source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "smbd/globals.h"
  29
  30 /****************************************************************************
  31  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  32  path or anything including wildcards.
  33  We're assuming here that '/' is not the second byte in any multibyte char
  34  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  35  set.
  36 ****************************************************************************/
  37
  38 /* Custom version for processing POSIX paths. */
  39 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  40
  41 static NTSTATUS check_path_syntax_internal(char *path,
  42                                            bool posix_path,
  43                                            bool *p_last_component_contains_wcard)
  44 {
  45         char *d = path;
  46         const char *s = path;
  47         NTSTATUS ret = NT_STATUS_OK;
  48         bool start_of_name_component = True;
  49         bool stream_started = false;
  50
  51         *p_last_component_contains_wcard = False;
  52
  53         while (*s) {
  54                 if (stream_started) {
  55                         switch (*s) {
  56                         case '/':
  57                         case '\\':
  58                                 return NT_STATUS_OBJECT_NAME_INVALID;
  59                         case ':':
  60                                 if (s[1] == '\0') {
  61                                         return NT_STATUS_OBJECT_NAME_INVALID;
  62                                 }
  63                                 if (strchr_m(&s[1], ':')) {
  64                                         return NT_STATUS_OBJECT_NAME_INVALID;
  65                                 }
  66                                 break;
  67                         }
  68                 }
  69
  70                 if ((*s == ':') && !posix_path && !stream_started) {
  71                         if (*p_last_component_contains_wcard) {
  72                                 return NT_STATUS_OBJECT_NAME_INVALID;
  73                         }
  74                         /* Stream names allow more characters than file names.
  75                            We're overloading posix_path here to allow a wider
  76                            range of characters. If stream_started is true this
  77                            is still a Windows path even if posix_path is true.
  78                            JRA.
  79                         */
  80                         stream_started = true;
  81                         start_of_name_component = false;
  82                         posix_path = true;
  83
  84                         if (s[1] == '\0') {
  85                                 return NT_STATUS_OBJECT_NAME_INVALID;
  86                         }
  87                 }
  88
  89                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
  90                         /*
  91                          * Safe to assume is not the second part of a mb char
  92                          * as this is handled below.
  93                          */
  94                         /* Eat multiple '/' or '\\' */
  95                         while (IS_PATH_SEP(*s,posix_path)) {
  96                                 s++;
  97                         }
  98                         if ((d != path) && (*s != '\0')) {
  99                                 /* We only care about non-leading or trailing '/' or '\\' */
 100                                 *d++ = '/';
 101                         }
 102
 103                         start_of_name_component = True;
 104                         /* New component. */
 105                         *p_last_component_contains_wcard = False;
 106                         continue;
 107                 }
 108
 109                 if (start_of_name_component) {
 110                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 111                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 112
 113                                 /*
 114                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 115                                  */
 116
 117                                 /* If  we just added a '/' - delete it */
 118                                 if ((d > path) && (*(d-1) == '/')) {
 119                                         *(d-1) = '\0';
 120                                         d--;
 121                                 }
 122
 123                                 /* Are we at the start ? Can't go back further if so. */
 124                                 if (d <= path) {
 125                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 126                                         break;
 127                                 }
 128                                 /* Go back one level... */
 129                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 130                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 131                                 /* Decrement d first as d points to the *next* char to write into. */
 132                                 for (d--; d > path; d--) {
 133                                         if (*d == '/')
 134                                                 break;
 135                                 }
 136                                 s += 2; /* Else go past the .. */
 137                                 /* We're still at the start of a name component, just the previous one. */
 138                                 continue;
 139
 140                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 141                                 if (posix_path) {
 142                                         /* Eat the '.' */
 143                                         s++;
 144                                         continue;
 145                                 }
 146                         }
 147
 148                 }
 149
 150                 if (!(*s & 0x80)) {
 151                         if (!posix_path) {
 152                                 if (*s <= 0x1f || *s == '|') {
 153                                         return NT_STATUS_OBJECT_NAME_INVALID;
 154                                 }
 155                                 switch (*s) {
 156                                         case '*':
 157                                         case '?':
 158                                         case '<':
 159                                         case '>':
 160                                         case '"':
 161                                                 *p_last_component_contains_wcard = True;
 162                                                 break;
 163                                         default:
 164                                                 break;
 165                                 }
 166                         }
 167                         *d++ = *s++;
 168                 } else {
 169                         size_t siz;
 170                         /* Get the size of the next MB character. */
 171                         next_codepoint(s,&siz);
 172                         switch(siz) {
 173                                 case 5:
 174                                         *d++ = *s++;
 175                                         /*fall through*/
 176                                 case 4:
 177                                         *d++ = *s++;
 178                                         /*fall through*/
 179                                 case 3:
 180                                         *d++ = *s++;
 181                                         /*fall through*/
 182                                 case 2:
 183                                         *d++ = *s++;
 184                                         /*fall through*/
 185                                 case 1:
 186                                         *d++ = *s++;
 187                                         break;
 188                                 default:
 189                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 190                                         *d = '\0';
 191                                         return NT_STATUS_INVALID_PARAMETER;
 192                         }
 193                 }
 194                 start_of_name_component = False;
 195         }
 196
 197         *d = '\0';
 198
 199         return ret;
 200 }
 201
 202 /****************************************************************************
 203  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 204  No wildcards allowed.
 205 ****************************************************************************/
 206
 207 NTSTATUS check_path_syntax(char *path)
 208 {
 209         bool ignore;
 210         return check_path_syntax_internal(path, False, &ignore);
 211 }
 212
 213 /****************************************************************************
 214  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 215  Wildcards allowed - p_contains_wcard returns true if the last component contained
 216  a wildcard.
 217 ****************************************************************************/
 218
 219 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 220 {
 221         return check_path_syntax_internal(path, False, p_contains_wcard);
 222 }
 223
 224 /****************************************************************************
 225  Check the path for a POSIX client.
 226  We're assuming here that '/' is not the second byte in any multibyte char
 227  set (a safe assumption).
 228 ****************************************************************************/
 229
 230 NTSTATUS check_path_syntax_posix(char *path)
 231 {
 232         bool ignore;
 233         return check_path_syntax_internal(path, True, &ignore);
 234 }
 235
 236 /****************************************************************************
 237  Pull a string and check the path allowing a wilcard - provide for error return.
 238 ****************************************************************************/
 239
 240 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 241                         const char *base_ptr,
 242                         uint16 smb_flags2,
 243                         char **pp_dest,
 244                         const char *src,
 245                         size_t src_len,
 246                         int flags,
 247                         NTSTATUS *err,
 248                         bool *contains_wcard)
 249 {
 250         size_t ret;
 251
 252         *pp_dest = NULL;
 253
 254         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 255                                  src_len, flags);
 256
 257         if (!*pp_dest) {
 258                 *err = NT_STATUS_INVALID_PARAMETER;
 259                 return ret;
 260         }
 261
 262         *contains_wcard = False;
 263
 264         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 265                 /*
 266                  * For a DFS path the function parse_dfs_path()
 267                  * will do the path processing, just make a copy.
 268                  */
 269                 *err = NT_STATUS_OK;
 270                 return ret;
 271         }
 272
 273         if (lp_posix_pathnames()) {
 274                 *err = check_path_syntax_posix(*pp_dest);
 275         } else {
 276                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 277         }
 278
 279         return ret;
 280 }
 281
 282 /****************************************************************************
 283  Pull a string and check the path - provide for error return.
 284 ****************************************************************************/
 285
 286 size_t srvstr_get_path(TALLOC_CTX *ctx,
 287                         const char *base_ptr,
 288                         uint16 smb_flags2,
 289                         char **pp_dest,
 290                         const char *src,
 291                         size_t src_len,
 292                         int flags,
 293                         NTSTATUS *err)
 294 {
 295         bool ignore;
 296         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 297                                      src_len, flags, err, &ignore);
 298 }
 299
 300 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 301                                  char **pp_dest, const char *src, int flags,
 302                                  NTSTATUS *err, bool *contains_wcard)
 303 {
 304         return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
 305                                      pp_dest, src, smbreq_bufrem(req, src),
 306                                      flags, err, contains_wcard);
 307 }
 308
 309 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 310                            char **pp_dest, const char *src, int flags,
 311                            NTSTATUS *err)
 312 {
 313         bool ignore;
 314         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 315                                          flags, err, &ignore);
 316 }
 317
 318 /****************************************************************************
 319  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 320 ****************************************************************************/
 321
 322 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 323                     files_struct *fsp)
 324 {
 325         if (!(fsp) || !(conn)) {
 326                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 327                 return False;
 328         }
 329         if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
 330                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 331                 return False;
 332         }
 333         return True;
 334 }
 335
 336 /****************************************************************************
 337  Check if we have a correct fsp pointing to a file.
 338 ****************************************************************************/
 339
 340 bool check_fsp(connection_struct *conn, struct smb_request *req,
 341                files_struct *fsp)
 342 {
 343         if (!check_fsp_open(conn, req, fsp)) {
 344                 return False;
 345         }
 346         if ((fsp)->is_directory) {
 347                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 348                 return False;
 349         }
 350         if ((fsp)->fh->fd == -1) {
 351                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 352                 return False;
 353         }
 354         (fsp)->num_smb_operations++;
 355         return True;
 356 }
 357
 358 /****************************************************************************
 359  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 360  the CHECK_NTQUOTA_HANDLE_OK macro.
 361 ****************************************************************************/
 362
 363 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 364                               files_struct *fsp)
 365 {
 366         if (!check_fsp_open(conn, req, fsp)) {
 367                 return false;
 368         }
 369
 370         if (fsp->is_directory) {
 371                 return false;
 372         }
 373
 374         if (fsp->fake_file_handle == NULL) {
 375                 return false;
 376         }
 377
 378         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 379                 return false;
 380         }
 381
 382         if (fsp->fake_file_handle->private_data == NULL) {
 383                 return false;
 384         }
 385
 386         return true;
 387 }
 388
 389 /****************************************************************************
 390  Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
 391 ****************************************************************************/
 392
 393 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
 394                       files_struct *fsp)
 395 {
 396         if ((fsp) && (conn) && ((conn)==(fsp)->conn)
 397             && (req->vuid == (fsp)->vuid)) {
 398                 return True;
 399         }
 400
 401         reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 402         return False;
 403 }
 404
 405 static bool netbios_session_retarget(const char *name, int name_type)
 406 {
 407         char *trim_name;
 408         char *trim_name_type;
 409         const char *retarget_parm;
 410         char *retarget;
 411         char *p;
 412         int retarget_type = 0x20;
 413         int retarget_port = 139;
 414         struct sockaddr_storage retarget_addr;
 415         struct sockaddr_in *in_addr;
 416         bool ret = false;
 417         uint8_t outbuf[10];
 418
 419         if (get_socket_port(smbd_server_fd()) != 139) {
 420                 return false;
 421         }
 422
 423         trim_name = talloc_strdup(talloc_tos(), name);
 424         if (trim_name == NULL) {
 425                 goto fail;
 426         }
 427         trim_char(trim_name, ' ', ' ');
 428
 429         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 430                                          name_type);
 431         if (trim_name_type == NULL) {
 432                 goto fail;
 433         }
 434
 435         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 436                                              trim_name_type, NULL);
 437         if (retarget_parm == NULL) {
 438                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 439                                                      trim_name, NULL);
 440         }
 441         if (retarget_parm == NULL) {
 442                 goto fail;
 443         }
 444
 445         retarget = talloc_strdup(trim_name, retarget_parm);
 446         if (retarget == NULL) {
 447                 goto fail;
 448         }
 449
 450         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 451
 452         p = strchr(retarget, ':');
 453         if (p != NULL) {
 454                 *p++ = '\0';
 455                 retarget_port = atoi(p);
 456         }
 457
 458         p = strchr_m(retarget, '#');
 459         if (p != NULL) {
 460                 *p++ = '\0';
 461                 sscanf(p, "%x", &retarget_type);
 462         }
 463
 464         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 465         if (!ret) {
 466                 DEBUG(10, ("could not resolve %s\n", retarget));
 467                 goto fail;
 468         }
 469
 470         if (retarget_addr.ss_family != AF_INET) {
 471                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 472                 goto fail;
 473         }
 474
 475         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 476
 477         _smb_setlen(outbuf, 6);
 478         SCVAL(outbuf, 0, 0x84);
 479         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 480         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 481
 482         if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
 483                           NULL)) {
 484                 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
 485                                     "failed.");
 486         }
 487
 488         ret = true;
 489  fail:
 490         TALLOC_FREE(trim_name);
 491         return ret;
 492 }
 493
 494 /****************************************************************************
 495  Reply to a (netbios-level) special message.
 496 ****************************************************************************/
 497
 498 void reply_special(char *inbuf)
 499 {
 500         int msg_type = CVAL(inbuf,0);
 501         int msg_flags = CVAL(inbuf,1);
 502         fstring name1,name2;
 503         char name_type1, name_type2;
 504         struct smbd_server_connection *sconn = smbd_server_conn;
 505
 506         /*
 507          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 508          * calculation & friends (srv_send_smb uses that) we need the full smb
 509          * header.
 510          */
 511         char outbuf[smb_size];
 512
 513         *name1 = *name2 = 0;
 514
 515         memset(outbuf, '\0', sizeof(outbuf));
 516
 517         smb_setlen(outbuf,0);
 518
 519         switch (msg_type) {
 520         case 0x81: /* session request */
 521
 522                 if (sconn->nbt.got_session) {
 523                         exit_server_cleanly("multiple session request not permitted");
 524                 }
 525
 526                 SCVAL(outbuf,0,0x82);
 527                 SCVAL(outbuf,3,0);
 528                 if (name_len(inbuf+4) > 50 ||
 529                     name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
 530                         DEBUG(0,("Invalid name length in session request\n"));
 531                         return;
 532                 }
 533                 name_type1 = name_extract(inbuf,4,name1);
 534                 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
 535                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 536                          name1, name_type1, name2, name_type2));
 537
 538                 if (netbios_session_retarget(name1, name_type1)) {
 539                         exit_server_cleanly("retargeted client");
 540                 }
 541
 542                 set_local_machine_name(name1, True);
 543                 set_remote_machine_name(name2, True);
 544
 545                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 546                          get_local_machine_name(), get_remote_machine_name(),
 547                          name_type2));
 548
 549                 if (name_type2 == 'R') {
 550                         /* We are being asked for a pathworks session ---
 551                            no thanks! */
 552                         SCVAL(outbuf, 0,0x83);
 553                         break;
 554                 }
 555
 556                 /* only add the client's machine name to the list
 557                    of possibly valid usernames if we are operating
 558                    in share mode security */
 559                 if (lp_security() == SEC_SHARE) {
 560                         add_session_user(sconn, get_remote_machine_name());
 561                 }
 562
 563                 reload_services(True);
 564                 reopen_logs();
 565
 566                 sconn->nbt.got_session = true;
 567                 break;
 568
 569         case 0x89: /* session keepalive request
 570                       (some old clients produce this?) */
 571                 SCVAL(outbuf,0,SMBkeepalive);
 572                 SCVAL(outbuf,3,0);
 573                 break;
 574
 575         case 0x82: /* positive session response */
 576         case 0x83: /* negative session response */
 577         case 0x84: /* retarget session response */
 578                 DEBUG(0,("Unexpected session response\n"));
 579                 break;
 580
 581         case SMBkeepalive: /* session keepalive */
 582         default:
 583                 return;
 584         }
 585
 586         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 587                     msg_type, msg_flags));
 588
 589         srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
 590         return;
 591 }
 592
 593 /****************************************************************************
 594  Reply to a tcon.
 595  conn POINTER CAN BE NULL HERE !
 596 ****************************************************************************/
 597
 598 void reply_tcon(struct smb_request *req)
 599 {
 600         connection_struct *conn = req->conn;
 601         const char *service;
 602         char *service_buf = NULL;
 603         char *password = NULL;
 604         char *dev = NULL;
 605         int pwlen=0;
 606         NTSTATUS nt_status;
 607         const char *p;
 608         DATA_BLOB password_blob;
 609         TALLOC_CTX *ctx = talloc_tos();
 610         struct smbd_server_connection *sconn = req->sconn;
 611
 612         START_PROFILE(SMBtcon);
 613
 614         if (req->buflen < 4) {
 615                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 616                 END_PROFILE(SMBtcon);
 617                 return;
 618         }
 619
 620         p = (const char *)req->buf + 1;
 621         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 622         p += 1;
 623         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 624         p += pwlen+1;
 625         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 626         p += 1;
 627
 628         if (service_buf == NULL || password == NULL || dev == NULL) {
 629                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 630                 END_PROFILE(SMBtcon);
 631                 return;
 632         }
 633         p = strrchr_m(service_buf,'\\');
 634         if (p) {
 635                 service = p+1;
 636         } else {
 637                 service = service_buf;
 638         }
 639
 640         password_blob = data_blob(password, pwlen+1);
 641
 642         conn = make_connection(sconn,service,password_blob,dev,
 643                                req->vuid,&nt_status);
 644         req->conn = conn;
 645
 646         data_blob_clear_free(&password_blob);
 647
 648         if (!conn) {
 649                 reply_nterror(req, nt_status);
 650                 END_PROFILE(SMBtcon);
 651                 return;
 652         }
 653
 654         reply_outbuf(req, 2, 0);
 655         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 656         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 657         SSVAL(req->outbuf,smb_tid,conn->cnum);
 658
 659         DEBUG(3,("tcon service=%s cnum=%d\n",
 660                  service, conn->cnum));
 661
 662         END_PROFILE(SMBtcon);
 663         return;
 664 }
 665
 666 /****************************************************************************
 667  Reply to a tcon and X.
 668  conn POINTER CAN BE NULL HERE !
 669 ****************************************************************************/
 670
 671 void reply_tcon_and_X(struct smb_request *req)
 672 {
 673         connection_struct *conn = req->conn;
 674         const char *service = NULL;
 675         DATA_BLOB password;
 676         TALLOC_CTX *ctx = talloc_tos();
 677         /* what the cleint thinks the device is */
 678         char *client_devicetype = NULL;
 679         /* what the server tells the client the share represents */
 680         const char *server_devicetype;
 681         NTSTATUS nt_status;
 682         int passlen;
 683         char *path = NULL;
 684         const char *p, *q;
 685         uint16 tcon_flags;
 686         struct smbd_server_connection *sconn = req->sconn;
 687
 688         START_PROFILE(SMBtconX);
 689
 690         if (req->wct < 4) {
 691                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 692                 END_PROFILE(SMBtconX);
 693                 return;
 694         }
 695
 696         passlen = SVAL(req->vwv+3, 0);
 697         tcon_flags = SVAL(req->vwv+2, 0);
 698
 699         /* we might have to close an old one */
 700         if ((tcon_flags & 0x1) && conn) {
 701                 close_cnum(conn,req->vuid);
 702                 req->conn = NULL;
 703                 conn = NULL;
 704         }
 705
 706         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 707                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 708                 END_PROFILE(SMBtconX);
 709                 return;
 710         }
 711
 712         if (sconn->smb1.negprot.encrypted_passwords) {
 713                 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
 714                 if (lp_security() == SEC_SHARE) {
 715                         /*
 716                          * Security = share always has a pad byte
 717                          * after the password.
 718                          */
 719                         p = (const char *)req->buf + passlen + 1;
 720                 } else {
 721                         p = (const char *)req->buf + passlen;
 722                 }
 723         } else {
 724                 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
 725                 /* Ensure correct termination */
 726                 password.data[passlen]=0;
 727                 p = (const char *)req->buf + passlen + 1;
 728         }
 729
 730         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 731
 732         if (path == NULL) {
 733                 data_blob_clear_free(&password);
 734                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 735                 END_PROFILE(SMBtconX);
 736                 return;
 737         }
 738
 739         /*
 740          * the service name can be either: \\server\share
 741          * or share directly like on the DELL PowerVault 705
 742          */
 743         if (*path=='\\') {
 744                 q = strchr_m(path+2,'\\');
 745                 if (!q) {
 746                         data_blob_clear_free(&password);
 747                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 748                         END_PROFILE(SMBtconX);
 749                         return;
 750                 }
 751                 service = q+1;
 752         } else {
 753                 service = path;
 754         }
 755
 756         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 757                                 &client_devicetype, p,
 758                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 759
 760         if (client_devicetype == NULL) {
 761                 data_blob_clear_free(&password);
 762                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 763                 END_PROFILE(SMBtconX);
 764                 return;
 765         }
 766
 767         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 768
 769         conn = make_connection(sconn, service, password, client_devicetype,
 770                                req->vuid, &nt_status);
 771         req->conn =conn;
 772
 773         data_blob_clear_free(&password);
 774
 775         if (!conn) {
 776                 reply_nterror(req, nt_status);
 777                 END_PROFILE(SMBtconX);
 778                 return;
 779         }
 780
 781         if ( IS_IPC(conn) )
 782                 server_devicetype = "IPC";
 783         else if ( IS_PRINT(conn) )
 784                 server_devicetype = "LPT1:";
 785         else
 786                 server_devicetype = "A:";
 787
 788         if (get_Protocol() < PROTOCOL_NT1) {
 789                 reply_outbuf(req, 2, 0);
 790                 if (message_push_string(&req->outbuf, server_devicetype,
 791                                         STR_TERMINATE|STR_ASCII) == -1) {
 792                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 793                         END_PROFILE(SMBtconX);
 794                         return;
 795                 }
 796         } else {
 797                 /* NT sets the fstype of IPC$ to the null string */
 798                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 799
 800                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 801                         /* Return permissions. */
 802                         uint32 perm1 = 0;
 803                         uint32 perm2 = 0;
 804
 805                         reply_outbuf(req, 7, 0);
 806
 807                         if (IS_IPC(conn)) {
 808                                 perm1 = FILE_ALL_ACCESS;
 809                                 perm2 = FILE_ALL_ACCESS;
 810                         } else {
 811                                 perm1 = CAN_WRITE(conn) ?
 812                                                 SHARE_ALL_ACCESS :
 813                                                 SHARE_READ_ONLY;
 814                         }
 815
 816                         SIVAL(req->outbuf, smb_vwv3, perm1);
 817                         SIVAL(req->outbuf, smb_vwv5, perm2);
 818                 } else {
 819                         reply_outbuf(req, 3, 0);
 820                 }
 821
 822                 if ((message_push_string(&req->outbuf, server_devicetype,
 823                                          STR_TERMINATE|STR_ASCII) == -1)
 824                     || (message_push_string(&req->outbuf, fstype,
 825                                             STR_TERMINATE) == -1)) {
 826                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 827                         END_PROFILE(SMBtconX);
 828                         return;
 829                 }
 830
 831                 /* what does setting this bit do? It is set by NT4 and
 832                    may affect the ability to autorun mounted cdroms */
 833                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 834                       (lp_csc_policy(SNUM(conn)) << 2));
 835
 836                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
 837                         DEBUG(2,("Serving %s as a Dfs root\n",
 838                                  lp_servicename(SNUM(conn)) ));
 839                         SSVAL(req->outbuf, smb_vwv2,
 840                               SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
 841                 }
 842         }
 843
 844
 845         DEBUG(3,("tconX service=%s \n",
 846                  service));
 847
 848         /* set the incoming and outgoing tid to the just created one */
 849         SSVAL(req->inbuf,smb_tid,conn->cnum);
 850         SSVAL(req->outbuf,smb_tid,conn->cnum);
 851
 852         END_PROFILE(SMBtconX);
 853
 854         req->tid = conn->cnum;
 855         chain_reply(req);
 856         return;
 857 }
 858
 859 /****************************************************************************
 860  Reply to an unknown type.
 861 ****************************************************************************/
 862
 863 void reply_unknown_new(struct smb_request *req, uint8 type)
 864 {
 865         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 866                   smb_fn_name(type), type, type));
 867         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
 868         return;
 869 }
 870
 871 /****************************************************************************
 872  Reply to an ioctl.
 873  conn POINTER CAN BE NULL HERE !
