goto out;
3255         }
3256
3257         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
3258
3259         status = unlink_internals(conn, req, dirtype, smb_fname,
3260                                   path_contains_wcard);
3261         if (!NT_STATUS_IS_OK(status)) {
3262                 if (open_was_deferred(req->xconn, req->mid)) {
3263                         /* We have re-scheduled this call. */
3264                         goto out;
3265                 }
3266                 reply_nterror(req, status);
3267                 goto out;
3268         }
3269
3270         reply_outbuf(req, 0, 0);
3271  out:
3272         TALLOC_FREE(smb_fname);
3273         END_PROFILE(SMBunlink);
3274         return;
3275 }
3276
3277 /****************************************************************************
3278  Fail for readbraw.
3279 ****************************************************************************/
3280
3281 static void fail_readraw(void)
3282 {
3283         const char *errstr = talloc_asprintf(talloc_tos(),
3284                         "FAIL ! reply_readbraw: socket write fail (%s)",
3285                         strerror(errno));
3286         if (!errstr) {
3287                 errstr = "";
3288         }
3289         exit_server_cleanly(errstr);
3290 }
3291
3292 /****************************************************************************
3293  Fake (read/write) sendfile. Returns -1 on read or write fail.
3294 ****************************************************************************/
3295
3296 ssize_t fake_sendfile(struct smbXsrv_connection *xconn, files_struct *fsp,
3297                       off_t startpos, size_t nread)
3298 {
3299         size_t bufsize;
3300         size_t tosend = nread;
3301         char *buf;
3302
3303         if (nread == 0) {
3304                 return 0;
3305         }
3306
3307         bufsize = MIN(nread, 65536);
3308
3309         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3310                 return -1;
3311         }
3312
3313         while (tosend > 0) {
3314                 ssize_t ret;
3315                 size_t cur_read;
3316
3317                 cur_read = MIN(tosend, bufsize);
3318                 ret = read_file(fsp,buf,startpos,cur_read);
3319                 if (ret == -1) {
3320                         SAFE_FREE(buf);
3321                         return -1;
3322                 }
3323
3324                 /* If we had a short read, fill with zeros. */
3325                 if (ret < cur_read) {
3326                         memset(buf + ret, '\0', cur_read - ret);
3327                 }
3328
3329                 ret = write_data(xconn->transport.sock, buf, cur_read);
3330                 if (ret != cur_read) {
3331                         int saved_errno = errno;
3332                         /*
3333                          * Try and give an error message saying what
3334                          * client failed.
3335                          */
3336                         DEBUG(0, ("write_data failed for client %s. "
3337                                   "Error %s\n",
3338                                   smbXsrv_connection_dbg(xconn),
3339                                   strerror(saved_errno)));
3340                         SAFE_FREE(buf);
3341                         errno = saved_errno;
3342                         return -1;
3343                 }
3344                 tosend -= cur_read;
3345                 startpos += cur_read;
3346         }
3347
3348         SAFE_FREE(buf);
3349         return (ssize_t)nread;
3350 }
3351
3352 /****************************************************************************
3353  Deal with the case of sendfile reading less bytes from the file than
3354  requested. Fill with zeros (all we can do). Returns 0 on success
3355 ****************************************************************************/
3356
3357 ssize_t sendfile_short_send(struct smbXsrv_connection *xconn,
3358                             files_struct *fsp,
3359                             ssize_t nread,
3360                             size_t headersize,
3361                             size_t smb_maxcnt)
3362 {
3363 #define SHORT_SEND_BUFSIZE 1024
3364         if (nread < headersize) {
3365                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3366                         "header for file %s (%s). Terminating\n",
3367                         fsp_str_dbg(fsp), strerror(errno)));
3368                 return -1;
3369         }
3370
3371         nread -= headersize;
3372
3373         if (nread < smb_maxcnt) {
3374                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3375                 if (!buf) {
3376                         DEBUG(0,("sendfile_short_send: malloc failed "
3377                                 "for file %s (%s). Terminating\n",
3378                                 fsp_str_dbg(fsp), strerror(errno)));
3379                         return -1;
3380                 }
3381
3382                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3383                         "with zeros !\n", fsp_str_dbg(fsp)));
3384
3385                 while (nread < smb_maxcnt) {
3386                         /*
3387                          * We asked for the real file size and told sendfile
3388                          * to not go beyond the end of the file. But it can
3389                          * happen that in between our fstat call and the
3390                          * sendfile call the file was truncated. This is very
3391                          * bad because we have already announced the larger
3392                          * number of bytes to the client.
3393                          *
3394                          * The best we can do now is to send 0-bytes, just as
3395                          * a read from a hole in a sparse file would do.
3396                          *
3397                          * This should happen rarely enough that I don't care
3398                          * about efficiency here :-)
3399                          */
3400                         size_t to_write;
3401                         ssize_t ret;
3402
3403                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3404                         ret = write_data(xconn->transport.sock, buf, to_write);
3405                         if (ret != to_write) {
3406                                 int saved_errno = errno;
3407                                 /*
3408                                  * Try and give an error message saying what
3409                                  * client failed.
3410                                  */
3411                                 DEBUG(0, ("write_data failed for client %s. "
3412                                           "Error %s\n",
3413                                           smbXsrv_connection_dbg(xconn),
3414                                           strerror(saved_errno)));
3415                                 errno = saved_errno;
3416                                 return -1;
3417                         }
3418                         nread += to_write;
3419                 }
3420                 SAFE_FREE(buf);
3421         }
3422
3423         return 0;
3424 }
3425
3426 /****************************************************************************
3427  Return a readbraw error (4 bytes of zero).
3428 ****************************************************************************/
3429
3430 static void reply_readbraw_error(struct smbXsrv_connection *xconn)
3431 {
3432         char header[4];
3433
3434         SIVAL(header,0,0);
3435
3436         smbd_lock_socket(xconn);
3437         if (write_data(xconn->transport.sock,header,4) != 4) {
3438                 int saved_errno = errno;
3439                 /*
3440                  * Try and give an error message saying what
3441                  * client failed.
3442                  */
3443                 DEBUG(0, ("write_data failed for client %s. "
3444                           "Error %s\n",
3445                           smbXsrv_connection_dbg(xconn),
3446                           strerror(saved_errno)));
3447                 errno = saved_errno;
3448
3449                 fail_readraw();
3450         }
3451         smbd_unlock_socket(xconn);
3452 }
3453
3454 /****************************************************************************
3455  Use sendfile in readbraw.
3456 ****************************************************************************/
3457
3458 static void send_file_readbraw(connection_struct *conn,
3459                                struct smb_request *req,
3460                                files_struct *fsp,
3461                                off_t startpos,
3462                                size_t nread,
3463                                ssize_t mincount)
3464 {
3465         struct smbXsrv_connection *xconn = req->xconn;
3466         char *outbuf = NULL;
3467         ssize_t ret=0;
3468
3469         /*
3470          * We can only use sendfile on a non-chained packet
3471          * but we can use on a non-oplocked file. tridge proved this
3472          * on a train in Germany :-). JRA.
3473          * reply_readbraw has already checked the length.
3474          */
3475
3476         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3477             (fsp->wcp == NULL) &&
3478             lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3479                 ssize_t sendfile_read = -1;
3480                 char header[4];
3481                 DATA_BLOB header_blob;
3482
3483                 _smb_setlen(header,nread);
3484                 header_blob = data_blob_const(header, 4);
3485
3486                 sendfile_read = SMB_VFS_SENDFILE(xconn->transport.sock, fsp,
3487                                                  &header_blob, startpos,
3488                                                  nread);
3489                 if (sendfile_read == -1) {
3490                         /* Returning ENOSYS means no data at all was sent.
3491                          * Do this as a normal read. */
3492                         if (errno == ENOSYS) {
3493                                 goto normal_readbraw;
3494                         }
3495
3496                         /*
3497                          * Special hack for broken Linux with no working sendfile. If we
3498                          * return EINTR we sent the header but not the rest of the data.
3499                          * Fake this up by doing read/write calls.
3500                          */
3501                         if (errno == EINTR) {
3502                                 /* Ensure we don't do this again. */
3503                                 set_use_sendfile(SNUM(conn), False);
3504                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3505
3506                                 if (fake_sendfile(xconn, fsp, startpos, nread) == -1) {
3507                                         DEBUG(0,("send_file_readbraw: "
3508                                                  "fake_sendfile failed for "
3509                                                  "file %s (%s).\n",
3510                                                  fsp_str_dbg(fsp),
3511                                                  strerror(errno)));
3512                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3513                                 }
3514                                 return;
3515                         }
3516
3517                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3518                                  "file %s (%s). Terminating\n",
3519                                  fsp_str_dbg(fsp), strerror(errno)));
3520                         exit_server_cleanly("send_file_readbraw sendfile failed");
3521                 } else if (sendfile_read == 0) {
3522                         /*
3523                          * Some sendfile implementations return 0 to indicate
3524                          * that there was a short read, but nothing was
3525                          * actually written to the socket.  In this case,
3526                          * fallback to the normal read path so the header gets
3527                          * the correct byte count.
3528                          */
3529                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3530                                   "bytes falling back to the normal read: "
3531                                   "%s\n", fsp_str_dbg(fsp)));
3532                         goto normal_readbraw;
3533                 }
3534
3535                 /* Deal with possible short send. */
3536                 if (sendfile_read != 4+nread) {
3537                         ret = sendfile_short_send(xconn, fsp,
3538                                                   sendfile_read, 4, nread);
3539                         if (ret == -1) {
3540                                 fail_readraw();
3541                         }
3542                 }
3543                 return;
3544         }
3545
3546 normal_readbraw:
3547
3548         outbuf = talloc_array(NULL, char, nread+4);
3549         if (!outbuf) {
3550                 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3551                         (unsigned)(nread+4)));
3552                 reply_readbraw_error(xconn);
3553                 return;
3554         }
3555
3556         if (nread > 0) {
3557                 ret = read_file(fsp,outbuf+4,startpos,nread);
3558 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3559                 if (ret < mincount)
3560                         ret = 0;
3561 #else
3562                 if (ret < nread)
3563                         ret = 0;
3564 #endif
3565         }
3566
3567         _smb_setlen(outbuf,ret);
3568         if (write_data(xconn->transport.sock, outbuf, 4+ret) != 4+ret) {
3569                 int saved_errno = errno;
3570                 /*
3571                  * Try and give an error message saying what
3572                  * client failed.
3573                  */
3574                 DEBUG(0, ("write_data failed for client %s. Error %s\n",
3575                           smbXsrv_connection_dbg(xconn),
3576                           strerror(saved_errno)));
3577                 errno = saved_errno;
3578
3579                 fail_readraw();
3580         }
3581
3582         TALLOC_FREE(outbuf);
3583 }
3584
3585 /****************************************************************************
3586  Reply to a readbraw (core+ protocol).
3587 ****************************************************************************/
3588
3589 void reply_readbraw(struct smb_request *req)
3590 {
3591         connection_struct *conn = req->conn;
3592         struct smbXsrv_connection *xconn = req->xconn;
3593         ssize_t maxcount,mincount;
3594         size_t nread = 0;
3595         off_t startpos;
3596         files_struct *fsp;
3597         struct lock_struct lock;
3598         off_t size = 0;
3599
3600         START_PROFILE(SMBreadbraw);
3601
3602         if (srv_is_signing_active(xconn) || req->encrypted) {
3603                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3604                         "raw reads/writes are disallowed.");
3605         }
3606
3607         if (req->wct < 8) {
3608                 reply_readbraw_error(xconn);
3609                 END_PROFILE(SMBreadbraw);
3610                 return;
3611         }
3612
3613         if (xconn->smb1.echo_handler.trusted_fde) {
3614                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3615                          "'async smb echo handler = yes'\n"));
3616                 reply_readbraw_error(xconn);
3617                 END_PROFILE(SMBreadbraw);
3618                 return;
3619         }
3620
3621         /*
3622          * Special check if an oplock break has been issued
3623          * and the readraw request croses on the wire, we must
3624          * return a zero length response here.
3625          */
3626
3627         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3628
3629         /*
3630          * We have to do a check_fsp by hand here, as
3631          * we must always return 4 zero bytes on error,
3632          * not a NTSTATUS.
3633          */
3634
3635         if (!fsp || !conn || conn != fsp->conn ||
3636                         req->vuid != fsp->vuid ||
3637                         fsp->is_directory || fsp->fh->fd == -1) {
3638                 /*
3639                  * fsp could be NULL here so use the value from the packet. JRA.
3640                  */
3641                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3642                         "- cache prime?\n",
3643                         (int)SVAL(req->vwv+0, 0)));
3644                 reply_readbraw_error(xconn);
3645                 END_PROFILE(SMBreadbraw);
3646                 return;
3647         }
3648
3649         /* Do a "by hand" version of CHECK_READ. */
3650         if (!(fsp->can_read ||
3651                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3652                                 (fsp->access_mask & FILE_EXECUTE)))) {
3653                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3654                                 (int)SVAL(req->vwv+0, 0)));
3655                 reply_readbraw_error(xconn);
3656                 END_PROFILE(SMBreadbraw);
3657                 return;
3658         }
3659
3660         flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3661
3662         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3663         if(req->wct == 10) {
3664                 /*
3665                  * This is a large offset (64 bit) read.
3666                  */
3667
3668                 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3669
3670                 if(startpos < 0) {
3671                         DEBUG(0,("reply_readbraw: negative 64 bit "
3672                                 "readraw offset (%.0f) !\n",
3673                                 (double)startpos ));
3674                         reply_readbraw_error(xconn);
3675                         END_PROFILE(SMBreadbraw);
3676                         return;
3677                 }
3678         }
3679
3680         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3681         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3682
3683         /* ensure we don't overrun the packet size */
3684         maxcount = MIN(65535,maxcount);
3685
3686         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3687             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3688             &lock);
3689
3690         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3691                 reply_readbraw_error(xconn);
3692                 END_PROFILE(SMBreadbraw);
3693                 return;
3694         }
3695
3696         if (fsp_stat(fsp) == 0) {
3697                 size = fsp->fsp_name->st.st_ex_size;
3698         }
3699
3700         if (startpos >= size) {
3701                 nread = 0;
3702         } else {
3703                 nread = MIN(maxcount,(size - startpos));
3704         }
3705
3706 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3707         if (nread < mincount)
3708                 nread = 0;
3709 #endif
3710
3711         DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3712                 "min=%lu nread=%lu\n",
3713                 fsp_fnum_dbg(fsp), (double)startpos,
3714                 (unsigned long)maxcount,
3715                 (unsigned long)mincount,
3716                 (unsigned long)nread ) );
3717
3718         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3719
3720         DEBUG(5,("reply_readbraw finished\n"));
3721
3722         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3723
3724         END_PROFILE(SMBreadbraw);
3725         return;
3726 }
3727
3728 #undef DBGC_CLASS
3729 #define DBGC_CLASS DBGC_LOCKING
3730
3731 /****************************************************************************
3732  Reply to a lockread (core+ protocol).
3733 ****************************************************************************/
3734
3735 void reply_lockread(struct smb_request *req)
3736 {
3737         connection_struct *conn = req->conn;
3738         ssize_t nread = -1;
3739         char *data;
3740         off_t startpos;
3741         size_t numtoread;
3742         size_t maxtoread;
3743         NTSTATUS status;
3744         files_struct *fsp;
3745         struct byte_range_lock *br_lck = NULL;
3746         char *p = NULL;
3747         struct smbXsrv_connection *xconn = req->xconn;
3748
3749         START_PROFILE(SMBlockread);
3750
3751         if (req->wct < 5) {
3752                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3753                 END_PROFILE(SMBlockread);
3754                 return;
3755         }
3756
3757         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3758
3759         if (!check_fsp(conn, req, fsp)) {
3760                 END_PROFILE(SMBlockread);
3761                 return;
3762         }
3763
3764         if (!CHECK_READ(fsp,req)) {
3765                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3766                 END_PROFILE(SMBlockread);
3767                 return;
3768         }
3769
3770         numtoread = SVAL(req->vwv+1, 0);
3771         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3772
3773         /*
3774          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3775          * protocol request that predates the read/write lock concept.
3776          * Thus instead of asking for a read lock here we need to ask
3777          * for a write lock. JRA.
3778          * Note that the requested lock size is unaffected by max_send.
3779          */
3780
3781         br_lck = do_lock(req->sconn->msg_ctx,
3782                         fsp,
3783                         (uint64_t)req->smbpid,
3784                         (uint64_t)numtoread,
3785                         (uint64_t)startpos,
3786                         WRITE_LOCK,
3787                         WINDOWS_LOCK,
3788                         False, /* Non-blocking lock. */
3789                         &status,
3790                         NULL);
3791         TALLOC_FREE(br_lck);
3792
3793         if (NT_STATUS_V(status)) {
3794                 reply_nterror(req, status);
3795                 END_PROFILE(SMBlockread);
3796                 return;
3797         }
3798
3799         /*
3800          * However the requested READ size IS affected by max_send. Insanity.... JRA.
3801          */
3802         maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3803
3804         if (numtoread > maxtoread) {
3805                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3806 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3807                         (unsigned int)numtoread, (unsigned int)maxtoread,
3808                         (unsigned int)xconn->smb1.sessions.max_send));
3809                 numtoread = maxtoread;
3810         }
3811
3812         reply_outbuf(req, 5, numtoread + 3);
3813
3814         data = smb_buf(req->outbuf) + 3;
3815
3816         nread = read_file(fsp,data,startpos,numtoread);
3817
3818         if (nread < 0) {
3819                 reply_nterror(req, map_nt_error_from_unix(errno));
3820                 END_PROFILE(SMBlockread);
3821                 return;
3822         }
3823
3824         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3825
3826         SSVAL(req->outbuf,smb_vwv0,nread);
3827         SSVAL(req->outbuf,smb_vwv5,nread+3);
3828         p = smb_buf(req->outbuf);
3829         SCVAL(p,0,0); /* pad byte. */
3830         SSVAL(p,1,nread);
3831
3832         DEBUG(3,("lockread %s num=%d nread=%d\n",
3833                  fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3834
3835         END_PROFILE(SMBlockread);
3836         return;
3837 }
3838
3839 #undef DBGC_CLASS
3840 #define DBGC_CLASS DBGC_ALL
3841
3842 /****************************************************************************
3843  Reply to a read.
3844 ****************************************************************************/
3845
3846 void reply_read(struct smb_request *req)
3847 {
3848         connection_struct *conn = req->conn;
3849         size_t numtoread;
3850         size_t maxtoread;
3851         ssize_t nread = 0;
3852         char *data;
3853         off_t startpos;
3854         files_struct *fsp;
3855         struct lock_struct lock;
3856         struct smbXsrv_connection *xconn = req->xconn;
3857
3858         START_PROFILE(SMBread);
3859
3860         if (req->wct < 3) {
3861                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3862                 END_PROFILE(SMBread);
3863                 return;
3864         }
3865
3866         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3867
3868         if (!check_fsp(conn, req, fsp)) {
3869                 END_PROFILE(SMBread);
3870                 return;
3871         }
3872
3873         if (!CHECK_READ(fsp,req)) {
3874                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3875                 END_PROFILE(SMBread);
3876                 return;
3877         }
3878
3879         numtoread = SVAL(req->vwv+1, 0);
3880         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3881
3882         /*
3883          * The requested read size cannot be greater than max_send. JRA.