 874 ****************************************************************************/
 875
 876 void reply_ioctl(struct smb_request *req)
 877 {
 878         connection_struct *conn = req->conn;
 879         uint16 device;
 880         uint16 function;
 881         uint32 ioctl_code;
 882         int replysize;
 883         char *p;
 884
 885         START_PROFILE(SMBioctl);
 886
 887         if (req->wct < 3) {
 888                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 889                 END_PROFILE(SMBioctl);
 890                 return;
 891         }
 892
 893         device     = SVAL(req->vwv+1, 0);
 894         function   = SVAL(req->vwv+2, 0);
 895         ioctl_code = (device << 16) + function;
 896
 897         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 898
 899         switch (ioctl_code) {
 900             case IOCTL_QUERY_JOB_INFO:
 901                     replysize = 32;
 902                     break;
 903             default:
 904                     reply_force_doserror(req, ERRSRV, ERRnosupport);
 905                     END_PROFILE(SMBioctl);
 906                     return;
 907         }
 908
 909         reply_outbuf(req, 8, replysize+1);
 910         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 911         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 912         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 913         p = smb_buf(req->outbuf);
 914         memset(p, '\0', replysize+1); /* valgrind-safe. */
 915         p += 1;          /* Allow for alignment */
 916
 917         switch (ioctl_code) {
 918                 case IOCTL_QUERY_JOB_INFO:
 919                 {
 920                         files_struct *fsp = file_fsp(
 921                                 req, SVAL(req->vwv+0, 0));
 922                         if (!fsp) {
 923                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 924                                 END_PROFILE(SMBioctl);
 925                                 return;
 926                         }
 927                         /* Job number */
 928                         if (fsp->print_file) {
 929                                 SSVAL(p, 0, fsp->print_file->rap_jobid);
 930                         } else {
 931                                 SSVAL(p, 0, 0);
 932                         }
 933                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 934                                     global_myname(), 15,
 935                                     STR_TERMINATE|STR_ASCII);
 936                         if (conn) {
 937                                 srvstr_push((char *)req->outbuf, req->flags2,
 938                                             p+18, lp_servicename(SNUM(conn)),
 939                                             13, STR_TERMINATE|STR_ASCII);
 940                         } else {
 941                                 memset(p+18, 0, 13);
 942                         }
 943                         break;
 944                 }
 945         }
 946
 947         END_PROFILE(SMBioctl);
 948         return;
 949 }
 950
 951 /****************************************************************************
 952  Strange checkpath NTSTATUS mapping.
 953 ****************************************************************************/
 954
 955 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
 956 {
 957         /* Strange DOS error code semantics only for checkpath... */
 958         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 959                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 960                         /* We need to map to ERRbadpath */
 961                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 962                 }
 963         }
 964         return status;
 965 }
 966
 967 /****************************************************************************
 968  Reply to a checkpath.
 969 ****************************************************************************/
 970
 971 void reply_checkpath(struct smb_request *req)
 972 {
 973         connection_struct *conn = req->conn;
 974         struct smb_filename *smb_fname = NULL;
 975         char *name = NULL;
 976         NTSTATUS status;
 977         TALLOC_CTX *ctx = talloc_tos();
 978
 979         START_PROFILE(SMBcheckpath);
 980
 981         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
 982                             STR_TERMINATE, &status);
 983
 984         if (!NT_STATUS_IS_OK(status)) {
 985                 status = map_checkpath_error(req->flags2, status);
 986                 reply_nterror(req, status);
 987                 END_PROFILE(SMBcheckpath);
 988                 return;
 989         }
 990
 991         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
 992
 993         status = filename_convert(ctx,
 994                                 conn,
 995                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
 996                                 name,
 997                                 0,
 998                                 NULL,
 999                                 &smb_fname);
1000
1001         if (!NT_STATUS_IS_OK(status)) {
1002                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1003                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1004                                         ERRSRV, ERRbadpath);
1005                         END_PROFILE(SMBcheckpath);
1006                         return;
1007                 }
1008                 goto path_err;
1009         }
1010
1011         if (!VALID_STAT(smb_fname->st) &&
1012             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1013                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1014                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1015                 status = map_nt_error_from_unix(errno);
1016                 goto path_err;
1017         }
1018
1019         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1020                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1021                                 ERRDOS, ERRbadpath);
1022                 goto out;
1023         }
1024
1025         reply_outbuf(req, 0, 0);
1026
1027  path_err:
1028         /* We special case this - as when a Windows machine
1029                 is parsing a path is steps through the components
1030                 one at a time - if a component fails it expects
1031                 ERRbadpath, not ERRbadfile.
1032         */
1033         status = map_checkpath_error(req->flags2, status);
1034         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1035                 /*
1036                  * Windows returns different error codes if
1037                  * the parent directory is valid but not the
1038                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1039                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1040                  * if the path is invalid.
1041                  */
1042                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1043                                 ERRDOS, ERRbadpath);
1044                 goto out;
1045         }
1046
1047         reply_nterror(req, status);
1048
1049  out:
1050         TALLOC_FREE(smb_fname);
1051         END_PROFILE(SMBcheckpath);
1052         return;
1053 }
1054
1055 /****************************************************************************
1056  Reply to a getatr.
1057 ****************************************************************************/
1058
1059 void reply_getatr(struct smb_request *req)
1060 {
1061         connection_struct *conn = req->conn;
1062         struct smb_filename *smb_fname = NULL;
1063         char *fname = NULL;
1064         int mode=0;
1065         SMB_OFF_T size=0;
1066         time_t mtime=0;
1067         const char *p;
1068         NTSTATUS status;
1069         TALLOC_CTX *ctx = talloc_tos();
1070         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1071
1072         START_PROFILE(SMBgetatr);
1073
1074         p = (const char *)req->buf + 1;
1075         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1076         if (!NT_STATUS_IS_OK(status)) {
1077                 reply_nterror(req, status);
1078                 goto out;
1079         }
1080
1081         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1082                 under WfWg - weird! */
1083         if (*fname == '\0') {
1084                 mode = aHIDDEN | aDIR;
1085                 if (!CAN_WRITE(conn)) {
1086                         mode |= aRONLY;
1087                 }
1088                 size = 0;
1089                 mtime = 0;
1090         } else {
1091                 status = filename_convert(ctx,
1092                                 conn,
1093                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1094                                 fname,
1095                                 0,
1096                                 NULL,
1097                                 &smb_fname);
1098                 if (!NT_STATUS_IS_OK(status)) {
1099                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1100                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1101                                                 ERRSRV, ERRbadpath);
1102                                 goto out;
1103                         }
1104                         reply_nterror(req, status);
1105                         goto out;
1106                 }
1107                 if (!VALID_STAT(smb_fname->st) &&
1108                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1109                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1110                                  smb_fname_str_dbg(smb_fname),
1111                                  strerror(errno)));
1112                         reply_nterror(req,  map_nt_error_from_unix(errno));
1113                         goto out;
1114                 }
1115
1116                 mode = dos_mode(conn, smb_fname);
1117                 size = smb_fname->st.st_ex_size;
1118
1119                 if (ask_sharemode) {
1120                         struct timespec write_time_ts;
1121                         struct file_id fileid;
1122
1123                         ZERO_STRUCT(write_time_ts);
1124                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1125                         get_file_infos(fileid, NULL, &write_time_ts);
1126                         if (!null_timespec(write_time_ts)) {
1127                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1128                         }
1129                 }
1130
1131                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1132                 if (mode & aDIR) {
1133                         size = 0;
1134                 }
1135         }
1136
1137         reply_outbuf(req, 10, 0);
1138
1139         SSVAL(req->outbuf,smb_vwv0,mode);
1140         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1141                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1142         } else {
1143                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1144         }
1145         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1146
1147         if (get_Protocol() >= PROTOCOL_NT1) {
1148                 SSVAL(req->outbuf, smb_flg2,
1149                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1150         }
1151
1152         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1153                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1154
1155  out:
1156         TALLOC_FREE(smb_fname);
1157         TALLOC_FREE(fname);
1158         END_PROFILE(SMBgetatr);
1159         return;
1160 }
1161
1162 /****************************************************************************
1163  Reply to a setatr.
1164 ****************************************************************************/
1165
1166 void reply_setatr(struct smb_request *req)
1167 {
1168         struct smb_file_time ft;
1169         connection_struct *conn = req->conn;
1170         struct smb_filename *smb_fname = NULL;
1171         char *fname = NULL;
1172         int mode;
1173         time_t mtime;
1174         const char *p;
1175         NTSTATUS status;
1176         TALLOC_CTX *ctx = talloc_tos();
1177
1178         START_PROFILE(SMBsetatr);
1179
1180         ZERO_STRUCT(ft);
1181
1182         if (req->wct < 2) {
1183                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1184                 goto out;
1185         }
1186
1187         p = (const char *)req->buf + 1;
1188         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1189         if (!NT_STATUS_IS_OK(status)) {
1190                 reply_nterror(req, status);
1191                 goto out;
1192         }
1193
1194         status = filename_convert(ctx,
1195                                 conn,
1196                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1197                                 fname,
1198                                 0,
1199                                 NULL,
1200                                 &smb_fname);
1201         if (!NT_STATUS_IS_OK(status)) {
1202                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1203                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1204                                         ERRSRV, ERRbadpath);
1205                         goto out;
1206                 }
1207                 reply_nterror(req, status);
1208                 goto out;
1209         }
1210
1211         if (smb_fname->base_name[0] == '.' &&
1212             smb_fname->base_name[1] == '\0') {
1213                 /*
1214                  * Not sure here is the right place to catch this
1215                  * condition. Might be moved to somewhere else later -- vl
1216                  */
1217                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1218                 goto out;
1219         }
1220
1221         mode = SVAL(req->vwv+0, 0);
1222         mtime = srv_make_unix_date3(req->vwv+1);
1223
1224         ft.mtime = convert_time_t_to_timespec(mtime);
1225         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1226         if (!NT_STATUS_IS_OK(status)) {
1227                 reply_nterror(req, status);
1228                 goto out;
1229         }
1230
1231         if (mode != FILE_ATTRIBUTE_NORMAL) {
1232                 if (VALID_STAT_OF_DIR(smb_fname->st))
1233                         mode |= aDIR;
1234                 else
1235                         mode &= ~aDIR;
1236
1237                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1238                                      false) != 0) {
1239                         reply_nterror(req, map_nt_error_from_unix(errno));
1240                         goto out;
1241                 }
1242         }
1243
1244         reply_outbuf(req, 0, 0);
1245
1246         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1247                  mode));
1248  out:
1249         TALLOC_FREE(smb_fname);
1250         END_PROFILE(SMBsetatr);
1251         return;
1252 }
1253
1254 /****************************************************************************
1255  Reply to a dskattr.
1256 ****************************************************************************/
1257
1258 void reply_dskattr(struct smb_request *req)
1259 {
1260         connection_struct *conn = req->conn;
1261         uint64_t dfree,dsize,bsize;
1262         START_PROFILE(SMBdskattr);
1263
1264         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1265                 reply_nterror(req, map_nt_error_from_unix(errno));
1266                 END_PROFILE(SMBdskattr);
1267                 return;
1268         }
1269
1270         reply_outbuf(req, 5, 0);
1271
1272         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1273                 double total_space, free_space;
1274                 /* we need to scale this to a number that DOS6 can handle. We
1275                    use floating point so we can handle large drives on systems
1276                    that don't have 64 bit integers
1277
1278                    we end up displaying a maximum of 2G to DOS systems
1279                 */
1280                 total_space = dsize * (double)bsize;
1281                 free_space = dfree * (double)bsize;
1282
1283                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1284                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1285
1286                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1287                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1288
1289                 SSVAL(req->outbuf,smb_vwv0,dsize);
1290                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1291                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1292                 SSVAL(req->outbuf,smb_vwv3,dfree);
1293         } else {
1294                 SSVAL(req->outbuf,smb_vwv0,dsize);
1295                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1296                 SSVAL(req->outbuf,smb_vwv2,512);
1297                 SSVAL(req->outbuf,smb_vwv3,dfree);
1298         }
1299
1300         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1301
1302         END_PROFILE(SMBdskattr);
1303         return;
1304 }
1305
1306 /*
1307  * Utility function to split the filename from the directory.
1308  */
1309 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1310                                      char **fname_dir_out,
1311                                      char **fname_mask_out)
1312 {
1313         const char *p = NULL;
1314         char *fname_dir = NULL;
1315         char *fname_mask = NULL;
1316
1317         p = strrchr_m(fname_in, '/');
1318         if (!p) {
1319                 fname_dir = talloc_strdup(ctx, ".");
1320                 fname_mask = talloc_strdup(ctx, fname_in);
1321         } else {
1322                 fname_dir = talloc_strndup(ctx, fname_in,
1323                     PTR_DIFF(p, fname_in));
1324                 fname_mask = talloc_strdup(ctx, p+1);
1325         }
1326
1327         if (!fname_dir || !fname_mask) {
1328                 TALLOC_FREE(fname_dir);
1329                 TALLOC_FREE(fname_mask);
1330                 return NT_STATUS_NO_MEMORY;
1331         }
1332
1333         *fname_dir_out = fname_dir;
1334         *fname_mask_out = fname_mask;
1335         return NT_STATUS_OK;
1336 }
1337
1338 /****************************************************************************
1339  Reply to a search.
1340  Can be called from SMBsearch, SMBffirst or SMBfunique.
1341 ****************************************************************************/
1342
1343 void reply_search(struct smb_request *req)
1344 {
1345         connection_struct *conn = req->conn;
1346         char *path = NULL;
1347         const char *mask = NULL;
1348         char *directory = NULL;
1349         struct smb_filename *smb_fname = NULL;
1350         char *fname = NULL;
1351         SMB_OFF_T size;
1352         uint32 mode;
1353         struct timespec date;
1354         uint32 dirtype;
1355         unsigned int numentries = 0;
1356         unsigned int maxentries = 0;
1357         bool finished = False;
1358         const char *p;
1359         int status_len;
1360         char status[21];
1361         int dptr_num= -1;
1362         bool check_descend = False;
1363         bool expect_close = False;
1364         NTSTATUS nt_status;
1365         bool mask_contains_wcard = False;
1366         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1367         TALLOC_CTX *ctx = talloc_tos();
1368         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1369         struct dptr_struct *dirptr = NULL;
1370         struct smbd_server_connection *sconn = req->sconn;
1371
1372         START_PROFILE(SMBsearch);
1373
1374         if (req->wct < 2) {
1375                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1376                 goto out;
1377         }
1378
1379         if (lp_posix_pathnames()) {
1380                 reply_unknown_new(req, req->cmd);
1381                 goto out;
1382         }
1383
1384         /* If we were called as SMBffirst then we must expect close. */
1385         if(req->cmd == SMBffirst) {
1386                 expect_close = True;
1387         }
1388
1389         reply_outbuf(req, 1, 3);
1390         maxentries = SVAL(req->vwv+0, 0);
1391         dirtype = SVAL(req->vwv+1, 0);
1392         p = (const char *)req->buf + 1;
1393         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1394                                        &nt_status, &mask_contains_wcard);
1395         if (!NT_STATUS_IS_OK(nt_status)) {
1396                 reply_nterror(req, nt_status);
1397                 goto out;
1398         }
1399
1400         p++;
1401         status_len = SVAL(p, 0);
1402         p += 2;
1403
1404         /* dirtype &= ~aDIR; */
1405
1406         if (status_len == 0) {
1407                 nt_status = filename_convert(ctx, conn,
1408                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1409                                              path,
1410                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1411                                              &mask_contains_wcard,
1412                                              &smb_fname);
1413                 if (!NT_STATUS_IS_OK(nt_status)) {
1414                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1415                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1416                                                 ERRSRV, ERRbadpath);
1417                                 goto out;
1418                         }
1419                         reply_nterror(req, nt_status);
1420                         goto out;
1421                 }
1422
1423                 directory = smb_fname->base_name;
1424
1425                 p = strrchr_m(directory,'/');
1426                 if ((p != NULL) && (*directory != '/')) {
1427                         mask = p + 1;
1428                         directory = talloc_strndup(ctx, directory,
1429                                                    PTR_DIFF(p, directory));
1430                 } else {
1431                         mask = directory;
1432                         directory = talloc_strdup(ctx,".");
1433                 }
1434
1435                 if (!directory) {
1436                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1437                         goto out;
1438                 }
1439
1440                 memset((char *)status,'\0',21);
1441                 SCVAL(status,0,(dirtype & 0x1F));
1442
1443                 nt_status = dptr_create(conn,
1444                                         directory,
1445                                         True,
1446                                         expect_close,
1447                                         req->smbpid,
1448                                         mask,
1449                                         mask_contains_wcard,
1450                                         dirtype,
1451                                         &dirptr);
1452                 if (!NT_STATUS_IS_OK(nt_status)) {
1453                         reply_nterror(req, nt_status);
1454                         goto out;
1455                 }
1456                 dptr_num = dptr_dnum(dirptr);
1457         } else {
1458                 int status_dirtype;
1459                 const char *dirpath;
1460
1461                 memcpy(status,p,21);
1462                 status_dirtype = CVAL(status,0) & 0x1F;
1463                 if (status_dirtype != (dirtype & 0x1F)) {
1464                         dirtype = status_dirtype;
1465                 }
1466
1467                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1468                 if (!dirptr) {
1469                         goto SearchEmpty;
1470                 }
1471                 dirpath = dptr_path(sconn, dptr_num);
1472                 directory = talloc_strdup(ctx, dirpath);
1473                 if (!directory) {
1474                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1475                         goto out;
1476                 }
1477
1478                 mask = dptr_wcard(sconn, dptr_num);
1479                 if (!mask) {
1480                         goto SearchEmpty;
1481                 }
1482                 /*
1483                  * For a 'continue' search we have no string. So
1484                  * check from the initial saved string.
1485                  */
1486                 mask_contains_wcard = ms_has_wild(mask);
1487                 dirtype = dptr_attr(sconn, dptr_num);
1488         }
1489
1490         DEBUG(4,("dptr_num is %d\n",dptr_num));
1491
1492         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1493         dptr_init_search_op(dirptr);
1494
1495         if ((dirtype&0x1F) == aVOLID) {
1496                 char buf[DIR_STRUCT_SIZE];
1497                 memcpy(buf,status,21);
1498                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1499                                 0,aVOLID,0,!allow_long_path_components)) {
1500                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1501                         goto out;
1502                 }
1503                 dptr_fill(sconn, buf+12,dptr_num);
1504                 if (dptr_zero(buf+12) && (status_len==0)) {
1505                         numentries = 1;
1506                 } else {
1507                         numentries = 0;
1508                 }
1509                 if (message_push_blob(&req->outbuf,
1510                                       data_blob_const(buf, sizeof(buf)))
1511                     == -1) {
1512                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1513                         goto out;
1514                 }
1515         } else {
1516                 unsigned int i;
1517                 maxentries = MIN(
1518                         maxentries,
1519                         ((BUFFER_SIZE -
1520                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1521                          /DIR_STRUCT_SIZE));
1522
1523                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1524                         directory,lp_dontdescend(SNUM(conn))));
1525                 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1526                         check_descend = True;
1527                 }
1528
1529                 for (i=numentries;(i<maxentries) && !finished;i++) {
1530                         finished = !get_dir_entry(ctx,
1531                                                   dirptr,
1532                                                   mask,
1533                                                   dirtype,
1534                                                   &fname,
1535                                                   &size,
1536                                                   &mode,
1537                                                   &date,
1538                                                   check_descend,
1539                                                   ask_sharemode);
1540                         if (!finished) {
1541                                 char buf[DIR_STRUCT_SIZE];
1542                                 memcpy(buf,status,21);
1543                                 if (!make_dir_struct(ctx,
1544                                                 buf,
1545                                                 mask,
1546                                                 fname,
1547                                                 size,
1548                                                 mode,
1549                                                 convert_timespec_to_time_t(date),
1550                                                 !allow_long_path_components)) {
1551                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1552                                         goto out;
1553                                 }
1554                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1555                                         break;
1556                                 }
1557                                 if (message_push_blob(&req->outbuf,
1558                                                       data_blob_const(buf, sizeof(buf)))
1559                                     == -1) {
1560                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1561                                         goto out;
1562                                 }
1563                                 numentries++;
1564                         }
1565                 }
1566         }
1567
1568   SearchEmpty:
1569
1570         /* If we were called as SMBffirst with smb_search_id == NULL
1571                 and no entries were found then return error and close dirptr
1572                 (X/Open spec) */
1573
1574         if (numentries == 0) {
1575                 dptr_close(sconn, &dptr_num);
1576         } else if(expect_close && status_len == 0) {
1577                 /* Close the dptr - we know it's gone */
1578                 dptr_close(sconn, &dptr_num);
1579         }
1580
1581         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1582         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1583                 dptr_close(sconn, &dptr_num);
1584         }
1585
1586         if ((numentries == 0) && !mask_contains_wcard) {
1587                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1588                 goto out;
1589         }
1590
1591         SSVAL(req->outbuf,smb_vwv0,numentries);
1592         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1593         SCVAL(smb_buf(req->outbuf),0,5);
1594         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1595
1596         /* The replies here are never long name. */
1597         SSVAL(req->outbuf, smb_flg2,
1598               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1599         if (!allow_long_path_components) {
1600                 SSVAL(req->outbuf, smb_flg2,
1601                       SVAL(req->outbuf, smb_flg2)
1602                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1603         }
1604
1605         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1606         SSVAL(req->outbuf, smb_flg2,
1607               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1608
1609         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1610                 smb_fn_name(req->cmd),
1611                 mask,
1612                 directory,
1613                 dirtype,
1614                 numentries,
1615                 maxentries ));
1616  out:
1617         TALLOC_FREE(directory);
1618         TALLOC_FREE(smb_fname);
1619         END_PROFILE(SMBsearch);
1620         return;
1621 }
1622
1623 /****************************************************************************
1624  Reply to a fclose (stop directory search).
1625 ****************************************************************************/
1626
1627 void reply_fclose(struct smb_request *req)
1628 {
1629         int status_len;
1630         char status[21];
1631         int dptr_num= -2;
1632         const char *p;
1633         char *path = NULL;
1634         NTSTATUS err;
1635         bool path_contains_wcard = False;
1636         TALLOC_CTX *ctx = talloc_tos();
1637         struct smbd_server_connection *sconn = req->sconn;
1638
1639         START_PROFILE(SMBfclose);
1640
1641         if (lp_posix_pathnames()) {
1642                 reply_unknown_new(req, req->cmd);
1643                 END_PROFILE(SMBfclose);
1644                 return;
1645         }
1646
1647         p = (const char *)req->buf + 1;
1648         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1649                                        &err, &path_contains_wcard);
1650         if (!NT_STATUS_IS_OK(err)) {
1651                 reply_nterror(req, err);
1652                 END_PROFILE(SMBfclose);
1653                 return;
1654         }
1655         p++;
1656         status_len = SVAL(p,0);
1657         p += 2;
1658
1659         if (status_len == 0) {
1660                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1661                 END_PROFILE(SMBfclose);
1662                 return;
1663         }
1664
1665         memcpy(status,p,21);
1666
1667         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1668                 /*  Close the dptr - we know it's gone */
1669                 dptr_close(sconn, &dptr_num);
1670         }
1671
1672         reply_outbuf(req, 1, 0);
1673         SSVAL(req->outbuf,smb_vwv0,0);
1674
1675         DEBUG(3,("search close\n"));
1676
1677         END_PROFILE(SMBfclose);
1678         return;
1679 }
1680
1681 /****************************************************************************
1682  Reply to an open.
1683 ****************************************************************************/
1684
1685 void reply_open(struct smb_request *req)
1686 {
1687         connection_struct *conn = req->conn;
1688         struct smb_filename *smb_fname = NULL;
1689         char *fname = NULL;
1690         uint32 fattr=0;
1691         SMB_OFF_T size = 0;
1692         time_t mtime=0;
1693         int info;
1694         files_struct *fsp;
1695         int oplock_request;
1696         int deny_mode;
1697         uint32 dos_attr;
1698         uint32 access_mask;
1699         uint32 share_mode;
1700         uint32 create_disposition;
1701         uint32 create_options = 0;
1702         uint32_t private_flags = 0;
1703         NTSTATUS status;
1704         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1705         TALLOC_CTX *ctx = talloc_tos();
1706
1707         START_PROFILE(SMBopen);
1708
1709         if (req->wct < 2) {
1710                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1711                 goto out;
1712         }
1713
1714         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1715         deny_mode = SVAL(req->vwv+0, 0);
1716         dos_attr = SVAL(req->vwv+1, 0);
1717
1718         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1719                             STR_TERMINATE, &status);
1720         if (!NT_STATUS_IS_OK(status)) {
1721                 reply_nterror(req, status);
1722                 goto out;
1723         }
1724
1725         status = filename_convert(ctx,
1726                                 conn,
1727                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1728                                 fname,
1729                                 0,
1730                                 NULL,
1731                                 &smb_fname);
1732         if (!NT_STATUS_IS_OK(status)) {
1733                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1734                         reply_botherror(req,
1735                                         NT_STATUS_PATH_NOT_COVERED,
1736                                         ERRSRV, ERRbadpath);
1737                         goto out;
1738                 }
1739                 reply_nterror(req, status);
1740                 goto out;
1741         }
1742
1743         if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1744                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1745                                          &share_mode, &create_disposition,
1746                                          &create_options, &private_flags)) {
1747                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1748                 goto out;
1749         }
1750
1751         status = SMB_VFS_CREATE_FILE(
1752                 conn,                                   /* conn */
1753                 req,                                    /* req */
1754                 0,                                      /* root_dir_fid */
1755                 smb_fname,                              /* fname */
1756                 access_mask,                            /* access_mask */
1757                 share_mode,                             /* share_access */
1758                 create_disposition,                     /* create_disposition*/
1759                 create_options,                         /* create_options */
1760                 dos_attr,                               /* file_attributes */
1761                 oplock_request,                         /* oplock_request */
1762                 0,                                      /* allocation_size */
1763                 private_flags,
1764                 NULL,                                   /* sd */
1765                 NULL,                                   /* ea_list */
1766                 &fsp,                                   /* result */
1767                 &info);                                 /* pinfo */
1768
1769         if (!NT_STATUS_IS_OK(status)) {
1770                 if (open_was_deferred(req->mid)) {
1771                         /* We have re-scheduled this call. */
1772                         goto out;
1773                 }
1774                 reply_openerror(req, status);
1775                 goto out;
1776         }
1777
1778         size = smb_fname->st.st_ex_size;
1779         fattr = dos_mode(conn, smb_fname);
1780
1781         /* Deal with other possible opens having a modified
1782            write time. JRA. */
1783         if (ask_sharemode) {
1784                 struct timespec write_time_ts;
1785
1786                 ZERO_STRUCT(write_time_ts);
1787                 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1788                 if (!null_timespec(write_time_ts)) {
1789                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1790                 }
1791         }
1792
1793         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1794
1795         if (fattr & aDIR) {
1796                 DEBUG(3,("attempt to open a directory %s\n",
1797                          fsp_str_dbg(fsp)));
1798                 close_file(req, fsp, ERROR_CLOSE);
1799                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1800                         ERRDOS, ERRnoaccess);
1801                 goto out;
1802         }
1803
1804         reply_outbuf(req, 7, 0);
1805         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1806         SSVAL(req->outbuf,smb_vwv1,fattr);
1807         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1808                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1809         } else {
1810                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1811         }
1812         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1813         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1814
1815         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1816                 SCVAL(req->outbuf,smb_flg,
1817                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1818         }
1819
1820         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1821                 SCVAL(req->outbuf,smb_flg,
1822                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1823         }
1824  out:
1825         TALLOC_FREE(smb_fname);
1826         END_PROFILE(SMBopen);
1827         return;
1828 }
1829
1830 /****************************************************************************
1831  Reply to an open and X.
1832 ****************************************************************************/
1833
1834 void reply_open_and_X(struct smb_request *req)
1835 {
1836         connection_struct *conn = req->conn;
1837         struct smb_filename *smb_fname = NULL;
1838         char *fname = NULL;
1839         uint16 open_flags;
1840         int deny_mode;
1841         uint32 smb_attr;
1842         /* Breakout the oplock request bits so we can set the
1843                 reply bits separately. */
1844         int ex_oplock_request;
1845         int core_oplock_request;
1846         int oplock_request;
1847 #if 0
1848         int smb_sattr = SVAL(req->vwv+4, 0);
1849         uint32 smb_time = make_unix_date3(req->vwv+6);
1850 #endif
1851         int smb_ofun;
1852         uint32 fattr=0;
1853         int mtime=0;
1854         int smb_action = 0;
1855         files_struct *fsp;
1856         NTSTATUS status;
1857         uint64_t allocation_size;
1858         ssize_t retval = -1;
1859         uint32 access_mask;
1860         uint32 share_mode;
1861         uint32 create_disposition;
1862         uint32 create_options = 0;
1863         uint32_t private_flags = 0;
1864         TALLOC_CTX *ctx = talloc_tos();
1865
1866         START_PROFILE(SMBopenX);
1867
1868         if (req->wct < 15) {
1869                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1870                 goto out;
1871         }
1872
1873         open_flags = SVAL(req->vwv+2, 0);
1874         deny_mode = SVAL(req->vwv+3, 0);
1875         smb_attr = SVAL(req->vwv+5, 0);
1876         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1877         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1878         oplock_request = ex_oplock_request | core_oplock_request;
1879         smb_ofun = SVAL(req->vwv+8, 0);
1880         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1881
1882         /* If it's an IPC, pass off the pipe handler. */
1883         if (IS_IPC(conn)) {
1884                 if (lp_nt_pipe_support()) {
1885                         reply_open_pipe_and_X(conn, req);
1886                 } else {
1887                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1888                 }
1889                 goto out;
1890         }
1891
1892         /* XXXX we need to handle passed times, sattr and flags */
1893         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1894                         STR_TERMINATE, &status);
1895         if (!NT_STATUS_IS_OK(status)) {
1896                 reply_nterror(req, status);
1897                 goto out;
1898         }
1899
1900         status = filename_convert(ctx,
1901                                 conn,
1902                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1903                                 fname,
1904                                 0,
1905                                 NULL,
1906                                 &smb_fname);
1907         if (!NT_STATUS_IS_OK(status)) {
1908                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1909                         reply_botherror(req,
1910                                         NT_STATUS_PATH_NOT_COVERED,
1911                                         ERRSRV, ERRbadpath);
1912                         goto out;
1913                 }
1914                 reply_nterror(req, status);
1915                 goto out;
1916         }
1917
1918         if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1919                                          &access_mask, &share_mode,
1920                                          &create_disposition,
1921                                          &create_options,
1922                                          &private_flags)) {
1923                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1924                 goto out;
1925         }
1926
1927         status = SMB_VFS_CREATE_FILE(
1928                 conn,                                   /* conn */
1929                 req,                                    /* req */
1930                 0,                                      /* root_dir_fid */
1931                 smb_fname,                              /* fname */
1932                 access_mask,                            /* access_mask */
1933                 share_mode,                             /* share_access */
1934                 create_disposition,                     /* create_disposition*/
1935                 create_options,                         /* create_options */
1936                 smb_attr,                               /* file_attributes */
1937                 oplock_request,                         /* oplock_request */
1938                 0,                                      /* allocation_size */
1939                 private_flags,
1940                 NULL,                                   /* sd */
1941                 NULL,                                   /* ea_list */
1942                 &fsp,                                   /* result */
1943                 &smb_action);                           /* pinfo */
1944
1945         if (!NT_STATUS_IS_OK(status)) {
1946                 if (open_was_deferred(req->mid)) {
1947                         /* We have re-scheduled this call. */
1948                         goto out;
1949                 }
1950                 reply_openerror(req, status);
1951                 goto out;
1952         }
1953
1954         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1955            if the file is truncated or created. */
1956         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1957                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1958                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1959                         close_file(req, fsp, ERROR_CLOSE);
1960                         reply_nterror(req, NT_STATUS_DISK_FULL);
1961                         goto out;
1962                 }
1963                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1964                 if (retval < 0) {
1965                         close_file(req, fsp, ERROR_CLOSE);
1966                         reply_nterror(req, NT_STATUS_DISK_FULL);
1967                         goto out;
1968                 }
1969                 smb_fname->st.st_ex_size =
1970                     SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1971         }
1972
1973         fattr = dos_mode(conn, smb_fname);
1974         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1975         if (fattr & aDIR) {
1976                 close_file(req, fsp, ERROR_CLOSE);
1977                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1978                 goto out;
1979         }
1980
1981         /* If the caller set the extended oplock request bit
1982                 and we granted one (by whatever means) - set the
1983                 correct bit for extended oplock reply.
1984         */
1985
1986         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1987                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1988         }
1989
1990         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1991                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1992         }
1993
1994         /* If the caller set the core oplock request bit
1995                 and we granted one (by whatever means) - set the
1996                 correct bit for core oplock reply.
1997         */
1998
1999         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2000                 reply_outbuf(req, 19, 0);
2001         } else {
2002                 reply_outbuf(req, 15, 0);
2003         }
2004
2005         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2006                 SCVAL(req->outbuf, smb_flg,
2007                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2008         }
2009
2010         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2011                 SCVAL(req->outbuf, smb_flg,
2012                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2013         }
2014
2015         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2016         SSVAL(req->outbuf,smb_vwv3,fattr);
2017         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2018                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2019         } else {
2020                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2021         }
2022         SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2023         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2024         SSVAL(req->outbuf,smb_vwv11,smb_action);
2025
2026         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2027                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2028         }
2029
2030         chain_reply(req);
2031  out:
2032         TALLOC_FREE(smb_fname);
2033         END_PROFILE(SMBopenX);
2034         return;
2035 }
2036
2037 /****************************************************************************
2038  Reply to a SMBulogoffX.
2039 ****************************************************************************/
2040
2041 void reply_ulogoffX(struct smb_request *req)
2042 {
2043         struct smbd_server_connection *sconn = req->sconn;
2044         user_struct *vuser;
2045
2046         START_PROFILE(SMBulogoffX);
2047
2048         vuser = get_valid_user_struct(sconn, req->vuid);
2049
2050         if(vuser == NULL) {
2051                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2052                          req->vuid));
2053         }
2054
2055         /* in user level security we are supposed to close any files
2056                 open by this user */
2057         if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2058                 file_close_user(req->vuid);
2059         }
2060
2061         invalidate_vuid(sconn, req->vuid);
2062
2063         reply_outbuf(req, 2, 0);
2064
2065         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2066
2067         END_PROFILE(SMBulogoffX);
2068         req->vuid = UID_FIELD_INVALID;
2069         chain_reply(req);
2070 }
2071
2072 /****************************************************************************
2073  Reply to a mknew or a create.
2074 ****************************************************************************/
2075
2076 void reply_mknew(struct smb_request *req)
2077 {
2078         connection_struct *conn = req->conn;
2079         struct smb_filename *smb_fname = NULL;
2080         char *fname = NULL;
2081         uint32 fattr = 0;
2082         struct smb_file_time ft;
2083         files_struct *fsp;
2084         int oplock_request = 0;
2085         NTSTATUS status;
2086         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2087         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2088         uint32 create_disposition;
2089         uint32 create_options = 0;
2090         TALLOC_CTX *ctx = talloc_tos();
2091
2092         START_PROFILE(SMBcreate);
2093         ZERO_STRUCT(ft);
2094
2095         if (req->wct < 3) {
2096                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2097                 goto out;
2098         }
2099
2100         fattr = SVAL(req->vwv+0, 0);
2101         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2102
2103         /* mtime. */
2104         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2105
2106         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2107                             STR_TERMINATE, &status);
2108         if (!NT_STATUS_IS_OK(status)) {
2109                 reply_nterror(req, status);
2110                 goto out;
2111         }
2112
2113         status = filename_convert(ctx,
2114                                 conn,
2115                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2116                                 fname,
2117                                 0,
2118                                 NULL,
2119                                 &smb_fname);
2120         if (!NT_STATUS_IS_OK(status)) {
2121                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2122                         reply_botherror(req,
2123                                         NT_STATUS_PATH_NOT_COVERED,
2124                                         ERRSRV, ERRbadpath);
2125                         goto out;
2126                 }
2127                 reply_nterror(req, status);
2128                 goto out;
2129         }
2130
2131         if (fattr & aVOLID) {
2132                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2133                          "please report this\n",
2134                          smb_fname_str_dbg(smb_fname)));
2135         }
2136
2137         if(req->cmd == SMBmknew) {
2138                 /* We should fail if file exists. */
2139                 create_disposition = FILE_CREATE;
2140         } else {
2141                 /* Create if file doesn't exist, truncate if it does. */
2142                 create_disposition = FILE_OVERWRITE_IF;
2143         }
2144
2145         status = SMB_VFS_CREATE_FILE(
2146                 conn,                                   /* conn */
2147                 req,                                    /* req */
2148                 0,                                      /* root_dir_fid */
2149                 smb_fname,                              /* fname */
2150                 access_mask,                            /* access_mask */
2151                 share_mode,                             /* share_access */
2152                 create_disposition,                     /* create_disposition*/
2153                 create_options,                         /* create_options */
2154                 fattr,                                  /* file_attributes */
2155                 oplock_request,                         /* oplock_request */
2156                 0,                                      /* allocation_size */
2157                 0,                                      /* private_flags */
2158                 NULL,                                   /* sd */
2159                 NULL,                                   /* ea_list */
2160                 &fsp,                                   /* result */
2161                 NULL);                                  /* pinfo */
2162
2163         if (!NT_STATUS_IS_OK(status)) {
2164                 if (open_was_deferred(req->mid)) {
2165                         /* We have re-scheduled this call. */
2166                         goto out;
2167                 }
2168                 reply_openerror(req, status);
2169                 goto out;
2170         }
2171
2172         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2173         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2174         if (!NT_STATUS_IS_OK(status)) {
2175                 END_PROFILE(SMBcreate);
2176                 goto out;
2177         }
2178
2179         reply_outbuf(req, 1, 0);
2180         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2181
2182         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2183                 SCVAL(req->outbuf,smb_flg,
2184                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2185         }
2186
2187         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2188                 SCVAL(req->outbuf,smb_flg,
2189                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2190         }
2191
2192         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2193         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2194                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2195                   (unsigned int)fattr));
2196
2197  out:
2198         TALLOC_FREE(smb_fname);
2199         END_PROFILE(SMBcreate);
2200         return;
2201 }
2202
2203 /****************************************************************************
2204  Reply to a create temporary file.
2205 ****************************************************************************/
2206
2207 void reply_ctemp(struct smb_request *req)
2208 {
2209         connection_struct *conn = req->conn;
2210         struct smb_filename *smb_fname = NULL;
2211         char *fname = NULL;
2212         uint32 fattr;
2213         files_struct *fsp;
2214         int oplock_request;
2215         int tmpfd;
2216         char *s;
2217         NTSTATUS status;
2218         TALLOC_CTX *ctx = talloc_tos();
2219
2220         START_PROFILE(SMBctemp);
2221
2222         if (req->wct < 3) {
2223                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2224                 goto out;
2225         }
2226
2227         fattr = SVAL(req->vwv+0, 0);
2228         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2229
2230         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2231                             STR_TERMINATE, &status);
2232         if (!NT_STATUS_IS_OK(status)) {
2233                 reply_nterror(req, status);
2234                 goto out;
2235         }
2236         if (*fname) {
2237                 fname = talloc_asprintf(ctx,
2238                                 "%s/TMXXXXXX",
2239                                 fname);
2240         } else {
2241                 fname = talloc_strdup(ctx, "TMXXXXXX");
2242         }
2243
2244         if (!fname) {
2245                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2246                 goto out;
2247         }
2248
2249         status = filename_convert(ctx, conn,
2250                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2251                                 fname,
2252                                 0,
2253                                 NULL,
2254                                 &smb_fname);
2255         if (!NT_STATUS_IS_OK(status)) {
2256                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2257                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2258                                         ERRSRV, ERRbadpath);
2259                         goto out;
2260                 }
2261                 reply_nterror(req, status);
2262                 goto out;
2263         }
2264
2265         tmpfd = mkstemp(smb_fname->base_name);
2266         if (tmpfd == -1) {
2267                 reply_nterror(req, map_nt_error_from_unix(errno));
2268                 goto out;
2269         }
2270
2271         SMB_VFS_STAT(conn, smb_fname);
2272
2273         /* We should fail if file does not exist. */
2274         status = SMB_VFS_CREATE_FILE(
2275                 conn,                                   /* conn */
2276                 req,                                    /* req */
2277                 0,                                      /* root_dir_fid */
2278                 smb_fname,                              /* fname */
2279                 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2280                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2281                 FILE_OPEN,                              /* create_disposition*/
2282                 0,                                      /* create_options */
2283                 fattr,                                  /* file_attributes */
2284                 oplock_request,                         /* oplock_request */
2285                 0,                                      /* allocation_size */
2286                 0,                                      /* private_flags */
2287                 NULL,                                   /* sd */
2288                 NULL,                                   /* ea_list */
2289                 &fsp,                                   /* result */
2290                 NULL);                                  /* pinfo */
2291
2292         /* close fd from mkstemp() */
2293         close(tmpfd);
2294
2295         if (!NT_STATUS_IS_OK(status)) {
2296                 if (open_was_deferred(req->mid)) {
2297                         /* We have re-scheduled this call. */
2298                         goto out;
2299                 }
2300                 reply_openerror(req, status);
2301                 goto out;
2302         }
2303
2304         reply_outbuf(req, 1, 0);
2305         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2306
2307         /* the returned filename is relative to the directory */
2308         s = strrchr_m(fsp->fsp_name->base_name, '/');
2309         if (!s) {
2310                 s = fsp->fsp_name->base_name;
2311         } else {
2312                 s++;
2313         }
2314
2315 #if 0
2316         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2317            thing in the byte section. JRA */
2318         SSVALS(p, 0, -1); /* what is this? not in spec */
2319 #endif
2320         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2321             == -1) {
2322                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2323                 goto out;
2324         }
2325
2326         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2327                 SCVAL(req->outbuf, smb_flg,
2328                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2329         }
2330
2331         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2332                 SCVAL(req->outbuf, smb_flg,
2333                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2334         }
2335
2336         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2337         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2338                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2339  out:
2340         TALLOC_FREE(smb_fname);
2341         END_PROFILE(SMBctemp);
2342         return;
2343 }
2344
2345 /*******************************************************************
2346  Check if a user is allowed to rename a file.
2347 ********************************************************************/
2348
2349 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2350                         uint16 dirtype)
2351 {
2352         uint32 fmode;
2353
2354         if (!CAN_WRITE(conn)) {
2355                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2356         }
2357
2358         fmode = dos_mode(conn, fsp->fsp_name);
2359         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2360                 return NT_STATUS_NO_SUCH_FILE;
2361         }
2362
2363         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2364                 if (fsp->posix_open) {
2365                         return NT_STATUS_OK;
2366                 }
2367
2368                 /* If no pathnames are open below this
2369                    directory, allow the rename. */
2370
2371                 if (file_find_subpath(fsp)) {
2372                         return NT_STATUS_ACCESS_DENIED;
2373                 }
2374                 return NT_STATUS_OK;
2375         }
2376
2377         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2378                 return NT_STATUS_OK;
2379         }
2380
2381         return NT_STATUS_ACCESS_DENIED;
2382 }
2383
2384 /*******************************************************************
2385  * unlink a file with all relevant access checks
2386  *******************************************************************/
2387
2388 static NTSTATUS do_unlink(connection_struct *conn,
2389                         struct smb_request *req,
2390                         struct smb_filename *smb_fname,
2391                         uint32 dirtype)
2392 {
2393         uint32 fattr;
2394         files_struct *fsp;
2395         uint32 dirtype_orig = dirtype;
2396         NTSTATUS status;
2397         int ret;
2398         bool posix_paths = lp_posix_pathnames();
2399
2400         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2401                   smb_fname_str_dbg(smb_fname),
2402                   dirtype));
2403
2404         if (!CAN_WRITE(conn)) {
2405                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2406         }
2407
2408         if (posix_paths) {
2409                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2410         } else {
2411                 ret = SMB_VFS_STAT(conn, smb_fname);
2412         }
2413         if (ret != 0) {
2414                 return map_nt_error_from_unix(errno);
2415         }
2416
2417         fattr = dos_mode(conn, smb_fname);
2418
2419         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2420                 dirtype = aDIR|aARCH|aRONLY;
2421         }
2422
2423         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2424         if (!dirtype) {
2425                 return NT_STATUS_NO_SUCH_FILE;
2426         }
2427
2428         if (!dir_check_ftype(conn, fattr, dirtype)) {
2429                 if (fattr & aDIR) {
2430                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2431                 }
2432                 return NT_STATUS_NO_SUCH_FILE;
2433         }
2434
2435         if (dirtype_orig & 0x8000) {
2436                 /* These will never be set for POSIX. */
2437                 return NT_STATUS_NO_SUCH_FILE;
2438         }
2439
2440 #if 0
2441         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2442                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2443         }
2444
2445         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2446                 return NT_STATUS_NO_SUCH_FILE;
2447         }
2448
2449         if (dirtype & 0xFF00) {
2450                 /* These will never be set for POSIX. */
2451                 return NT_STATUS_NO_SUCH_FILE;
2452         }
2453
2454         dirtype &= 0xFF;
2455         if (!dirtype) {
2456                 return NT_STATUS_NO_SUCH_FILE;
2457         }
2458
2459         /* Can't delete a directory. */
2460         if (fattr & aDIR) {
2461                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2462         }
2463 #endif
2464
2465 #if 0 /* JRATEST */
2466         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2467                 return NT_STATUS_OBJECT_NAME_INVALID;
2468 #endif /* JRATEST */
2469
2470         /* On open checks the open itself will check the share mode, so
2471            don't do it here as we'll get it wrong. */
2472
2473         status = SMB_VFS_CREATE_FILE
2474                 (conn,                  /* conn */
2475                  req,                   /* req */
2476                  0,                     /* root_dir_fid */
2477                  smb_fname,             /* fname */
2478                  DELETE_ACCESS,         /* access_mask */
2479                  FILE_SHARE_NONE,       /* share_access */
2480                  FILE_OPEN,             /* create_disposition*/
2481                  FILE_NON_DIRECTORY_FILE, /* create_options */
2482                                         /* file_attributes */
2483                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2484                                 FILE_ATTRIBUTE_NORMAL,
2485                  0,                     /* oplock_request */
2486                  0,                     /* allocation_size */
2487                  0,                     /* private_flags */
2488                  NULL,                  /* sd */
2489                  NULL,                  /* ea_list */
2490                  &fsp,                  /* result */
2491                  NULL);                 /* pinfo */
2492
2493         if (!NT_STATUS_IS_OK(status)) {
2494                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2495                            nt_errstr(status)));
2496                 return status;
2497         }
2498
2499         status = can_set_delete_on_close(fsp, fattr);
2500         if (!NT_STATUS_IS_OK(status)) {
2501                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2502                         "(%s)\n",
2503                         smb_fname_str_dbg(smb_fname),
2504                         nt_errstr(status)));
2505                 close_file(req, fsp, NORMAL_CLOSE);
2506                 return status;
2507         }
2508
2509         /* The set is across all open files on this dev/inode pair. */
2510         if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2511                 close_file(req, fsp, NORMAL_CLOSE);
2512                 return NT_STATUS_ACCESS_DENIED;
2513         }
2514
2515         return close_file(req, fsp, NORMAL_CLOSE);
2516 }
2517
2518 /****************************************************************************
2519  The guts of the unlink command, split out so it may be called by the NT SMB
2520  code.
2521 ****************************************************************************/
2522
2523 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2524                           uint32 dirtype, struct smb_filename *smb_fname,
2525                           bool has_wild)
2526 {
2527         char *fname_dir = NULL;
2528         char *fname_mask = NULL;
2529         int count=0;
2530         NTSTATUS status = NT_STATUS_OK;
2531         TALLOC_CTX *ctx = talloc_tos();
2532
2533         /* Split up the directory from the filename/mask. */
2534         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2535                                       &fname_dir, &fname_mask);
2536         if (!NT_STATUS_IS_OK(status)) {
2537                 goto out;
2538         }
2539
2540         /*
2541          * We should only check the mangled cache
2542          * here if unix_convert failed. This means
2543          * that the path in 'mask' doesn't exist
2544          * on the file system and so we need to look
2545          * for a possible mangle. This patch from
2546          * Tine Smukavec <valentin.smukavec@hermes.si>.
2547          */
2548
2549         if (!VALID_STAT(smb_fname->st) &&
2550             mangle_is_mangled(fname_mask, conn->params)) {
2551                 char *new_mask = NULL;
2552                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2553                                             &new_mask, conn->params);
2554                 if (new_mask) {
2555                         TALLOC_FREE(fname_mask);
2556                         fname_mask = new_mask;
2557                 }
2558         }
2559
2560         if (!has_wild) {
2561
2562                 /*
2563                  * Only one file needs to be unlinked. Append the mask back
2564                  * onto the directory.