3884          */
3885         maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3886
3887         if (numtoread > maxtoread) {
3888                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3889 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3890                         (unsigned int)numtoread, (unsigned int)maxtoread,
3891                         (unsigned int)xconn->smb1.sessions.max_send));
3892                 numtoread = maxtoread;
3893         }
3894
3895         reply_outbuf(req, 5, numtoread+3);
3896
3897         data = smb_buf(req->outbuf) + 3;
3898
3899         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3900             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3901             &lock);
3902
3903         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3904                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3905                 END_PROFILE(SMBread);
3906                 return;
3907         }
3908
3909         if (numtoread > 0)
3910                 nread = read_file(fsp,data,startpos,numtoread);
3911
3912         if (nread < 0) {
3913                 reply_nterror(req, map_nt_error_from_unix(errno));
3914                 goto strict_unlock;
3915         }
3916
3917         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3918
3919         SSVAL(req->outbuf,smb_vwv0,nread);
3920         SSVAL(req->outbuf,smb_vwv5,nread+3);
3921         SCVAL(smb_buf(req->outbuf),0,1);
3922         SSVAL(smb_buf(req->outbuf),1,nread);
3923
3924         DEBUG(3, ("read %s num=%d nread=%d\n",
3925                   fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3926
3927 strict_unlock:
3928         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3929
3930         END_PROFILE(SMBread);
3931         return;
3932 }
3933
3934 /****************************************************************************
3935  Setup readX header.
3936 ****************************************************************************/
3937
3938 int setup_readX_header(char *outbuf, size_t smb_maxcnt)
3939 {
3940         int outsize;
3941
3942         outsize = srv_set_message(outbuf,12,smb_maxcnt + 1 /* padding byte */,
3943                                   False);
3944
3945         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3946
3947         SCVAL(outbuf,smb_vwv0,0xFF);
3948         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3949         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3950         SSVAL(outbuf,smb_vwv6,
3951               (smb_wct - 4)     /* offset from smb header to wct */
3952               + 1               /* the wct field */
3953               + 12 * sizeof(uint16_t) /* vwv */
3954               + 2               /* the buflen field */
3955               + 1);             /* padding byte */
3956         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3957         SCVAL(smb_buf(outbuf), 0, 0); /* padding byte */
3958         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3959         _smb_setlen_large(outbuf,
3960                           smb_size + 12*2 + smb_maxcnt - 4 + 1 /* pad */);
3961         return outsize;
3962 }
3963
3964 /****************************************************************************
3965  Reply to a read and X - possibly using sendfile.
3966 ****************************************************************************/
3967
3968 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3969                             files_struct *fsp, off_t startpos,
3970                             size_t smb_maxcnt)
3971 {
3972         struct smbXsrv_connection *xconn = req->xconn;
3973         ssize_t nread = -1;
3974         struct lock_struct lock;
3975         int saved_errno = 0;
3976
3977         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3978             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3979             &lock);
3980
3981         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3982                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3983                 return;
3984         }
3985
3986         /*
3987          * We can only use sendfile on a non-chained packet
3988          * but we can use on a non-oplocked file. tridge proved this
3989          * on a train in Germany :-). JRA.
3990          */
3991
3992         if (!req_is_in_chain(req) &&
3993             !req->encrypted &&
3994             (fsp->base_fsp == NULL) &&
3995             (fsp->wcp == NULL) &&
3996             lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3997                 uint8_t headerbuf[smb_size + 12 * 2 + 1 /* padding byte */];
3998                 DATA_BLOB header;
3999
4000                 if(fsp_stat(fsp) == -1) {
4001                         reply_nterror(req, map_nt_error_from_unix(errno));
4002                         goto strict_unlock;
4003                 }
4004
4005                 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
4006                     (startpos > fsp->fsp_name->st.st_ex_size) ||
4007                     (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
4008                         /*
4009                          * We already know that we would do a short read, so don't
4010                          * try the sendfile() path.
4011                          */
4012                         goto nosendfile_read;
4013                 }
4014
4015                 /*
4016                  * Set up the packet header before send. We
4017                  * assume here the sendfile will work (get the
4018                  * correct amount of data).
4019                  */
4020
4021                 header = data_blob_const(headerbuf, sizeof(headerbuf));
4022
4023                 construct_reply_common_req(req, (char *)headerbuf);
4024                 setup_readX_header((char *)headerbuf, smb_maxcnt);
4025
4026                 nread = SMB_VFS_SENDFILE(xconn->transport.sock, fsp, &header,
4027                                          startpos, smb_maxcnt);
4028                 if (nread == -1) {
4029                         saved_errno = errno;
4030
4031                         /* Returning ENOSYS means no data at all was sent.
4032                            Do this as a normal read. */
4033                         if (errno == ENOSYS) {
4034                                 goto normal_read;
4035                         }
4036
4037                         /*
4038                          * Special hack for broken Linux with no working sendfile. If we
4039                          * return EINTR we sent the header but not the rest of the data.
4040                          * Fake this up by doing read/write calls.
4041                          */
4042
4043                         if (errno == EINTR) {
4044                                 /* Ensure we don't do this again. */
4045                                 set_use_sendfile(SNUM(conn), False);
4046                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
4047                                 nread = fake_sendfile(xconn, fsp, startpos,
4048                                                       smb_maxcnt);
4049                                 if (nread == -1) {
4050                                         saved_errno = errno;
4051                                         DEBUG(0,("send_file_readX: "
4052                                                  "fake_sendfile failed for "
4053                                                  "file %s (%s) for client %s. "
4054                                                  "Terminating\n",
4055                                                  fsp_str_dbg(fsp),
4056                                                  smbXsrv_connection_dbg(xconn),
4057                                                  strerror(saved_errno)));
4058                                         errno = saved_errno;
4059                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
4060                                 }
4061                                 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
4062                                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
4063                                 /* No outbuf here means successful sendfile. */
4064                                 goto strict_unlock;
4065                         }
4066
4067                         DEBUG(0,("send_file_readX: sendfile failed for file "
4068                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
4069                                  strerror(errno)));
4070                         exit_server_cleanly("send_file_readX sendfile failed");
4071                 } else if (nread == 0) {
4072                         /*
4073                          * Some sendfile implementations return 0 to indicate
4074                          * that there was a short read, but nothing was
4075                          * actually written to the socket.  In this case,
4076                          * fallback to the normal read path so the header gets
4077                          * the correct byte count.
4078                          */
4079                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
4080                                   "falling back to the normal read: %s\n",
4081                                   fsp_str_dbg(fsp)));
4082                         goto normal_read;
4083                 }
4084
4085                 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
4086                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
4087
4088                 /* Deal with possible short send. */
4089                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
4090                         ssize_t ret;
4091
4092                         ret = sendfile_short_send(xconn, fsp, nread,
4093                                                   sizeof(headerbuf), smb_maxcnt);
4094                         if (ret == -1) {
4095                                 const char *r;
4096                                 r = "send_file_readX: sendfile_short_send failed";
4097                                 DEBUG(0,("%s for file %s (%s).\n",
4098                                          r, fsp_str_dbg(fsp), strerror(errno)));
4099                                 exit_server_cleanly(r);
4100                         }
4101                 }
4102                 /* No outbuf here means successful sendfile. */
4103                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
4104                 SMB_PERFCOUNT_END(&req->pcd);
4105                 goto strict_unlock;
4106         }
4107
4108 normal_read:
4109
4110         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
4111                 uint8_t headerbuf[smb_size + 2*12 + 1 /* padding byte */];
4112                 ssize_t ret;
4113
4114                 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
4115                     (startpos > fsp->fsp_name->st.st_ex_size) ||
4116                     (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
4117                         /*
4118                          * We already know that we would do a short
4119                          * read, so don't try the sendfile() path.
4120                          */
4121                         goto nosendfile_read;
4122                 }
4123
4124                 construct_reply_common_req(req, (char *)headerbuf);
4125                 setup_readX_header((char *)headerbuf, smb_maxcnt);
4126
4127                 /* Send out the header. */
4128                 ret = write_data(xconn->transport.sock, (char *)headerbuf,
4129                                  sizeof(headerbuf));
4130                 if (ret != sizeof(headerbuf)) {
4131                         saved_errno = errno;
4132                         /*
4133                          * Try and give an error message saying what
4134                          * client failed.
4135                          */
4136                         DEBUG(0,("send_file_readX: write_data failed for file "
4137                                  "%s (%s) for client %s. Terminating\n",
4138                                  fsp_str_dbg(fsp),
4139                                  smbXsrv_connection_dbg(xconn),
4140                                  strerror(saved_errno)));
4141                         errno = saved_errno;
4142                         exit_server_cleanly("send_file_readX sendfile failed");
4143                 }
4144                 nread = fake_sendfile(xconn, fsp, startpos, smb_maxcnt);
4145                 if (nread == -1) {
4146                         saved_errno = errno;
4147                         DEBUG(0,("send_file_readX: fake_sendfile failed for file "
4148                                  "%s (%s) for client %s. Terminating\n",
4149                                  fsp_str_dbg(fsp),
4150                                  smbXsrv_connection_dbg(xconn),
4151                                  strerror(saved_errno)));
4152                         errno = saved_errno;
4153                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
4154                 }
4155                 goto strict_unlock;
4156         }
4157
4158 nosendfile_read:
4159
4160         reply_outbuf(req, 12, smb_maxcnt + 1 /* padding byte */);
4161         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4162         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
4163
4164         nread = read_file(fsp, smb_buf(req->outbuf) + 1 /* padding byte */,
4165                           startpos, smb_maxcnt);
4166         saved_errno = errno;
4167
4168         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4169
4170         if (nread < 0) {
4171                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4172                 return;
4173         }
4174
4175         setup_readX_header((char *)req->outbuf, nread);
4176
4177         DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
4178                   fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
4179         return;
4180
4181  strict_unlock:
4182         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4183         TALLOC_FREE(req->outbuf);
4184         return;
4185 }
4186
4187 /****************************************************************************
4188  Work out how much space we have for a read return.
4189 ****************************************************************************/
4190
4191 static size_t calc_max_read_pdu(const struct smb_request *req)
4192 {
4193         struct smbXsrv_connection *xconn = req->xconn;
4194
4195         if (xconn->protocol < PROTOCOL_NT1) {
4196                 return xconn->smb1.sessions.max_send;
4197         }
4198
4199         if (!lp_large_readwrite()) {
4200                 return xconn->smb1.sessions.max_send;
4201         }
4202
4203         if (req_is_in_chain(req)) {
4204                 return xconn->smb1.sessions.max_send;
4205         }
4206
4207         if (req->encrypted) {
4208                 /*
4209                  * Don't take encrypted traffic up to the
4210                  * limit. There are padding considerations
4211                  * that make that tricky.
4212                  */
4213                 return xconn->smb1.sessions.max_send;
4214         }
4215
4216         if (srv_is_signing_active(xconn)) {
4217                 return 0x1FFFF;
4218         }
4219
4220         if (!lp_unix_extensions()) {
4221                 return 0x1FFFF;
4222         }
4223
4224         /*
4225          * We can do ultra-large POSIX reads.
4226          */
4227         return 0xFFFFFF;
4228 }
4229
4230 /****************************************************************************
4231  Calculate how big a read can be. Copes with all clients. It's always
4232  safe to return a short read - Windows does this.
4233 ****************************************************************************/
4234
4235 static size_t calc_read_size(const struct smb_request *req,
4236                              size_t upper_size,
4237                              size_t lower_size)
4238 {
4239         struct smbXsrv_connection *xconn = req->xconn;
4240         size_t max_pdu = calc_max_read_pdu(req);
4241         size_t total_size = 0;
4242         size_t hdr_len = MIN_SMB_SIZE + VWV(12);
4243         size_t max_len = max_pdu - hdr_len - 1 /* padding byte */;
4244
4245         /*
4246          * Windows explicitly ignores upper size of 0xFFFF.
4247          * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
4248          * We must do the same as these will never fit even in
4249          * an extended size NetBIOS packet.
4250          */
4251         if (upper_size == 0xFFFF) {
4252                 upper_size = 0;
4253         }
4254
4255         if (xconn->protocol < PROTOCOL_NT1) {
4256                 upper_size = 0;
4257         }
4258
4259         total_size = ((upper_size<<16) | lower_size);
4260
4261         /*
4262          * LARGE_READX test shows it's always safe to return
4263          * a short read. Windows does so.
4264          */
4265         return MIN(total_size, max_len);
4266 }
4267
4268 /****************************************************************************
4269  Reply to a read and X.
4270 ****************************************************************************/
4271
4272 void reply_read_and_X(struct smb_request *req)
4273 {
4274         connection_struct *conn = req->conn;
4275         files_struct *fsp;
4276         off_t startpos;
4277         size_t smb_maxcnt;
4278         size_t upper_size;
4279         bool big_readX = False;
4280 #if 0
4281         size_t smb_mincnt = SVAL(req->vwv+6, 0);
4282 #endif
4283
4284         START_PROFILE(SMBreadX);
4285
4286         if ((req->wct != 10) && (req->wct != 12)) {
4287                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4288                 return;
4289         }
4290
4291         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4292         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4293         smb_maxcnt = SVAL(req->vwv+5, 0);
4294
4295         /* If it's an IPC, pass off the pipe handler. */
4296         if (IS_IPC(conn)) {
4297                 reply_pipe_read_and_X(req);
4298                 END_PROFILE(SMBreadX);
4299                 return;
4300         }
4301
4302         if (!check_fsp(conn, req, fsp)) {
4303                 END_PROFILE(SMBreadX);
4304                 return;
4305         }
4306
4307         if (!CHECK_READ(fsp,req)) {
4308                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4309                 END_PROFILE(SMBreadX);
4310                 return;
4311         }
4312
4313         upper_size = SVAL(req->vwv+7, 0);
4314         smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4315         if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4316                 /*
4317                  * This is a heuristic to avoid keeping large
4318                  * outgoing buffers around over long-lived aio
4319                  * requests.
4320                  */
4321                 big_readX = True;
4322         }
4323
4324         if (req->wct == 12) {
4325                 /*
4326                  * This is a large offset (64 bit) read.
4327                  */
4328                 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4329
4330         }
4331
4332         if (!big_readX) {
4333                 NTSTATUS status = schedule_aio_read_and_X(conn,
4334                                         req,
4335                                         fsp,
4336                                         startpos,
4337                                         smb_maxcnt);
4338                 if (NT_STATUS_IS_OK(status)) {
4339                         /* Read scheduled - we're done. */
4340                         goto out;
4341                 }
4342                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4343                         /* Real error - report to client. */
4344                         END_PROFILE(SMBreadX);
4345                         reply_nterror(req, status);
4346                         return;
4347                 }
4348                 /* NT_STATUS_RETRY - fall back to sync read. */
4349         }
4350
4351         smbd_lock_socket(req->xconn);
4352         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4353         smbd_unlock_socket(req->xconn);
4354
4355  out:
4356         END_PROFILE(SMBreadX);
4357         return;
4358 }
4359
4360 /****************************************************************************
4361  Error replies to writebraw must have smb_wct == 1. Fix this up.
4362 ****************************************************************************/
4363
4364 void error_to_writebrawerr(struct smb_request *req)
4365 {
4366         uint8_t *old_outbuf = req->outbuf;
4367
4368         reply_outbuf(req, 1, 0);
4369
4370         memcpy(req->outbuf, old_outbuf, smb_size);
4371         TALLOC_FREE(old_outbuf);
4372 }
4373
4374 /****************************************************************************
4375  Read 4 bytes of a smb packet and return the smb length of the packet.
4376  Store the result in the buffer. This version of the function will
4377  never return a session keepalive (length of zero).
4378  Timeout is in milliseconds.
4379 ****************************************************************************/
4380
4381 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4382                                 size_t *len)
4383 {
4384         uint8_t msgtype = NBSSkeepalive;
4385
4386         while (msgtype == NBSSkeepalive) {
4387                 NTSTATUS status;
4388
4389                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4390                                                           len);
4391                 if (!NT_STATUS_IS_OK(status)) {
4392                         char addr[INET6_ADDRSTRLEN];
4393                         /* Try and give an error message
4394                          * saying what client failed. */
4395                         DEBUG(0, ("read_fd_with_timeout failed for "
4396                                   "client %s read error = %s.\n",
4397                                   get_peer_addr(fd,addr,sizeof(addr)),
4398                                   nt_errstr(status)));
4399                         return status;
4400                 }
4401
4402                 msgtype = CVAL(inbuf, 0);
4403         }
4404
4405         DEBUG(10,("read_smb_length: got smb length of %lu\n",
4406                   (unsigned long)len));
4407
4408         return NT_STATUS_OK;
4409 }
4410
4411 /****************************************************************************
4412  Reply to a writebraw (core+ or LANMAN1.0 protocol).
4413 ****************************************************************************/
4414
4415 void reply_writebraw(struct smb_request *req)
4416 {
4417         connection_struct *conn = req->conn;
4418         struct smbXsrv_connection *xconn = req->xconn;
4419         char *buf = NULL;
4420         ssize_t nwritten=0;
4421         ssize_t total_written=0;
4422         size_t numtowrite=0;
4423         size_t tcount;
4424         off_t startpos;
4425         const char *data=NULL;
4426         bool write_through;
4427         files_struct *fsp;
4428         struct lock_struct lock;
4429         NTSTATUS status;
4430
4431         START_PROFILE(SMBwritebraw);
4432
4433         /*
4434          * If we ever reply with an error, it must have the SMB command
4435          * type of SMBwritec, not SMBwriteBraw, as this tells the client
4436          * we're finished.
4437          */
4438         SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4439
4440         if (srv_is_signing_active(xconn)) {
4441                 END_PROFILE(SMBwritebraw);
4442                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4443                                 "raw reads/writes are disallowed.");
4444         }
4445
4446         if (req->wct < 12) {
4447                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4448                 error_to_writebrawerr(req);
4449                 END_PROFILE(SMBwritebraw);
4450                 return;
4451         }
4452
4453         if (xconn->smb1.echo_handler.trusted_fde) {
4454                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4455                          "'async smb echo handler = yes'\n"));
4456                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4457                 error_to_writebrawerr(req);
4458                 END_PROFILE(SMBwritebraw);
4459                 return;
4460         }
4461
4462         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4463         if (!check_fsp(conn, req, fsp)) {
4464                 error_to_writebrawerr(req);
4465                 END_PROFILE(SMBwritebraw);
4466                 return;
4467         }
4468
4469         if (!CHECK_WRITE(fsp)) {
4470                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4471                 error_to_writebrawerr(req);
4472                 END_PROFILE(SMBwritebraw);
4473                 return;
4474         }
4475
4476         tcount = IVAL(req->vwv+1, 0);
4477         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4478         write_through = BITSETW(req->vwv+7,0);
4479
4480         /* We have to deal with slightly different formats depending
4481                 on whether we are using the core+ or lanman1.0 protocol */
4482
4483         if(get_Protocol() <= PROTOCOL_COREPLUS) {
4484                 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4485                 data = smb_buf_const(req->inbuf);
4486         } else {
4487                 numtowrite = SVAL(req->vwv+10, 0);
4488                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4489         }
4490
4491         /* Ensure we don't write bytes past the end of this packet. */
4492         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4493                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4494                 error_to_writebrawerr(req);
4495                 END_PROFILE(SMBwritebraw);
4496                 return;
4497         }
4498
4499         if (!fsp->print_file) {
4500                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4501                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4502                     &lock);
4503
4504                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4505                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4506                         error_to_writebrawerr(req);
4507                         END_PROFILE(SMBwritebraw);
4508                         return;
4509                 }
4510         }
4511
4512         if (numtowrite>0) {
4513                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4514         }
4515
4516         DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4517                         "wrote=%d sync=%d\n",
4518                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4519                 (int)nwritten, (int)write_through));
4520
4521         if (nwritten < (ssize_t)numtowrite)  {
4522                 reply_nterror(req, NT_STATUS_DISK_FULL);
4523                 error_to_writebrawerr(req);
4524                 goto strict_unlock;
4525         }
4526
4527         total_written = nwritten;
4528
4529         /* Allocate a buffer of 64k + length. */
4530         buf = talloc_array(NULL, char, 65540);
4531         if (!buf) {
4532                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4533                 error_to_writebrawerr(req);
4534                 goto strict_unlock;
4535         }
4536
4537         /* Return a SMBwritebraw message to the redirector to tell
4538          * it to send more bytes */
4539
4540         memcpy(buf, req->inbuf, smb_size);
4541         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4542         SCVAL(buf,smb_com,SMBwritebraw);
4543         SSVALS(buf,smb_vwv0,0xFFFF);
4544         show_msg(buf);
4545         if (!srv_send_smb(req->xconn,
4546                           buf,
4547                           false, 0, /* no signing */
4548                           IS_CONN_ENCRYPTED(conn),
4549                           &req->pcd)) {
4550                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4551                         "failed.");
4552         }
4553
4554         /* Now read the raw data into the buffer and write it */
4555         status = read_smb_length(xconn->transport.sock, buf, SMB_SECONDARY_WAIT,
4556                                  &numtowrite);
4557         if (!NT_STATUS_IS_OK(status)) {
4558                 exit_server_cleanly("secondary writebraw failed");
4559         }
4560
4561         /* Set up outbuf to return the correct size */
4562         reply_outbuf(req, 1, 0);
4563
4564         if (numtowrite != 0) {
4565
4566                 if (numtowrite > 0xFFFF) {
4567                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4568                                 "raw requested (%u). Terminating\n",
4569                                 (unsigned int)numtowrite ));
4570                         exit_server_cleanly("secondary writebraw failed");
4571                 }
4572
4573                 if (tcount > nwritten+numtowrite) {
4574                         DEBUG(3,("reply_writebraw: Client overestimated the "
4575                                 "write %d %d %d\n",
4576                                 (int)tcount,(int)nwritten,(int)numtowrite));
4577                 }
4578
4579                 status = read_data_ntstatus(xconn->transport.sock, buf+4,
4580                                             numtowrite);
4581
4582                 if (!NT_STATUS_IS_OK(status)) {
4583                         /* Try and give an error message
4584                          * saying what client failed. */
4585                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4586                                   "raw read failed (%s) for client %s. "
4587                                   "Terminating\n", nt_errstr(status),
4588                                   smbXsrv_connection_dbg(xconn)));
4589                         exit_server_cleanly("secondary writebraw failed");
4590                 }
4591
4592                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4593                 if (nwritten == -1) {
4594                         TALLOC_FREE(buf);
4595                         reply_nterror(req, map_nt_error_from_unix(errno));
4596                         error_to_writebrawerr(req);
4597                         goto strict_unlock;
4598                 }
4599
4600                 if (nwritten < (ssize_t)numtowrite) {
4601                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4602                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4603                 }
4604
4605                 if (nwritten > 0) {
4606                         total_written += nwritten;
4607                 }
4608         }
4609
4610         TALLOC_FREE(buf);
4611         SSVAL(req->outbuf,smb_vwv0,total_written);
4612
4613         status = sync_file(conn, fsp, write_through);
4614         if (!NT_STATUS_IS_OK(status)) {
4615                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4616                          fsp_str_dbg(fsp), nt_errstr(status)));
4617                 reply_nterror(req, status);
4618                 error_to_writebrawerr(req);
4619                 goto strict_unlock;
4620         }
4621
4622         DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4623                 "wrote=%d\n",
4624                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4625                 (int)total_written));
4626
4627         if (!fsp->print_file) {
4628                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4629         }
4630
4631         /* We won't return a status if write through is not selected - this
4632          * follows what WfWg does */
4633         END_PROFILE(SMBwritebraw);
4634
4635         if (!write_through && total_written==tcount) {
4636
4637 #if RABBIT_PELLET_FIX
4638                 /*
4639                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4640                  * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4641                  * JRA.