2565                  */
2566                 TALLOC_FREE(smb_fname->base_name);
2567                 smb_fname->base_name = talloc_asprintf(smb_fname,
2568                                                        "%s/%s",
2569                                                        fname_dir,
2570                                                        fname_mask);
2571                 if (!smb_fname->base_name) {
2572                         status = NT_STATUS_NO_MEMORY;
2573                         goto out;
2574                 }
2575                 if (dirtype == 0) {
2576                         dirtype = FILE_ATTRIBUTE_NORMAL;
2577                 }
2578
2579                 status = check_name(conn, smb_fname->base_name);
2580                 if (!NT_STATUS_IS_OK(status)) {
2581                         goto out;
2582                 }
2583
2584                 status = do_unlink(conn, req, smb_fname, dirtype);
2585                 if (!NT_STATUS_IS_OK(status)) {
2586                         goto out;
2587                 }
2588
2589                 count++;
2590         } else {
2591                 struct smb_Dir *dir_hnd = NULL;
2592                 long offset = 0;
2593                 const char *dname = NULL;
2594                 char *talloced = NULL;
2595
2596                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2597                         status = NT_STATUS_OBJECT_NAME_INVALID;
2598                         goto out;
2599                 }
2600
2601                 if (strequal(fname_mask,"????????.???")) {
2602                         TALLOC_FREE(fname_mask);
2603                         fname_mask = talloc_strdup(ctx, "*");
2604                         if (!fname_mask) {
2605                                 status = NT_STATUS_NO_MEMORY;
2606                                 goto out;
2607                         }
2608                 }
2609
2610                 status = check_name(conn, fname_dir);
2611                 if (!NT_STATUS_IS_OK(status)) {
2612                         goto out;
2613                 }
2614
2615                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2616                                   dirtype);
2617                 if (dir_hnd == NULL) {
2618                         status = map_nt_error_from_unix(errno);
2619                         goto out;
2620                 }
2621
2622                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2623                    the pattern matches against the long name, otherwise the short name
2624                    We don't implement this yet XXXX
2625                 */
2626
2627                 status = NT_STATUS_NO_SUCH_FILE;
2628
2629                 while ((dname = ReadDirName(dir_hnd, &offset,
2630                                             &smb_fname->st, &talloced))) {
2631                         TALLOC_CTX *frame = talloc_stackframe();
2632
2633                         if (!is_visible_file(conn, fname_dir, dname,
2634                                              &smb_fname->st, true)) {
2635                                 TALLOC_FREE(frame);
2636                                 TALLOC_FREE(talloced);
2637                                 continue;
2638                         }
2639
2640                         /* Quick check for "." and ".." */
2641                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2642                                 TALLOC_FREE(frame);
2643                                 TALLOC_FREE(talloced);
2644                                 continue;
2645                         }
2646
2647                         if(!mask_match(dname, fname_mask,
2648                                        conn->case_sensitive)) {
2649                                 TALLOC_FREE(frame);
2650                                 TALLOC_FREE(talloced);
2651                                 continue;
2652                         }
2653
2654                         TALLOC_FREE(smb_fname->base_name);
2655                         smb_fname->base_name =
2656                             talloc_asprintf(smb_fname, "%s/%s",
2657                                             fname_dir, dname);
2658
2659                         if (!smb_fname->base_name) {
2660                                 TALLOC_FREE(dir_hnd);
2661                                 status = NT_STATUS_NO_MEMORY;
2662                                 TALLOC_FREE(frame);
2663                                 TALLOC_FREE(talloced);
2664                                 goto out;
2665                         }
2666
2667                         status = check_name(conn, smb_fname->base_name);
2668                         if (!NT_STATUS_IS_OK(status)) {
2669                                 TALLOC_FREE(dir_hnd);
2670                                 TALLOC_FREE(frame);
2671                                 TALLOC_FREE(talloced);
2672                                 goto out;
2673                         }
2674
2675                         status = do_unlink(conn, req, smb_fname, dirtype);
2676                         if (!NT_STATUS_IS_OK(status)) {
2677                                 TALLOC_FREE(frame);
2678                                 TALLOC_FREE(talloced);
2679                                 continue;
2680                         }
2681
2682                         count++;
2683                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2684                                  smb_fname->base_name));
2685
2686                         TALLOC_FREE(frame);
2687                         TALLOC_FREE(talloced);
2688                 }
2689                 TALLOC_FREE(dir_hnd);
2690         }
2691
2692         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2693                 status = map_nt_error_from_unix(errno);
2694         }
2695
2696  out:
2697         TALLOC_FREE(fname_dir);
2698         TALLOC_FREE(fname_mask);
2699         return status;
2700 }
2701
2702 /****************************************************************************
2703  Reply to a unlink
2704 ****************************************************************************/
2705
2706 void reply_unlink(struct smb_request *req)
2707 {
2708         connection_struct *conn = req->conn;
2709         char *name = NULL;
2710         struct smb_filename *smb_fname = NULL;
2711         uint32 dirtype;
2712         NTSTATUS status;
2713         bool path_contains_wcard = False;
2714         TALLOC_CTX *ctx = talloc_tos();
2715
2716         START_PROFILE(SMBunlink);
2717
2718         if (req->wct < 1) {
2719                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2720                 goto out;
2721         }
2722
2723         dirtype = SVAL(req->vwv+0, 0);
2724
2725         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2726                                   STR_TERMINATE, &status,
2727                                   &path_contains_wcard);
2728         if (!NT_STATUS_IS_OK(status)) {
2729                 reply_nterror(req, status);
2730                 goto out;
2731         }
2732
2733         status = filename_convert(ctx, conn,
2734                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2735                                   name,
2736                                   UCF_COND_ALLOW_WCARD_LCOMP,
2737                                   &path_contains_wcard,
2738                                   &smb_fname);
2739         if (!NT_STATUS_IS_OK(status)) {
2740                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2741                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2742                                         ERRSRV, ERRbadpath);
2743                         goto out;
2744                 }
2745                 reply_nterror(req, status);
2746                 goto out;
2747         }
2748
2749         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2750
2751         status = unlink_internals(conn, req, dirtype, smb_fname,
2752                                   path_contains_wcard);
2753         if (!NT_STATUS_IS_OK(status)) {
2754                 if (open_was_deferred(req->mid)) {
2755                         /* We have re-scheduled this call. */
2756                         goto out;
2757                 }
2758                 reply_nterror(req, status);
2759                 goto out;
2760         }
2761
2762         reply_outbuf(req, 0, 0);
2763  out:
2764         TALLOC_FREE(smb_fname);
2765         END_PROFILE(SMBunlink);
2766         return;
2767 }
2768
2769 /****************************************************************************
2770  Fail for readbraw.
2771 ****************************************************************************/
2772
2773 static void fail_readraw(void)
2774 {
2775         const char *errstr = talloc_asprintf(talloc_tos(),
2776                         "FAIL ! reply_readbraw: socket write fail (%s)",
2777                         strerror(errno));
2778         if (!errstr) {
2779                 errstr = "";
2780         }
2781         exit_server_cleanly(errstr);
2782 }
2783
2784 /****************************************************************************
2785  Fake (read/write) sendfile. Returns -1 on read or write fail.
2786 ****************************************************************************/
2787
2788 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2789                              size_t nread)
2790 {
2791         size_t bufsize;
2792         size_t tosend = nread;
2793         char *buf;
2794
2795         if (nread == 0) {
2796                 return 0;
2797         }
2798
2799         bufsize = MIN(nread, 65536);
2800
2801         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2802                 return -1;
2803         }
2804
2805         while (tosend > 0) {
2806                 ssize_t ret;
2807                 size_t cur_read;
2808
2809                 if (tosend > bufsize) {
2810                         cur_read = bufsize;
2811                 } else {
2812                         cur_read = tosend;
2813                 }
2814                 ret = read_file(fsp,buf,startpos,cur_read);
2815                 if (ret == -1) {
2816                         SAFE_FREE(buf);
2817                         return -1;
2818                 }
2819
2820                 /* If we had a short read, fill with zeros. */
2821                 if (ret < cur_read) {
2822                         memset(buf + ret, '\0', cur_read - ret);
2823                 }
2824
2825                 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2826                         SAFE_FREE(buf);
2827                         return -1;
2828                 }
2829                 tosend -= cur_read;
2830                 startpos += cur_read;
2831         }
2832
2833         SAFE_FREE(buf);
2834         return (ssize_t)nread;
2835 }
2836
2837 #if defined(WITH_SENDFILE)
2838 /****************************************************************************
2839  Deal with the case of sendfile reading less bytes from the file than
2840  requested. Fill with zeros (all we can do).
2841 ****************************************************************************/
2842
2843 static void sendfile_short_send(files_struct *fsp,
2844                                 ssize_t nread,
2845                                 size_t headersize,
2846                                 size_t smb_maxcnt)
2847 {
2848 #define SHORT_SEND_BUFSIZE 1024
2849         if (nread < headersize) {
2850                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2851                         "header for file %s (%s). Terminating\n",
2852                         fsp_str_dbg(fsp), strerror(errno)));
2853                 exit_server_cleanly("sendfile_short_send failed");
2854         }
2855
2856         nread -= headersize;
2857
2858         if (nread < smb_maxcnt) {
2859                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2860                 if (!buf) {
2861                         exit_server_cleanly("sendfile_short_send: "
2862                                 "malloc failed");
2863                 }
2864
2865                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2866                         "with zeros !\n", fsp_str_dbg(fsp)));
2867
2868                 while (nread < smb_maxcnt) {
2869                         /*
2870                          * We asked for the real file size and told sendfile
2871                          * to not go beyond the end of the file. But it can
2872                          * happen that in between our fstat call and the
2873                          * sendfile call the file was truncated. This is very
2874                          * bad because we have already announced the larger
2875                          * number of bytes to the client.
2876                          *
2877                          * The best we can do now is to send 0-bytes, just as
2878                          * a read from a hole in a sparse file would do.
2879                          *
2880                          * This should happen rarely enough that I don't care
2881                          * about efficiency here :-)
2882                          */
2883                         size_t to_write;
2884
2885                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2886                         if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2887                                 exit_server_cleanly("sendfile_short_send: "
2888                                         "write_data failed");
2889                         }
2890                         nread += to_write;
2891                 }
2892                 SAFE_FREE(buf);
2893         }
2894 }
2895 #endif /* defined WITH_SENDFILE */
2896
2897 /****************************************************************************
2898  Return a readbraw error (4 bytes of zero).
2899 ****************************************************************************/
2900
2901 static void reply_readbraw_error(void)
2902 {
2903         char header[4];
2904
2905         SIVAL(header,0,0);
2906
2907         smbd_lock_socket(smbd_server_conn);
2908         if (write_data(smbd_server_fd(),header,4) != 4) {
2909                 fail_readraw();
2910         }
2911         smbd_unlock_socket(smbd_server_conn);
2912 }
2913
2914 /****************************************************************************
2915  Use sendfile in readbraw.
2916 ****************************************************************************/
2917
2918 static void send_file_readbraw(connection_struct *conn,
2919                                struct smb_request *req,
2920                                files_struct *fsp,
2921                                SMB_OFF_T startpos,
2922                                size_t nread,
2923                                ssize_t mincount)
2924 {
2925         char *outbuf = NULL;
2926         ssize_t ret=0;
2927
2928 #if defined(WITH_SENDFILE)
2929         /*
2930          * We can only use sendfile on a non-chained packet
2931          * but we can use on a non-oplocked file. tridge proved this
2932          * on a train in Germany :-). JRA.
2933          * reply_readbraw has already checked the length.
2934          */
2935
2936         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2937             (fsp->wcp == NULL) &&
2938             lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
2939                 ssize_t sendfile_read = -1;
2940                 char header[4];
2941                 DATA_BLOB header_blob;
2942
2943                 _smb_setlen(header,nread);
2944                 header_blob = data_blob_const(header, 4);
2945
2946                 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2947                                 &header_blob, startpos, nread)) == -1) {
2948                         /* Returning ENOSYS means no data at all was sent.
2949                          * Do this as a normal read. */
2950                         if (errno == ENOSYS) {
2951                                 goto normal_readbraw;
2952                         }
2953
2954                         /*
2955                          * Special hack for broken Linux with no working sendfile. If we
2956                          * return EINTR we sent the header but not the rest of the data.
2957                          * Fake this up by doing read/write calls.
2958                          */
2959                         if (errno == EINTR) {
2960                                 /* Ensure we don't do this again. */
2961                                 set_use_sendfile(SNUM(conn), False);
2962                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2963
2964                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
2965                                         DEBUG(0,("send_file_readbraw: "
2966                                                  "fake_sendfile failed for "
2967                                                  "file %s (%s).\n",
2968                                                  fsp_str_dbg(fsp),
2969                                                  strerror(errno)));
2970                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2971                                 }
2972                                 return;
2973                         }
2974
2975                         DEBUG(0,("send_file_readbraw: sendfile failed for "
2976                                  "file %s (%s). Terminating\n",
2977                                  fsp_str_dbg(fsp), strerror(errno)));
2978                         exit_server_cleanly("send_file_readbraw sendfile failed");
2979                 } else if (sendfile_read == 0) {
2980                         /*
2981                          * Some sendfile implementations return 0 to indicate
2982                          * that there was a short read, but nothing was
2983                          * actually written to the socket.  In this case,
2984                          * fallback to the normal read path so the header gets
2985                          * the correct byte count.
2986                          */
2987                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2988                                   "bytes falling back to the normal read: "
2989                                   "%s\n", fsp_str_dbg(fsp)));
2990                         goto normal_readbraw;
2991                 }
2992
2993                 /* Deal with possible short send. */
2994                 if (sendfile_read != 4+nread) {
2995                         sendfile_short_send(fsp, sendfile_read, 4, nread);
2996                 }
2997                 return;
2998         }
2999
3000 normal_readbraw:
3001 #endif
3002
3003         outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3004         if (!outbuf) {
3005                 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3006                         (unsigned)(nread+4)));
3007                 reply_readbraw_error();
3008                 return;
3009         }
3010
3011         if (nread > 0) {
3012                 ret = read_file(fsp,outbuf+4,startpos,nread);
3013 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3014                 if (ret < mincount)
3015                         ret = 0;
3016 #else
3017                 if (ret < nread)
3018                         ret = 0;
3019 #endif
3020         }
3021
3022         _smb_setlen(outbuf,ret);
3023         if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
3024                 fail_readraw();
3025
3026         TALLOC_FREE(outbuf);
3027 }
3028
3029 /****************************************************************************
3030  Reply to a readbraw (core+ protocol).
3031 ****************************************************************************/
3032
3033 void reply_readbraw(struct smb_request *req)
3034 {
3035         connection_struct *conn = req->conn;
3036         ssize_t maxcount,mincount;
3037         size_t nread = 0;
3038         SMB_OFF_T startpos;
3039         files_struct *fsp;
3040         struct lock_struct lock;
3041         SMB_OFF_T size = 0;
3042
3043         START_PROFILE(SMBreadbraw);
3044
3045         if (srv_is_signing_active(smbd_server_conn) ||
3046             is_encrypted_packet(req->inbuf)) {
3047                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3048                         "raw reads/writes are disallowed.");
3049         }
3050
3051         if (req->wct < 8) {
3052                 reply_readbraw_error();
3053                 END_PROFILE(SMBreadbraw);
3054                 return;
3055         }
3056
3057         if (smbd_server_conn->smb1.echo_handler.trusted_fde) {
3058                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3059                          "'async smb echo handler = yes'\n"));
3060                 reply_readbraw_error();
3061                 END_PROFILE(SMBreadbraw);
3062                 return;
3063         }
3064
3065         /*
3066          * Special check if an oplock break has been issued
3067          * and the readraw request croses on the wire, we must
3068          * return a zero length response here.
3069          */
3070
3071         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3072
3073         /*
3074          * We have to do a check_fsp by hand here, as
3075          * we must always return 4 zero bytes on error,
3076          * not a NTSTATUS.
3077          */
3078
3079         if (!fsp || !conn || conn != fsp->conn ||
3080                         req->vuid != fsp->vuid ||
3081                         fsp->is_directory || fsp->fh->fd == -1) {
3082                 /*
3083                  * fsp could be NULL here so use the value from the packet. JRA.
3084                  */
3085                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3086                         "- cache prime?\n",
3087                         (int)SVAL(req->vwv+0, 0)));
3088                 reply_readbraw_error();
3089                 END_PROFILE(SMBreadbraw);
3090                 return;
3091         }
3092
3093         /* Do a "by hand" version of CHECK_READ. */
3094         if (!(fsp->can_read ||
3095                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3096                                 (fsp->access_mask & FILE_EXECUTE)))) {
3097                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3098                                 (int)SVAL(req->vwv+0, 0)));
3099                 reply_readbraw_error();
3100                 END_PROFILE(SMBreadbraw);
3101                 return;
3102         }
3103
3104         flush_write_cache(fsp, READRAW_FLUSH);
3105
3106         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3107         if(req->wct == 10) {
3108                 /*
3109                  * This is a large offset (64 bit) read.
3110                  */
3111 #ifdef LARGE_SMB_OFF_T
3112
3113                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3114
3115 #else /* !LARGE_SMB_OFF_T */
3116
3117                 /*
3118                  * Ensure we haven't been sent a >32 bit offset.
3119                  */
3120
3121                 if(IVAL(req->vwv+8, 0) != 0) {
3122                         DEBUG(0,("reply_readbraw: large offset "
3123                                 "(%x << 32) used and we don't support "
3124                                 "64 bit offsets.\n",
3125                         (unsigned int)IVAL(req->vwv+8, 0) ));
3126                         reply_readbraw_error();
3127                         END_PROFILE(SMBreadbraw);
3128                         return;
3129                 }
3130
3131 #endif /* LARGE_SMB_OFF_T */
3132
3133                 if(startpos < 0) {
3134                         DEBUG(0,("reply_readbraw: negative 64 bit "
3135                                 "readraw offset (%.0f) !\n",
3136                                 (double)startpos ));
3137                         reply_readbraw_error();
3138                         END_PROFILE(SMBreadbraw);
3139                         return;
3140                 }
3141         }
3142
3143         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3144         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3145
3146         /* ensure we don't overrun the packet size */
3147         maxcount = MIN(65535,maxcount);
3148
3149         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3150             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3151             &lock);
3152
3153         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3154                 reply_readbraw_error();
3155                 END_PROFILE(SMBreadbraw);
3156                 return;
3157         }
3158
3159         if (fsp_stat(fsp) == 0) {
3160                 size = fsp->fsp_name->st.st_ex_size;
3161         }
3162
3163         if (startpos >= size) {
3164                 nread = 0;
3165         } else {
3166                 nread = MIN(maxcount,(size - startpos));
3167         }
3168
3169 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3170         if (nread < mincount)
3171                 nread = 0;
3172 #endif
3173
3174         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3175                 "min=%lu nread=%lu\n",
3176                 fsp->fnum, (double)startpos,
3177                 (unsigned long)maxcount,
3178                 (unsigned long)mincount,
3179                 (unsigned long)nread ) );
3180
3181         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3182
3183         DEBUG(5,("reply_readbraw finished\n"));
3184
3185         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3186
3187         END_PROFILE(SMBreadbraw);
3188         return;
3189 }
3190
3191 #undef DBGC_CLASS
3192 #define DBGC_CLASS DBGC_LOCKING
3193
3194 /****************************************************************************
3195  Reply to a lockread (core+ protocol).
3196 ****************************************************************************/
3197
3198 void reply_lockread(struct smb_request *req)
3199 {
3200         connection_struct *conn = req->conn;
3201         ssize_t nread = -1;
3202         char *data;
3203         SMB_OFF_T startpos;
3204         size_t numtoread;
3205         NTSTATUS status;
3206         files_struct *fsp;
3207         struct byte_range_lock *br_lck = NULL;
3208         char *p = NULL;
3209         struct smbd_server_connection *sconn = smbd_server_conn;
3210
3211         START_PROFILE(SMBlockread);
3212
3213         if (req->wct < 5) {
3214                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3215                 END_PROFILE(SMBlockread);
3216                 return;
3217         }
3218
3219         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3220
3221         if (!check_fsp(conn, req, fsp)) {
3222                 END_PROFILE(SMBlockread);
3223                 return;
3224         }
3225
3226         if (!CHECK_READ(fsp,req)) {
3227                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3228                 END_PROFILE(SMBlockread);
3229                 return;
3230         }
3231
3232         numtoread = SVAL(req->vwv+1, 0);
3233         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3234
3235         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3236
3237         reply_outbuf(req, 5, numtoread + 3);
3238
3239         data = smb_buf(req->outbuf) + 3;
3240
3241         /*
3242          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3243          * protocol request that predates the read/write lock concept.
3244          * Thus instead of asking for a read lock here we need to ask
3245          * for a write lock. JRA.
3246          * Note that the requested lock size is unaffected by max_recv.
3247          */
3248
3249         br_lck = do_lock(smbd_messaging_context(),
3250                         fsp,
3251                         (uint64_t)req->smbpid,
3252                         (uint64_t)numtoread,
3253                         (uint64_t)startpos,
3254                         WRITE_LOCK,
3255                         WINDOWS_LOCK,
3256                         False, /* Non-blocking lock. */
3257                         &status,
3258                         NULL,
3259                         NULL);
3260         TALLOC_FREE(br_lck);
3261
3262         if (NT_STATUS_V(status)) {
3263                 reply_nterror(req, status);
3264                 END_PROFILE(SMBlockread);
3265                 return;
3266         }
3267
3268         /*
3269          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3270          */
3271
3272         if (numtoread > sconn->smb1.negprot.max_recv) {
3273                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3274 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3275                         (unsigned int)numtoread,
3276                         (unsigned int)sconn->smb1.negprot.max_recv));
3277                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3278         }
3279         nread = read_file(fsp,data,startpos,numtoread);
3280
3281         if (nread < 0) {
3282                 reply_nterror(req, map_nt_error_from_unix(errno));
3283                 END_PROFILE(SMBlockread);
3284                 return;
3285         }
3286
3287         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3288
3289         SSVAL(req->outbuf,smb_vwv0,nread);
3290         SSVAL(req->outbuf,smb_vwv5,nread+3);
3291         p = smb_buf(req->outbuf);
3292         SCVAL(p,0,0); /* pad byte. */
3293         SSVAL(p,1,nread);
3294
3295         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3296                  fsp->fnum, (int)numtoread, (int)nread));
3297
3298         END_PROFILE(SMBlockread);
3299         return;
3300 }
3301
3302 #undef DBGC_CLASS
3303 #define DBGC_CLASS DBGC_ALL
3304
3305 /****************************************************************************
3306  Reply to a read.
3307 ****************************************************************************/
3308
3309 void reply_read(struct smb_request *req)
3310 {
3311         connection_struct *conn = req->conn;
3312         size_t numtoread;
3313         ssize_t nread = 0;
3314         char *data;
3315         SMB_OFF_T startpos;
3316         int outsize = 0;
3317         files_struct *fsp;
3318         struct lock_struct lock;
3319         struct smbd_server_connection *sconn = smbd_server_conn;
3320
3321         START_PROFILE(SMBread);
3322
3323         if (req->wct < 3) {
3324                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3325                 END_PROFILE(SMBread);
3326                 return;
3327         }
3328
3329         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3330
3331         if (!check_fsp(conn, req, fsp)) {
3332                 END_PROFILE(SMBread);
3333                 return;
3334         }
3335
3336         if (!CHECK_READ(fsp,req)) {
3337                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3338                 END_PROFILE(SMBread);
3339                 return;
3340         }
3341
3342         numtoread = SVAL(req->vwv+1, 0);
3343         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3344
3345         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3346
3347         /*
3348          * The requested read size cannot be greater than max_recv. JRA.
3349          */
3350         if (numtoread > sconn->smb1.negprot.max_recv) {
3351                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3352 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3353                         (unsigned int)numtoread,
3354                         (unsigned int)sconn->smb1.negprot.max_recv));
3355                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3356         }
3357
3358         reply_outbuf(req, 5, numtoread+3);
3359
3360         data = smb_buf(req->outbuf) + 3;
3361
3362         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3363             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3364             &lock);
3365
3366         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3367                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3368                 END_PROFILE(SMBread);
3369                 return;
3370         }
3371
3372         if (numtoread > 0)
3373                 nread = read_file(fsp,data,startpos,numtoread);
3374
3375         if (nread < 0) {
3376                 reply_nterror(req, map_nt_error_from_unix(errno));
3377                 goto strict_unlock;
3378         }
3379
3380         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3381
3382         SSVAL(req->outbuf,smb_vwv0,nread);
3383         SSVAL(req->outbuf,smb_vwv5,nread+3);
3384         SCVAL(smb_buf(req->outbuf),0,1);
3385         SSVAL(smb_buf(req->outbuf),1,nread);
3386
3387         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3388                 fsp->fnum, (int)numtoread, (int)nread ) );
3389
3390 strict_unlock:
3391         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3392
3393         END_PROFILE(SMBread);
3394         return;
3395 }
3396
3397 /****************************************************************************
3398  Setup readX header.
3399 ****************************************************************************/
3400
3401 static int setup_readX_header(struct smb_request *req, char *outbuf,
3402                               size_t smb_maxcnt)
3403 {
3404         int outsize;
3405         char *data;
3406
3407         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3408         data = smb_buf(outbuf);
3409
3410         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3411
3412         SCVAL(outbuf,smb_vwv0,0xFF);
3413         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3414         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3415         SSVAL(outbuf,smb_vwv6,
3416               req_wct_ofs(req)
3417               + 1               /* the wct field */
3418               + 12 * sizeof(uint16_t) /* vwv */
3419               + 2);             /* the buflen field */
3420         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3421         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3422         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3423         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3424         return outsize;
3425 }
3426
3427 /****************************************************************************
3428  Reply to a read and X - possibly using sendfile.
3429 ****************************************************************************/
3430
3431 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3432                             files_struct *fsp, SMB_OFF_T startpos,
3433                             size_t smb_maxcnt)
3434 {
3435         ssize_t nread = -1;
3436         struct lock_struct lock;
3437         int saved_errno = 0;
3438
3439         if(fsp_stat(fsp) == -1) {
3440                 reply_nterror(req, map_nt_error_from_unix(errno));
3441                 return;
3442         }
3443
3444         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3445             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3446             &lock);
3447
3448         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3449                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3450                 return;
3451         }
3452
3453         if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3454                         (startpos > fsp->fsp_name->st.st_ex_size)
3455                         || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3456                 /*
3457                  * We already know that we would do a short read, so don't
3458                  * try the sendfile() path.