4642                  */
4643                 if (!send_keepalive(xconn->transport.sock)) {
4644                         exit_server_cleanly("reply_writebraw: send of "
4645                                 "keepalive failed");
4646                 }
4647 #endif
4648                 TALLOC_FREE(req->outbuf);
4649         }
4650         return;
4651
4652 strict_unlock:
4653         if (!fsp->print_file) {
4654                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4655         }
4656
4657         END_PROFILE(SMBwritebraw);
4658         return;
4659 }
4660
4661 #undef DBGC_CLASS
4662 #define DBGC_CLASS DBGC_LOCKING
4663
4664 /****************************************************************************
4665  Reply to a writeunlock (core+).
4666 ****************************************************************************/
4667
4668 void reply_writeunlock(struct smb_request *req)
4669 {
4670         connection_struct *conn = req->conn;
4671         ssize_t nwritten = -1;
4672         size_t numtowrite;
4673         off_t startpos;
4674         const char *data;
4675         NTSTATUS status = NT_STATUS_OK;
4676         files_struct *fsp;
4677         struct lock_struct lock;
4678         int saved_errno = 0;
4679
4680         START_PROFILE(SMBwriteunlock);
4681
4682         if (req->wct < 5) {
4683                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4684                 END_PROFILE(SMBwriteunlock);
4685                 return;
4686         }
4687
4688         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4689
4690         if (!check_fsp(conn, req, fsp)) {
4691                 END_PROFILE(SMBwriteunlock);
4692                 return;
4693         }
4694
4695         if (!CHECK_WRITE(fsp)) {
4696                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4697                 END_PROFILE(SMBwriteunlock);
4698                 return;
4699         }
4700
4701         numtowrite = SVAL(req->vwv+1, 0);
4702         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4703         data = (const char *)req->buf + 3;
4704
4705         if (!fsp->print_file && numtowrite > 0) {
4706                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4707                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4708                     &lock);
4709
4710                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4711                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4712                         END_PROFILE(SMBwriteunlock);
4713                         return;
4714                 }
4715         }
4716
4717         /* The special X/Open SMB protocol handling of
4718            zero length writes is *NOT* done for
4719            this call */
4720         if(numtowrite == 0) {
4721                 nwritten = 0;
4722         } else {
4723                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4724                 saved_errno = errno;
4725         }
4726
4727         status = sync_file(conn, fsp, False /* write through */);
4728         if (!NT_STATUS_IS_OK(status)) {
4729                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4730                          fsp_str_dbg(fsp), nt_errstr(status)));
4731                 reply_nterror(req, status);
4732                 goto strict_unlock;
4733         }
4734
4735         if(nwritten < 0) {
4736                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4737                 goto strict_unlock;
4738         }
4739
4740         if((nwritten < numtowrite) && (numtowrite != 0)) {
4741                 reply_nterror(req, NT_STATUS_DISK_FULL);
4742                 goto strict_unlock;
4743         }
4744
4745         if (numtowrite && !fsp->print_file) {
4746                 status = do_unlock(req->sconn->msg_ctx,
4747                                 fsp,
4748                                 (uint64_t)req->smbpid,
4749                                 (uint64_t)numtowrite,
4750                                 (uint64_t)startpos,
4751                                 WINDOWS_LOCK);
4752
4753                 if (NT_STATUS_V(status)) {
4754                         reply_nterror(req, status);
4755                         goto strict_unlock;
4756                 }
4757         }
4758
4759         reply_outbuf(req, 1, 0);
4760
4761         SSVAL(req->outbuf,smb_vwv0,nwritten);
4762
4763         DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4764                   fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4765
4766 strict_unlock:
4767         if (numtowrite && !fsp->print_file) {
4768                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4769         }
4770
4771         END_PROFILE(SMBwriteunlock);
4772         return;
4773 }
4774
4775 #undef DBGC_CLASS
4776 #define DBGC_CLASS DBGC_ALL
4777
4778 /****************************************************************************
4779  Reply to a write.
4780 ****************************************************************************/
4781
4782 void reply_write(struct smb_request *req)
4783 {
4784         connection_struct *conn = req->conn;
4785         size_t numtowrite;
4786         ssize_t nwritten = -1;
4787         off_t startpos;
4788         const char *data;
4789         files_struct *fsp;
4790         struct lock_struct lock;
4791         NTSTATUS status;
4792         int saved_errno = 0;
4793
4794         START_PROFILE(SMBwrite);
4795
4796         if (req->wct < 5) {
4797                 END_PROFILE(SMBwrite);
4798                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4799                 return;
4800         }
4801
4802         /* If it's an IPC, pass off the pipe handler. */
4803         if (IS_IPC(conn)) {
4804                 reply_pipe_write(req);
4805                 END_PROFILE(SMBwrite);
4806                 return;
4807         }
4808
4809         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4810
4811         if (!check_fsp(conn, req, fsp)) {
4812                 END_PROFILE(SMBwrite);
4813                 return;
4814         }
4815
4816         if (!CHECK_WRITE(fsp)) {
4817                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4818                 END_PROFILE(SMBwrite);
4819                 return;
4820         }
4821
4822         numtowrite = SVAL(req->vwv+1, 0);
4823         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4824         data = (const char *)req->buf + 3;
4825
4826         if (!fsp->print_file) {
4827                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4828                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4829                         &lock);
4830
4831                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4832                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4833                         END_PROFILE(SMBwrite);
4834                         return;
4835                 }
4836         }
4837
4838         /*
4839          * X/Open SMB protocol says that if smb_vwv1 is
4840          * zero then the file size should be extended or
4841          * truncated to the size given in smb_vwv[2-3].
4842          */
4843
4844         if(numtowrite == 0) {
4845                 /*
4846                  * This is actually an allocate call, and set EOF. JRA.
4847                  */
4848                 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4849                 if (nwritten < 0) {
4850                         reply_nterror(req, NT_STATUS_DISK_FULL);
4851                         goto strict_unlock;
4852                 }
4853                 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4854                 if (nwritten < 0) {
4855                         reply_nterror(req, NT_STATUS_DISK_FULL);
4856                         goto strict_unlock;
4857                 }
4858                 trigger_write_time_update_immediate(fsp);
4859         } else {
4860                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4861         }
4862
4863         status = sync_file(conn, fsp, False);
4864         if (!NT_STATUS_IS_OK(status)) {
4865                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4866                          fsp_str_dbg(fsp), nt_errstr(status)));
4867                 reply_nterror(req, status);
4868                 goto strict_unlock;
4869         }
4870
4871         if(nwritten < 0) {
4872                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4873                 goto strict_unlock;
4874         }
4875
4876         if((nwritten == 0) && (numtowrite != 0)) {
4877                 reply_nterror(req, NT_STATUS_DISK_FULL);
4878                 goto strict_unlock;
4879         }
4880
4881         reply_outbuf(req, 1, 0);
4882
4883         SSVAL(req->outbuf,smb_vwv0,nwritten);
4884
4885         if (nwritten < (ssize_t)numtowrite) {
4886                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4887                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4888         }
4889
4890         DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4891
4892 strict_unlock:
4893         if (!fsp->print_file) {
4894                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4895         }
4896
4897         END_PROFILE(SMBwrite);
4898         return;
4899 }
4900
4901 /****************************************************************************
4902  Ensure a buffer is a valid writeX for recvfile purposes.
4903 ****************************************************************************/
4904
4905 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4906                                                 (2*14) + /* word count (including bcc) */ \
4907                                                 1 /* pad byte */)
4908
4909 bool is_valid_writeX_buffer(struct smbXsrv_connection *xconn,
4910                             const uint8_t *inbuf)
4911 {
4912         size_t numtowrite;
4913         unsigned int doff = 0;
4914         size_t len = smb_len_large(inbuf);
4915         uint16_t fnum;
4916         struct smbXsrv_open *op = NULL;
4917         struct files_struct *fsp = NULL;
4918         NTSTATUS status;
4919
4920         if (is_encrypted_packet(inbuf)) {
4921                 /* Can't do this on encrypted
4922                  * connections. */
4923                 return false;
4924         }
4925
4926         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4927                 return false;
4928         }
4929
4930         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4931                         CVAL(inbuf,smb_wct) != 14) {
4932                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4933                         "invalid word length.\n"));
4934                 return false;
4935         }
4936
4937         fnum = SVAL(inbuf, smb_vwv2);
4938         status = smb1srv_open_lookup(xconn,
4939                                      fnum,
4940                                      0, /* now */
4941                                      &op);
4942         if (!NT_STATUS_IS_OK(status)) {
4943                 DEBUG(10,("is_valid_writeX_buffer: bad fnum\n"));
4944                 return false;
4945         }
4946         fsp = op->compat;
4947         if (fsp == NULL) {
4948                 DEBUG(10,("is_valid_writeX_buffer: bad fsp\n"));
4949                 return false;
4950         }
4951         if (fsp->conn == NULL) {
4952                 DEBUG(10,("is_valid_writeX_buffer: bad fsp->conn\n"));
4953                 return false;
4954         }
4955
4956         if (IS_IPC(fsp->conn)) {
4957                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4958                 return false;
4959         }
4960         if (IS_PRINT(fsp->conn)) {
4961                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4962                 return false;
4963         }
4964         doff = SVAL(inbuf,smb_vwv11);
4965
4966         numtowrite = SVAL(inbuf,smb_vwv10);
4967
4968         if (len > doff && len - doff > 0xFFFF) {
4969                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4970         }
4971
4972         if (numtowrite == 0) {
4973                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4974                 return false;
4975         }
4976
4977         /* Ensure the sizes match up. */
4978         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4979                 /* no pad byte...old smbclient :-( */
4980                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4981                         (unsigned int)doff,
4982                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4983                 return false;
4984         }
4985
4986         if (len - doff != numtowrite) {
4987                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4988                         "len = %u, doff = %u, numtowrite = %u\n",
4989                         (unsigned int)len,
4990                         (unsigned int)doff,
4991                         (unsigned int)numtowrite ));
4992                 return false;
4993         }
4994
4995         DEBUG(10,("is_valid_writeX_buffer: true "
4996                 "len = %u, doff = %u, numtowrite = %u\n",
4997                 (unsigned int)len,
4998                 (unsigned int)doff,
4999                 (unsigned int)numtowrite ));
5000
5001         return true;
5002 }
5003
5004 /****************************************************************************
5005  Reply to a write and X.
5006 ****************************************************************************/
5007
5008 void reply_write_and_X(struct smb_request *req)
5009 {
5010         connection_struct *conn = req->conn;
5011         struct smbXsrv_connection *xconn = req->xconn;
5012         files_struct *fsp;
5013         struct lock_struct lock;
5014         off_t startpos;
5015         size_t numtowrite;
5016         bool write_through;
5017         ssize_t nwritten;
5018         unsigned int smb_doff;
5019         unsigned int smblen;
5020         const char *data;
5021         NTSTATUS status;
5022         int saved_errno = 0;
5023
5024         START_PROFILE(SMBwriteX);
5025
5026         if ((req->wct != 12) && (req->wct != 14)) {
5027                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5028                 goto out;
5029         }
5030
5031         numtowrite = SVAL(req->vwv+10, 0);
5032         smb_doff = SVAL(req->vwv+11, 0);
5033         smblen = smb_len(req->inbuf);
5034
5035         if (req->unread_bytes > 0xFFFF ||
5036                         (smblen > smb_doff &&
5037                                 smblen - smb_doff > 0xFFFF)) {
5038                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
5039         }
5040
5041         if (req->unread_bytes) {
5042                 /* Can't do a recvfile write on IPC$ */
5043                 if (IS_IPC(conn)) {
5044                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5045                         goto out;
5046                 }
5047                 if (numtowrite != req->unread_bytes) {
5048                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5049                         goto out;
5050                 }
5051         } else {
5052                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
5053                                 smb_doff + numtowrite > smblen) {
5054                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5055                         goto out;
5056                 }
5057         }
5058
5059         /* If it's an IPC, pass off the pipe handler. */
5060         if (IS_IPC(conn)) {
5061                 if (req->unread_bytes) {
5062                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5063                         goto out;
5064                 }
5065                 reply_pipe_write_and_X(req);
5066                 goto out;
5067         }
5068
5069         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
5070         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
5071         write_through = BITSETW(req->vwv+7,0);
5072
5073         if (!check_fsp(conn, req, fsp)) {
5074                 goto out;
5075         }
5076
5077         if (!CHECK_WRITE(fsp)) {
5078                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5079                 goto out;
5080         }
5081
5082         data = smb_base(req->inbuf) + smb_doff;
5083
5084         if(req->wct == 14) {
5085                 /*
5086                  * This is a large offset (64 bit) write.
5087                  */
5088                 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
5089
5090         }
5091
5092         /* X/Open SMB protocol says that, unlike SMBwrite
5093         if the length is zero then NO truncation is
5094         done, just a write of zero. To truncate a file,
5095         use SMBwrite. */
5096
5097         if(numtowrite == 0) {
5098                 nwritten = 0;
5099         } else {
5100                 if (req->unread_bytes == 0) {
5101                         status = schedule_aio_write_and_X(conn,
5102                                                 req,
5103                                                 fsp,
5104                                                 data,
5105                                                 startpos,
5106                                                 numtowrite);
5107
5108                         if (NT_STATUS_IS_OK(status)) {
5109                                 /* write scheduled - we're done. */
5110                                 goto out;
5111                         }
5112                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
5113                                 /* Real error - report to client. */
5114                                 reply_nterror(req, status);
5115                                 goto out;
5116                         }
5117                         /* NT_STATUS_RETRY - fall through to sync write. */
5118                 }
5119
5120                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5121                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5122                     &lock);
5123
5124                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5125                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5126                         goto out;
5127                 }
5128
5129                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5130                 saved_errno = errno;
5131
5132                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5133         }
5134
5135         if(nwritten < 0) {
5136                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
5137                 goto out;
5138         }
5139
5140         if((nwritten == 0) && (numtowrite != 0)) {
5141                 reply_nterror(req, NT_STATUS_DISK_FULL);
5142                 goto out;
5143         }
5144
5145         reply_outbuf(req, 6, 0);
5146         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
5147         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
5148         SSVAL(req->outbuf,smb_vwv2,nwritten);
5149         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
5150
5151         DEBUG(3,("writeX %s num=%d wrote=%d\n",
5152                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
5153
5154         status = sync_file(conn, fsp, write_through);
5155         if (!NT_STATUS_IS_OK(status)) {
5156                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
5157                          fsp_str_dbg(fsp), nt_errstr(status)));
5158                 reply_nterror(req, status);
5159                 goto out;
5160         }
5161
5162         END_PROFILE(SMBwriteX);
5163         return;
5164
5165 out:
5166         if (req->unread_bytes) {
5167                 /* writeX failed. drain socket. */
5168                 if (drain_socket(xconn->transport.sock, req->unread_bytes) !=
5169                                 req->unread_bytes) {
5170                         smb_panic("failed to drain pending bytes");
5171                 }
5172                 req->unread_bytes = 0;
5173         }
5174
5175         END_PROFILE(SMBwriteX);
5176         return;
5177 }
5178
5179 /****************************************************************************
5180  Reply to a lseek.
5181 ****************************************************************************/
5182
5183 void reply_lseek(struct smb_request *req)
5184 {
5185         connection_struct *conn = req->conn;
5186         off_t startpos;
5187         off_t res= -1;
5188         int mode,umode;
5189         files_struct *fsp;
5190
5191         START_PROFILE(SMBlseek);
5192
5193         if (req->wct < 4) {
5194                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5195                 END_PROFILE(SMBlseek);
5196                 return;
5197         }
5198
5199         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5200
5201         if (!check_fsp(conn, req, fsp)) {
5202                 return;
5203         }
5204
5205         flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
5206
5207         mode = SVAL(req->vwv+1, 0) & 3;
5208         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
5209         startpos = (off_t)IVALS(req->vwv+2, 0);
5210
5211         switch (mode) {
5212                 case 0:
5213                         umode = SEEK_SET;
5214                         res = startpos;
5215                         break;
5216                 case 1:
5217                         umode = SEEK_CUR;
5218                         res = fsp->fh->pos + startpos;
5219                         break;
5220                 case 2:
5221                         umode = SEEK_END;
5222                         break;
5223                 default:
5224                         umode = SEEK_SET;
5225                         res = startpos;
5226                         break;
5227         }
5228
5229         if (umode == SEEK_END) {
5230                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
5231                         if(errno == EINVAL) {
5232                                 off_t current_pos = startpos;
5233
5234                                 if(fsp_stat(fsp) == -1) {
5235                                         reply_nterror(req,
5236                                                 map_nt_error_from_unix(errno));
5237                                         END_PROFILE(SMBlseek);
5238                                         return;
5239                                 }
5240
5241                                 current_pos += fsp->fsp_name->st.st_ex_size;
5242                                 if(current_pos < 0)
5243                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
5244                         }
5245                 }
5246
5247                 if(res == -1) {
5248                         reply_nterror(req, map_nt_error_from_unix(errno));
5249                         END_PROFILE(SMBlseek);
5250                         return;
5251                 }
5252         }
5253
5254         fsp->fh->pos = res;
5255
5256         reply_outbuf(req, 2, 0);
5257         SIVAL(req->outbuf,smb_vwv0,res);
5258
5259         DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
5260                 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
5261
5262         END_PROFILE(SMBlseek);
5263         return;
5264 }
5265
5266 /****************************************************************************
5267  Reply to a flush.
5268 ****************************************************************************/
5269
5270 void reply_flush(struct smb_request *req)
5271 {
5272         connection_struct *conn = req->conn;
5273         uint16_t fnum;
5274         files_struct *fsp;
5275
5276         START_PROFILE(SMBflush);
5277
5278         if (req->wct < 1) {
5279                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5280                 return;
5281         }
5282
5283         fnum = SVAL(req->vwv+0, 0);
5284         fsp = file_fsp(req, fnum);
5285
5286         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
5287                 return;
5288         }
5289
5290         if (!fsp) {
5291                 file_sync_all(conn);
5292         } else {
5293                 NTSTATUS status = sync_file(conn, fsp, True);
5294                 if (!NT_STATUS_IS_OK(status)) {
5295                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
5296                                 fsp_str_dbg(fsp), nt_errstr(status)));
5297                         reply_nterror(req, status);
5298                         END_PROFILE(SMBflush);
5299                         return;
5300                 }
5301         }
5302
5303         reply_outbuf(req, 0, 0);
5304
5305         DEBUG(3,("flush\n"));
5306         END_PROFILE(SMBflush);
5307         return;
5308 }
5309
5310 /****************************************************************************
5311  Reply to a exit.
5312  conn POINTER CAN BE NULL HERE !
5313 ****************************************************************************/
5314
5315 void reply_exit(struct smb_request *req)
5316 {
5317         START_PROFILE(SMBexit);
5318
5319         file_close_pid(req->sconn, req->smbpid, req->vuid);
5320
5321         reply_outbuf(req, 0, 0);
5322
5323         DEBUG(3,("exit\n"));
5324
5325         END_PROFILE(SMBexit);
5326         return;
5327 }
5328
5329 struct reply_close_state {
5330         files_struct *fsp;
5331         struct smb_request *smbreq;
5332 };
5333
5334 static void do_smb1_close(struct tevent_req *req);
5335
5336 void reply_close(struct smb_request *req)
5337 {
5338         connection_struct *conn = req->conn;
5339         NTSTATUS status = NT_STATUS_OK;
5340         files_struct *fsp = NULL;
5341         START_PROFILE(SMBclose);
5342
5343         if (req->wct < 3) {
5344                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5345                 END_PROFILE(SMBclose);
5346                 return;
5347         }
5348
5349         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5350
5351         /*
5352          * We can only use check_fsp if we know it's not a directory.
5353          */
5354
5355         if (!check_fsp_open(conn, req, fsp)) {
5356                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5357                 END_PROFILE(SMBclose);
5358                 return;
5359         }
5360
5361         DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5362                   fsp->is_directory ? "directory" : "file",
5363                   fsp->fh->fd, fsp_fnum_dbg(fsp),
5364                   conn->num_files_open));
5365
5366         if (!fsp->is_directory) {
5367                 time_t t;
5368
5369                 /*
5370                  * Take care of any time sent in the close.
5371                  */
5372
5373                 t = srv_make_unix_date3(req->vwv+1);
5374                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5375         }
5376
5377         if (fsp->num_aio_requests != 0) {
5378
5379                 struct reply_close_state *state;
5380
5381                 DEBUG(10, ("closing with aio %u requests pending\n",
5382                            fsp->num_aio_requests));
5383
5384                 /*
5385                  * We depend on the aio_extra destructor to take care of this
5386                  * close request once fsp->num_aio_request drops to 0.
5387                  */
5388
5389                 fsp->deferred_close = tevent_wait_send(
5390                         fsp, fsp->conn->sconn->ev_ctx);
5391                 if (fsp->deferred_close == NULL) {
5392                         status = NT_STATUS_NO_MEMORY;
5393                         goto done;
5394                 }
5395
5396                 state = talloc(fsp, struct reply_close_state);
5397                 if (state == NULL) {
5398                         TALLOC_FREE(fsp->deferred_close);
5399                         status = NT_STATUS_NO_MEMORY;
5400                         goto done;
5401                 }
5402                 state->fsp = fsp;
5403                 state->smbreq = talloc_move(fsp, &req);
5404                 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5405                                         state);
5406                 END_PROFILE(SMBclose);
5407                 return;
5408         }
5409
5410         /*
5411          * close_file() returns the unix errno if an error was detected on
5412          * close - normally this is due to a disk full error. If not then it
5413          * was probably an I/O error.
5414          */
5415
5416         status = close_file(req, fsp, NORMAL_CLOSE);
5417 done:
5418         if (!NT_STATUS_IS_OK(status)) {
5419                 reply_nterror(req, status);
5420                 END_PROFILE(SMBclose);
5421                 return;
5422         }
5423
5424         reply_outbuf(req, 0, 0);
5425         END_PROFILE(SMBclose);
5426         return;
5427 }
5428
5429 static void do_smb1_close(struct tevent_req *req)
5430 {
5431         struct reply_close_state *state = tevent_req_callback_data(
5432                 req, struct reply_close_state);
5433         struct smb_request *smbreq;
5434         NTSTATUS status;
5435         int ret;
5436
5437         ret = tevent_wait_recv(req);
5438         TALLOC_FREE(req);
5439         if (ret != 0) {
5440                 DEBUG(10, ("tevent_wait_recv returned %s\n",
5441                            strerror(ret)));
5442                 /*
5443                  * Continue anyway, this should never happen
5444                  */
5445         }
5446
5447         /*
5448          * fsp->smb2_close_request right now is a talloc grandchild of
5449          * fsp. When we close_file(fsp), it would go with it. No chance to
5450          * reply...
5451          */
5452         smbreq = talloc_move(talloc_tos(), &state->smbreq);
5453
5454         status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5455         if (NT_STATUS_IS_OK(status)) {
5456                 reply_outbuf(smbreq, 0, 0);
5457         } else {
5458                 reply_nterror(smbreq, status);
5459         }
5460         if (!srv_send_smb(smbreq->xconn,
5461                         (char *)smbreq->outbuf,
5462                         true,
5463                         smbreq->seqnum+1,
5464                         IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5465                         NULL)) {
5466                 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5467                                     "failed.");
5468         }
5469         TALLOC_FREE(smbreq);
5470 }
5471
5472 /****************************************************************************
5473  Reply to a writeclose (Core+ protocol).
5474 ****************************************************************************/
5475
5476 void reply_writeclose(struct smb_request *req)
5477 {
5478         connection_struct *conn = req->conn;
5479         size_t numtowrite;
5480         ssize_t nwritten = -1;
5481         NTSTATUS close_status = NT_STATUS_OK;
5482         off_t startpos;
5483         const char *data;
5484         struct timespec mtime;
5485         files_struct *fsp;
5486         struct lock_struct lock;
5487
5488         START_PROFILE(SMBwriteclose);
5489
5490         if (req->wct < 6) {
5491                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5492                 END_PROFILE(SMBwriteclose);
5493                 return;
5494         }
5495
5496         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5497
5498         if (!check_fsp(conn, req, fsp)) {
5499                 END_PROFILE(SMBwriteclose);
5500                 return;
5501         }
5502         if (!CHECK_WRITE(fsp)) {
5503                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5504                 END_PROFILE(SMBwriteclose);
5505                 return;
5506         }
5507
5508         numtowrite = SVAL(req->vwv+1, 0);
5509         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5510         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5511         data = (const char *)req->buf + 1;
5512
5513         if (fsp->print_file == NULL) {
5514                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5515                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5516                     &lock);
5517
5518                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5519                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5520                         END_PROFILE(SMBwriteclose);
5521                         return;
5522                 }
5523         }
5524
5525         nwritten = write_file(req,fsp,data,startpos,numtowrite);
5526
5527         if (fsp->print_file == NULL) {
5528                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5529         }
5530
5531         set_close_write_time(fsp, mtime);
5532
5533         /*
5534          * More insanity. W2K only closes the file if writelen > 0.
5535          * JRA.
5536          */
5537
5538         DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5539                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5540                 (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
5541
5542         if (numtowrite) {
5543                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5544                          "file %s\n", fsp_str_dbg(fsp)));
5545                 close_status = close_file(req, fsp, NORMAL_CLOSE);
5546                 fsp = NULL;
5547         }
5548
5549         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5550                 reply_nterror(req, NT_STATUS_DISK_FULL);
5551                 goto out;
5552         }
5553
5554         if(!NT_STATUS_IS_OK(close_status)) {
5555                 reply_nterror(req, close_status);
5556                 goto out;
5557         }
5558
5559         reply_outbuf(req, 1, 0);
5560
5561         SSVAL(req->outbuf,smb_vwv0,nwritten);
5562
5563 out:
5564
5565         END_PROFILE(SMBwriteclose);
5566         return;
5567 }
5568
5569 #undef DBGC_CLASS
5570 #define DBGC_CLASS DBGC_LOCKING
5571
5572 /****************************************************************************
5573  Reply to a lock.
5574 ****************************************************************************/
5575
5576 void reply_lock(struct smb_request *req)
5577 {
5578         connection_struct *conn = req->conn;
5579         uint64_t count,offset;
5580         NTSTATUS status;
5581         files_struct *fsp;
5582         struct byte_range_lock *br_lck = NULL;
5583
5584         START_PROFILE(SMBlock);
5585
5586         if (req->wct < 5) {
5587                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5588                 END_PROFILE(SMBlock);
5589                 return;
5590         }
5591
5592         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5593
5594         if (!check_fsp(conn, req, fsp)) {
5595                 END_PROFILE(SMBlock);
5596                 return;
5597         }
5598
5599         count = (uint64_t)IVAL(req->vwv+1, 0);
5600         offset = (uint64_t)IVAL(req->vwv+3, 0);
5601
5602         DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5603                  fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5604
5605         br_lck = do_lock(req->sconn->msg_ctx,
5606                         fsp,
5607                         (uint64_t)req->smbpid,
5608                         count,
5609                         offset,
5610                         WRITE_LOCK,
5611                         WINDOWS_LOCK,
5612                         False, /* Non-blocking lock. */
5613                         &status,
5614                         NULL);
5615
5616         TALLOC_FREE(br_lck);
5617
5618         if (NT_STATUS_V(status)) {
5619                 reply_nterror(req, status);
5620                 END_PROFILE(SMBlock);
5621                 return;
5622         }
5623
5624         reply_outbuf(req, 0, 0);
5625
5626         END_PROFILE(SMBlock);
5627         return;
5628 }
5629
5630 /****************************************************************************
5631  Reply to a unlock.
5632 ****************************************************************************/
5633
5634 void reply_unlock(struct smb_request *req)
5635 {
5636         connection_struct *conn = req->conn;
5637         uint64_t count,offset;
5638         NTSTATUS status;
5639         files_struct *fsp;
5640
5641         START_PROFILE(SMBunlock);
5642
5643         if (req->wct < 5) {
5644                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5645                 END_PROFILE(SMBunlock);
5646                 return;
5647         }
5648
5649         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5650
5651         if (!check_fsp(conn, req, fsp)) {
5652                 END_PROFILE(SMBunlock);
5653                 return;
5654         }
5655
5656         count = (uint64_t)IVAL(req->vwv+1, 0);
5657         offset = (uint64_t)IVAL(req->vwv+3, 0);
5658
5659         status = do_unlock(req->sconn->msg_ctx,
5660                         fsp,
5661                         (uint64_t)req->smbpid,
5662                         count,
5663                         offset,
5664                         WINDOWS_LOCK);
5665
5666         if (NT_STATUS_V(status)) {
5667                 reply_nterror(req, status);
5668                 END_PROFILE(SMBunlock);
5669                 return;
5670         }
5671
5672         DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5673                     fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5674
5675         reply_outbuf(req, 0, 0);
5676
5677         END_PROFILE(SMBunlock);
5678         return;
5679 }
5680
5681 #undef DBGC_CLASS
5682 #define DBGC_CLASS DBGC_ALL
5683
5684 /****************************************************************************
5685  Reply to a tdis.
5686  conn POINTER CAN BE NULL HERE !
5687 ****************************************************************************/
5688
5689 void reply_tdis(struct smb_request *req)
5690 {
5691         NTSTATUS status;
5692         connection_struct *conn = req->conn;
5693         struct smbXsrv_tcon *tcon;
5694
5695         START_PROFILE(SMBtdis);
5696
5697         if (!conn) {
5698                 DEBUG(4,("Invalid connection in tdis\n"));
5699                 reply_force_doserror(req, ERRSRV, ERRinvnid);
5700                 END_PROFILE(SMBtdis);
5701                 return;
5702         }
5703
5704         tcon = conn->tcon;
5705         req->conn = NULL;
5706
5707         /*
5708          * TODO: cancel all outstanding requests on the tcon
5709          */
5710         status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5711         if (!NT_STATUS_IS_OK(status)) {
5712                 DEBUG(0, ("reply_tdis: "
5713                           "smbXsrv_tcon_disconnect() failed: %s\n",
5714                           nt_errstr(status)));
5715                 /*
5716                  * If we hit this case, there is something completely
5717                  * wrong, so we better disconnect the transport connection.
5718                  */
5719                 END_PROFILE(SMBtdis);
5720                 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5721                 return;
5722         }
5723
5724         TALLOC_FREE(tcon);
5725
5726         reply_outbuf(req, 0, 0);
5727         END_PROFILE(SMBtdis);
5728         return;
5729 }
5730
5731 /****************************************************************************
5732  Reply to a echo.
5733  conn POINTER CAN BE NULL HERE !
5734 ****************************************************************************/
5735
5736 void reply_echo(struct smb_request *req)
5737 {
5738         connection_struct *conn = req->conn;
5739         struct smb_perfcount_data local_pcd;
5740         struct smb_perfcount_data *cur_pcd;
5741         int smb_reverb;
5742         int seq_num;
5743
5744         START_PROFILE(SMBecho);
5745
5746         smb_init_perfcount_data(&local_pcd);
5747
5748         if (req->wct < 1) {
5749                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5750                 END_PROFILE(SMBecho);
5751                 return;
5752         }
5753
5754         smb_reverb = SVAL(req->vwv+0, 0);
5755
5756         reply_outbuf(req, 1, req->buflen);
5757
5758         /* copy any incoming data back out */
5759         if (req->buflen > 0) {
5760                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5761         }
5762
5763         if (smb_reverb > 100) {
5764                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5765                 smb_reverb = 100;
5766         }
5767
5768         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5769
5770                 /* this makes sure we catch the request pcd */
5771                 if (seq_num == smb_reverb) {
5772                         cur_pcd = &req->pcd;
5773                 } else {
5774                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5775                         cur_pcd = &local_pcd;
5776                 }
5777
5778                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5779
5780                 show_msg((char *)req->outbuf);
5781                 if (!srv_send_smb(req->xconn,
5782                                 (char *)req->outbuf,
5783                                 true, req->seqnum+1,
5784                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5785                                 cur_pcd))
5786                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5787         }
5788
5789         DEBUG(3,("echo %d times\n", smb_reverb));
5790
5791         TALLOC_FREE(req->outbuf);
5792
5793         END_PROFILE(SMBecho);
5794         return;
5795 }
5796
5797 /****************************************************************************
5798  Reply to a printopen.
5799 ****************************************************************************/
5800
5801 void reply_printopen(struct smb_request *req)
5802 {
5803         connection_struct *conn = req->conn;
5804         files_struct *fsp;
5805         NTSTATUS status;
5806
5807         START_PROFILE(SMBsplopen);
5808
5809         if (req->wct < 2) {
5810                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5811                 END_PROFILE(SMBsplopen);
5812                 return;
5813         }
5814
5815         if (!CAN_PRINT(conn)) {
5816                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5817                 END_PROFILE(SMBsplopen);
5818                 return;
5819         }
5820
5821         status = file_new(req, conn, &fsp);
5822         if(!NT_STATUS_IS_OK(status)) {
5823                 reply_nterror(req, status);
5824                 END_PROFILE(SMBsplopen);
5825                 return;
5826         }
5827
5828         /* Open for exclusive use, write only. */
5829         status = print_spool_open(fsp, NULL, req->vuid);
5830
5831         if (!NT_STATUS_IS_OK(status)) {
5832                 file_free(req, fsp);
5833                 reply_nterror(req, status);
5834                 END_PROFILE(SMBsplopen);
5835                 return;
5836         }
5837
5838         reply_outbuf(req, 1, 0);
5839         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5840
5841         DEBUG(3,("openprint fd=%d %s\n",
5842                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5843
5844         END_PROFILE(SMBsplopen);
5845         return;
5846 }
5847
5848 /****************************************************************************
5849  Reply to a printclose.
5850 ****************************************************************************/
5851
5852 void reply_printclose(struct smb_request *req)
5853 {
5854         connection_struct *conn = req->conn;
5855         files_struct *fsp;
5856         NTSTATUS status;
5857
5858         START_PROFILE(SMBsplclose);
5859
5860         if (req->wct < 1) {
5861                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5862                 END_PROFILE(SMBsplclose);
5863                 return;
5864         }
5865
5866         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5867
5868         if (!check_fsp(conn, req, fsp)) {
5869                 END_PROFILE(SMBsplclose);
5870                 return;
5871         }
5872
5873         if (!CAN_PRINT(conn)) {
5874                 reply_force_doserror(req, ERRSRV, ERRerror);
5875                 END_PROFILE(SMBsplclose);
5876                 return;
5877         }
5878
5879         DEBUG(3,("printclose fd=%d %s\n",
5880                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5881
5882         status = close_file(req, fsp, NORMAL_CLOSE);
5883
5884         if(!NT_STATUS_IS_OK(status)) {
5885                 reply_nterror(req, status);
5886                 END_PROFILE(SMBsplclose);
5887                 return;
5888         }
5889
5890         reply_outbuf(req, 0, 0);
5891
5892         END_PROFILE(SMBsplclose);
5893         return;
5894 }
5895
5896 /****************************************************************************
5897  Reply to a printqueue.
5898 ****************************************************************************/
5899
5900 void reply_printqueue(struct smb_request *req)
5901 {
5902         connection_struct *conn = req->conn;
5903         int max_count;
5904         int start_index;
5905
5906         START_PROFILE(SMBsplretq);
5907
5908         if (req->wct < 2) {
5909                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5910                 END_PROFILE(SMBsplretq);
5911                 return;
5912         }
5913
5914         max_count = SVAL(req->vwv+0, 0);
5915         start_index = SVAL(req->vwv+1, 0);
5916
5917         /* we used to allow the client to get the cnum wrong, but that
5918            is really quite gross and only worked when there was only
5919            one printer - I think we should now only accept it if they
5920            get it right (tridge) */
5921         if (!CAN_PRINT(conn)) {
5922                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5923                 END_PROFILE(SMBsplretq);
5924                 return;
5925         }
5926
5927         reply_outbuf(req, 2, 3);
5928         SSVAL(req->outbuf,smb_vwv0,0);
5929         SSVAL(req->outbuf,smb_vwv1,0);
5930         SCVAL(smb_buf(req->outbuf),0,1);
5931         SSVAL(smb_buf(req->outbuf),1,0);
5932
5933         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5934                  start_index, max_count));
5935
5936         {
5937                 TALLOC_CTX *mem_ctx = talloc_tos();
5938                 NTSTATUS status;
5939                 WERROR werr;
5940                 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5941                 struct rpc_pipe_client *cli = NULL;
5942                 struct dcerpc_binding_handle *b = NULL;
5943                 struct policy_handle handle;
5944                 struct spoolss_DevmodeContainer devmode_ctr;
5945                 union spoolss_JobInfo *info;
5946                 uint32_t count;
5947                 uint32_t num_to_get;
5948                 uint32_t first;
5949                 uint32_t i;
5950
5951                 ZERO_STRUCT(handle);
5952
5953                 status = rpc_pipe_open_interface(conn,
5954                                                  &ndr_table_spoolss,
5955                                                  conn->session_info,
5956                                                  conn->sconn->remote_address,
5957                                                  conn->sconn->msg_ctx,
5958                                                  &cli);
5959                 if (!NT_STATUS_IS_OK(status)) {
5960                         DEBUG(0, ("reply_printqueue: "
5961                                   "could not connect to spoolss: %s\n",
5962                                   nt_errstr(status)));
5963                         reply_nterror(req, status);
5964                         goto out;
5965                 }
5966                 b = cli->binding_handle;
5967
5968                 ZERO_STRUCT(devmode_ctr);
5969
5970                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5971                                                 sharename,
5972                                                 NULL, devmode_ctr,
5973                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5974                                                 &handle,
5975                                                 &werr);
5976                 if (!NT_STATUS_IS_OK(status)) {
5977                         reply_nterror(req, status);
5978                         goto out;
5979                 }
5980                 if (!W_ERROR_IS_OK(werr)) {
5981                         reply_nterror(req, werror_to_ntstatus(werr));
5982                         goto out;
5983                 }
5984
5985                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5986                                                &handle,
5987                                                0, /* firstjob */
5988                                                0xff, /* numjobs */
5989                                                2, /* level */
5990                                                0, /* offered */
5991                                                &count,
5992                                                &info);
5993                 if (!W_ERROR_IS_OK(werr)) {
5994                         reply_nterror(req, werror_to_ntstatus(werr));
5995                         goto out;
5996                 }
5997
5998                 if (max_count > 0) {
5999                         first = start_index;
6000                 } else {
6001                         first = start_index + max_count + 1;
6002                 }
6003
6004                 if (first >= count) {
6005                         num_to_get = first;
6006                 } else {
6007                         num_to_get = first + MIN(ABS(max_count), count - first);
6008                 }
6009
6010                 for (i = first; i < num_to_get; i++) {
6011                         char blob[28];
6012                         char *p = blob;
6013                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
6014                         int qstatus;
6015                         size_t len = 0;
6016                         uint16_t qrapjobid = pjobid_to_rap(sharename,
6017                                                         info[i].info2.job_id);
6018
6019                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
6020                                 qstatus = 2;
6021                         } else {
6022                                 qstatus = 3;
6023                         }
6024
6025                         srv_put_dos_date2(p, 0, qtime);
6026                         SCVAL(p, 4, qstatus);
6027                         SSVAL(p, 5, qrapjobid);
6028                         SIVAL(p, 7, info[i].info2.size);
6029                         SCVAL(p, 11, 0);
6030                         status = srvstr_push(blob, req->flags2, p+12,
6031                                     info[i].info2.notify_name, 16, STR_ASCII, &len);
6032                         if (!NT_STATUS_IS_OK(status)) {
6033                                 reply_nterror(req, status);
6034                                 goto out;
6035                         }
6036                         if (message_push_blob(
6037                                     &req->outbuf,
6038                                     data_blob_const(
6039                                             blob, sizeof(blob))) == -1) {
6040                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6041                                 goto out;
6042                         }
6043                 }
6044
6045                 if (count > 0) {
6046                         SSVAL(req->outbuf,smb_vwv0,count);
6047                         SSVAL(req->outbuf,smb_vwv1,
6048                               (max_count>0?first+count:first-1));
6049                         SCVAL(smb_buf(req->outbuf),0,1);
6050                         SSVAL(smb_buf(req->outbuf),1,28*count);
6051                 }
6052
6053
6054                 DEBUG(3, ("%u entries returned in queue\n",
6055                           (unsigned)count));
6056
6057 out:
6058                 if (b && is_valid_policy_hnd(&handle)) {
6059                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
6060                 }
6061
6062         }
6063
6064         END_PROFILE(SMBsplretq);
6065         return;
6066 }
6067
6068 /****************************************************************************