3459                  */
3460                 goto nosendfile_read;
3461         }
3462
3463 #if defined(WITH_SENDFILE)
3464         /*
3465          * We can only use sendfile on a non-chained packet
3466          * but we can use on a non-oplocked file. tridge proved this
3467          * on a train in Germany :-). JRA.
3468          */
3469
3470         if (!req_is_in_chain(req) &&
3471             !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3472             (fsp->wcp == NULL) &&
3473             lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
3474                 uint8 headerbuf[smb_size + 12 * 2];
3475                 DATA_BLOB header;
3476
3477                 /*
3478                  * Set up the packet header before send. We
3479                  * assume here the sendfile will work (get the
3480                  * correct amount of data).
3481                  */
3482
3483                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3484
3485                 construct_reply_common_req(req, (char *)headerbuf);
3486                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3487
3488                 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3489                         /* Returning ENOSYS means no data at all was sent.
3490                            Do this as a normal read. */
3491                         if (errno == ENOSYS) {
3492                                 goto normal_read;
3493                         }
3494
3495                         /*
3496                          * Special hack for broken Linux with no working sendfile. If we
3497                          * return EINTR we sent the header but not the rest of the data.
3498                          * Fake this up by doing read/write calls.
3499                          */
3500
3501                         if (errno == EINTR) {
3502                                 /* Ensure we don't do this again. */
3503                                 set_use_sendfile(SNUM(conn), False);
3504                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3505                                 nread = fake_sendfile(fsp, startpos,
3506                                                       smb_maxcnt);
3507                                 if (nread == -1) {
3508                                         DEBUG(0,("send_file_readX: "
3509                                                  "fake_sendfile failed for "
3510                                                  "file %s (%s).\n",
3511                                                  fsp_str_dbg(fsp),
3512                                                  strerror(errno)));
3513                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3514                                 }
3515                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3516                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3517                                 /* No outbuf here means successful sendfile. */
3518                                 goto strict_unlock;
3519                         }
3520
3521                         DEBUG(0,("send_file_readX: sendfile failed for file "
3522                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3523                                  strerror(errno)));
3524                         exit_server_cleanly("send_file_readX sendfile failed");
3525                 } else if (nread == 0) {
3526                         /*
3527                          * Some sendfile implementations return 0 to indicate
3528                          * that there was a short read, but nothing was
3529                          * actually written to the socket.  In this case,
3530                          * fallback to the normal read path so the header gets
3531                          * the correct byte count.
3532                          */
3533                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3534                                   "falling back to the normal read: %s\n",
3535                                   fsp_str_dbg(fsp)));
3536                         goto normal_read;
3537                 }
3538
3539                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3540                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3541
3542                 /* Deal with possible short send. */
3543                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3544                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3545                 }
3546                 /* No outbuf here means successful sendfile. */
3547                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3548                 SMB_PERFCOUNT_END(&req->pcd);
3549                 goto strict_unlock;
3550         }
3551
3552 normal_read:
3553
3554 #endif
3555
3556         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3557                 uint8 headerbuf[smb_size + 2*12];
3558
3559                 construct_reply_common_req(req, (char *)headerbuf);
3560                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3561
3562                 /* Send out the header. */
3563                 if (write_data(smbd_server_fd(), (char *)headerbuf,
3564                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3565                         DEBUG(0,("send_file_readX: write_data failed for file "
3566                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3567                                  strerror(errno)));
3568                         exit_server_cleanly("send_file_readX sendfile failed");
3569                 }
3570                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3571                 if (nread == -1) {
3572                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3573                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3574                                  strerror(errno)));
3575                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3576                 }
3577                 goto strict_unlock;
3578         }
3579
3580 nosendfile_read:
3581
3582         reply_outbuf(req, 12, smb_maxcnt);
3583
3584         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3585         saved_errno = errno;
3586
3587         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3588
3589         if (nread < 0) {
3590                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3591                 return;
3592         }
3593
3594         setup_readX_header(req, (char *)req->outbuf, nread);
3595
3596         DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3597                     fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3598
3599         chain_reply(req);
3600         return;
3601
3602  strict_unlock:
3603         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3604         TALLOC_FREE(req->outbuf);
3605         return;
3606 }
3607
3608 /****************************************************************************
3609  Reply to a read and X.
3610 ****************************************************************************/
3611
3612 void reply_read_and_X(struct smb_request *req)
3613 {
3614         connection_struct *conn = req->conn;
3615         files_struct *fsp;
3616         SMB_OFF_T startpos;
3617         size_t smb_maxcnt;
3618         bool big_readX = False;
3619 #if 0
3620         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3621 #endif
3622
3623         START_PROFILE(SMBreadX);
3624
3625         if ((req->wct != 10) && (req->wct != 12)) {
3626                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3627                 return;
3628         }
3629
3630         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3631         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3632         smb_maxcnt = SVAL(req->vwv+5, 0);
3633
3634         /* If it's an IPC, pass off the pipe handler. */
3635         if (IS_IPC(conn)) {
3636                 reply_pipe_read_and_X(req);
3637                 END_PROFILE(SMBreadX);
3638                 return;
3639         }
3640
3641         if (!check_fsp(conn, req, fsp)) {
3642                 END_PROFILE(SMBreadX);
3643                 return;
3644         }
3645
3646         if (!CHECK_READ(fsp,req)) {
3647                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3648                 END_PROFILE(SMBreadX);
3649                 return;
3650         }
3651
3652         if (global_client_caps & CAP_LARGE_READX) {
3653                 size_t upper_size = SVAL(req->vwv+7, 0);
3654                 smb_maxcnt |= (upper_size<<16);
3655                 if (upper_size > 1) {
3656                         /* Can't do this on a chained packet. */
3657                         if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3658                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3659                                 END_PROFILE(SMBreadX);
3660                                 return;
3661                         }
3662                         /* We currently don't do this on signed or sealed data. */
3663                         if (srv_is_signing_active(smbd_server_conn) ||
3664                             is_encrypted_packet(req->inbuf)) {
3665                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3666                                 END_PROFILE(SMBreadX);
3667                                 return;
3668                         }
3669                         /* Is there room in the reply for this data ? */
3670                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3671                                 reply_nterror(req,
3672                                               NT_STATUS_INVALID_PARAMETER);
3673                                 END_PROFILE(SMBreadX);
3674                                 return;
3675                         }
3676                         big_readX = True;
3677                 }
3678         }
3679
3680         if (req->wct == 12) {
3681 #ifdef LARGE_SMB_OFF_T
3682                 /*
3683                  * This is a large offset (64 bit) read.
3684                  */
3685                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3686
3687 #else /* !LARGE_SMB_OFF_T */
3688
3689                 /*
3690                  * Ensure we haven't been sent a >32 bit offset.
3691                  */
3692
3693                 if(IVAL(req->vwv+10, 0) != 0) {
3694                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3695                                  "used and we don't support 64 bit offsets.\n",
3696                                  (unsigned int)IVAL(req->vwv+10, 0) ));
3697                         END_PROFILE(SMBreadX);
3698                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3699                         return;
3700                 }
3701
3702 #endif /* LARGE_SMB_OFF_T */
3703
3704         }
3705
3706         if (!big_readX) {
3707                 NTSTATUS status = schedule_aio_read_and_X(conn,
3708                                         req,
3709                                         fsp,
3710                                         startpos,
3711                                         smb_maxcnt);
3712                 if (NT_STATUS_IS_OK(status)) {
3713                         /* Read scheduled - we're done. */
3714                         goto out;
3715                 }
3716                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3717                         /* Real error - report to client. */
3718                         END_PROFILE(SMBreadX);
3719                         reply_nterror(req, status);
3720                         return;
3721                 }
3722                 /* NT_STATUS_RETRY - fall back to sync read. */
3723         }
3724
3725         smbd_lock_socket(smbd_server_conn);
3726         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3727         smbd_unlock_socket(smbd_server_conn);
3728
3729  out:
3730         END_PROFILE(SMBreadX);
3731         return;
3732 }
3733
3734 /****************************************************************************
3735  Error replies to writebraw must have smb_wct == 1. Fix this up.
3736 ****************************************************************************/
3737
3738 void error_to_writebrawerr(struct smb_request *req)
3739 {
3740         uint8 *old_outbuf = req->outbuf;
3741
3742         reply_outbuf(req, 1, 0);
3743
3744         memcpy(req->outbuf, old_outbuf, smb_size);
3745         TALLOC_FREE(old_outbuf);
3746 }
3747
3748 /****************************************************************************
3749  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3750 ****************************************************************************/
3751
3752 void reply_writebraw(struct smb_request *req)
3753 {
3754         connection_struct *conn = req->conn;
3755         char *buf = NULL;
3756         ssize_t nwritten=0;
3757         ssize_t total_written=0;
3758         size_t numtowrite=0;
3759         size_t tcount;
3760         SMB_OFF_T startpos;
3761         char *data=NULL;
3762         bool write_through;
3763         files_struct *fsp;
3764         struct lock_struct lock;
3765         NTSTATUS status;
3766
3767         START_PROFILE(SMBwritebraw);
3768
3769         /*
3770          * If we ever reply with an error, it must have the SMB command
3771          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3772          * we're finished.
3773          */
3774         SCVAL(req->inbuf,smb_com,SMBwritec);
3775
3776         if (srv_is_signing_active(smbd_server_conn)) {
3777                 END_PROFILE(SMBwritebraw);
3778                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3779                                 "raw reads/writes are disallowed.");
3780         }
3781
3782         if (req->wct < 12) {
3783                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3784                 error_to_writebrawerr(req);
3785                 END_PROFILE(SMBwritebraw);
3786                 return;
3787         }
3788
3789         if (smbd_server_conn->smb1.echo_handler.trusted_fde) {
3790                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3791                          "'async smb echo handler = yes'\n"));
3792                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3793                 error_to_writebrawerr(req);
3794                 END_PROFILE(SMBwritebraw);
3795                 return;
3796         }
3797
3798         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3799         if (!check_fsp(conn, req, fsp)) {
3800                 error_to_writebrawerr(req);
3801                 END_PROFILE(SMBwritebraw);
3802                 return;
3803         }
3804
3805         if (!CHECK_WRITE(fsp)) {
3806                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3807                 error_to_writebrawerr(req);
3808                 END_PROFILE(SMBwritebraw);
3809                 return;
3810         }
3811
3812         tcount = IVAL(req->vwv+1, 0);
3813         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3814         write_through = BITSETW(req->vwv+7,0);
3815
3816         /* We have to deal with slightly different formats depending
3817                 on whether we are using the core+ or lanman1.0 protocol */
3818
3819         if(get_Protocol() <= PROTOCOL_COREPLUS) {
3820                 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3821                 data = smb_buf(req->inbuf);
3822         } else {
3823                 numtowrite = SVAL(req->vwv+10, 0);
3824                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3825         }
3826
3827         /* Ensure we don't write bytes past the end of this packet. */
3828         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3829                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3830                 error_to_writebrawerr(req);
3831                 END_PROFILE(SMBwritebraw);
3832                 return;
3833         }
3834
3835         if (!fsp->print_file) {
3836                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3837                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3838                     &lock);
3839
3840                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3841                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3842                         error_to_writebrawerr(req);
3843                         END_PROFILE(SMBwritebraw);
3844                         return;
3845                 }
3846         }
3847
3848         if (numtowrite>0) {
3849                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3850         }
3851
3852         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3853                         "wrote=%d sync=%d\n",
3854                 fsp->fnum, (double)startpos, (int)numtowrite,
3855                 (int)nwritten, (int)write_through));
3856
3857         if (nwritten < (ssize_t)numtowrite)  {
3858                 reply_nterror(req, NT_STATUS_DISK_FULL);
3859                 error_to_writebrawerr(req);
3860                 goto strict_unlock;
3861         }
3862
3863         total_written = nwritten;
3864
3865         /* Allocate a buffer of 64k + length. */
3866         buf = TALLOC_ARRAY(NULL, char, 65540);
3867         if (!buf) {
3868                 reply_nterror(req, NT_STATUS_NO_MEMORY);
3869                 error_to_writebrawerr(req);
3870                 goto strict_unlock;
3871         }
3872
3873         /* Return a SMBwritebraw message to the redirector to tell
3874          * it to send more bytes */
3875
3876         memcpy(buf, req->inbuf, smb_size);
3877         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3878         SCVAL(buf,smb_com,SMBwritebraw);
3879         SSVALS(buf,smb_vwv0,0xFFFF);
3880         show_msg(buf);
3881         if (!srv_send_smb(smbd_server_fd(),
3882                           buf,
3883                           false, 0, /* no signing */
3884                           IS_CONN_ENCRYPTED(conn),
3885                           &req->pcd)) {
3886                 exit_server_cleanly("reply_writebraw: srv_send_smb "
3887                         "failed.");
3888         }
3889
3890         /* Now read the raw data into the buffer and write it */
3891         status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3892                                  &numtowrite);
3893         if (!NT_STATUS_IS_OK(status)) {
3894                 exit_server_cleanly("secondary writebraw failed");
3895         }
3896
3897         /* Set up outbuf to return the correct size */
3898         reply_outbuf(req, 1, 0);
3899
3900         if (numtowrite != 0) {
3901
3902                 if (numtowrite > 0xFFFF) {
3903                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3904                                 "raw requested (%u). Terminating\n",
3905                                 (unsigned int)numtowrite ));
3906                         exit_server_cleanly("secondary writebraw failed");
3907                 }
3908
3909                 if (tcount > nwritten+numtowrite) {
3910                         DEBUG(3,("reply_writebraw: Client overestimated the "
3911                                 "write %d %d %d\n",
3912                                 (int)tcount,(int)nwritten,(int)numtowrite));
3913                 }
3914
3915                 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3916
3917                 if (!NT_STATUS_IS_OK(status)) {
3918                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3919                                  "raw read failed (%s). Terminating\n",
3920                                  nt_errstr(status)));
3921                         exit_server_cleanly("secondary writebraw failed");
3922                 }
3923
3924                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3925                 if (nwritten == -1) {
3926                         TALLOC_FREE(buf);
3927                         reply_nterror(req, map_nt_error_from_unix(errno));
3928                         error_to_writebrawerr(req);
3929                         goto strict_unlock;
3930                 }
3931
3932                 if (nwritten < (ssize_t)numtowrite) {
3933                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
3934                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
3935                 }
3936
3937                 if (nwritten > 0) {
3938                         total_written += nwritten;
3939                 }
3940         }
3941
3942         TALLOC_FREE(buf);
3943         SSVAL(req->outbuf,smb_vwv0,total_written);
3944
3945         status = sync_file(conn, fsp, write_through);
3946         if (!NT_STATUS_IS_OK(status)) {
3947                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3948                          fsp_str_dbg(fsp), nt_errstr(status)));
3949                 reply_nterror(req, status);
3950                 error_to_writebrawerr(req);
3951                 goto strict_unlock;
3952         }
3953
3954         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3955                 "wrote=%d\n",
3956                 fsp->fnum, (double)startpos, (int)numtowrite,
3957                 (int)total_written));
3958
3959         if (!fsp->print_file) {
3960                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3961         }
3962
3963         /* We won't return a status if write through is not selected - this
3964          * follows what WfWg does */
3965         END_PROFILE(SMBwritebraw);
3966
3967         if (!write_through && total_written==tcount) {
3968
3969 #if RABBIT_PELLET_FIX
3970                 /*
3971                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3972                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3973                  * JRA.
3974                  */
3975                 if (!send_keepalive(smbd_server_fd())) {
3976                         exit_server_cleanly("reply_writebraw: send of "
3977                                 "keepalive failed");
3978                 }
3979 #endif
3980                 TALLOC_FREE(req->outbuf);
3981         }
3982         return;
3983
3984 strict_unlock:
3985         if (!fsp->print_file) {
3986                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3987         }
3988
3989         END_PROFILE(SMBwritebraw);
3990         return;
3991 }
3992
3993 #undef DBGC_CLASS
3994 #define DBGC_CLASS DBGC_LOCKING
3995
3996 /****************************************************************************
3997  Reply to a writeunlock (core+).
3998 ****************************************************************************/
3999
4000 void reply_writeunlock(struct smb_request *req)
4001 {
4002         connection_struct *conn = req->conn;
4003         ssize_t nwritten = -1;
4004         size_t numtowrite;
4005         SMB_OFF_T startpos;
4006         const char *data;
4007         NTSTATUS status = NT_STATUS_OK;
4008         files_struct *fsp;
4009         struct lock_struct lock;
4010         int saved_errno = 0;
4011
4012         START_PROFILE(SMBwriteunlock);
4013
4014         if (req->wct < 5) {
4015                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4016                 END_PROFILE(SMBwriteunlock);
4017                 return;
4018         }
4019
4020         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4021
4022         if (!check_fsp(conn, req, fsp)) {
4023                 END_PROFILE(SMBwriteunlock);
4024                 return;
4025         }
4026
4027         if (!CHECK_WRITE(fsp)) {
4028                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4029                 END_PROFILE(SMBwriteunlock);
4030                 return;
4031         }
4032
4033         numtowrite = SVAL(req->vwv+1, 0);
4034         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4035         data = (const char *)req->buf + 3;
4036
4037         if (!fsp->print_file && numtowrite > 0) {
4038                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4039                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4040                     &lock);
4041
4042                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4043                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4044                         END_PROFILE(SMBwriteunlock);
4045                         return;
4046                 }
4047         }
4048
4049         /* The special X/Open SMB protocol handling of
4050            zero length writes is *NOT* done for
4051            this call */
4052         if(numtowrite == 0) {
4053                 nwritten = 0;
4054         } else {
4055                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4056                 saved_errno = errno;
4057         }
4058
4059         status = sync_file(conn, fsp, False /* write through */);
4060         if (!NT_STATUS_IS_OK(status)) {
4061                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4062                          fsp_str_dbg(fsp), nt_errstr(status)));
4063                 reply_nterror(req, status);
4064                 goto strict_unlock;
4065         }
4066
4067         if(nwritten < 0) {
4068                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4069                 goto strict_unlock;
4070         }
4071
4072         if((nwritten < numtowrite) && (numtowrite != 0)) {
4073                 reply_nterror(req, NT_STATUS_DISK_FULL);
4074                 goto strict_unlock;
4075         }
4076
4077         if (numtowrite && !fsp->print_file) {
4078                 status = do_unlock(smbd_messaging_context(),
4079                                 fsp,
4080                                 (uint64_t)req->smbpid,
4081                                 (uint64_t)numtowrite,
4082                                 (uint64_t)startpos,
4083                                 WINDOWS_LOCK);
4084
4085                 if (NT_STATUS_V(status)) {
4086                         reply_nterror(req, status);
4087                         goto strict_unlock;
4088                 }
4089         }
4090
4091         reply_outbuf(req, 1, 0);
4092
4093         SSVAL(req->outbuf,smb_vwv0,nwritten);
4094
4095         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4096                  fsp->fnum, (int)numtowrite, (int)nwritten));
4097
4098 strict_unlock:
4099         if (numtowrite && !fsp->print_file) {
4100                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4101         }
4102
4103         END_PROFILE(SMBwriteunlock);
4104         return;
4105 }
4106
4107 #undef DBGC_CLASS
4108 #define DBGC_CLASS DBGC_ALL
4109
4110 /****************************************************************************
4111  Reply to a write.
4112 ****************************************************************************/
4113
4114 void reply_write(struct smb_request *req)
4115 {
4116         connection_struct *conn = req->conn;
4117         size_t numtowrite;
4118         ssize_t nwritten = -1;
4119         SMB_OFF_T startpos;
4120         const char *data;
4121         files_struct *fsp;
4122         struct lock_struct lock;
4123         NTSTATUS status;
4124         int saved_errno = 0;
4125
4126         START_PROFILE(SMBwrite);
4127
4128         if (req->wct < 5) {
4129                 END_PROFILE(SMBwrite);
4130                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4131                 return;
4132         }
4133
4134         /* If it's an IPC, pass off the pipe handler. */
4135         if (IS_IPC(conn)) {
4136                 reply_pipe_write(req);
4137                 END_PROFILE(SMBwrite);
4138                 return;
4139         }
4140
4141         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4142
4143         if (!check_fsp(conn, req, fsp)) {
4144                 END_PROFILE(SMBwrite);
4145                 return;
4146         }
4147
4148         if (!CHECK_WRITE(fsp)) {
4149                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4150                 END_PROFILE(SMBwrite);
4151                 return;
4152         }
4153
4154         numtowrite = SVAL(req->vwv+1, 0);
4155         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4156         data = (const char *)req->buf + 3;
4157
4158         if (!fsp->print_file) {
4159                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4160                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4161                         &lock);
4162
4163                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4164                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4165                         END_PROFILE(SMBwrite);
4166                         return;
4167                 }
4168         }
4169
4170         /*
4171          * X/Open SMB protocol says that if smb_vwv1 is
4172          * zero then the file size should be extended or
4173          * truncated to the size given in smb_vwv[2-3].
4174          */
4175
4176         if(numtowrite == 0) {
4177                 /*
4178                  * This is actually an allocate call, and set EOF. JRA.