6069  Reply to a printwrite.
6070 ****************************************************************************/
6071
6072 void reply_printwrite(struct smb_request *req)
6073 {
6074         connection_struct *conn = req->conn;
6075         int numtowrite;
6076         const char *data;
6077         files_struct *fsp;
6078
6079         START_PROFILE(SMBsplwr);
6080
6081         if (req->wct < 1) {
6082                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6083                 END_PROFILE(SMBsplwr);
6084                 return;
6085         }
6086
6087         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
6088
6089         if (!check_fsp(conn, req, fsp)) {
6090                 END_PROFILE(SMBsplwr);
6091                 return;
6092         }
6093
6094         if (!fsp->print_file) {
6095                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
6096                 END_PROFILE(SMBsplwr);
6097                 return;
6098         }
6099
6100         if (!CHECK_WRITE(fsp)) {
6101                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
6102                 END_PROFILE(SMBsplwr);
6103                 return;
6104         }
6105
6106         numtowrite = SVAL(req->buf, 1);
6107
6108         if (req->buflen < numtowrite + 3) {
6109                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6110                 END_PROFILE(SMBsplwr);
6111                 return;
6112         }
6113
6114         data = (const char *)req->buf + 3;
6115
6116         if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
6117                 reply_nterror(req, map_nt_error_from_unix(errno));
6118                 END_PROFILE(SMBsplwr);
6119                 return;
6120         }
6121
6122         DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
6123
6124         END_PROFILE(SMBsplwr);
6125         return;
6126 }
6127
6128 /****************************************************************************
6129  Reply to a mkdir.
6130 ****************************************************************************/
6131
6132 void reply_mkdir(struct smb_request *req)
6133 {
6134         connection_struct *conn = req->conn;
6135         struct smb_filename *smb_dname = NULL;
6136         char *directory = NULL;
6137         NTSTATUS status;
6138         uint32_t ucf_flags;
6139         TALLOC_CTX *ctx = talloc_tos();
6140
6141         START_PROFILE(SMBmkdir);
6142
6143         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
6144                             STR_TERMINATE, &status);
6145         if (!NT_STATUS_IS_OK(status)) {
6146                 reply_nterror(req, status);
6147                 goto out;
6148         }
6149
6150         ucf_flags = filename_create_ucf_flags(req, FILE_CREATE);
6151         status = filename_convert(ctx, conn,
6152                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
6153                                  directory,
6154                                  ucf_flags,
6155                                  NULL,
6156                                  &smb_dname);
6157         if (!NT_STATUS_IS_OK(status)) {
6158                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6159                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6160                                         ERRSRV, ERRbadpath);
6161                         goto out;
6162                 }
6163                 reply_nterror(req, status);
6164                 goto out;
6165         }
6166
6167         status = create_directory(conn, req, smb_dname);
6168
6169         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
6170
6171         if (!NT_STATUS_IS_OK(status)) {
6172
6173                 if (!use_nt_status()
6174                     && NT_STATUS_EQUAL(status,
6175                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
6176                         /*
6177                          * Yes, in the DOS error code case we get a
6178                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
6179                          * samba4 torture test.
6180                          */
6181                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
6182                 }
6183
6184                 reply_nterror(req, status);
6185                 goto out;
6186         }
6187
6188         reply_outbuf(req, 0, 0);
6189
6190         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
6191  out:
6192         TALLOC_FREE(smb_dname);
6193         END_PROFILE(SMBmkdir);
6194         return;
6195 }
6196
6197 /****************************************************************************
6198  Reply to a rmdir.
6199 ****************************************************************************/
6200
6201 void reply_rmdir(struct smb_request *req)
6202 {
6203         connection_struct *conn = req->conn;
6204         struct smb_filename *smb_dname = NULL;
6205         char *directory = NULL;
6206         NTSTATUS status;
6207         TALLOC_CTX *ctx = talloc_tos();
6208         files_struct *fsp = NULL;
6209         int info = 0;
6210         uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
6211         struct smbd_server_connection *sconn = req->sconn;
6212
6213         START_PROFILE(SMBrmdir);
6214
6215         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
6216                             STR_TERMINATE, &status);
6217         if (!NT_STATUS_IS_OK(status)) {
6218                 reply_nterror(req, status);
6219                 goto out;
6220         }
6221
6222         status = filename_convert(ctx, conn,
6223                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
6224                                  directory,
6225                                  ucf_flags,
6226                                  NULL,
6227                                  &smb_dname);
6228         if (!NT_STATUS_IS_OK(status)) {
6229                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6230                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6231                                         ERRSRV, ERRbadpath);
6232                         goto out;
6233                 }
6234                 reply_nterror(req, status);
6235                 goto out;
6236         }
6237
6238         if (is_ntfs_stream_smb_fname(smb_dname)) {
6239                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
6240                 goto out;
6241         }
6242
6243         status = SMB_VFS_CREATE_FILE(
6244                 conn,                                   /* conn */
6245                 req,                                    /* req */
6246                 0,                                      /* root_dir_fid */
6247                 smb_dname,                              /* fname */
6248                 DELETE_ACCESS,                          /* access_mask */
6249                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
6250                         FILE_SHARE_DELETE),
6251                 FILE_OPEN,                              /* create_disposition*/
6252                 FILE_DIRECTORY_FILE,                    /* create_options */
6253                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
6254                 0,                                      /* oplock_request */
6255                 NULL,                                   /* lease */
6256                 0,                                      /* allocation_size */
6257                 0,                                      /* private_flags */
6258                 NULL,                                   /* sd */
6259                 NULL,                                   /* ea_list */
6260                 &fsp,                                   /* result */
6261                 &info,                                  /* pinfo */
6262                 NULL, NULL);                            /* create context */
6263
6264         if (!NT_STATUS_IS_OK(status)) {
6265                 if (open_was_deferred(req->xconn, req->mid)) {
6266                         /* We have re-scheduled this call. */
6267                         goto out;
6268                 }
6269                 reply_nterror(req, status);
6270                 goto out;
6271         }
6272
6273         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
6274         if (!NT_STATUS_IS_OK(status)) {
6275                 close_file(req, fsp, ERROR_CLOSE);
6276                 reply_nterror(req, status);
6277                 goto out;
6278         }
6279
6280         if (!set_delete_on_close(fsp, true,
6281                         conn->session_info->security_token,
6282                         conn->session_info->unix_token)) {
6283                 close_file(req, fsp, ERROR_CLOSE);
6284                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
6285                 goto out;
6286         }
6287
6288         status = close_file(req, fsp, NORMAL_CLOSE);
6289         if (!NT_STATUS_IS_OK(status)) {
6290                 reply_nterror(req, status);
6291         } else {
6292                 reply_outbuf(req, 0, 0);
6293         }
6294
6295         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
6296
6297         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
6298  out:
6299         TALLOC_FREE(smb_dname);
6300         END_PROFILE(SMBrmdir);
6301         return;
6302 }
6303
6304 /*******************************************************************
6305  Resolve wildcards in a filename rename.
6306 ********************************************************************/
6307
6308 static bool resolve_wildcards(TALLOC_CTX *ctx,
6309                                 const char *name1,
6310                                 const char *name2,
6311                                 char **pp_newname)
6312 {
6313         char *name2_copy = NULL;
6314         char *root1 = NULL;
6315         char *root2 = NULL;
6316         char *ext1 = NULL;
6317         char *ext2 = NULL;
6318         char *p,*p2, *pname1, *pname2;
6319
6320         name2_copy = talloc_strdup(ctx, name2);
6321         if (!name2_copy) {
6322                 return False;
6323         }
6324
6325         pname1 = strrchr_m(name1,'/');
6326         pname2 = strrchr_m(name2_copy,'/');
6327
6328         if (!pname1 || !pname2) {
6329                 return False;
6330         }
6331
6332         /* Truncate the copy of name2 at the last '/' */
6333         *pname2 = '\0';
6334
6335         /* Now go past the '/' */
6336         pname1++;
6337         pname2++;
6338
6339         root1 = talloc_strdup(ctx, pname1);
6340         root2 = talloc_strdup(ctx, pname2);
6341
6342         if (!root1 || !root2) {
6343                 return False;
6344         }
6345
6346         p = strrchr_m(root1,'.');
6347         if (p) {
6348                 *p = 0;
6349                 ext1 = talloc_strdup(ctx, p+1);
6350         } else {
6351                 ext1 = talloc_strdup(ctx, "");
6352         }
6353         p = strrchr_m(root2,'.');
6354         if (p) {
6355                 *p = 0;
6356                 ext2 = talloc_strdup(ctx, p+1);
6357         } else {
6358                 ext2 = talloc_strdup(ctx, "");
6359         }
6360
6361         if (!ext1 || !ext2) {
6362                 return False;
6363         }
6364
6365         p = root1;
6366         p2 = root2;
6367         while (*p2) {
6368                 if (*p2 == '?') {
6369                         /* Hmmm. Should this be mb-aware ? */
6370                         *p2 = *p;
6371                         p2++;
6372                 } else if (*p2 == '*') {
6373                         *p2 = '\0';
6374                         root2 = talloc_asprintf(ctx, "%s%s",
6375                                                 root2,
6376                                                 p);
6377                         if (!root2) {
6378                                 return False;
6379                         }
6380                         break;
6381                 } else {
6382                         p2++;
6383                 }
6384                 if (*p) {
6385                         p++;
6386                 }
6387         }
6388
6389         p = ext1;
6390         p2 = ext2;
6391         while (*p2) {
6392                 if (*p2 == '?') {
6393                         /* Hmmm. Should this be mb-aware ? */
6394                         *p2 = *p;
6395                         p2++;
6396                 } else if (*p2 == '*') {
6397                         *p2 = '\0';
6398                         ext2 = talloc_asprintf(ctx, "%s%s",
6399                                                 ext2,
6400                                                 p);
6401                         if (!ext2) {
6402                                 return False;
6403                         }
6404                         break;
6405                 } else {
6406                         p2++;
6407                 }
6408                 if (*p) {
6409                         p++;
6410                 }
6411         }
6412
6413         if (*ext2) {
6414                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6415                                 name2_copy,
6416                                 root2,
6417                                 ext2);
6418         } else {
6419                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6420                                 name2_copy,
6421                                 root2);
6422         }
6423
6424         if (!*pp_newname) {
6425                 return False;
6426         }
6427
6428         return True;
6429 }
6430
6431 /****************************************************************************
6432  Ensure open files have their names updated. Updated to notify other smbd's
6433  asynchronously.
6434 ****************************************************************************/
6435
6436 static void rename_open_files(connection_struct *conn,
6437                               struct share_mode_lock *lck,
6438                               struct file_id id,
6439                               uint32_t orig_name_hash,
6440                               const struct smb_filename *smb_fname_dst)
6441 {
6442         files_struct *fsp;
6443         bool did_rename = False;
6444         NTSTATUS status;
6445         uint32_t new_name_hash = 0;
6446
6447         for(fsp = file_find_di_first(conn->sconn, id); fsp;
6448             fsp = file_find_di_next(fsp)) {
6449                 /* fsp_name is a relative path under the fsp. To change this for other
6450                    sharepaths we need to manipulate relative paths. */
6451                 /* TODO - create the absolute path and manipulate the newname
6452                    relative to the sharepath. */
6453                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6454                         continue;
6455                 }
6456                 if (fsp->name_hash != orig_name_hash) {
6457                         continue;
6458                 }
6459                 DEBUG(10, ("rename_open_files: renaming file %s "
6460                            "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6461                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6462                            smb_fname_str_dbg(smb_fname_dst)));
6463
6464                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6465                 if (NT_STATUS_IS_OK(status)) {
6466                         did_rename = True;
6467                         new_name_hash = fsp->name_hash;
6468                 }
6469         }
6470
6471         if (!did_rename) {
6472                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6473                            "for %s\n", file_id_string_tos(&id),
6474                            smb_fname_str_dbg(smb_fname_dst)));
6475         }
6476
6477         /* Send messages to all smbd's (not ourself) that the name has changed. */
6478         rename_share_filename(conn->sconn->msg_ctx, lck, id, conn->connectpath,
6479                               orig_name_hash, new_name_hash,
6480                               smb_fname_dst);
6481
6482 }
6483
6484 /****************************************************************************
6485  We need to check if the source path is a parent directory of the destination
6486  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6487  refuse the rename with a sharing violation. Under UNIX the above call can
6488  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6489  probably need to check that the client is a Windows one before disallowing
6490  this as a UNIX client (one with UNIX extensions) can know the source is a
6491  symlink and make this decision intelligently. Found by an excellent bug
6492  report from <AndyLiebman@aol.com>.
6493 ****************************************************************************/
6494
6495 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6496                                      const struct smb_filename *smb_fname_dst)
6497 {
6498         const char *psrc = smb_fname_src->base_name;
6499         const char *pdst = smb_fname_dst->base_name;
6500         size_t slen;
6501
6502         if (psrc[0] == '.' && psrc[1] == '/') {
6503                 psrc += 2;
6504         }
6505         if (pdst[0] == '.' && pdst[1] == '/') {
6506                 pdst += 2;
6507         }
6508         if ((slen = strlen(psrc)) > strlen(pdst)) {
6509                 return False;
6510         }
6511         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6512 }
6513
6514 /*
6515  * Do the notify calls from a rename
6516  */
6517
6518 static void notify_rename(connection_struct *conn, bool is_dir,
6519                           const struct smb_filename *smb_fname_src,
6520                           const struct smb_filename *smb_fname_dst)
6521 {
6522         char *parent_dir_src = NULL;
6523         char *parent_dir_dst = NULL;
6524         uint32_t mask;
6525
6526         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6527                 : FILE_NOTIFY_CHANGE_FILE_NAME;
6528
6529         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6530                             &parent_dir_src, NULL) ||
6531             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6532                             &parent_dir_dst, NULL)) {
6533                 goto out;
6534         }
6535
6536         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6537                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6538                              smb_fname_src->base_name);
6539                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6540                              smb_fname_dst->base_name);
6541         }
6542         else {
6543                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6544                              smb_fname_src->base_name);
6545                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6546                              smb_fname_dst->base_name);
6547         }
6548
6549         /* this is a strange one. w2k3 gives an additional event for
6550            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6551            files, but not directories */
6552         if (!is_dir) {
6553                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6554                              FILE_NOTIFY_CHANGE_ATTRIBUTES
6555                              |FILE_NOTIFY_CHANGE_CREATION,
6556                              smb_fname_dst->base_name);
6557         }
6558  out:
6559         TALLOC_FREE(parent_dir_src);
6560         TALLOC_FREE(parent_dir_dst);
6561 }
6562
6563 /****************************************************************************
6564  Returns an error if the parent directory for a filename is open in an
6565  incompatible way.
6566 ****************************************************************************/
6567
6568 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6569                                         const struct smb_filename *smb_fname_dst_in)
6570 {
6571         char *parent_dir = NULL;
6572         struct smb_filename smb_fname_parent;
6573         struct file_id id;
6574         files_struct *fsp = NULL;
6575         int ret;
6576
6577         if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6578                         &parent_dir, NULL)) {
6579                 return NT_STATUS_NO_MEMORY;
6580         }
6581         ZERO_STRUCT(smb_fname_parent);
6582         smb_fname_parent.base_name = parent_dir;
6583
6584         ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6585         if (ret == -1) {
6586                 return map_nt_error_from_unix(errno);
6587         }
6588
6589         /*
6590          * We're only checking on this smbd here, mostly good
6591          * enough.. and will pass tests.
6592          */
6593
6594         id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6595         for (fsp = file_find_di_first(conn->sconn, id); fsp;
6596                         fsp = file_find_di_next(fsp)) {
6597                 if (fsp->access_mask & DELETE_ACCESS) {
6598                         return NT_STATUS_SHARING_VIOLATION;
6599                 }
6600         }
6601         return NT_STATUS_OK;
6602 }
6603
6604 /****************************************************************************
6605  Rename an open file - given an fsp.
6606 ****************************************************************************/
6607
6608 NTSTATUS rename_internals_fsp(connection_struct *conn,
6609                         files_struct *fsp,
6610                         const struct smb_filename *smb_fname_dst_in,
6611                         uint32_t attrs,
6612                         bool replace_if_exists)
6613 {
6614         TALLOC_CTX *ctx = talloc_tos();
6615         struct smb_filename *smb_fname_dst = NULL;
6616         NTSTATUS status = NT_STATUS_OK;
6617         struct share_mode_lock *lck = NULL;
6618         uint32_t access_mask = SEC_DIR_ADD_FILE;
6619         bool dst_exists, old_is_stream, new_is_stream;
6620
6621         status = check_name(conn, smb_fname_dst_in->base_name);
6622         if (!NT_STATUS_IS_OK(status)) {
6623                 return status;
6624         }
6625
6626         status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6627         if (!NT_STATUS_IS_OK(status)) {
6628                 return status;
6629         }
6630
6631         /* Make a copy of the dst smb_fname structs */
6632
6633         smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6634         if (smb_fname_dst == NULL) {
6635                 status = NT_STATUS_NO_MEMORY;
6636                 goto out;
6637         }
6638
6639         /*
6640          * Check for special case with case preserving and not
6641          * case sensitive. If the new last component differs from the original
6642          * last component only by case, then we should allow
6643          * the rename (user is trying to change the case of the
6644          * filename).
6645          */
6646         if (!conn->case_sensitive && conn->case_preserve &&
6647             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6648             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6649                 char *fname_dst_parent = NULL;
6650                 const char *fname_dst_lcomp = NULL;
6651                 char *orig_lcomp_path = NULL;
6652                 char *orig_lcomp_stream = NULL;
6653                 bool ok = true;
6654
6655                 /*
6656                  * Split off the last component of the processed
6657                  * destination name. We will compare this to
6658                  * the split components of smb_fname_dst->original_lcomp.
6659                  */
6660                 if (!parent_dirname(ctx,
6661                                 smb_fname_dst->base_name,
6662                                 &fname_dst_parent,
6663                                 &fname_dst_lcomp)) {
6664                         status = NT_STATUS_NO_MEMORY;
6665                         goto out;
6666                 }
6667
6668                 /*
6669                  * The original_lcomp component contains
6670                  * the last_component of the path + stream
6671                  * name (if a stream exists).
6672                  *
6673                  * Split off the stream name so we
6674                  * can check them separately.
6675                  */
6676
6677                 if (fsp->posix_flags & FSP_POSIX_FLAGS_PATHNAMES) {
6678                         /* POSIX - no stream component. */
6679                         orig_lcomp_path = talloc_strdup(ctx,
6680                                                 smb_fname_dst->original_lcomp);
6681                         if (orig_lcomp_path == NULL) {
6682                                 ok = false;
6683                         }
6684                 } else {
6685                         ok = split_stream_filename(ctx,
6686                                         smb_fname_dst->original_lcomp,
6687                                         &orig_lcomp_path,
6688                                         &orig_lcomp_stream);
6689                 }
6690
6691                 if (!ok) {
6692                         TALLOC_FREE(fname_dst_parent);
6693                         status = NT_STATUS_NO_MEMORY;
6694                         goto out;
6695                 }
6696
6697                 /* If the base names only differ by case, use original. */
6698                 if(!strcsequal(fname_dst_lcomp, orig_lcomp_path)) {
6699                         char *tmp;
6700                         /*
6701                          * Replace the modified last component with the
6702                          * original.
6703                          */
6704                         if (!ISDOT(fname_dst_parent)) {
6705                                 tmp = talloc_asprintf(smb_fname_dst,
6706                                         "%s/%s",
6707                                         fname_dst_parent,
6708                                         orig_lcomp_path);
6709                         } else {
6710                                 tmp = talloc_strdup(smb_fname_dst,
6711                                         orig_lcomp_path);
6712                         }
6713                         if (tmp == NULL) {
6714                                 status = NT_STATUS_NO_MEMORY;
6715                                 TALLOC_FREE(fname_dst_parent);
6716                                 TALLOC_FREE(orig_lcomp_path);
6717                                 TALLOC_FREE(orig_lcomp_stream);
6718                                 goto out;
6719                         }
6720                         TALLOC_FREE(smb_fname_dst->base_name);
6721                         smb_fname_dst->base_name = tmp;
6722                 }
6723
6724                 /* If the stream_names only differ by case, use original. */
6725                 if(!strcsequal(smb_fname_dst->stream_name,
6726                                orig_lcomp_stream)) {
6727                         /* Use the original stream. */
6728                         char *tmp = talloc_strdup(smb_fname_dst,
6729                                             orig_lcomp_stream);
6730                         if (tmp == NULL) {
6731                                 status = NT_STATUS_NO_MEMORY;
6732                                 TALLOC_FREE(fname_dst_parent);
6733                                 TALLOC_FREE(orig_lcomp_path);
6734                                 TALLOC_FREE(orig_lcomp_stream);
6735                                 goto out;
6736                         }
6737                         TALLOC_FREE(smb_fname_dst->stream_name);
6738                         smb_fname_dst->stream_name = tmp;
6739                 }
6740                 TALLOC_FREE(fname_dst_parent);
6741                 TALLOC_FREE(orig_lcomp_path);
6742                 TALLOC_FREE(orig_lcomp_stream);
6743         }
6744
6745         /*
6746          * If the src and dest names are identical - including case,
6747          * don't do the rename, just return success.
6748          */
6749
6750         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6751             strcsequal(fsp->fsp_name->stream_name,
6752                        smb_fname_dst->stream_name)) {
6753                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6754                           "- returning success\n",
6755                           smb_fname_str_dbg(smb_fname_dst)));
6756                 status = NT_STATUS_OK;
6757                 goto out;
6758         }
6759
6760         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6761         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6762
6763         /* Return the correct error code if both names aren't streams. */
6764         if (!old_is_stream && new_is_stream) {
6765                 status = NT_STATUS_OBJECT_NAME_INVALID;
6766                 goto out;
6767         }
6768
6769         if (old_is_stream && !new_is_stream) {
6770                 status = NT_STATUS_INVALID_PARAMETER;
6771                 goto out;
6772         }
6773
6774         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6775
6776         if(!replace_if_exists && dst_exists) {
6777                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6778                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6779                           smb_fname_str_dbg(smb_fname_dst)));
6780                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6781                 goto out;
6782         }
6783
6784         if (dst_exists) {
6785                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6786                     &smb_fname_dst->st);
6787                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6788                                                            fileid);
6789                 /* The file can be open when renaming a stream */
6790                 if (dst_fsp && !new_is_stream) {
6791                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6792                         status = NT_STATUS_ACCESS_DENIED;
6793                         goto out;
6794                 }
6795         }
6796
6797         /* Ensure we have a valid stat struct for the source. */
6798         status = vfs_stat_fsp(fsp);
6799         if (!NT_STATUS_IS_OK(status)) {
6800                 goto out;
6801         }
6802
6803         status = can_rename(conn, fsp, attrs);
6804
6805         if (!NT_STATUS_IS_OK(status)) {
6806                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6807                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6808                           smb_fname_str_dbg(smb_fname_dst)));
6809                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6810                         status = NT_STATUS_ACCESS_DENIED;
6811                 goto out;
6812         }
6813
6814         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6815                 status = NT_STATUS_ACCESS_DENIED;
6816                 goto out;
6817         }
6818
6819         /* Do we have rights to move into the destination ? */
6820         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
6821                 /* We're moving a directory. */
6822                 access_mask = SEC_DIR_ADD_SUBDIR;
6823         }
6824         status = check_parent_access(conn,
6825                                 smb_fname_dst,
6826                                 access_mask);
6827         if (!NT_STATUS_IS_OK(status)) {
6828                 DBG_INFO("check_parent_access on "
6829                         "dst %s returned %s\n",
6830                         smb_fname_str_dbg(smb_fname_dst),
6831                         nt_errstr(status));
6832                 goto out;
6833         }
6834
6835         lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6836
6837         /*
6838          * We have the file open ourselves, so not being able to get the
6839          * corresponding share mode lock is a fatal error.
6840          */
6841
6842         SMB_ASSERT(lck != NULL);
6843
6844         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6845                 uint32_t create_options = fsp->fh->private_options;
6846
6847                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6848                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6849                           smb_fname_str_dbg(smb_fname_dst)));
6850
6851                 if (!fsp->is_directory &&
6852                     !(fsp->posix_flags & FSP_POSIX_FLAGS_PATHNAMES) &&
6853                     (lp_map_archive(SNUM(conn)) ||
6854                     lp_store_dos_attributes(SNUM(conn)))) {
6855                         /* We must set the archive bit on the newly
6856                            renamed file. */
6857                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6858                                 uint32_t old_dosmode = dos_mode(conn,
6859                                                         smb_fname_dst);
6860                                 file_set_dosmode(conn,
6861                                         smb_fname_dst,
6862                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6863                                         NULL,
6864                                         true);
6865                         }
6866                 }
6867
6868                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6869                               smb_fname_dst);
6870
6871                 rename_open_files(conn, lck, fsp->file_id, fsp->name_hash,
6872                                   smb_fname_dst);
6873
6874                 /*
6875                  * A rename acts as a new file create w.r.t. allowing an initial delete
6876                  * on close, probably because in Windows there is a new handle to the
6877                  * new file. If initial delete on close was requested but not
6878                  * originally set, we need to set it here. This is probably not 100% correct,
6879                  * but will work for the CIFSFS client which in non-posix mode
6880                  * depends on these semantics. JRA.
6881                  */
6882
6883                 if (create_options & FILE_DELETE_ON_CLOSE) {
6884                         status = can_set_delete_on_close(fsp, 0);
6885
6886                         if (NT_STATUS_IS_OK(status)) {
6887                                 /* Note that here we set the *inital* delete on close flag,
6888                                  * not the regular one. The magic gets handled in close. */
6889                                 fsp->initial_delete_on_close = True;
6890                         }
6891                 }
6892                 TALLOC_FREE(lck);
6893                 status = NT_STATUS_OK;
6894                 goto out;
6895         }
6896
6897         TALLOC_FREE(lck);
6898
6899         if (errno == ENOTDIR || errno == EISDIR) {
6900                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6901         } else {
6902                 status = map_nt_error_from_unix(errno);
6903         }
6904
6905         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6906                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6907                   smb_fname_str_dbg(smb_fname_dst)));
6908
6909  out:
6910         TALLOC_FREE(smb_fname_dst);
6911
6912         return status;
6913 }
6914
6915 /****************************************************************************
6916  The guts of the rename command, split out so it may be called by the NT SMB
6917  code.
6918 ****************************************************************************/
6919
6920 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6921                         connection_struct *conn,
6922                         struct smb_request *req,
6923                         struct smb_filename *smb_fname_src,
6924                         struct smb_filename *smb_fname_dst,
6925                         uint32_t attrs,
6926                         bool replace_if_exists,
6927                         bool src_has_wild,
6928                         bool dest_has_wild,
6929                         uint32_t access_mask)
6930 {
6931         char *fname_src_dir = NULL;
6932         struct smb_filename *smb_fname_src_dir = NULL;
6933         char *fname_src_mask = NULL;
6934         int count=0;
6935         NTSTATUS status = NT_STATUS_OK;
6936         struct smb_Dir *dir_hnd = NULL;
6937         const char *dname = NULL;
6938         char *talloced = NULL;
6939         long offset = 0;
6940         int create_options = 0;
6941         bool posix_pathnames = (req != NULL && req->posix_pathnames);
6942         int rc;
6943
6944         /*
6945          * Split the old name into directory and last component
6946          * strings. Note that unix_convert may have stripped off a
6947          * leading ./ from both name and newname if the rename is
6948          * at the root of the share. We need to make sure either both
6949          * name and newname contain a / character or neither of them do
6950          * as this is checked in resolve_wildcards().
6951          */
6952
6953         /* Split up the directory from the filename/mask. */
6954         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6955                                       &fname_src_dir, &fname_src_mask);
6956         if (!NT_STATUS_IS_OK(status)) {
6957                 status = NT_STATUS_NO_MEMORY;
6958                 goto out;
6959         }
6960
6961         /*
6962          * We should only check the mangled cache
6963          * here if unix_convert failed. This means
6964          * that the path in 'mask' doesn't exist
6965          * on the file system and so we need to look
6966          * for a possible mangle. This patch from
6967          * Tine Smukavec <valentin.smukavec@hermes.si>.
6968          */
6969
6970         if (!VALID_STAT(smb_fname_src->st) &&
6971             mangle_is_mangled(fname_src_mask, conn->params)) {
6972                 char *new_mask = NULL;
6973                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6974                                             conn->params);
6975                 if (new_mask) {
6976                         TALLOC_FREE(fname_src_mask);
6977                         fname_src_mask = new_mask;
6978                 }
6979         }
6980
6981         if (!src_has_wild) {
6982                 files_struct *fsp;
6983
6984                 /*
6985                  * Only one file needs to be renamed. Append the mask back
6986                  * onto the directory.
6987                  */
6988                 TALLOC_FREE(smb_fname_src->base_name);
6989                 if (ISDOT(fname_src_dir)) {
6990                         /* Ensure we use canonical names on open. */
6991                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6992                                                         "%s",
6993                                                         fname_src_mask);
6994                 } else {
6995                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6996                                                         "%s/%s",
6997                                                         fname_src_dir,
6998                                                         fname_src_mask);
6999                 }
7000                 if (!smb_fname_src->base_name) {
7001                         status = NT_STATUS_NO_MEMORY;
7002                         goto out;
7003                 }
7004
7005                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
7006                           "case_preserve = %d, short case preserve = %d, "
7007                           "directory = %s, newname = %s, "
7008                           "last_component_dest = %s\n",
7009                           conn->case_sensitive, conn->case_preserve,
7010                           conn->short_case_preserve,
7011                           smb_fname_str_dbg(smb_fname_src),
7012                           smb_fname_str_dbg(smb_fname_dst),
7013                           smb_fname_dst->original_lcomp));
7014
7015                 /* The dest name still may have wildcards. */
7016                 if (dest_has_wild) {
7017                         char *fname_dst_mod = NULL;
7018                         if (!resolve_wildcards(smb_fname_dst,
7019                                                smb_fname_src->base_name,
7020                                                smb_fname_dst->base_name,
7021                                                &fname_dst_mod)) {
7022                                 DEBUG(6, ("rename_internals: resolve_wildcards "
7023                                           "%s %s failed\n",
7024                                           smb_fname_src->base_name,
7025                                           smb_fname_dst->base_name));
7026                                 status = NT_STATUS_NO_MEMORY;
7027                                 goto out;
7028                         }
7029                         TALLOC_FREE(smb_fname_dst->base_name);
7030                         smb_fname_dst->base_name = fname_dst_mod;
7031                 }
7032
7033                 ZERO_STRUCT(smb_fname_src->st);
7034                 if (posix_pathnames) {
7035                         rc = SMB_VFS_LSTAT(conn, smb_fname_src);
7036                 } else {
7037                         rc = SMB_VFS_STAT(conn, smb_fname_src);
7038                 }
7039                 if (rc == -1) {
7040                         status = map_nt_error_from_unix_common(errno);
7041                         goto out;
7042                 }
7043
7044                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
7045                         create_options |= FILE_DIRECTORY_FILE;
7046                 }
7047
7048                 status = SMB_VFS_CREATE_FILE(
7049                         conn,                           /* conn */
7050                         req,                            /* req */
7051                         0,                              /* root_dir_fid */
7052                         smb_fname_src,                  /* fname */
7053                         access_mask,                    /* access_mask */
7054                         (FILE_SHARE_READ |              /* share_access */
7055                             FILE_SHARE_WRITE),
7056                         FILE_OPEN,                      /* create_disposition*/
7057                         create_options,                 /* create_options */
7058                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
7059                         0,                              /* oplock_request */
7060                         NULL,                           /* lease */
7061                         0,                              /* allocation_size */
7062                         0,                              /* private_flags */
7063                         NULL,                           /* sd */
7064                         NULL,                           /* ea_list */
7065                         &fsp,                           /* result */
7066                         NULL,                           /* pinfo */
7067                         NULL, NULL);                    /* create context */
7068
7069                 if (!NT_STATUS_IS_OK(status)) {
7070                         DEBUG(3, ("Could not open rename source %s: %s\n",
7071                                   smb_fname_str_dbg(smb_fname_src),
7072                                   nt_errstr(status)));
7073                         goto out;
7074                 }
7075
7076                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
7077                                               attrs, replace_if_exists);
7078
7079                 close_file(req, fsp, NORMAL_CLOSE);
7080
7081                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
7082                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
7083                           smb_fname_str_dbg(smb_fname_dst)));
7084
7085                 goto out;
7086         }
7087
7088         /*
7089          * Wildcards - process each file that matches.
7090          */
7091         if (strequal(fname_src_mask, "????????.???")) {
7092                 TALLOC_FREE(fname_src_mask);
7093                 fname_src_mask = talloc_strdup(ctx, "*");
7094                 if (!fname_src_mask) {
7095                         status = NT_STATUS_NO_MEMORY;
7096                         goto out;
7097                 }
7098         }
7099
7100         status = check_name(conn, fname_src_dir);
7101         if (!NT_STATUS_IS_OK(status)) {
7102                 goto out;
7103         }
7104
7105         smb_fname_src_dir = synthetic_smb_fname(talloc_tos(),
7106                                 fname_src_dir,
7107                                 NULL,
7108                                 NULL,
7109                                 smb_fname_src->flags);
7110         if (smb_fname_src_dir == NULL) {
7111                 status = NT_STATUS_NO_MEMORY;
7112                 goto out;
7113         }
7114
7115         dir_hnd = OpenDir(talloc_tos(), conn, smb_fname_src_dir, fname_src_mask,
7116                           attrs);
7117         if (dir_hnd == NULL) {
7118                 status = map_nt_error_from_unix(errno);
7119                 goto out;
7120         }
7121
7122         status = NT_STATUS_NO_SUCH_FILE;
7123         /*
7124          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
7125          * - gentest fix. JRA
7126          */
7127
7128         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
7129                                     &talloced))) {
7130                 files_struct *fsp = NULL;
7131                 char *destname = NULL;
7132                 bool sysdir_entry = False;
7133
7134                 /* Quick check for "." and ".." */
7135                 if (ISDOT(dname) || ISDOTDOT(dname)) {
7136                         if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
7137                                 sysdir_entry = True;
7138                         } else {
7139                                 TALLOC_FREE(talloced);
7140                                 continue;
7141                         }
7142                 }
7143
7144                 if (!is_visible_file(conn, fname_src_dir, dname,
7145                                      &smb_fname_src->st, false)) {
7146                         TALLOC_FREE(talloced);
7147                         continue;
7148                 }
7149
7150                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
7151                         TALLOC_FREE(talloced);
7152                         continue;
7153                 }
7154
7155                 if (sysdir_entry) {
7156                         status = NT_STATUS_OBJECT_NAME_INVALID;
7157                         break;
7158                 }
7159
7160                 TALLOC_FREE(smb_fname_src->base_name);
7161                 if (ISDOT(fname_src_dir)) {
7162                         /* Ensure we use canonical names on open. */
7163                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7164                                                         "%s",
7165                                                         dname);
7166                 } else {
7167                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7168                                                         "%s/%s",
7169                                                         fname_src_dir,
7170                                                         dname);
7171                 }
7172                 if (!smb_fname_src->base_name) {
7173                         status = NT_STATUS_NO_MEMORY;
7174                         goto out;
7175                 }
7176
7177                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7178                                        smb_fname_dst->base_name,
7179                                        &destname)) {
7180                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
7181                                   smb_fname_src->base_name, destname));
7182                         TALLOC_FREE(talloced);
7183                         continue;
7184                 }
7185                 if (!destname) {
7186                         status = NT_STATUS_NO_MEMORY;
7187                         goto out;
7188                 }
7189
7190                 TALLOC_FREE(smb_fname_dst->base_name);
7191                 smb_fname_dst->base_name = destname;
7192
7193                 ZERO_STRUCT(smb_fname_src->st);
7194                 if (posix_pathnames) {
7195                         SMB_VFS_LSTAT(conn, smb_fname_src);
7196                 } else {
7197                         SMB_VFS_STAT(conn, smb_fname_src);
7198                 }
7199
7200                 create_options = 0;
7201
7202                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
7203                         create_options |= FILE_DIRECTORY_FILE;
7204                 }
7205
7206                 status = SMB_VFS_CREATE_FILE(
7207                         conn,                           /* conn */
7208                         req,                            /* req */
7209                         0,                              /* root_dir_fid */
7210                         smb_fname_src,                  /* fname */
7211                         access_mask,                    /* access_mask */
7212                         (FILE_SHARE_READ |              /* share_access */
7213                             FILE_SHARE_WRITE),
7214                         FILE_OPEN,                      /* create_disposition*/
7215                         create_options,                 /* create_options */
7216                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
7217                         0,                              /* oplock_request */
7218                         NULL,                           /* lease */
7219                         0,                              /* allocation_size */
7220                         0,                              /* private_flags */
7221                         NULL,                           /* sd */
7222                         NULL,                           /* ea_list */
7223                         &fsp,                           /* result */
7224                         NULL,                           /* pinfo */
7225                         NULL, NULL);                    /* create context */
7226
7227                 if (!NT_STATUS_IS_OK(status)) {
7228                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
7229                                  "returned %s rename %s -> %s\n",
7230                                  nt_errstr(status),
7231                                  smb_fname_str_dbg(smb_fname_src),
7232                                  smb_fname_str_dbg(smb_fname_dst)));
7233                         break;
7234                 }
7235
7236                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
7237                                                               dname);
7238                 if (!smb_fname_dst->original_lcomp) {
7239                         status = NT_STATUS_NO_MEMORY;
7240                         goto out;
7241                 }
7242
7243                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
7244                                               attrs, replace_if_exists);
7245
7246                 close_file(req, fsp, NORMAL_CLOSE);
7247
7248                 if (!NT_STATUS_IS_OK(status)) {
7249                         DEBUG(3, ("rename_internals_fsp returned %s for "
7250                                   "rename %s -> %s\n", nt_errstr(status),
7251                                   smb_fname_str_dbg(smb_fname_src),
7252                                   smb_fname_str_dbg(smb_fname_dst)));
7253                         break;
7254                 }
7255
7256                 count++;
7257
7258                 DEBUG(3,("rename_internals: doing rename on %s -> "
7259                          "%s\n", smb_fname_str_dbg(smb_fname_src),
7260                          smb_fname_str_dbg(smb_fname_src)));
7261                 TALLOC_FREE(talloced);
7262         }
7263         TALLOC_FREE(dir_hnd);
7264
7265         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
7266                 status = map_nt_error_from_unix(errno);
7267         }
7268
7269  out:
7270         TALLOC_FREE(talloced);
7271         TALLOC_FREE(smb_fname_src_dir);
7272         TALLOC_FREE(fname_src_dir);
7273         TALLOC_FREE(fname_src_mask);
7274         return status;
7275 }
7276
7277 /****************************************************************************
7278  Reply to a mv.
7279 ****************************************************************************/
7280
7281 void reply_mv(struct smb_request *req)
7282 {
7283         connection_struct *conn = req->conn;
7284         char *name = NULL;
7285         char *newname = NULL;
7286         const char *p;
7287         uint32_t attrs;
7288         NTSTATUS status;
7289         bool src_has_wcard = False;
7290         bool dest_has_wcard = False;
7291         TALLOC_CTX *ctx = talloc_tos();
7292         struct smb_filename *smb_fname_src = NULL;
7293         struct smb_filename *smb_fname_dst = NULL;
7294         uint32_t src_ucf_flags = (req->posix_pathnames ?