4179                  */
4180                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4181                 if (nwritten < 0) {
4182                         reply_nterror(req, NT_STATUS_DISK_FULL);
4183                         goto strict_unlock;
4184                 }
4185                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4186                 if (nwritten < 0) {
4187                         reply_nterror(req, NT_STATUS_DISK_FULL);
4188                         goto strict_unlock;
4189                 }
4190                 trigger_write_time_update_immediate(fsp);
4191         } else {
4192                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4193         }
4194
4195         status = sync_file(conn, fsp, False);
4196         if (!NT_STATUS_IS_OK(status)) {
4197                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4198                          fsp_str_dbg(fsp), nt_errstr(status)));
4199                 reply_nterror(req, status);
4200                 goto strict_unlock;
4201         }
4202
4203         if(nwritten < 0) {
4204                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4205                 goto strict_unlock;
4206         }
4207
4208         if((nwritten == 0) && (numtowrite != 0)) {
4209                 reply_nterror(req, NT_STATUS_DISK_FULL);
4210                 goto strict_unlock;
4211         }
4212
4213         reply_outbuf(req, 1, 0);
4214
4215         SSVAL(req->outbuf,smb_vwv0,nwritten);
4216
4217         if (nwritten < (ssize_t)numtowrite) {
4218                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4219                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4220         }
4221
4222         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4223
4224 strict_unlock:
4225         if (!fsp->print_file) {
4226                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4227         }
4228
4229         END_PROFILE(SMBwrite);
4230         return;
4231 }
4232
4233 /****************************************************************************
4234  Ensure a buffer is a valid writeX for recvfile purposes.
4235 ****************************************************************************/
4236
4237 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4238                                                 (2*14) + /* word count (including bcc) */ \
4239                                                 1 /* pad byte */)
4240
4241 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4242 {
4243         size_t numtowrite;
4244         connection_struct *conn = NULL;
4245         unsigned int doff = 0;
4246         size_t len = smb_len_large(inbuf);
4247         struct smbd_server_connection *sconn = smbd_server_conn;
4248
4249         if (is_encrypted_packet(inbuf)) {
4250                 /* Can't do this on encrypted
4251                  * connections. */
4252                 return false;
4253         }
4254
4255         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4256                 return false;
4257         }
4258
4259         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4260                         CVAL(inbuf,smb_wct) != 14) {
4261                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4262                         "invalid word length.\n"));
4263                 return false;
4264         }
4265
4266         conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4267         if (conn == NULL) {
4268                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4269                 return false;
4270         }
4271         if (IS_IPC(conn)) {
4272                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4273                 return false;
4274         }
4275         if (IS_PRINT(conn)) {
4276                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4277                 return false;
4278         }
4279         doff = SVAL(inbuf,smb_vwv11);
4280
4281         numtowrite = SVAL(inbuf,smb_vwv10);
4282
4283         if (len > doff && len - doff > 0xFFFF) {
4284                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4285         }
4286
4287         if (numtowrite == 0) {
4288                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4289                 return false;
4290         }
4291
4292         /* Ensure the sizes match up. */
4293         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4294                 /* no pad byte...old smbclient :-( */
4295                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4296                         (unsigned int)doff,
4297                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4298                 return false;
4299         }
4300
4301         if (len - doff != numtowrite) {
4302                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4303                         "len = %u, doff = %u, numtowrite = %u\n",
4304                         (unsigned int)len,
4305                         (unsigned int)doff,
4306                         (unsigned int)numtowrite ));
4307                 return false;
4308         }
4309
4310         DEBUG(10,("is_valid_writeX_buffer: true "
4311                 "len = %u, doff = %u, numtowrite = %u\n",
4312                 (unsigned int)len,
4313                 (unsigned int)doff,
4314                 (unsigned int)numtowrite ));
4315
4316         return true;
4317 }
4318
4319 /****************************************************************************
4320  Reply to a write and X.
4321 ****************************************************************************/
4322
4323 void reply_write_and_X(struct smb_request *req)
4324 {
4325         connection_struct *conn = req->conn;
4326         files_struct *fsp;
4327         struct lock_struct lock;
4328         SMB_OFF_T startpos;
4329         size_t numtowrite;
4330         bool write_through;
4331         ssize_t nwritten;
4332         unsigned int smb_doff;
4333         unsigned int smblen;
4334         char *data;
4335         NTSTATUS status;
4336         int saved_errno = 0;
4337
4338         START_PROFILE(SMBwriteX);
4339
4340         if ((req->wct != 12) && (req->wct != 14)) {
4341                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4342                 END_PROFILE(SMBwriteX);
4343                 return;
4344         }
4345
4346         numtowrite = SVAL(req->vwv+10, 0);
4347         smb_doff = SVAL(req->vwv+11, 0);
4348         smblen = smb_len(req->inbuf);
4349
4350         if (req->unread_bytes > 0xFFFF ||
4351                         (smblen > smb_doff &&
4352                                 smblen - smb_doff > 0xFFFF)) {
4353                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4354         }
4355
4356         if (req->unread_bytes) {
4357                 /* Can't do a recvfile write on IPC$ */
4358                 if (IS_IPC(conn)) {
4359                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4360                         END_PROFILE(SMBwriteX);
4361                         return;
4362                 }
4363                 if (numtowrite != req->unread_bytes) {
4364                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4365                         END_PROFILE(SMBwriteX);
4366                         return;
4367                 }
4368         } else {
4369                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4370                                 smb_doff + numtowrite > smblen) {
4371                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4372                         END_PROFILE(SMBwriteX);
4373                         return;
4374                 }
4375         }
4376
4377         /* If it's an IPC, pass off the pipe handler. */
4378         if (IS_IPC(conn)) {
4379                 if (req->unread_bytes) {
4380                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4381                         END_PROFILE(SMBwriteX);
4382                         return;
4383                 }
4384                 reply_pipe_write_and_X(req);
4385                 END_PROFILE(SMBwriteX);
4386                 return;
4387         }
4388
4389         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4390         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4391         write_through = BITSETW(req->vwv+7,0);
4392
4393         if (!check_fsp(conn, req, fsp)) {
4394                 END_PROFILE(SMBwriteX);
4395                 return;
4396         }
4397
4398         if (!CHECK_WRITE(fsp)) {
4399                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4400                 END_PROFILE(SMBwriteX);
4401                 return;
4402         }
4403
4404         data = smb_base(req->inbuf) + smb_doff;
4405
4406         if(req->wct == 14) {
4407 #ifdef LARGE_SMB_OFF_T
4408                 /*
4409                  * This is a large offset (64 bit) write.
4410                  */
4411                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4412
4413 #else /* !LARGE_SMB_OFF_T */
4414
4415                 /*
4416                  * Ensure we haven't been sent a >32 bit offset.
4417                  */
4418
4419                 if(IVAL(req->vwv+12, 0) != 0) {
4420                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4421                                  "used and we don't support 64 bit offsets.\n",
4422                                  (unsigned int)IVAL(req->vwv+12, 0) ));
4423                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4424                         END_PROFILE(SMBwriteX);
4425                         return;
4426                 }
4427
4428 #endif /* LARGE_SMB_OFF_T */
4429         }
4430
4431         /* X/Open SMB protocol says that, unlike SMBwrite
4432         if the length is zero then NO truncation is
4433         done, just a write of zero. To truncate a file,
4434         use SMBwrite. */
4435
4436         if(numtowrite == 0) {
4437                 nwritten = 0;
4438         } else {
4439                 if (req->unread_bytes == 0) {
4440                         status = schedule_aio_write_and_X(conn,
4441                                                 req,
4442                                                 fsp,
4443                                                 data,
4444                                                 startpos,
4445                                                 numtowrite);
4446
4447                         if (NT_STATUS_IS_OK(status)) {
4448                                 /* write scheduled - we're done. */
4449                                 goto out;
4450                         }
4451                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4452                                 /* Real error - report to client. */
4453                                 reply_nterror(req, status);
4454                                 goto out;
4455                         }
4456                         /* NT_STATUS_RETRY - fall through to sync write. */
4457                 }
4458
4459                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4460                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4461                     &lock);
4462
4463                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4464                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4465                         goto out;
4466                 }
4467
4468                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4469                 saved_errno = errno;
4470
4471                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4472         }
4473
4474         if(nwritten < 0) {
4475                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4476                 goto out;
4477         }
4478
4479         if((nwritten == 0) && (numtowrite != 0)) {
4480                 reply_nterror(req, NT_STATUS_DISK_FULL);
4481                 goto out;
4482         }
4483
4484         reply_outbuf(req, 6, 0);
4485         SSVAL(req->outbuf,smb_vwv2,nwritten);
4486         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4487
4488         if (nwritten < (ssize_t)numtowrite) {
4489                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4490                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4491         }
4492
4493         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4494                 fsp->fnum, (int)numtowrite, (int)nwritten));
4495
4496         status = sync_file(conn, fsp, write_through);
4497         if (!NT_STATUS_IS_OK(status)) {
4498                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4499                          fsp_str_dbg(fsp), nt_errstr(status)));
4500                 reply_nterror(req, status);
4501                 goto out;
4502         }
4503
4504         END_PROFILE(SMBwriteX);
4505         chain_reply(req);
4506         return;
4507
4508 out:
4509         END_PROFILE(SMBwriteX);
4510         return;
4511 }
4512
4513 /****************************************************************************
4514  Reply to a lseek.
4515 ****************************************************************************/
4516
4517 void reply_lseek(struct smb_request *req)
4518 {
4519         connection_struct *conn = req->conn;
4520         SMB_OFF_T startpos;
4521         SMB_OFF_T res= -1;
4522         int mode,umode;
4523         files_struct *fsp;
4524
4525         START_PROFILE(SMBlseek);
4526
4527         if (req->wct < 4) {
4528                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4529                 END_PROFILE(SMBlseek);
4530                 return;
4531         }
4532
4533         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4534
4535         if (!check_fsp(conn, req, fsp)) {
4536                 return;
4537         }
4538
4539         flush_write_cache(fsp, SEEK_FLUSH);
4540
4541         mode = SVAL(req->vwv+1, 0) & 3;
4542         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4543         startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4544
4545         switch (mode) {
4546                 case 0:
4547                         umode = SEEK_SET;
4548                         res = startpos;
4549                         break;
4550                 case 1:
4551                         umode = SEEK_CUR;
4552                         res = fsp->fh->pos + startpos;
4553                         break;
4554                 case 2:
4555                         umode = SEEK_END;
4556                         break;
4557                 default:
4558                         umode = SEEK_SET;
4559                         res = startpos;
4560                         break;
4561         }
4562
4563         if (umode == SEEK_END) {
4564                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4565                         if(errno == EINVAL) {
4566                                 SMB_OFF_T current_pos = startpos;
4567
4568                                 if(fsp_stat(fsp) == -1) {
4569                                         reply_nterror(req,
4570                                                 map_nt_error_from_unix(errno));
4571                                         END_PROFILE(SMBlseek);
4572                                         return;
4573                                 }
4574
4575                                 current_pos += fsp->fsp_name->st.st_ex_size;
4576                                 if(current_pos < 0)
4577                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4578                         }
4579                 }
4580
4581                 if(res == -1) {
4582                         reply_nterror(req, map_nt_error_from_unix(errno));
4583                         END_PROFILE(SMBlseek);
4584                         return;
4585                 }
4586         }
4587
4588         fsp->fh->pos = res;
4589
4590         reply_outbuf(req, 2, 0);
4591         SIVAL(req->outbuf,smb_vwv0,res);
4592
4593         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4594                 fsp->fnum, (double)startpos, (double)res, mode));
4595
4596         END_PROFILE(SMBlseek);
4597         return;
4598 }
4599
4600 /****************************************************************************
4601  Reply to a flush.
4602 ****************************************************************************/
4603
4604 void reply_flush(struct smb_request *req)
4605 {
4606         connection_struct *conn = req->conn;
4607         uint16 fnum;
4608         files_struct *fsp;
4609
4610         START_PROFILE(SMBflush);
4611
4612         if (req->wct < 1) {
4613                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4614                 return;
4615         }
4616
4617         fnum = SVAL(req->vwv+0, 0);
4618         fsp = file_fsp(req, fnum);
4619
4620         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4621                 return;
4622         }
4623
4624         if (!fsp) {
4625                 file_sync_all(conn);
4626         } else {
4627                 NTSTATUS status = sync_file(conn, fsp, True);
4628                 if (!NT_STATUS_IS_OK(status)) {
4629                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4630                                 fsp_str_dbg(fsp), nt_errstr(status)));
4631                         reply_nterror(req, status);
4632                         END_PROFILE(SMBflush);
4633                         return;
4634                 }
4635         }
4636
4637         reply_outbuf(req, 0, 0);
4638
4639         DEBUG(3,("flush\n"));
4640         END_PROFILE(SMBflush);
4641         return;
4642 }
4643
4644 /****************************************************************************
4645  Reply to a exit.
4646  conn POINTER CAN BE NULL HERE !
4647 ****************************************************************************/
4648
4649 void reply_exit(struct smb_request *req)
4650 {
4651         START_PROFILE(SMBexit);
4652
4653         file_close_pid(req->smbpid, req->vuid);
4654
4655         reply_outbuf(req, 0, 0);
4656
4657         DEBUG(3,("exit\n"));
4658
4659         END_PROFILE(SMBexit);
4660         return;
4661 }
4662
4663 /****************************************************************************
4664  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4665 ****************************************************************************/
4666
4667 void reply_close(struct smb_request *req)
4668 {
4669         connection_struct *conn = req->conn;
4670         NTSTATUS status = NT_STATUS_OK;
4671         files_struct *fsp = NULL;
4672         START_PROFILE(SMBclose);
4673
4674         if (req->wct < 3) {
4675                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4676                 END_PROFILE(SMBclose);
4677                 return;
4678         }
4679
4680         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4681
4682         /*
4683          * We can only use check_fsp if we know it's not a directory.
4684          */
4685
4686         if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4687                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4688                 END_PROFILE(SMBclose);
4689                 return;
4690         }
4691
4692         if(fsp->is_directory) {
4693                 /*
4694                  * Special case - close NT SMB directory handle.
4695                  */
4696                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4697                 status = close_file(req, fsp, NORMAL_CLOSE);
4698         } else {
4699                 time_t t;
4700                 /*
4701                  * Close ordinary file.
4702                  */
4703
4704                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4705                          fsp->fh->fd, fsp->fnum,
4706                          conn->num_files_open));
4707
4708                 /*
4709                  * Take care of any time sent in the close.
4710                  */
4711
4712                 t = srv_make_unix_date3(req->vwv+1);
4713                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4714
4715                 /*
4716                  * close_file() returns the unix errno if an error
4717                  * was detected on close - normally this is due to
4718                  * a disk full error. If not then it was probably an I/O error.
4719                  */
4720
4721                 status = close_file(req, fsp, NORMAL_CLOSE);
4722         }
4723
4724         if (!NT_STATUS_IS_OK(status)) {
4725                 reply_nterror(req, status);
4726                 END_PROFILE(SMBclose);
4727                 return;
4728         }
4729
4730         reply_outbuf(req, 0, 0);
4731         END_PROFILE(SMBclose);
4732         return;
4733 }
4734
4735 /****************************************************************************
4736  Reply to a writeclose (Core+ protocol).
4737 ****************************************************************************/
4738
4739 void reply_writeclose(struct smb_request *req)
4740 {
4741         connection_struct *conn = req->conn;
4742         size_t numtowrite;
4743         ssize_t nwritten = -1;
4744         NTSTATUS close_status = NT_STATUS_OK;
4745         SMB_OFF_T startpos;
4746         const char *data;
4747         struct timespec mtime;
4748         files_struct *fsp;
4749         struct lock_struct lock;
4750
4751         START_PROFILE(SMBwriteclose);
4752
4753         if (req->wct < 6) {
4754                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4755                 END_PROFILE(SMBwriteclose);
4756                 return;
4757         }
4758
4759         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4760
4761         if (!check_fsp(conn, req, fsp)) {
4762                 END_PROFILE(SMBwriteclose);
4763                 return;
4764         }
4765         if (!CHECK_WRITE(fsp)) {
4766                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4767                 END_PROFILE(SMBwriteclose);
4768                 return;
4769         }
4770
4771         numtowrite = SVAL(req->vwv+1, 0);
4772         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4773         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4774         data = (const char *)req->buf + 1;
4775
4776         if (!fsp->print_file) {
4777                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4778                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4779                     &lock);
4780
4781                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4782                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4783                         END_PROFILE(SMBwriteclose);
4784                         return;
4785                 }
4786         }
4787
4788         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4789
4790         set_close_write_time(fsp, mtime);
4791
4792         /*
4793          * More insanity. W2K only closes the file if writelen > 0.
4794          * JRA.
4795          */
4796
4797         if (numtowrite) {
4798                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4799                          "file %s\n", fsp_str_dbg(fsp)));
4800                 close_status = close_file(req, fsp, NORMAL_CLOSE);
4801         }
4802
4803         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4804                  fsp->fnum, (int)numtowrite, (int)nwritten,
4805                  conn->num_files_open));
4806
4807         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4808                 reply_nterror(req, NT_STATUS_DISK_FULL);
4809                 goto strict_unlock;
4810         }
4811
4812         if(!NT_STATUS_IS_OK(close_status)) {
4813                 reply_nterror(req, close_status);
4814                 goto strict_unlock;
4815         }
4816
4817         reply_outbuf(req, 1, 0);
4818
4819         SSVAL(req->outbuf,smb_vwv0,nwritten);
4820
4821 strict_unlock:
4822         if (numtowrite && !fsp->print_file) {
4823                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4824         }
4825
4826         END_PROFILE(SMBwriteclose);
4827         return;
4828 }
4829
4830 #undef DBGC_CLASS
4831 #define DBGC_CLASS DBGC_LOCKING
4832
4833 /****************************************************************************
4834  Reply to a lock.
4835 ****************************************************************************/
4836
4837 void reply_lock(struct smb_request *req)
4838 {
4839         connection_struct *conn = req->conn;
4840         uint64_t count,offset;
4841         NTSTATUS status;
4842         files_struct *fsp;
4843         struct byte_range_lock *br_lck = NULL;
4844
4845         START_PROFILE(SMBlock);
4846
4847         if (req->wct < 5) {
4848                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4849                 END_PROFILE(SMBlock);
4850                 return;
4851         }
4852
4853         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4854
4855         if (!check_fsp(conn, req, fsp)) {
4856                 END_PROFILE(SMBlock);
4857                 return;
4858         }
4859
4860         count = (uint64_t)IVAL(req->vwv+1, 0);
4861         offset = (uint64_t)IVAL(req->vwv+3, 0);
4862
4863         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4864                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4865
4866         br_lck = do_lock(smbd_messaging_context(),
4867                         fsp,
4868                         (uint64_t)req->smbpid,
4869                         count,
4870                         offset,
4871                         WRITE_LOCK,
4872                         WINDOWS_LOCK,
4873                         False, /* Non-blocking lock. */
4874                         &status,
4875                         NULL,
4876                         NULL);
4877
4878         TALLOC_FREE(br_lck);
4879
4880         if (NT_STATUS_V(status)) {
4881                 reply_nterror(req, status);
4882                 END_PROFILE(SMBlock);
4883                 return;
4884         }
4885
4886         reply_outbuf(req, 0, 0);
4887
4888         END_PROFILE(SMBlock);
4889         return;
4890 }
4891
4892 /****************************************************************************
4893  Reply to a unlock.
4894 ****************************************************************************/
4895
4896 void reply_unlock(struct smb_request *req)
4897 {
4898         connection_struct *conn = req->conn;
4899         uint64_t count,offset;
4900         NTSTATUS status;
4901         files_struct *fsp;
4902
4903         START_PROFILE(SMBunlock);
4904
4905         if (req->wct < 5) {
4906                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4907                 END_PROFILE(SMBunlock);
4908                 return;
4909         }
4910
4911         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4912
4913         if (!check_fsp(conn, req, fsp)) {
4914                 END_PROFILE(SMBunlock);
4915                 return;
4916         }
4917
4918         count = (uint64_t)IVAL(req->vwv+1, 0);
4919         offset = (uint64_t)IVAL(req->vwv+3, 0);
4920
4921         status = do_unlock(smbd_messaging_context(),
4922                         fsp,
4923                         (uint64_t)req->smbpid,
4924                         count,
4925                         offset,
4926                         WINDOWS_LOCK);
4927
4928         if (NT_STATUS_V(status)) {
4929                 reply_nterror(req, status);
4930                 END_PROFILE(SMBunlock);
4931                 return;
4932         }
4933
4934         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4935                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4936
4937         reply_outbuf(req, 0, 0);
4938
4939         END_PROFILE(SMBunlock);
4940         return;
4941 }
4942
4943 #undef DBGC_CLASS
4944 #define DBGC_CLASS DBGC_ALL
4945
4946 /****************************************************************************
4947  Reply to a tdis.
4948  conn POINTER CAN BE NULL HERE !
4949 ****************************************************************************/
4950
4951 void reply_tdis(struct smb_request *req)
4952 {
4953         connection_struct *conn = req->conn;
4954         START_PROFILE(SMBtdis);
4955
4956         if (!conn) {
4957                 DEBUG(4,("Invalid connection in tdis\n"));
4958                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
4959                 END_PROFILE(SMBtdis);
4960                 return;
4961         }
4962
4963         conn->used = False;
4964
4965         close_cnum(conn,req->vuid);
4966         req->conn = NULL;
4967
4968         reply_outbuf(req, 0, 0);
4969         END_PROFILE(SMBtdis);
4970         return;
4971 }
4972
4973 /****************************************************************************
4974  Reply to a echo.
4975  conn POINTER CAN BE NULL HERE !
4976 ****************************************************************************/
4977
4978 void reply_echo(struct smb_request *req)
4979 {
4980         connection_struct *conn = req->conn;
4981         struct smb_perfcount_data local_pcd;
4982         struct smb_perfcount_data *cur_pcd;
4983         int smb_reverb;
4984         int seq_num;
4985
4986         START_PROFILE(SMBecho);
4987
4988         smb_init_perfcount_data(&local_pcd);
4989
4990         if (req->wct < 1) {
4991                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4992                 END_PROFILE(SMBecho);
4993                 return;
4994         }
4995
4996         smb_reverb = SVAL(req->vwv+0, 0);
4997
4998         reply_outbuf(req, 1, req->buflen);
4999
5000         /* copy any incoming data back out */
5001         if (req->buflen > 0) {
5002                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5003         }
5004
5005         if (smb_reverb > 100) {
5006                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5007                 smb_reverb = 100;
5008         }
5009
5010         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5011
5012                 /* this makes sure we catch the request pcd */
5013                 if (seq_num == smb_reverb) {
5014                         cur_pcd = &req->pcd;
5015                 } else {
5016                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5017                         cur_pcd = &local_pcd;
5018                 }
5019
5020                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5021
5022                 show_msg((char *)req->outbuf);
5023                 if (!srv_send_smb(smbd_server_fd(),
5024                                 (char *)req->outbuf,
5025                                 true, req->seqnum+1,
5026                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5027                                 cur_pcd))
5028                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5029         }
5030
5031         DEBUG(3,("echo %d times\n", smb_reverb));
5032
5033         TALLOC_FREE(req->outbuf);
5034
5035         END_PROFILE(SMBecho);
5036         return;
5037 }
5038
5039 /****************************************************************************
5040  Reply to a printopen.
5041 ****************************************************************************/
5042
5043 void reply_printopen(struct smb_request *req)
5044 {
5045         connection_struct *conn = req->conn;
5046         files_struct *fsp;
5047         NTSTATUS status;
5048
5049         START_PROFILE(SMBsplopen);
5050
5051         if (req->wct < 2) {
5052                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5053                 END_PROFILE(SMBsplopen);
5054                 return;
5055         }
5056
5057         if (!CAN_PRINT(conn)) {
5058                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5059                 END_PROFILE(SMBsplopen);
5060                 return;
5061         }
5062
5063         status = file_new(req, conn, &fsp);
5064         if(!NT_STATUS_IS_OK(status)) {
5065                 reply_nterror(req, status);
5066                 END_PROFILE(SMBsplopen);
5067                 return;
5068         }
5069
5070         /* Open for exclusive use, write only. */
5071         status = print_fsp_open(req, conn, NULL, req->vuid, fsp);
5072
5073         if (!NT_STATUS_IS_OK(status)) {
5074                 file_free(req, fsp);
5075                 reply_nterror(req, status);
5076                 END_PROFILE(SMBsplopen);
5077                 return;
5078         }
5079
5080         reply_outbuf(req, 1, 0);
5081         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5082
5083         DEBUG(3,("openprint fd=%d fnum=%d\n",
5084                  fsp->fh->fd, fsp->fnum));
5085
5086         END_PROFILE(SMBsplopen);
5087         return;
5088 }
5089
5090 /****************************************************************************
5091  Reply to a printclose.
5092 ****************************************************************************/
5093
5094 void reply_printclose(struct smb_request *req)
5095 {
5096         connection_struct *conn = req->conn;
5097         files_struct *fsp;
5098         NTSTATUS status;
5099
5100         START_PROFILE(SMBsplclose);
5101
5102         if (req->wct < 1) {
5103                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5104                 END_PROFILE(SMBsplclose);
5105                 return;
5106         }
5107
5108         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5109
5110         if (!check_fsp(conn, req, fsp)) {
5111                 END_PROFILE(SMBsplclose);
5112                 return;
5113         }
5114
5115         if (!CAN_PRINT(conn)) {
5116                 reply_force_doserror(req, ERRSRV, ERRerror);
5117                 END_PROFILE(SMBsplclose);
5118                 return;
5119         }
5120
5121         DEBUG(3,("printclose fd=%d fnum=%d\n",
5122                  fsp->fh->fd,fsp->fnum));
5123
5124         status = close_file(req, fsp, NORMAL_CLOSE);
5125
5126         if(!NT_STATUS_IS_OK(status)) {
5127                 reply_nterror(req, status);
5128                 END_PROFILE(SMBsplclose);
5129                 return;
5130         }
5131
5132         reply_outbuf(req, 0, 0);
5133
5134         END_PROFILE(SMBsplclose);
5135         return;
5136 }
5137
5138 /****************************************************************************