7295                 (UCF_UNIX_NAME_LOOKUP|UCF_POSIX_PATHNAMES) :
7296                 UCF_COND_ALLOW_WCARD_LCOMP);
7297         uint32_t dst_ucf_flags = UCF_SAVE_LCOMP |
7298                 (req->posix_pathnames ? UCF_POSIX_PATHNAMES :
7299                  UCF_COND_ALLOW_WCARD_LCOMP);
7300         bool stream_rename = false;
7301
7302         START_PROFILE(SMBmv);
7303
7304         if (req->wct < 1) {
7305                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7306                 goto out;
7307         }
7308
7309         attrs = SVAL(req->vwv+0, 0);
7310
7311         p = (const char *)req->buf + 1;
7312         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
7313                                        &status, &src_has_wcard);
7314         if (!NT_STATUS_IS_OK(status)) {
7315                 reply_nterror(req, status);
7316                 goto out;
7317         }
7318         p++;
7319         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
7320                                        &status, &dest_has_wcard);
7321         if (!NT_STATUS_IS_OK(status)) {
7322                 reply_nterror(req, status);
7323                 goto out;
7324         }
7325
7326         if (!req->posix_pathnames) {
7327                 /* The newname must begin with a ':' if the
7328                    name contains a ':'. */
7329                 if (strchr_m(name, ':')) {
7330                         if (newname[0] != ':') {
7331                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7332                                 goto out;
7333                         }
7334                         stream_rename = true;
7335                 }
7336         }
7337
7338         status = filename_convert(ctx,
7339                                   conn,
7340                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7341                                   name,
7342                                   src_ucf_flags,
7343                                   &src_has_wcard,
7344                                   &smb_fname_src);
7345
7346         if (!NT_STATUS_IS_OK(status)) {
7347                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7348                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7349                                         ERRSRV, ERRbadpath);
7350                         goto out;
7351                 }
7352                 reply_nterror(req, status);
7353                 goto out;
7354         }
7355
7356         status = filename_convert(ctx,
7357                                   conn,
7358                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7359                                   newname,
7360                                   dst_ucf_flags,
7361                                   &dest_has_wcard,
7362                                   &smb_fname_dst);
7363
7364         if (!NT_STATUS_IS_OK(status)) {
7365                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7366                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7367                                         ERRSRV, ERRbadpath);
7368                         goto out;
7369                 }
7370                 reply_nterror(req, status);
7371                 goto out;
7372         }
7373
7374         if (stream_rename) {
7375                 /* smb_fname_dst->base_name must be the same as
7376                    smb_fname_src->base_name. */
7377                 TALLOC_FREE(smb_fname_dst->base_name);
7378                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
7379                                                 smb_fname_src->base_name);
7380                 if (!smb_fname_dst->base_name) {
7381                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7382                         goto out;
7383                 }
7384         }
7385
7386         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7387                  smb_fname_str_dbg(smb_fname_dst)));
7388
7389         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7390                                   attrs, False, src_has_wcard, dest_has_wcard,
7391                                   DELETE_ACCESS);
7392         if (!NT_STATUS_IS_OK(status)) {
7393                 if (open_was_deferred(req->xconn, req->mid)) {
7394                         /* We have re-scheduled this call. */
7395                         goto out;
7396                 }
7397                 reply_nterror(req, status);
7398                 goto out;
7399         }
7400
7401         reply_outbuf(req, 0, 0);
7402  out:
7403         TALLOC_FREE(smb_fname_src);
7404         TALLOC_FREE(smb_fname_dst);
7405         END_PROFILE(SMBmv);
7406         return;
7407 }
7408
7409 /*******************************************************************
7410  Copy a file as part of a reply_copy.
7411 ******************************************************************/
7412
7413 /*
7414  * TODO: check error codes on all callers
7415  */
7416
7417 NTSTATUS copy_file(TALLOC_CTX *ctx,
7418                         connection_struct *conn,
7419                         struct smb_filename *smb_fname_src,
7420                         struct smb_filename *smb_fname_dst,
7421                         int ofun,
7422                         int count,
7423                         bool target_is_directory)
7424 {
7425         struct smb_filename *smb_fname_dst_tmp = NULL;
7426         off_t ret=-1;
7427         files_struct *fsp1,*fsp2;
7428         uint32_t dosattrs;
7429         uint32_t new_create_disposition;
7430         NTSTATUS status;
7431
7432
7433         smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7434         if (smb_fname_dst_tmp == NULL) {
7435                 return NT_STATUS_NO_MEMORY;
7436         }
7437
7438         /*
7439          * If the target is a directory, extract the last component from the
7440          * src filename and append it to the dst filename
7441          */
7442         if (target_is_directory) {
7443                 const char *p;
7444
7445                 /* dest/target can't be a stream if it's a directory. */
7446                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7447
7448                 p = strrchr_m(smb_fname_src->base_name,'/');
7449                 if (p) {
7450                         p++;
7451                 } else {
7452                         p = smb_fname_src->base_name;
7453                 }
7454                 smb_fname_dst_tmp->base_name =
7455                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7456                                            p);
7457                 if (!smb_fname_dst_tmp->base_name) {
7458                         status = NT_STATUS_NO_MEMORY;
7459                         goto out;
7460                 }
7461         }
7462
7463         status = vfs_file_exist(conn, smb_fname_src);
7464         if (!NT_STATUS_IS_OK(status)) {
7465                 goto out;
7466         }
7467
7468         if (!target_is_directory && count) {
7469                 new_create_disposition = FILE_OPEN;
7470         } else {
7471                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7472                                                  0, ofun,
7473                                                  NULL, NULL,
7474                                                  &new_create_disposition,
7475                                                  NULL,
7476                                                  NULL)) {
7477                         status = NT_STATUS_INVALID_PARAMETER;
7478                         goto out;
7479                 }
7480         }
7481
7482         /* Open the src file for reading. */
7483         status = SMB_VFS_CREATE_FILE(
7484                 conn,                                   /* conn */
7485                 NULL,                                   /* req */
7486                 0,                                      /* root_dir_fid */
7487                 smb_fname_src,                          /* fname */
7488                 FILE_GENERIC_READ,                      /* access_mask */
7489                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7490                 FILE_OPEN,                              /* create_disposition*/
7491                 0,                                      /* create_options */
7492                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
7493                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7494                 NULL,                                   /* lease */
7495                 0,                                      /* allocation_size */
7496                 0,                                      /* private_flags */
7497                 NULL,                                   /* sd */
7498                 NULL,                                   /* ea_list */
7499                 &fsp1,                                  /* result */
7500                 NULL,                                   /* psbuf */
7501                 NULL, NULL);                            /* create context */
7502
7503         if (!NT_STATUS_IS_OK(status)) {
7504                 goto out;
7505         }
7506
7507         dosattrs = dos_mode(conn, smb_fname_src);
7508
7509         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7510                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7511         }
7512
7513         /* Open the dst file for writing. */
7514         status = SMB_VFS_CREATE_FILE(
7515                 conn,                                   /* conn */
7516                 NULL,                                   /* req */
7517                 0,                                      /* root_dir_fid */
7518                 smb_fname_dst,                          /* fname */
7519                 FILE_GENERIC_WRITE,                     /* access_mask */
7520                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7521                 new_create_disposition,                 /* create_disposition*/
7522                 0,                                      /* create_options */
7523                 dosattrs,                               /* file_attributes */
7524                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7525                 NULL,                                   /* lease */
7526                 0,                                      /* allocation_size */
7527                 0,                                      /* private_flags */
7528                 NULL,                                   /* sd */
7529                 NULL,                                   /* ea_list */
7530                 &fsp2,                                  /* result */
7531                 NULL,                                   /* psbuf */
7532                 NULL, NULL);                            /* create context */
7533
7534         if (!NT_STATUS_IS_OK(status)) {
7535                 close_file(NULL, fsp1, ERROR_CLOSE);
7536                 goto out;
7537         }
7538
7539         if (ofun & OPENX_FILE_EXISTS_OPEN) {
7540                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7541                 if (ret == -1) {
7542                         DEBUG(0, ("error - vfs lseek returned error %s\n",
7543                                 strerror(errno)));
7544                         status = map_nt_error_from_unix(errno);
7545                         close_file(NULL, fsp1, ERROR_CLOSE);
7546                         close_file(NULL, fsp2, ERROR_CLOSE);
7547                         goto out;
7548                 }
7549         }
7550
7551         /* Do the actual copy. */
7552         if (smb_fname_src->st.st_ex_size) {
7553                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7554         } else {
7555                 ret = 0;
7556         }
7557
7558         close_file(NULL, fsp1, NORMAL_CLOSE);
7559
7560         /* Ensure the modtime is set correctly on the destination file. */
7561         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7562
7563         /*
7564          * As we are opening fsp1 read-only we only expect
7565          * an error on close on fsp2 if we are out of space.
7566          * Thus we don't look at the error return from the
7567          * close of fsp1.
7568          */
7569         status = close_file(NULL, fsp2, NORMAL_CLOSE);
7570
7571         if (!NT_STATUS_IS_OK(status)) {
7572                 goto out;
7573         }
7574
7575         if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7576                 status = NT_STATUS_DISK_FULL;
7577                 goto out;
7578         }
7579
7580         status = NT_STATUS_OK;
7581
7582  out:
7583         TALLOC_FREE(smb_fname_dst_tmp);
7584         return status;
7585 }
7586
7587 /****************************************************************************
7588  Reply to a file copy.
7589 ****************************************************************************/
7590
7591 void reply_copy(struct smb_request *req)
7592 {
7593         connection_struct *conn = req->conn;
7594         struct smb_filename *smb_fname_src = NULL;
7595         struct smb_filename *smb_fname_src_dir = NULL;
7596         struct smb_filename *smb_fname_dst = NULL;
7597         char *fname_src = NULL;
7598         char *fname_dst = NULL;
7599         char *fname_src_mask = NULL;
7600         char *fname_src_dir = NULL;
7601         const char *p;
7602         int count=0;
7603         int error = ERRnoaccess;
7604         int tid2;
7605         int ofun;
7606         int flags;
7607         bool target_is_directory=False;
7608         bool source_has_wild = False;
7609         bool dest_has_wild = False;
7610         NTSTATUS status;
7611         uint32_t ucf_flags_src = UCF_COND_ALLOW_WCARD_LCOMP |
7612                 (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
7613         uint32_t ucf_flags_dst = UCF_COND_ALLOW_WCARD_LCOMP |
7614                 (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
7615         TALLOC_CTX *ctx = talloc_tos();
7616
7617         START_PROFILE(SMBcopy);
7618
7619         if (req->wct < 3) {
7620                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7621                 goto out;
7622         }
7623
7624         tid2 = SVAL(req->vwv+0, 0);
7625         ofun = SVAL(req->vwv+1, 0);
7626         flags = SVAL(req->vwv+2, 0);
7627
7628         p = (const char *)req->buf;
7629         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7630                                        &status, &source_has_wild);
7631         if (!NT_STATUS_IS_OK(status)) {
7632                 reply_nterror(req, status);
7633                 goto out;
7634         }
7635         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7636                                        &status, &dest_has_wild);
7637         if (!NT_STATUS_IS_OK(status)) {
7638                 reply_nterror(req, status);
7639                 goto out;
7640         }
7641
7642         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7643
7644         if (tid2 != conn->cnum) {
7645                 /* can't currently handle inter share copies XXXX */
7646                 DEBUG(3,("Rejecting inter-share copy\n"));
7647                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7648                 goto out;
7649         }
7650
7651         status = filename_convert(ctx, conn,
7652                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7653                                   fname_src,
7654                                   ucf_flags_src,
7655                                   &source_has_wild,
7656                                   &smb_fname_src);
7657         if (!NT_STATUS_IS_OK(status)) {
7658                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7659                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7660                                         ERRSRV, ERRbadpath);
7661                         goto out;
7662                 }
7663                 reply_nterror(req, status);
7664                 goto out;
7665         }
7666
7667         status = filename_convert(ctx, conn,
7668                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7669                                   fname_dst,
7670                                   ucf_flags_dst,
7671                                   &dest_has_wild,
7672                                   &smb_fname_dst);
7673         if (!NT_STATUS_IS_OK(status)) {
7674                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7675                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7676                                         ERRSRV, ERRbadpath);
7677                         goto out;
7678                 }
7679                 reply_nterror(req, status);
7680                 goto out;
7681         }
7682
7683         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7684
7685         if ((flags&1) && target_is_directory) {
7686                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7687                 goto out;
7688         }
7689
7690         if ((flags&2) && !target_is_directory) {
7691                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7692                 goto out;
7693         }
7694
7695         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7696                 /* wants a tree copy! XXXX */
7697                 DEBUG(3,("Rejecting tree copy\n"));
7698                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7699                 goto out;
7700         }
7701
7702         /* Split up the directory from the filename/mask. */
7703         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7704                                       &fname_src_dir, &fname_src_mask);
7705         if (!NT_STATUS_IS_OK(status)) {
7706                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7707                 goto out;
7708         }
7709
7710         /*
7711          * We should only check the mangled cache
7712          * here if unix_convert failed. This means
7713          * that the path in 'mask' doesn't exist
7714          * on the file system and so we need to look
7715          * for a possible mangle. This patch from
7716          * Tine Smukavec <valentin.smukavec@hermes.si>.
7717          */
7718         if (!VALID_STAT(smb_fname_src->st) &&
7719             mangle_is_mangled(fname_src_mask, conn->params)) {
7720                 char *new_mask = NULL;
7721                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7722                                             &new_mask, conn->params);
7723
7724                 /* Use demangled name if one was successfully found. */
7725                 if (new_mask) {
7726                         TALLOC_FREE(fname_src_mask);
7727                         fname_src_mask = new_mask;
7728                 }
7729         }
7730
7731         if (!source_has_wild) {
7732
7733                 /*
7734                  * Only one file needs to be copied. Append the mask back onto
7735                  * the directory.
7736                  */
7737                 TALLOC_FREE(smb_fname_src->base_name);
7738                 if (ISDOT(fname_src_dir)) {
7739                         /* Ensure we use canonical names on open. */
7740                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7741                                                         "%s",
7742                                                         fname_src_mask);
7743                 } else {
7744                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7745                                                         "%s/%s",
7746                                                         fname_src_dir,
7747                                                         fname_src_mask);
7748                 }
7749                 if (!smb_fname_src->base_name) {
7750                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7751                         goto out;
7752                 }
7753
7754                 if (dest_has_wild) {
7755                         char *fname_dst_mod = NULL;
7756                         if (!resolve_wildcards(smb_fname_dst,
7757                                                smb_fname_src->base_name,
7758                                                smb_fname_dst->base_name,
7759                                                &fname_dst_mod)) {
7760                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7761                                 goto out;
7762                         }
7763                         TALLOC_FREE(smb_fname_dst->base_name);
7764                         smb_fname_dst->base_name = fname_dst_mod;
7765                 }
7766
7767                 status = check_name(conn, smb_fname_src->base_name);
7768                 if (!NT_STATUS_IS_OK(status)) {
7769                         reply_nterror(req, status);
7770                         goto out;
7771                 }
7772
7773                 status = check_name(conn, smb_fname_dst->base_name);
7774                 if (!NT_STATUS_IS_OK(status)) {
7775                         reply_nterror(req, status);
7776                         goto out;
7777                 }
7778
7779                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7780                                    ofun, count, target_is_directory);
7781
7782                 if(!NT_STATUS_IS_OK(status)) {
7783                         reply_nterror(req, status);
7784                         goto out;
7785                 } else {
7786                         count++;
7787                 }
7788         } else {
7789                 struct smb_Dir *dir_hnd = NULL;
7790                 const char *dname = NULL;
7791                 char *talloced = NULL;
7792                 long offset = 0;
7793
7794                 /*
7795                  * There is a wildcard that requires us to actually read the
7796                  * src dir and copy each file matching the mask to the dst.
7797                  * Right now streams won't be copied, but this could
7798                  * presumably be added with a nested loop for reach dir entry.
7799                  */
7800                 SMB_ASSERT(!smb_fname_src->stream_name);
7801                 SMB_ASSERT(!smb_fname_dst->stream_name);
7802
7803                 smb_fname_src->stream_name = NULL;
7804                 smb_fname_dst->stream_name = NULL;
7805
7806                 if (strequal(fname_src_mask,"????????.???")) {
7807                         TALLOC_FREE(fname_src_mask);
7808                         fname_src_mask = talloc_strdup(ctx, "*");
7809                         if (!fname_src_mask) {
7810                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7811                                 goto out;
7812                         }
7813                 }
7814
7815                 status = check_name(conn, fname_src_dir);
7816                 if (!NT_STATUS_IS_OK(status)) {
7817                         reply_nterror(req, status);
7818                         goto out;
7819                 }
7820
7821                 smb_fname_src_dir = synthetic_smb_fname(talloc_tos(),
7822                                         fname_src_dir,
7823                                         NULL,
7824                                         NULL,
7825                                         smb_fname_src->flags);
7826                 if (smb_fname_src_dir == NULL) {
7827                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7828                         goto out;
7829                 }
7830
7831                 dir_hnd = OpenDir(ctx,
7832                                 conn,
7833                                 smb_fname_src_dir,
7834                                 fname_src_mask,
7835                                 0);
7836                 if (dir_hnd == NULL) {
7837                         status = map_nt_error_from_unix(errno);
7838                         reply_nterror(req, status);
7839                         goto out;
7840                 }
7841
7842                 error = ERRbadfile;
7843
7844                 /* Iterate over the src dir copying each entry to the dst. */
7845                 while ((dname = ReadDirName(dir_hnd, &offset,
7846                                             &smb_fname_src->st, &talloced))) {
7847                         char *destname = NULL;
7848
7849                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7850                                 TALLOC_FREE(talloced);
7851                                 continue;
7852                         }
7853
7854                         if (!is_visible_file(conn, fname_src_dir, dname,
7855                                              &smb_fname_src->st, false)) {
7856                                 TALLOC_FREE(talloced);
7857                                 continue;
7858                         }
7859
7860                         if(!mask_match(dname, fname_src_mask,
7861                                        conn->case_sensitive)) {
7862                                 TALLOC_FREE(talloced);
7863                                 continue;
7864                         }
7865
7866                         error = ERRnoaccess;
7867
7868                         /* Get the src smb_fname struct setup. */
7869                         TALLOC_FREE(smb_fname_src->base_name);
7870                         if (ISDOT(fname_src_dir)) {
7871                                 /* Ensure we use canonical names on open. */
7872                                 smb_fname_src->base_name =
7873                                         talloc_asprintf(smb_fname_src, "%s",
7874                                                 dname);
7875                         } else {
7876                                 smb_fname_src->base_name =
7877                                         talloc_asprintf(smb_fname_src, "%s/%s",
7878                                                 fname_src_dir, dname);
7879                         }
7880
7881                         if (!smb_fname_src->base_name) {
7882                                 TALLOC_FREE(dir_hnd);
7883                                 TALLOC_FREE(talloced);
7884                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7885                                 goto out;
7886                         }
7887
7888                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7889                                                smb_fname_dst->base_name,
7890                                                &destname)) {
7891                                 TALLOC_FREE(talloced);
7892                                 continue;
7893                         }
7894                         if (!destname) {
7895                                 TALLOC_FREE(dir_hnd);
7896                                 TALLOC_FREE(talloced);
7897                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7898                                 goto out;
7899                         }
7900
7901                         TALLOC_FREE(smb_fname_dst->base_name);
7902                         smb_fname_dst->base_name = destname;
7903
7904                         status = check_name(conn, smb_fname_src->base_name);
7905                         if (!NT_STATUS_IS_OK(status)) {
7906                                 TALLOC_FREE(dir_hnd);
7907                                 TALLOC_FREE(talloced);
7908                                 reply_nterror(req, status);
7909                                 goto out;
7910                         }
7911
7912                         status = check_name(conn, smb_fname_dst->base_name);
7913                         if (!NT_STATUS_IS_OK(status)) {
7914                                 TALLOC_FREE(dir_hnd);
7915                                 TALLOC_FREE(talloced);
7916                                 reply_nterror(req, status);
7917                                 goto out;
7918                         }
7919
7920                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7921                                 smb_fname_src->base_name,
7922                                 smb_fname_dst->base_name));
7923
7924                         status = copy_file(ctx, conn, smb_fname_src,
7925                                            smb_fname_dst, ofun, count,
7926                                            target_is_directory);
7927                         if (NT_STATUS_IS_OK(status)) {
7928                                 count++;
7929                         }
7930
7931                         TALLOC_FREE(talloced);
7932                 }
7933                 TALLOC_FREE(dir_hnd);
7934         }
7935
7936         if (count == 0) {
7937                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7938                 goto out;
7939         }
7940
7941         reply_outbuf(req, 1, 0);
7942         SSVAL(req->outbuf,smb_vwv0,count);
7943  out:
7944         TALLOC_FREE(smb_fname_src);
7945         TALLOC_FREE(smb_fname_src_dir);
7946         TALLOC_FREE(smb_fname_dst);
7947         TALLOC_FREE(fname_src);
7948         TALLOC_FREE(fname_dst);
7949         TALLOC_FREE(fname_src_mask);
7950         TALLOC_FREE(fname_src_dir);
7951
7952         END_PROFILE(SMBcopy);
7953         return;
7954 }
7955
7956 #undef DBGC_CLASS
7957 #define DBGC_CLASS DBGC_LOCKING
7958
7959 /****************************************************************************
7960  Get a lock pid, dealing with large count requests.
7961 ****************************************************************************/
7962
7963 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7964                     bool large_file_format)
7965 {
7966         if(!large_file_format)
7967                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7968         else
7969                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7970 }
7971
7972 /****************************************************************************
7973  Get a lock count, dealing with large count requests.
7974 ****************************************************************************/
7975
7976 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7977                         bool large_file_format)
7978 {
7979         uint64_t count = 0;
7980
7981         if(!large_file_format) {
7982                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7983         } else {
7984                 /*
7985                  * No BVAL, this is reversed!
7986                  */
7987                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7988                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7989         }
7990
7991         return count;
7992 }
7993
7994 /****************************************************************************
7995  Get a lock offset, dealing with large offset requests.
7996 ****************************************************************************/
7997
7998 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7999                          bool large_file_format)
8000 {
8001         uint64_t offset = 0;
8002
8003         if(!large_file_format) {
8004                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
8005         } else {
8006                 /*
8007                  * No BVAL, this is reversed!
8008                  */
8009                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
8010                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
8011         }
8012
8013         return offset;
8014 }
8015
8016 NTSTATUS smbd_do_locking(struct smb_request *req,
8017                          files_struct *fsp,
8018                          uint8_t type,
8019                          int32_t timeout,
8020                          uint16_t num_locks,
8021                          struct smbd_lock_element *locks,
8022                          bool *async)
8023 {
8024         connection_struct *conn = req->conn;
8025         int i;
8026         NTSTATUS status = NT_STATUS_OK;
8027
8028         *async = false;
8029
8030         /* Setup the timeout in seconds. */
8031
8032         if (!lp_blocking_locks(SNUM(conn))) {
8033                 timeout = 0;
8034         }
8035
8036         for(i = 0; i < (int)num_locks; i++) {
8037                 struct smbd_lock_element *e = &locks[i];
8038
8039                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
8040                           "%llu, file %s timeout = %d\n",
8041                           (double)e->offset,
8042                           (double)e->count,
8043                           (unsigned long long)e->smblctx,
8044                           fsp_str_dbg(fsp),
8045                           (int)timeout));
8046
8047                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
8048                         struct blocking_lock_record *blr = NULL;
8049
8050                         if (num_locks > 1) {
8051                                 /*
8052                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
8053                                  * if the lock vector contains one entry. When given multiple cancel
8054                                  * requests in a single PDU we expect the server to return an
8055                                  * error. Windows servers seem to accept the request but only
8056                                  * cancel the first lock.
8057                                  * JRA - Do what Windows does (tm) :-).
8058                                  */
8059
8060 #if 0
8061                                 /* MS-CIFS (2.2.4.32.1) behavior. */
8062                                 return NT_STATUS_DOS(ERRDOS,
8063                                                 ERRcancelviolation);
8064 #else
8065                                 /* Windows behavior. */
8066                                 if (i != 0) {
8067                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
8068                                                 "cancel request\n"));
8069                                         continue;
8070                                 }
8071 #endif
8072                         }
8073
8074                         if (lp_blocking_locks(SNUM(conn))) {
8075
8076                                 /* Schedule a message to ourselves to
8077                                    remove the blocking lock record and
8078                                    return the right error. */
8079
8080                                 blr = blocking_lock_cancel_smb1(fsp,
8081                                                 e->smblctx,
8082                                                 e->offset,
8083                                                 e->count,
8084                                                 WINDOWS_LOCK,
8085                                                 type,
8086                                                 NT_STATUS_FILE_LOCK_CONFLICT);
8087                                 if (blr == NULL) {
8088                                         return NT_STATUS_DOS(
8089                                                         ERRDOS,
8090                                                         ERRcancelviolation);
8091                                 }
8092                         }
8093                         /* Remove a matching pending lock. */
8094                         status = do_lock_cancel(fsp,
8095                                                 e->smblctx,
8096                                                 e->count,
8097                                                 e->offset,
8098                                                 WINDOWS_LOCK);
8099                 } else {
8100                         bool blocking_lock = timeout ? true : false;
8101                         bool defer_lock = false;
8102                         struct byte_range_lock *br_lck;
8103                         uint64_t block_smblctx;
8104
8105                         br_lck = do_lock(req->sconn->msg_ctx,
8106                                         fsp,
8107                                         e->smblctx,
8108                                         e->count,
8109                                         e->offset,
8110                                         e->brltype,
8111                                         WINDOWS_LOCK,
8112                                         blocking_lock,
8113                                         &status,
8114                                         &block_smblctx);
8115
8116                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
8117                                 /* Windows internal resolution for blocking locks seems
8118                                    to be about 200ms... Don't wait for less than that. JRA. */
8119                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
8120                                         timeout = lp_lock_spin_time();
8121                                 }
8122                                 defer_lock = true;
8123                         }
8124
8125                         /* If a lock sent with timeout of zero would fail, and
8126                          * this lock has been requested multiple times,
8127                          * according to brl_lock_failed() we convert this
8128                          * request to a blocking lock with a timeout of between
8129                          * 150 - 300 milliseconds.
8130                          *
8131                          * If lp_lock_spin_time() has been set to 0, we skip
8132                          * this blocking retry and fail immediately.
8133                          *
8134                          * Replacement for do_lock_spin(). JRA. */
8135
8136                         if (!req->sconn->using_smb2 &&
8137                             br_lck && lp_blocking_locks(SNUM(conn)) &&
8138                             lp_lock_spin_time() && !blocking_lock &&
8139                             NT_STATUS_EQUAL((status),
8140                                 NT_STATUS_FILE_LOCK_CONFLICT))
8141                         {
8142                                 defer_lock = true;
8143                                 timeout = lp_lock_spin_time();
8144                         }
8145
8146                         if (br_lck && defer_lock) {
8147                                 /*
8148                                  * A blocking lock was requested. Package up
8149                                  * this smb into a queued request and push it
8150                                  * onto the blocking lock queue.
8151                                  */
8152                                 if(push_blocking_lock_request(br_lck,
8153                                                         req,
8154                                                         fsp,
8155                                                         timeout,
8156                                                         i,
8157                                                         e->smblctx,
8158                                                         e->brltype,
8159                                                         WINDOWS_LOCK,
8160                                                         e->offset,
8161                                                         e->count,
8162                                                         block_smblctx)) {
8163                                         TALLOC_FREE(br_lck);
8164                                         *async = true;
8165                                         return NT_STATUS_OK;
8166                                 }
8167                         }
8168
8169                         TALLOC_FREE(br_lck);
8170                 }
8171
8172                 if (!NT_STATUS_IS_OK(status)) {
8173                         break;
8174                 }
8175         }
8176
8177         /* If any of the above locks failed, then we must unlock
8178            all of the previous locks (X/Open spec). */
8179
8180         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
8181
8182                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
8183                         i = -1; /* we want to skip the for loop */
8184                 }
8185
8186                 /*
8187                  * Ensure we don't do a remove on the lock that just failed,
8188                  * as under POSIX rules, if we have a lock already there, we
8189                  * will delete it (and we shouldn't) .....
8190                  */
8191                 for(i--; i >= 0; i--) {
8192                         struct smbd_lock_element *e = &locks[i];
8193
8194                         do_unlock(req->sconn->msg_ctx,
8195                                 fsp,
8196                                 e->smblctx,
8197                                 e->count,
8198                                 e->offset,
8199                                 WINDOWS_LOCK);
8200                 }
8201                 return status;
8202         }
8203
8204         DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d\n",
8205                   fsp_fnum_dbg(fsp), (unsigned int)type, num_locks));
8206
8207         return NT_STATUS_OK;
8208 }
8209
8210 NTSTATUS smbd_do_unlocking(struct smb_request *req,
8211                            files_struct *fsp,
8212                            uint16_t num_ulocks,
8213                            struct smbd_lock_element *ulocks)
8214 {
8215         int i;
8216
8217         for(i = 0; i < (int)num_ulocks; i++) {
8218                 struct smbd_lock_element *e = &ulocks[i];
8219                 NTSTATUS status;
8220
8221                 DEBUG(10,("%s: unlock start=%.0f, len=%.0f for "
8222                           "pid %u, file %s\n", __func__,
8223                           (double)e->offset,
8224                           (double)e->count,
8225                           (unsigned int)e->smblctx,
8226                           fsp_str_dbg(fsp)));
8227
8228                 if (e->brltype != UNLOCK_LOCK) {
8229                         /* this can only happen with SMB2 */
8230                         return NT_STATUS_INVALID_PARAMETER;
8231                 }
8232
8233                 status = do_unlock(req->sconn->msg_ctx,
8234                                 fsp,
8235                                 e->smblctx,
8236                                 e->count,
8237                                 e->offset,
8238                                 WINDOWS_LOCK);
8239
8240                 DEBUG(10, ("%s: unlock returned %s\n", __func__,
8241                            nt_errstr(status)));
8242
8243                 if (!NT_STATUS_IS_OK(status)) {
8244                         return status;
8245                 }
8246         }
8247
8248         DEBUG(3, ("%s: %s num_ulocks=%d\n", __func__, fsp_fnum_dbg(fsp),
8249                   num_ulocks));
8250
8251         return NT_STATUS_OK;
8252 }
8253
8254 /****************************************************************************
8255  Reply to a lockingX request.
8256 ****************************************************************************/
8257
8258 void reply_lockingX(struct smb_request *req)
8259 {
8260         connection_struct *conn = req->conn;
8261         files_struct *fsp;
8262         unsigned char locktype;
8263         unsigned char oplocklevel;
8264         uint16_t num_ulocks;
8265         uint16_t num_locks;
8266         int32_t lock_timeout;
8267         int i;
8268         const uint8_t *data;
8269         bool large_file_format;
8270         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
8271         struct smbd_lock_element *ulocks;
8272         struct smbd_lock_element *locks;
8273         bool async = false;
8274
8275         START_PROFILE(SMBlockingX);
8276
8277         if (req->wct < 8) {
8278                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8279                 END_PROFILE(SMBlockingX);
8280                 return;
8281         }
8282
8283         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
8284         locktype = CVAL(req->vwv+3, 0);
8285         oplocklevel = CVAL(req->vwv+3, 1);
8286         num_ulocks = SVAL(req->vwv+6, 0);
8287         num_locks = SVAL(req->vwv+7, 0);
8288         lock_timeout = IVAL(req->vwv+4, 0);
8289         large_file_format = ((locktype & LOCKING_ANDX_LARGE_FILES) != 0);
8290
8291         if (!check_fsp(conn, req, fsp)) {
8292                 END_PROFILE(SMBlockingX);
8293                 return;
8294         }
8295
8296         data = req->buf;
8297
8298         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
8299                 /* we don't support these - and CANCEL_LOCK makes w2k
8300                    and XP reboot so I don't really want to be
8301                    compatible! (tridge) */
8302                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
8303                 END_PROFILE(SMBlockingX);
8304                 return;
8305         }
8306
8307         /* Check if this is an oplock break on a file
8308            we have granted an oplock on.
8309         */
8310         if (locktype & LOCKING_ANDX_OPLOCK_RELEASE) {
8311                 /* Client can insist on breaking to none. */
8312                 bool break_to_none = (oplocklevel == 0);
8313                 bool result;
8314
8315                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
8316                          "for %s\n", (unsigned int)oplocklevel,
8317                          fsp_fnum_dbg(fsp)));
8318
8319                 /*
8320                  * Make sure we have granted an exclusive or batch oplock on
8321                  * this file.
8322                  */
8323
8324                 if (fsp->oplock_type == 0) {
8325
8326                         /* The Samba4 nbench simulator doesn't understand
8327                            the difference between break to level2 and break
8328                            to none from level2 - it sends oplock break
8329                            replies in both cases. Don't keep logging an error
8330                            message here - just ignore it. JRA. */
8331
8332                         DEBUG(5,("reply_lockingX: Error : oplock break from "
8333                                  "client for %s (oplock=%d) and no "
8334                                  "oplock granted on this file (%s).\n",
8335                                  fsp_fnum_dbg(fsp), fsp->oplock_type,
8336                                  fsp_str_dbg(fsp)));
8337
8338                         /* if this is a pure oplock break request then don't
8339                          * send a reply */
8340                         if (num_locks == 0 && num_ulocks == 0) {
8341                                 END_PROFILE(SMBlockingX);
8342                                 return;
8343                         } else {
8344                                 END_PROFILE(SMBlockingX);
8345                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8346                                 return;
8347                         }
8348                 }
8349
8350                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8351                     (break_to_none)) {
8352                         result = remove_oplock(fsp);
8353                 } else {
8354                         result = downgrade_oplock(fsp);
8355                 }
8356
8357                 if (!result) {
8358                         DEBUG(0, ("reply_lockingX: error in removing "
8359                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
8360                         /* Hmmm. Is this panic justified? */
8361                         smb_panic("internal tdb error");
8362                 }
8363
8364                 /* if this is a pure oplock break request then don't send a
8365                  * reply */
8366                 if (num_locks == 0 && num_ulocks == 0) {
8367                         /* Sanity check - ensure a pure oplock break is not a
8368                            chained request. */
8369                         if (CVAL(req->vwv+0, 0) != 0xff) {
8370                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
8371                                          "break is a chained %d request !\n",
8372                                          (unsigned int)CVAL(req->vwv+0, 0)));
8373                         }
8374                         END_PROFILE(SMBlockingX);
8375                         return;
8376                 }
8377         }
8378
8379         if (req->buflen <
8380             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8381                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8382                 END_PROFILE(SMBlockingX);
8383                 return;
8384         }
8385
8386         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8387         if (ulocks == NULL) {
8388                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8389                 END_PROFILE(SMBlockingX);
8390                 return;
8391         }
8392
8393         locks = talloc_array(req, struct smbd_lock_element, num_locks);
8394         if (locks == NULL) {
8395                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8396                 END_PROFILE(SMBlockingX);
8397                 return;
8398         }
8399
8400         /* Data now points at the beginning of the list
8401            of smb_unlkrng structs */
8402         for(i = 0; i < (int)num_ulocks; i++) {
8403                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8404                 ulocks[i].count = get_lock_count(data, i, large_file_format);
8405                 ulocks[i].offset = get_lock_offset(data, i, large_file_format);
8406                 ulocks[i].brltype = UNLOCK_LOCK;
8407         }
8408
8409         /* Now do any requested locks */
8410         data += ((large_file_format ? 20 : 10)*num_ulocks);
8411
8412         /* Data now points at the beginning of the list
8413            of smb_lkrng structs */
8414
8415         for(i = 0; i < (int)num_locks; i++) {
8416                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8417                 locks[i].count = get_lock_count(data, i, large_file_format);
8418                 locks[i].offset = get_lock_offset(data, i, large_file_format);
8419
8420                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8421                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8422                                 locks[i].brltype = PENDING_READ_LOCK;
8423                         } else {
8424                                 locks[i].brltype = READ_LOCK;
8425                         }
8426                 } else {
8427                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8428                                 locks[i].brltype = PENDING_WRITE_LOCK;
8429                         } else {
8430                                 locks[i].brltype = WRITE_LOCK;
8431                         }
8432                 }
8433         }
8434
8435         status = smbd_do_unlocking(req, fsp, num_ulocks, ulocks);
8436         if (!NT_STATUS_IS_OK(status)) {
8437                 END_PROFILE(SMBlockingX);
8438                 reply_nterror(req, status);
8439                 return;
8440         }
8441
8442         status = smbd_do_locking(req, fsp,
8443                                  locktype, lock_timeout,
8444                                  num_locks, locks,
8445                                  &async);
8446         if (!NT_STATUS_IS_OK(status)) {
8447                 END_PROFILE(SMBlockingX);
8448                 reply_nterror(req, status);
8449                 return;
8450         }
8451         if (async) {
8452                 END_PROFILE(SMBlockingX);
8453                 return;
8454         }
8455
8456         reply_outbuf(req, 2, 0);
8457         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8458         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
8459
8460         DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8461                   fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8462
8463         END_PROFILE(SMBlockingX);
8464 }
8465
8466 #undef DBGC_CLASS
8467 #define DBGC_CLASS DBGC_ALL
8468
8469 /****************************************************************************
8470  Reply to a SMBreadbmpx (read block multiplex) request.
8471  Always reply with an error, if someone has a platform really needs this,
8472  please contact vl@samba.org
8473 ****************************************************************************/
8474
8475 void reply_readbmpx(struct smb_request *req)
8476 {
8477         START_PROFILE(SMBreadBmpx);
8478         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8479         END_PROFILE(SMBreadBmpx);
8480         return;
8481 }
8482
8483 /****************************************************************************
8484  Reply to a SMBreadbs (read block multiplex secondary) request.
8485  Always reply with an error, if someone has a platform really needs this,
8486  please contact vl@samba.org
8487 ****************************************************************************/
8488
8489 void reply_readbs(struct smb_request *req)
8490 {
8491         START_PROFILE(SMBreadBs);
8492         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8493         END_PROFILE(SMBreadBs);
8494         return;
8495 }
8496
8497 /****************************************************************************
8498  Reply to a SMBsetattrE.
8499 ****************************************************************************/
8500
8501 void reply_setattrE(struct smb_request *req)
8502 {
8503         connection_struct *conn = req->conn;
8504         struct smb_file_time ft;
8505         files_struct *fsp;
8506         NTSTATUS status;
8507
8508         START_PROFILE(SMBsetattrE);
8509         ZERO_STRUCT(ft);
8510
8511         if (req->wct < 7) {
8512                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8513                 goto out;
8514         }
8515
8516         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8517
8518         if(!fsp || (fsp->conn != conn)) {
8519                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8520                 goto out;
8521         }
8522
8523         /*
8524          * Convert the DOS times into unix times.
8525          */
8526
8527         ft.atime = convert_time_t_to_timespec(
8528             srv_make_unix_date2(req->vwv+3));
8529         ft.mtime = convert_time_t_to_timespec(
8530             srv_make_unix_date2(req->vwv+5));
8531         ft.create_time = convert_time_t_to_timespec(
8532             srv_make_unix_date2(req->vwv+1));
8533
8534         reply_outbuf(req, 0, 0);
8535
8536         /*
8537          * Patch from Ray Frush <frush@engr.colostate.edu>
8538          * Sometimes times are sent as zero - ignore them.
8539          */
8540
8541         /* Ensure we have a valid stat struct for the source. */
8542         status = vfs_stat_fsp(fsp);
8543         if (!NT_STATUS_IS_OK(status)) {
8544                 reply_nterror(req, status);
8545                 goto out;
8546         }
8547
8548         if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8549                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8550                 goto out;
8551         }
8552
8553         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8554         if (!NT_STATUS_IS_OK(status)) {
8555                 reply_nterror(req, status);
8556                 goto out;
8557         }
8558
8559         DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8560                " createtime=%u\n",
8561                 fsp_fnum_dbg(fsp),
8562                 (unsigned int)ft.atime.tv_sec,
8563                 (unsigned int)ft.mtime.tv_sec,
8564                 (unsigned int)ft.create_time.tv_sec
8565                 ));
8566  out:
8567         END_PROFILE(SMBsetattrE);
8568         return;
8569 }
8570
8571
8572 /* Back from the dead for OS/2..... JRA. */
8573
8574 /****************************************************************************
8575  Reply to a SMBwritebmpx (write block multiplex primary) request.
8576  Always reply with an error, if someone has a platform really needs this,
8577  please contact vl@samba.org
8578 ****************************************************************************/
8579
8580 void reply_writebmpx(struct smb_request *req)
8581 {
8582         START_PROFILE(SMBwriteBmpx);
8583         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8584         END_PROFILE(SMBwriteBmpx);
8585         return;
8586 }
8587
8588 /****************************************************************************
8589  Reply to a SMBwritebs (write block multiplex secondary) request.
8590  Always reply with an error, if someone has a platform really needs this,
8591  please contact vl@samba.org
8592 ****************************************************************************/
8593
8594 void reply_writebs(struct smb_request *req)
8595 {
8596         START_PROFILE(SMBwriteBs);
8597         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8598         END_PROFILE(SMBwriteBs);
8599         return;
8600 }
8601
8602 /****************************************************************************
8603  Reply to a SMBgetattrE.
8604 ****************************************************************************/
8605
8606 void reply_getattrE(struct smb_request *req)
8607 {
8608         connection_struct *conn = req->conn;
8609         int mode;
8610         files_struct *fsp;
8611         struct timespec create_ts;
8612
8613         START_PROFILE(SMBgetattrE);
8614
8615         if (req->wct < 1) {
8616                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8617                 END_PROFILE(SMBgetattrE);
8618                 return;
8619         }
8620
8621         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8622
8623         if(!fsp || (fsp->conn != conn)) {
8624                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8625                 END_PROFILE(SMBgetattrE);
8626                 return;
8627         }
8628
8629         /* Do an fstat on this file */
8630         if(fsp_stat(fsp)) {
8631                 reply_nterror(req, map_nt_error_from_unix(errno));
8632                 END_PROFILE(SMBgetattrE);
8633                 return;
8634         }
8635
8636         mode = dos_mode(conn, fsp->fsp_name);
8637
8638         /*
8639          * Convert the times into dos times. Set create
8640          * date to be last modify date as UNIX doesn't save
8641          * this.
8642          */
8643
8644         reply_outbuf(req, 11, 0);
8645
8646         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8647         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8648         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8649                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8650         /* Should we check pending modtime here ? JRA */
8651         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8652                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8653
8654         if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8655                 SIVAL(req->outbuf, smb_vwv6, 0);
8656                 SIVAL(req->outbuf, smb_vwv8, 0);
8657         } else {
8658                 uint32_t allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8659                 SIVAL(req->outbuf, smb_vwv6, (uint32_t)fsp->fsp_name->st.st_ex_size);
8660                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8661         }
8662         SSVAL(req->outbuf,smb_vwv10, mode);
8663
8664         DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8665
8666         END_PROFILE(SMBgetattrE);
8667         return;
8668 }