5139  Reply to a printqueue.
5140 ****************************************************************************/
5141
5142 void reply_printqueue(struct smb_request *req)
5143 {
5144         connection_struct *conn = req->conn;
5145         int max_count;
5146         int start_index;
5147
5148         START_PROFILE(SMBsplretq);
5149
5150         if (req->wct < 2) {
5151                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5152                 END_PROFILE(SMBsplretq);
5153                 return;
5154         }
5155
5156         max_count = SVAL(req->vwv+0, 0);
5157         start_index = SVAL(req->vwv+1, 0);
5158
5159         /* we used to allow the client to get the cnum wrong, but that
5160            is really quite gross and only worked when there was only
5161            one printer - I think we should now only accept it if they
5162            get it right (tridge) */
5163         if (!CAN_PRINT(conn)) {
5164                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5165                 END_PROFILE(SMBsplretq);
5166                 return;
5167         }
5168
5169         reply_outbuf(req, 2, 3);
5170         SSVAL(req->outbuf,smb_vwv0,0);
5171         SSVAL(req->outbuf,smb_vwv1,0);
5172         SCVAL(smb_buf(req->outbuf),0,1);
5173         SSVAL(smb_buf(req->outbuf),1,0);
5174
5175         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5176                  start_index, max_count));
5177
5178         {
5179                 print_queue_struct *queue = NULL;
5180                 print_status_struct status;
5181                 int count = print_queue_status(SNUM(conn), &queue, &status);
5182                 int num_to_get = ABS(max_count);
5183                 int first = (max_count>0?start_index:start_index+max_count+1);
5184                 int i;
5185
5186                 if (first >= count)
5187                         num_to_get = 0;
5188                 else
5189                         num_to_get = MIN(num_to_get,count-first);
5190
5191
5192                 for (i=first;i<first+num_to_get;i++) {
5193                         char blob[28];
5194                         char *p = blob;
5195
5196                         srv_put_dos_date2(p,0,queue[i].time);
5197                         SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
5198                         SSVAL(p,5, queue[i].job);
5199                         SIVAL(p,7,queue[i].size);
5200                         SCVAL(p,11,0);
5201                         srvstr_push(blob, req->flags2, p+12,
5202                                     queue[i].fs_user, 16, STR_ASCII);
5203
5204                         if (message_push_blob(
5205                                     &req->outbuf,
5206                                     data_blob_const(
5207                                             blob, sizeof(blob))) == -1) {
5208                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5209                                 END_PROFILE(SMBsplretq);
5210                                 return;
5211                         }
5212                 }
5213
5214                 if (count > 0) {
5215                         SSVAL(req->outbuf,smb_vwv0,count);
5216                         SSVAL(req->outbuf,smb_vwv1,
5217                               (max_count>0?first+count:first-1));
5218                         SCVAL(smb_buf(req->outbuf),0,1);
5219                         SSVAL(smb_buf(req->outbuf),1,28*count);
5220                 }
5221
5222                 SAFE_FREE(queue);
5223
5224                 DEBUG(3,("%d entries returned in queue\n",count));
5225         }
5226
5227         END_PROFILE(SMBsplretq);
5228         return;
5229 }
5230
5231 /****************************************************************************
5232  Reply to a printwrite.
5233 ****************************************************************************/
5234
5235 void reply_printwrite(struct smb_request *req)
5236 {
5237         connection_struct *conn = req->conn;
5238         int numtowrite;
5239         const char *data;
5240         files_struct *fsp;
5241
5242         START_PROFILE(SMBsplwr);
5243
5244         if (req->wct < 1) {
5245                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5246                 END_PROFILE(SMBsplwr);
5247                 return;
5248         }
5249
5250         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5251
5252         if (!check_fsp(conn, req, fsp)) {
5253                 END_PROFILE(SMBsplwr);
5254                 return;
5255         }
5256
5257         if (!CAN_PRINT(conn)) {
5258                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5259                 END_PROFILE(SMBsplwr);
5260                 return;
5261         }
5262
5263         if (!CHECK_WRITE(fsp)) {
5264                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5265                 END_PROFILE(SMBsplwr);
5266                 return;
5267         }
5268
5269         numtowrite = SVAL(req->buf, 1);
5270
5271         if (req->buflen < numtowrite + 3) {
5272                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5273                 END_PROFILE(SMBsplwr);
5274                 return;
5275         }
5276
5277         data = (const char *)req->buf + 3;
5278
5279         if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5280                 reply_nterror(req, map_nt_error_from_unix(errno));
5281                 END_PROFILE(SMBsplwr);
5282                 return;
5283         }
5284
5285         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5286
5287         END_PROFILE(SMBsplwr);
5288         return;
5289 }
5290
5291 /****************************************************************************
5292  Reply to a mkdir.
5293 ****************************************************************************/
5294
5295 void reply_mkdir(struct smb_request *req)
5296 {
5297         connection_struct *conn = req->conn;
5298         struct smb_filename *smb_dname = NULL;
5299         char *directory = NULL;
5300         NTSTATUS status;
5301         TALLOC_CTX *ctx = talloc_tos();
5302
5303         START_PROFILE(SMBmkdir);
5304
5305         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5306                             STR_TERMINATE, &status);
5307         if (!NT_STATUS_IS_OK(status)) {
5308                 reply_nterror(req, status);
5309                 goto out;
5310         }
5311
5312         status = filename_convert(ctx, conn,
5313                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5314                                  directory,
5315                                  0,
5316                                  NULL,
5317                                  &smb_dname);
5318         if (!NT_STATUS_IS_OK(status)) {
5319                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5320                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5321                                         ERRSRV, ERRbadpath);
5322                         goto out;
5323                 }
5324                 reply_nterror(req, status);
5325                 goto out;
5326         }
5327
5328         status = create_directory(conn, req, smb_dname);
5329
5330         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5331
5332         if (!NT_STATUS_IS_OK(status)) {
5333
5334                 if (!use_nt_status()
5335                     && NT_STATUS_EQUAL(status,
5336                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5337                         /*
5338                          * Yes, in the DOS error code case we get a
5339                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5340                          * samba4 torture test.
5341                          */
5342                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5343                 }
5344
5345                 reply_nterror(req, status);
5346                 goto out;
5347         }
5348
5349         reply_outbuf(req, 0, 0);
5350
5351         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5352  out:
5353         TALLOC_FREE(smb_dname);
5354         END_PROFILE(SMBmkdir);
5355         return;
5356 }
5357
5358 /****************************************************************************
5359  Reply to a rmdir.
5360 ****************************************************************************/
5361
5362 void reply_rmdir(struct smb_request *req)
5363 {
5364         connection_struct *conn = req->conn;
5365         struct smb_filename *smb_dname = NULL;
5366         char *directory = NULL;
5367         NTSTATUS status;
5368         TALLOC_CTX *ctx = talloc_tos();
5369         files_struct *fsp = NULL;
5370         int info = 0;
5371         struct smbd_server_connection *sconn = smbd_server_conn;
5372
5373         START_PROFILE(SMBrmdir);
5374
5375         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5376                             STR_TERMINATE, &status);
5377         if (!NT_STATUS_IS_OK(status)) {
5378                 reply_nterror(req, status);
5379                 goto out;
5380         }
5381
5382         status = filename_convert(ctx, conn,
5383                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5384                                  directory,
5385                                  0,
5386                                  NULL,
5387                                  &smb_dname);
5388         if (!NT_STATUS_IS_OK(status)) {
5389                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5390                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5391                                         ERRSRV, ERRbadpath);
5392                         goto out;
5393                 }
5394                 reply_nterror(req, status);
5395                 goto out;
5396         }
5397
5398         if (is_ntfs_stream_smb_fname(smb_dname)) {
5399                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5400                 goto out;
5401         }
5402
5403         status = SMB_VFS_CREATE_FILE(
5404                 conn,                                   /* conn */
5405                 req,                                    /* req */
5406                 0,                                      /* root_dir_fid */
5407                 smb_dname,                              /* fname */
5408                 DELETE_ACCESS,                          /* access_mask */
5409                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5410                         FILE_SHARE_DELETE),
5411                 FILE_OPEN,                              /* create_disposition*/
5412                 FILE_DIRECTORY_FILE,                    /* create_options */
5413                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5414                 0,                                      /* oplock_request */
5415                 0,                                      /* allocation_size */
5416                 0,                                      /* private_flags */
5417                 NULL,                                   /* sd */
5418                 NULL,                                   /* ea_list */
5419                 &fsp,                                   /* result */
5420                 &info);                                 /* pinfo */
5421
5422         if (!NT_STATUS_IS_OK(status)) {
5423                 if (open_was_deferred(req->mid)) {
5424                         /* We have re-scheduled this call. */
5425                         goto out;
5426                 }
5427                 reply_nterror(req, status);
5428                 goto out;
5429         }
5430
5431         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5432         if (!NT_STATUS_IS_OK(status)) {
5433                 close_file(req, fsp, ERROR_CLOSE);
5434                 reply_nterror(req, status);
5435                 goto out;
5436         }
5437
5438         if (!set_delete_on_close(fsp, true, &conn->server_info->utok)) {
5439                 close_file(req, fsp, ERROR_CLOSE);
5440                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5441                 goto out;
5442         }
5443
5444         status = close_file(req, fsp, NORMAL_CLOSE);
5445         if (!NT_STATUS_IS_OK(status)) {
5446                 reply_nterror(req, status);
5447         } else {
5448                 reply_outbuf(req, 0, 0);
5449         }
5450
5451         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5452
5453         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5454  out:
5455         TALLOC_FREE(smb_dname);
5456         END_PROFILE(SMBrmdir);
5457         return;
5458 }
5459
5460 /*******************************************************************
5461  Resolve wildcards in a filename rename.
5462 ********************************************************************/
5463
5464 static bool resolve_wildcards(TALLOC_CTX *ctx,
5465                                 const char *name1,
5466                                 const char *name2,
5467                                 char **pp_newname)
5468 {
5469         char *name2_copy = NULL;
5470         char *root1 = NULL;
5471         char *root2 = NULL;
5472         char *ext1 = NULL;
5473         char *ext2 = NULL;
5474         char *p,*p2, *pname1, *pname2;
5475
5476         name2_copy = talloc_strdup(ctx, name2);
5477         if (!name2_copy) {
5478                 return False;
5479         }
5480
5481         pname1 = strrchr_m(name1,'/');
5482         pname2 = strrchr_m(name2_copy,'/');
5483
5484         if (!pname1 || !pname2) {
5485                 return False;
5486         }
5487
5488         /* Truncate the copy of name2 at the last '/' */
5489         *pname2 = '\0';
5490
5491         /* Now go past the '/' */
5492         pname1++;
5493         pname2++;
5494
5495         root1 = talloc_strdup(ctx, pname1);
5496         root2 = talloc_strdup(ctx, pname2);
5497
5498         if (!root1 || !root2) {
5499                 return False;
5500         }
5501
5502         p = strrchr_m(root1,'.');
5503         if (p) {
5504                 *p = 0;
5505                 ext1 = talloc_strdup(ctx, p+1);
5506         } else {
5507                 ext1 = talloc_strdup(ctx, "");
5508         }
5509         p = strrchr_m(root2,'.');
5510         if (p) {
5511                 *p = 0;
5512                 ext2 = talloc_strdup(ctx, p+1);
5513         } else {
5514                 ext2 = talloc_strdup(ctx, "");
5515         }
5516
5517         if (!ext1 || !ext2) {
5518                 return False;
5519         }
5520
5521         p = root1;
5522         p2 = root2;
5523         while (*p2) {
5524                 if (*p2 == '?') {
5525                         /* Hmmm. Should this be mb-aware ? */
5526                         *p2 = *p;
5527                         p2++;
5528                 } else if (*p2 == '*') {
5529                         *p2 = '\0';
5530                         root2 = talloc_asprintf(ctx, "%s%s",
5531                                                 root2,
5532                                                 p);
5533                         if (!root2) {
5534                                 return False;
5535                         }
5536                         break;
5537                 } else {
5538                         p2++;
5539                 }
5540                 if (*p) {
5541                         p++;
5542                 }
5543         }
5544
5545         p = ext1;
5546         p2 = ext2;
5547         while (*p2) {
5548                 if (*p2 == '?') {
5549                         /* Hmmm. Should this be mb-aware ? */
5550                         *p2 = *p;
5551                         p2++;
5552                 } else if (*p2 == '*') {
5553                         *p2 = '\0';
5554                         ext2 = talloc_asprintf(ctx, "%s%s",
5555                                                 ext2,
5556                                                 p);
5557                         if (!ext2) {
5558                                 return False;
5559                         }
5560                         break;
5561                 } else {
5562                         p2++;
5563                 }
5564                 if (*p) {
5565                         p++;
5566                 }
5567         }
5568
5569         if (*ext2) {
5570                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5571                                 name2_copy,
5572                                 root2,
5573                                 ext2);
5574         } else {
5575                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5576                                 name2_copy,
5577                                 root2);
5578         }
5579
5580         if (!*pp_newname) {
5581                 return False;
5582         }
5583
5584         return True;
5585 }
5586
5587 /****************************************************************************
5588  Ensure open files have their names updated. Updated to notify other smbd's
5589  asynchronously.
5590 ****************************************************************************/
5591
5592 static void rename_open_files(connection_struct *conn,
5593                               struct share_mode_lock *lck,
5594                               const struct smb_filename *smb_fname_dst)
5595 {
5596         files_struct *fsp;
5597         bool did_rename = False;
5598         NTSTATUS status;
5599
5600         for(fsp = file_find_di_first(lck->id); fsp;
5601             fsp = file_find_di_next(fsp)) {
5602                 /* fsp_name is a relative path under the fsp. To change this for other
5603                    sharepaths we need to manipulate relative paths. */
5604                 /* TODO - create the absolute path and manipulate the newname
5605                    relative to the sharepath. */
5606                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5607                         continue;
5608                 }
5609                 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5610                            "(file_id %s) from %s -> %s\n", fsp->fnum,
5611                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5612                            smb_fname_str_dbg(smb_fname_dst)));
5613
5614                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5615                 if (NT_STATUS_IS_OK(status)) {
5616                         did_rename = True;
5617                 }
5618         }
5619
5620         if (!did_rename) {
5621                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5622                            "for %s\n", file_id_string_tos(&lck->id),
5623                            smb_fname_str_dbg(smb_fname_dst)));
5624         }
5625
5626         /* Send messages to all smbd's (not ourself) that the name has changed. */
5627         rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5628                               smb_fname_dst);
5629
5630 }
5631
5632 /****************************************************************************
5633  We need to check if the source path is a parent directory of the destination
5634  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5635  refuse the rename with a sharing violation. Under UNIX the above call can
5636  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5637  probably need to check that the client is a Windows one before disallowing
5638  this as a UNIX client (one with UNIX extensions) can know the source is a
5639  symlink and make this decision intelligently. Found by an excellent bug
5640  report from <AndyLiebman@aol.com>.
5641 ****************************************************************************/
5642
5643 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5644                                      const struct smb_filename *smb_fname_dst)
5645 {
5646         const char *psrc = smb_fname_src->base_name;
5647         const char *pdst = smb_fname_dst->base_name;
5648         size_t slen;
5649
5650         if (psrc[0] == '.' && psrc[1] == '/') {
5651                 psrc += 2;
5652         }
5653         if (pdst[0] == '.' && pdst[1] == '/') {
5654                 pdst += 2;
5655         }
5656         if ((slen = strlen(psrc)) > strlen(pdst)) {
5657                 return False;
5658         }
5659         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5660 }
5661
5662 /*
5663  * Do the notify calls from a rename
5664  */
5665
5666 static void notify_rename(connection_struct *conn, bool is_dir,
5667                           const struct smb_filename *smb_fname_src,
5668                           const struct smb_filename *smb_fname_dst)
5669 {
5670         char *parent_dir_src = NULL;
5671         char *parent_dir_dst = NULL;
5672         uint32 mask;
5673
5674         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5675                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5676
5677         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5678                             &parent_dir_src, NULL) ||
5679             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5680                             &parent_dir_dst, NULL)) {
5681                 goto out;
5682         }
5683
5684         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5685                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5686                              smb_fname_src->base_name);
5687                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5688                              smb_fname_dst->base_name);
5689         }
5690         else {
5691                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5692                              smb_fname_src->base_name);
5693                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5694                              smb_fname_dst->base_name);
5695         }
5696
5697         /* this is a strange one. w2k3 gives an additional event for
5698            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5699            files, but not directories */
5700         if (!is_dir) {
5701                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5702                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5703                              |FILE_NOTIFY_CHANGE_CREATION,
5704                              smb_fname_dst->base_name);
5705         }
5706  out:
5707         TALLOC_FREE(parent_dir_src);
5708         TALLOC_FREE(parent_dir_dst);
5709 }
5710
5711 /****************************************************************************
5712  Rename an open file - given an fsp.
5713 ****************************************************************************/
5714
5715 NTSTATUS rename_internals_fsp(connection_struct *conn,
5716                         files_struct *fsp,
5717                         const struct smb_filename *smb_fname_dst_in,
5718                         uint32 attrs,
5719                         bool replace_if_exists)
5720 {
5721         TALLOC_CTX *ctx = talloc_tos();
5722         struct smb_filename *smb_fname_dst = NULL;
5723         NTSTATUS status = NT_STATUS_OK;
5724         struct share_mode_lock *lck = NULL;
5725         bool dst_exists, old_is_stream, new_is_stream;
5726
5727         status = check_name(conn, smb_fname_dst_in->base_name);
5728         if (!NT_STATUS_IS_OK(status)) {
5729                 return status;
5730         }
5731
5732         /* Make a copy of the dst smb_fname structs */
5733
5734         status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5735         if (!NT_STATUS_IS_OK(status)) {
5736                 goto out;
5737         }
5738
5739         /* Ensure the dst smb_fname contains a '/' */
5740         if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5741                 char * tmp;
5742                 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5743                                       smb_fname_dst->base_name);
5744                 if (!tmp) {
5745                         status = NT_STATUS_NO_MEMORY;
5746                         goto out;
5747                 }
5748                 TALLOC_FREE(smb_fname_dst->base_name);
5749                 smb_fname_dst->base_name = tmp;
5750         }
5751
5752         /*
5753          * Check for special case with case preserving and not
5754          * case sensitive. If the old last component differs from the original
5755          * last component only by case, then we should allow
5756          * the rename (user is trying to change the case of the
5757          * filename).
5758          */
5759         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5760             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5761             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5762                 char *last_slash;
5763                 char *fname_dst_lcomp_base_mod = NULL;
5764                 struct smb_filename *smb_fname_orig_lcomp = NULL;
5765
5766                 /*
5767                  * Get the last component of the destination name.  Note that
5768                  * we guarantee that destination name contains a '/' character
5769                  * above.
5770                  */
5771                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5772                 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5773                 if (!fname_dst_lcomp_base_mod) {
5774                         status = NT_STATUS_NO_MEMORY;
5775                         goto out;
5776                 }
5777
5778                 /*
5779                  * Create an smb_filename struct using the original last
5780                  * component of the destination.
5781                  */
5782                 status = create_synthetic_smb_fname_split(ctx,
5783                     smb_fname_dst->original_lcomp, NULL,
5784                     &smb_fname_orig_lcomp);
5785                 if (!NT_STATUS_IS_OK(status)) {
5786                         TALLOC_FREE(fname_dst_lcomp_base_mod);
5787                         goto out;
5788                 }
5789
5790                 /* If the base names only differ by case, use original. */
5791                 if(!strcsequal(fname_dst_lcomp_base_mod,
5792                                smb_fname_orig_lcomp->base_name)) {
5793                         char *tmp;
5794                         /*
5795                          * Replace the modified last component with the
5796                          * original.
5797                          */
5798                         *last_slash = '\0'; /* Truncate at the '/' */
5799                         tmp = talloc_asprintf(smb_fname_dst,
5800                                         "%s/%s",
5801                                         smb_fname_dst->base_name,
5802                                         smb_fname_orig_lcomp->base_name);
5803                         if (tmp == NULL) {
5804                                 status = NT_STATUS_NO_MEMORY;
5805                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5806                                 TALLOC_FREE(smb_fname_orig_lcomp);
5807                                 goto out;
5808                         }
5809                         TALLOC_FREE(smb_fname_dst->base_name);
5810                         smb_fname_dst->base_name = tmp;
5811                 }
5812
5813                 /* If the stream_names only differ by case, use original. */
5814                 if(!strcsequal(smb_fname_dst->stream_name,
5815                                smb_fname_orig_lcomp->stream_name)) {
5816                         char *tmp = NULL;
5817                         /* Use the original stream. */
5818                         tmp = talloc_strdup(smb_fname_dst,
5819                                             smb_fname_orig_lcomp->stream_name);
5820                         if (tmp == NULL) {
5821                                 status = NT_STATUS_NO_MEMORY;
5822                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5823                                 TALLOC_FREE(smb_fname_orig_lcomp);
5824                                 goto out;
5825                         }
5826                         TALLOC_FREE(smb_fname_dst->stream_name);
5827                         smb_fname_dst->stream_name = tmp;
5828                 }
5829                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5830                 TALLOC_FREE(smb_fname_orig_lcomp);
5831         }
5832
5833         /*
5834          * If the src and dest names are identical - including case,
5835          * don't do the rename, just return success.
5836          */
5837
5838         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5839             strcsequal(fsp->fsp_name->stream_name,
5840                        smb_fname_dst->stream_name)) {
5841                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
5842                           "- returning success\n",
5843                           smb_fname_str_dbg(smb_fname_dst)));
5844                 status = NT_STATUS_OK;
5845                 goto out;
5846         }
5847
5848         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
5849         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
5850
5851         /* Return the correct error code if both names aren't streams. */
5852         if (!old_is_stream && new_is_stream) {
5853                 status = NT_STATUS_OBJECT_NAME_INVALID;
5854                 goto out;
5855         }
5856
5857         if (old_is_stream && !new_is_stream) {
5858                 status = NT_STATUS_INVALID_PARAMETER;
5859                 goto out;
5860         }
5861
5862         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
5863
5864         if(!replace_if_exists && dst_exists) {
5865                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
5866                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
5867                           smb_fname_str_dbg(smb_fname_dst)));
5868                 status = NT_STATUS_OBJECT_NAME_COLLISION;
5869                 goto out;
5870         }
5871
5872         if (dst_exists) {
5873                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
5874                     &smb_fname_dst->st);
5875                 files_struct *dst_fsp = file_find_di_first(fileid);
5876                 /* The file can be open when renaming a stream */
5877                 if (dst_fsp && !new_is_stream) {
5878                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5879                         status = NT_STATUS_ACCESS_DENIED;
5880                         goto out;
5881                 }
5882         }
5883
5884         /* Ensure we have a valid stat struct for the source. */
5885         status = vfs_stat_fsp(fsp);
5886         if (!NT_STATUS_IS_OK(status)) {
5887                 goto out;
5888         }
5889
5890         status = can_rename(conn, fsp, attrs);
5891
5892         if (!NT_STATUS_IS_OK(status)) {
5893                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
5894                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
5895                           smb_fname_str_dbg(smb_fname_dst)));
5896                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5897                         status = NT_STATUS_ACCESS_DENIED;
5898                 goto out;
5899         }
5900
5901         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
5902                 status = NT_STATUS_ACCESS_DENIED;
5903         }
5904
5905         lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5906                                   NULL);
5907
5908         /*
5909          * We have the file open ourselves, so not being able to get the
5910          * corresponding share mode lock is a fatal error.
5911          */
5912
5913         SMB_ASSERT(lck != NULL);
5914
5915         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
5916                 uint32 create_options = fsp->fh->private_options;
5917
5918                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
5919                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
5920                           smb_fname_str_dbg(smb_fname_dst)));
5921
5922                 if (lp_map_archive(SNUM(conn)) ||
5923                     lp_store_dos_attributes(SNUM(conn))) {
5924                         /* We must set the archive bit on the newly
5925                            renamed file. */
5926                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
5927                                 uint32_t old_dosmode = dos_mode(conn,
5928                                                         smb_fname_dst);
5929                                 file_set_dosmode(conn,
5930                                         smb_fname_dst,
5931                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
5932                                         NULL,
5933                                         true);
5934                         }
5935                 }
5936
5937                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
5938                               smb_fname_dst);
5939
5940                 rename_open_files(conn, lck, smb_fname_dst);
5941
5942                 /*
5943                  * A rename acts as a new file create w.r.t. allowing an initial delete
5944                  * on close, probably because in Windows there is a new handle to the
5945                  * new file. If initial delete on close was requested but not
5946                  * originally set, we need to set it here. This is probably not 100% correct,
5947                  * but will work for the CIFSFS client which in non-posix mode
5948                  * depends on these semantics. JRA.
5949                  */
5950
5951                 if (create_options & FILE_DELETE_ON_CLOSE) {
5952                         status = can_set_delete_on_close(fsp, 0);
5953
5954                         if (NT_STATUS_IS_OK(status)) {
5955                                 /* Note that here we set the *inital* delete on close flag,
5956                                  * not the regular one. The magic gets handled in close. */
5957                                 fsp->initial_delete_on_close = True;
5958                         }
5959                 }
5960                 TALLOC_FREE(lck);
5961                 status = NT_STATUS_OK;
5962                 goto out;
5963         }
5964
5965         TALLOC_FREE(lck);
5966
5967         if (errno == ENOTDIR || errno == EISDIR) {
5968                 status = NT_STATUS_OBJECT_NAME_COLLISION;
5969         } else {
5970                 status = map_nt_error_from_unix(errno);
5971         }
5972
5973         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
5974                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
5975                   smb_fname_str_dbg(smb_fname_dst)));
5976
5977  out:
5978         TALLOC_FREE(smb_fname_dst);
5979
5980         return status;
5981 }
5982
5983 /****************************************************************************
5984  The guts of the rename command, split out so it may be called by the NT SMB
5985  code.
5986 ****************************************************************************/
5987
5988 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5989                         connection_struct *conn,
5990                         struct smb_request *req,
5991                         struct smb_filename *smb_fname_src,
5992                         struct smb_filename *smb_fname_dst,
5993                         uint32 attrs,
5994                         bool replace_if_exists,
5995                         bool src_has_wild,
5996                         bool dest_has_wild,
5997                         uint32_t access_mask)
5998 {
5999         char *fname_src_dir = NULL;
6000         char *fname_src_mask = NULL;
6001         int count=0;
6002         NTSTATUS status = NT_STATUS_OK;
6003         struct smb_Dir *dir_hnd = NULL;
6004         const char *dname = NULL;
6005         char *talloced = NULL;
6006         long offset = 0;
6007         int create_options = 0;
6008         bool posix_pathnames = lp_posix_pathnames();
6009
6010         /*
6011          * Split the old name into directory and last component
6012          * strings. Note that unix_convert may have stripped off a
6013          * leading ./ from both name and newname if the rename is
6014          * at the root of the share. We need to make sure either both
6015          * name and newname contain a / character or neither of them do
6016          * as this is checked in resolve_wildcards().
6017          */
6018
6019         /* Split up the directory from the filename/mask. */
6020         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6021                                       &fname_src_dir, &fname_src_mask);
6022         if (!NT_STATUS_IS_OK(status)) {
6023                 status = NT_STATUS_NO_MEMORY;
6024                 goto out;
6025         }
6026
6027         /*
6028          * We should only check the mangled cache
6029          * here if unix_convert failed. This means
6030          * that the path in 'mask' doesn't exist
6031          * on the file system and so we need to look
6032          * for a possible mangle. This patch from
6033          * Tine Smukavec <valentin.smukavec@hermes.si>.
6034          */
6035
6036         if (!VALID_STAT(smb_fname_src->st) &&
6037             mangle_is_mangled(fname_src_mask, conn->params)) {
6038                 char *new_mask = NULL;
6039                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6040                                             conn->params);
6041                 if (new_mask) {
6042                         TALLOC_FREE(fname_src_mask);
6043                         fname_src_mask = new_mask;
6044                 }
6045         }
6046
6047         if (!src_has_wild) {
6048                 files_struct *fsp;
6049
6050                 /*
6051                  * Only one file needs to be renamed. Append the mask back
6052                  * onto the directory.
6053                  */
6054                 TALLOC_FREE(smb_fname_src->base_name);
6055                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6056                                                            "%s/%s",
6057                                                            fname_src_dir,
6058                                                            fname_src_mask);
6059                 if (!smb_fname_src->base_name) {
6060                         status = NT_STATUS_NO_MEMORY;
6061                         goto out;
6062                 }
6063
6064                 /* Ensure dst fname contains a '/' also */
6065                 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6066                         char *tmp;
6067                         tmp = talloc_asprintf(smb_fname_dst, "./%s",
6068                                               smb_fname_dst->base_name);
6069                         if (!tmp) {
6070                                 status = NT_STATUS_NO_MEMORY;
6071                                 goto out;
6072                         }
6073                         TALLOC_FREE(smb_fname_dst->base_name);
6074                         smb_fname_dst->base_name = tmp;
6075                 }
6076
6077                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6078                           "case_preserve = %d, short case preserve = %d, "
6079                           "directory = %s, newname = %s, "
6080                           "last_component_dest = %s\n",
6081                           conn->case_sensitive, conn->case_preserve,
6082                           conn->short_case_preserve,
6083                           smb_fname_str_dbg(smb_fname_src),
6084                           smb_fname_str_dbg(smb_fname_dst),
6085                           smb_fname_dst->original_lcomp));
6086
6087                 /* The dest name still may have wildcards. */
6088                 if (dest_has_wild) {
6089                         char *fname_dst_mod = NULL;
6090                         if (!resolve_wildcards(smb_fname_dst,
6091                                                smb_fname_src->base_name,
6092                                                smb_fname_dst->base_name,
6093                                                &fname_dst_mod)) {
6094                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6095                                           "%s %s failed\n",
6096                                           smb_fname_src->base_name,
6097                                           smb_fname_dst->base_name));
6098                                 status = NT_STATUS_NO_MEMORY;
6099                                 goto out;
6100                         }
6101                         TALLOC_FREE(smb_fname_dst->base_name);
6102                         smb_fname_dst->base_name = fname_dst_mod;
6103                 }
6104
6105                 ZERO_STRUCT(smb_fname_src->st);
6106                 if (posix_pathnames) {
6107                         SMB_VFS_LSTAT(conn, smb_fname_src);
6108                 } else {
6109                         SMB_VFS_STAT(conn, smb_fname_src);
6110                 }
6111
6112                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6113                         create_options |= FILE_DIRECTORY_FILE;
6114                 }
6115
6116                 status = SMB_VFS_CREATE_FILE(
6117                         conn,                           /* conn */
6118                         req,                            /* req */
6119                         0,                              /* root_dir_fid */
6120                         smb_fname_src,                  /* fname */
6121                         access_mask,                    /* access_mask */
6122                         (FILE_SHARE_READ |              /* share_access */
6123                             FILE_SHARE_WRITE),
6124                         FILE_OPEN,                      /* create_disposition*/
6125                         create_options,                 /* create_options */
6126                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6127                         0,                              /* oplock_request */
6128                         0,                              /* allocation_size */
6129                         0,                              /* private_flags */
6130                         NULL,                           /* sd */
6131                         NULL,                           /* ea_list */
6132                         &fsp,                           /* result */
6133                         NULL);                          /* pinfo */
6134
6135                 if (!NT_STATUS_IS_OK(status)) {
6136                         DEBUG(3, ("Could not open rename source %s: %s\n",
6137                                   smb_fname_str_dbg(smb_fname_src),
6138                                   nt_errstr(status)));
6139                         goto out;
6140                 }
6141
6142                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6143                                               attrs, replace_if_exists);
6144
6145                 close_file(req, fsp, NORMAL_CLOSE);
6146
6147                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6148                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6149                           smb_fname_str_dbg(smb_fname_dst)));
6150
6151                 goto out;
6152         }
6153
6154         /*
6155          * Wildcards - process each file that matches.
6156          */
6157         if (strequal(fname_src_mask, "????????.???")) {
6158                 TALLOC_FREE(fname_src_mask);
6159                 fname_src_mask = talloc_strdup(ctx, "*");
6160                 if (!fname_src_mask) {
6161                         status = NT_STATUS_NO_MEMORY;
6162                         goto out;
6163                 }
6164         }
6165
6166         status = check_name(conn, fname_src_dir);
6167         if (!NT_STATUS_IS_OK(status)) {
6168                 goto out;
6169         }
6170
6171         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6172                           attrs);
6173         if (dir_hnd == NULL) {
6174                 status = map_nt_error_from_unix(errno);
6175                 goto out;
6176         }
6177
6178         status = NT_STATUS_NO_SUCH_FILE;
6179         /*
6180          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6181          * - gentest fix. JRA
6182          */
6183
6184         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6185                                     &talloced))) {
6186                 files_struct *fsp = NULL;
6187                 char *destname = NULL;
6188                 bool sysdir_entry = False;
6189
6190                 /* Quick check for "." and ".." */
6191                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6192                         if (attrs & aDIR) {
6193                                 sysdir_entry = True;
6194                         } else {
6195                                 TALLOC_FREE(talloced);
6196                                 continue;
6197                         }
6198                 }
6199
6200                 if (!is_visible_file(conn, fname_src_dir, dname,
6201                                      &smb_fname_src->st, false)) {
6202                         TALLOC_FREE(talloced);
6203                         continue;
6204                 }
6205
6206                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6207                         TALLOC_FREE(talloced);
6208                         continue;
6209                 }
6210
6211                 if (sysdir_entry) {
6212                         status = NT_STATUS_OBJECT_NAME_INVALID;
6213                         break;
6214                 }
6215
6216                 TALLOC_FREE(smb_fname_src->base_name);
6217                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6218                                                            "%s/%s",
6219                                                            fname_src_dir,
6220                                                            dname);
6221                 if (!smb_fname_src->base_name) {
6222                         status = NT_STATUS_NO_MEMORY;
6223                         goto out;
6224                 }
6225
6226                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6227                                        smb_fname_dst->base_name,
6228                                        &destname)) {
6229                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6230                                   smb_fname_src->base_name, destname));
6231                         TALLOC_FREE(talloced);
6232                         continue;
6233                 }
6234                 if (!destname) {
6235                         status = NT_STATUS_NO_MEMORY;
6236                         goto out;
6237                 }
6238
6239                 TALLOC_FREE(smb_fname_dst->base_name);
6240                 smb_fname_dst->base_name = destname;
6241
6242                 ZERO_STRUCT(smb_fname_src->st);
6243                 if (posix_pathnames) {
6244                         SMB_VFS_LSTAT(conn, smb_fname_src);
6245                 } else {
6246                         SMB_VFS_STAT(conn, smb_fname_src);
6247                 }
6248
6249                 create_options = 0;
6250
6251                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6252                         create_options |= FILE_DIRECTORY_FILE;
6253                 }
6254
6255                 status = SMB_VFS_CREATE_FILE(
6256                         conn,                           /* conn */
6257                         req,                            /* req */
6258                         0,                              /* root_dir_fid */
6259                         smb_fname_src,                  /* fname */
6260                         access_mask,                    /* access_mask */
6261                         (FILE_SHARE_READ |              /* share_access */
6262                             FILE_SHARE_WRITE),
6263                         FILE_OPEN,                      /* create_disposition*/
6264                         create_options,                 /* create_options */
6265                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6266                         0,                              /* oplock_request */
6267                         0,                              /* allocation_size */
6268                         0,                              /* private_flags */
6269                         NULL,                           /* sd */
6270                         NULL,                           /* ea_list */
6271                         &fsp,                           /* result */
6272                         NULL);                          /* pinfo */
6273
6274                 if (!NT_STATUS_IS_OK(status)) {
6275                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6276                                  "returned %s rename %s -> %s\n",
6277                                  nt_errstr(status),
6278                                  smb_fname_str_dbg(smb_fname_src),
6279                                  smb_fname_str_dbg(smb_fname_dst)));
6280                         break;
6281                 }
6282
6283                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6284                                                               dname);
6285                 if (!smb_fname_dst->original_lcomp) {
6286                         status = NT_STATUS_NO_MEMORY;
6287                         goto out;
6288                 }
6289
6290                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6291                                               attrs, replace_if_exists);
6292
6293                 close_file(req, fsp, NORMAL_CLOSE);
6294
6295                 if (!NT_STATUS_IS_OK(status)) {
6296                         DEBUG(3, ("rename_internals_fsp returned %s for "
6297                                   "rename %s -> %s\n", nt_errstr(status),
6298                                   smb_fname_str_dbg(smb_fname_src),
6299                                   smb_fname_str_dbg(smb_fname_dst)));
6300                         break;
6301                 }
6302
6303                 count++;
6304
6305                 DEBUG(3,("rename_internals: doing rename on %s -> "
6306                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6307                          smb_fname_str_dbg(smb_fname_src)));
6308                 TALLOC_FREE(talloced);
6309         }
6310         TALLOC_FREE(dir_hnd);
6311
6312         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6313                 status = map_nt_error_from_unix(errno);
6314         }
6315
6316  out:
6317         TALLOC_FREE(talloced);
6318         TALLOC_FREE(fname_src_dir);
6319         TALLOC_FREE(fname_src_mask);
6320         return status;
6321 }
6322
6323 /****************************************************************************
6324  Reply to a mv.
6325 ****************************************************************************/
6326
6327 void reply_mv(struct smb_request *req)
6328 {
6329         connection_struct *conn = req->conn;
6330         char *name = NULL;
6331         char *newname = NULL;
6332         const char *p;
6333         uint32 attrs;
6334         NTSTATUS status;
6335         bool src_has_wcard = False;
6336         bool dest_has_wcard = False;
6337         TALLOC_CTX *ctx = talloc_tos();
6338         struct smb_filename *smb_fname_src = NULL;
6339         struct smb_filename *smb_fname_dst = NULL;
6340
6341         START_PROFILE(SMBmv);
6342
6343         if (req->wct < 1) {
6344                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6345                 goto out;
6346         }
6347
6348         attrs = SVAL(req->vwv+0, 0);
6349
6350         p = (const char *)req->buf + 1;
6351         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6352                                        &status, &src_has_wcard);
6353         if (!NT_STATUS_IS_OK(status)) {
6354                 reply_nterror(req, status);
6355                 goto out;
6356         }
6357         p++;
6358         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6359                                        &status, &dest_has_wcard);
6360         if (!NT_STATUS_IS_OK(status)) {
6361                 reply_nterror(req, status);
6362                 goto out;
6363         }
6364
6365         status = filename_convert(ctx,
6366                                   conn,
6367                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6368                                   name,
6369                                   UCF_COND_ALLOW_WCARD_LCOMP,
6370                                   &src_has_wcard,
6371                                   &smb_fname_src);
6372
6373         if (!NT_STATUS_IS_OK(status)) {
6374                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6375                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6376                                         ERRSRV, ERRbadpath);
6377                         goto out;
6378                 }
6379                 reply_nterror(req, status);
6380                 goto out;
6381         }
6382
6383         status = filename_convert(ctx,
6384                                   conn,
6385                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6386                                   newname,
6387                                   UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6388                                   &dest_has_wcard,
6389                                   &smb_fname_dst);
6390
6391         if (!NT_STATUS_IS_OK(status)) {
6392                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6393                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6394                                         ERRSRV, ERRbadpath);
6395                         goto out;
6396                 }
6397                 reply_nterror(req, status);
6398                 goto out;
6399         }
6400
6401         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6402                  smb_fname_str_dbg(smb_fname_dst)));
6403
6404         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6405                                   attrs, False, src_has_wcard, dest_has_wcard,
6406                                   DELETE_ACCESS);
6407         if (!NT_STATUS_IS_OK(status)) {
6408                 if (open_was_deferred(req->mid)) {
6409                         /* We have re-scheduled this call. */
6410                         goto out;
6411                 }
6412                 reply_nterror(req, status);
6413                 goto out;
6414         }
6415
6416         reply_outbuf(req, 0, 0);
6417  out:
6418         TALLOC_FREE(smb_fname_src);
6419         TALLOC_FREE(smb_fname_dst);
6420         END_PROFILE(SMBmv);
6421         return;
6422 }
6423
6424 /*******************************************************************
6425  Copy a file as part of a reply_copy.
6426 ******************************************************************/
6427
6428 /*
6429  * TODO: check error codes on all callers
6430  */
6431
6432 NTSTATUS copy_file(TALLOC_CTX *ctx,
6433                         connection_struct *conn,
6434                         struct smb_filename *smb_fname_src,
6435                         struct smb_filename *smb_fname_dst,
6436                         int ofun,
6437                         int count,
6438                         bool target_is_directory)
6439 {
6440         struct smb_filename *smb_fname_dst_tmp = NULL;
6441         SMB_OFF_T ret=-1;
6442         files_struct *fsp1,*fsp2;
6443         uint32 dosattrs;
6444         uint32 new_create_disposition;
6445         NTSTATUS status;
6446
6447
6448         status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6449         if (!NT_STATUS_IS_OK(status)) {
6450                 return status;
6451         }
6452
6453         /*
6454          * If the target is a directory, extract the last component from the
6455          * src filename and append it to the dst filename
6456          */
6457         if (target_is_directory) {
6458                 const char *p;
6459
6460                 /* dest/target can't be a stream if it's a directory. */
6461                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6462
6463                 p = strrchr_m(smb_fname_src->base_name,'/');
6464                 if (p) {
6465                         p++;
6466                 } else {
6467                         p = smb_fname_src->base_name;
6468                 }
6469                 smb_fname_dst_tmp->base_name =
6470                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6471                                            p);
6472                 if (!smb_fname_dst_tmp->base_name) {
6473                         status = NT_STATUS_NO_MEMORY;
6474                         goto out;
6475                 }
6476         }
6477
6478         status = vfs_file_exist(conn, smb_fname_src);
6479         if (!NT_STATUS_IS_OK(status)) {
6480                 goto out;
6481         }
6482
6483         if (!target_is_directory && count) {
6484                 new_create_disposition = FILE_OPEN;
6485         } else {
6486                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6487                                                  NULL, NULL,
6488                                                  &new_create_disposition,
6489                                                  NULL,
6490                                                  NULL)) {
6491                         status = NT_STATUS_INVALID_PARAMETER;
6492                         goto out;
6493                 }
6494         }
6495
6496         /* Open the src file for reading. */
6497         status = SMB_VFS_CREATE_FILE(
6498                 conn,                                   /* conn */
6499                 NULL,                                   /* req */
6500                 0,                                      /* root_dir_fid */
6501                 smb_fname_src,                          /* fname */
6502                 FILE_GENERIC_READ,                      /* access_mask */
6503                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6504                 FILE_OPEN,                              /* create_disposition*/
6505                 0,                                      /* create_options */
6506                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
6507                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6508                 0,                                      /* allocation_size */
6509                 0,                                      /* private_flags */
6510                 NULL,                                   /* sd */
6511                 NULL,                                   /* ea_list */
6512                 &fsp1,                                  /* result */
6513                 NULL);                                  /* psbuf */
6514
6515         if (!NT_STATUS_IS_OK(status)) {
6516                 goto out;
6517         }
6518
6519         dosattrs = dos_mode(conn, smb_fname_src);
6520
6521         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6522                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6523         }
6524
6525         /* Open the dst file for writing. */
6526         status = SMB_VFS_CREATE_FILE(
6527                 conn,                                   /* conn */
6528                 NULL,                                   /* req */
6529                 0,                                      /* root_dir_fid */
6530                 smb_fname_dst,                          /* fname */
6531                 FILE_GENERIC_WRITE,                     /* access_mask */
6532                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6533                 new_create_disposition,                 /* create_disposition*/
6534                 0,                                      /* create_options */
6535                 dosattrs,                               /* file_attributes */
6536                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6537                 0,                                      /* allocation_size */
6538                 0,                                      /* private_flags */
6539                 NULL,                                   /* sd */
6540                 NULL,                                   /* ea_list */
6541                 &fsp2,                                  /* result */
6542                 NULL);                                  /* psbuf */
6543
6544         if (!NT_STATUS_IS_OK(status)) {
6545                 close_file(NULL, fsp1, ERROR_CLOSE);
6546                 goto out;
6547         }
6548
6549         if ((ofun&3) == 1) {
6550                 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6551                         DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6552                         /*
6553                          * Stop the copy from occurring.
6554                          */
6555                         ret = -1;
6556                         smb_fname_src->st.st_ex_size = 0;
6557                 }
6558         }
6559
6560         /* Do the actual copy. */
6561         if (smb_fname_src->st.st_ex_size) {
6562                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6563         }
6564
6565         close_file(NULL, fsp1, NORMAL_CLOSE);
6566
6567         /* Ensure the modtime is set correctly on the destination file. */
6568         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6569
6570         /*
6571          * As we are opening fsp1 read-only we only expect
6572          * an error on close on fsp2 if we are out of space.
6573          * Thus we don't look at the error return from the
6574          * close of fsp1.
6575          */
6576         status = close_file(NULL, fsp2, NORMAL_CLOSE);
6577
6578         if (!NT_STATUS_IS_OK(status)) {
6579                 goto out;
6580         }
6581
6582         if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6583                 status = NT_STATUS_DISK_FULL;
6584                 goto out;
6585         }
6586
6587         status = NT_STATUS_OK;
6588
6589  out:
6590         TALLOC_FREE(smb_fname_dst_tmp);
6591         return status;
6592 }
6593
6594 /****************************************************************************
6595  Reply to a file copy.
6596 ****************************************************************************/
6597
6598 void reply_copy(struct smb_request *req)
6599 {
6600         connection_struct *conn = req->conn;
6601         struct smb_filename *smb_fname_src = NULL;
6602         struct smb_filename *smb_fname_dst = NULL;
6603         char *fname_src = NULL;
6604         char *fname_dst = NULL;
6605         char *fname_src_mask = NULL;
6606         char *fname_src_dir = NULL;
6607         const char *p;
6608         int count=0;
6609         int error = ERRnoaccess;
6610         int tid2;
6611         int ofun;
6612         int flags;
6613         bool target_is_directory=False;
6614         bool source_has_wild = False;
6615         bool dest_has_wild = False;
6616         NTSTATUS status;
6617         TALLOC_CTX *ctx = talloc_tos();
6618
6619         START_PROFILE(SMBcopy);
6620
6621         if (req->wct < 3) {
6622                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6623                 goto out;
6624         }
6625
6626         tid2 = SVAL(req->vwv+0, 0);
6627         ofun = SVAL(req->vwv+1, 0);
6628         flags = SVAL(req->vwv+2, 0);
6629
6630         p = (const char *)req->buf;
6631         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6632                                        &status, &source_has_wild);
6633         if (!NT_STATUS_IS_OK(status)) {
6634                 reply_nterror(req, status);
6635                 goto out;
6636         }
6637         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6638                                        &status, &dest_has_wild);
6639         if (!NT_STATUS_IS_OK(status)) {
6640                 reply_nterror(req, status);
6641                 goto out;
6642         }
6643
6644         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6645
6646         if (tid2 != conn->cnum) {
6647                 /* can't currently handle inter share copies XXXX */
6648                 DEBUG(3,("Rejecting inter-share copy\n"));
6649                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6650                 goto out;
6651         }
6652
6653         status = filename_convert(ctx, conn,
6654                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6655                                   fname_src,
6656                                   UCF_COND_ALLOW_WCARD_LCOMP,
6657                                   &source_has_wild,
6658                                   &smb_fname_src);
6659         if (!NT_STATUS_IS_OK(status)) {
6660                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6661                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6662                                         ERRSRV, ERRbadpath);
6663                         goto out;
6664                 }
6665                 reply_nterror(req, status);
6666                 goto out;
6667         }
6668
6669         status = filename_convert(ctx, conn,
6670                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6671                                   fname_dst,
6672                                   UCF_COND_ALLOW_WCARD_LCOMP,
6673                                   &dest_has_wild,
6674                                   &smb_fname_dst);
6675         if (!NT_STATUS_IS_OK(status)) {
6676                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6677                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6678                                         ERRSRV, ERRbadpath);
6679                         goto out;
6680                 }
6681                 reply_nterror(req, status);
6682                 goto out;
6683         }
6684
6685         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6686
6687         if ((flags&1) && target_is_directory) {
6688                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6689                 goto out;
6690         }
6691
6692         if ((flags&2) && !target_is_directory) {
6693                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6694                 goto out;
6695         }
6696
6697         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6698                 /* wants a tree copy! XXXX */
6699                 DEBUG(3,("Rejecting tree copy\n"));
6700                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6701                 goto out;
6702         }
6703
6704         /* Split up the directory from the filename/mask. */
6705         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6706                                       &fname_src_dir, &fname_src_mask);
6707         if (!NT_STATUS_IS_OK(status)) {
6708                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6709                 goto out;
6710         }
6711
6712         /*
6713          * We should only check the mangled cache
6714          * here if unix_convert failed. This means
6715          * that the path in 'mask' doesn't exist
6716          * on the file system and so we need to look
6717          * for a possible mangle. This patch from
6718          * Tine Smukavec <valentin.smukavec@hermes.si>.
6719          */
6720         if (!VALID_STAT(smb_fname_src->st) &&
6721             mangle_is_mangled(fname_src_mask, conn->params)) {
6722                 char *new_mask = NULL;
6723                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6724                                             &new_mask, conn->params);
6725
6726                 /* Use demangled name if one was successfully found. */
6727                 if (new_mask) {
6728                         TALLOC_FREE(fname_src_mask);
6729                         fname_src_mask = new_mask;
6730                 }
6731         }
6732
6733         if (!source_has_wild) {
6734
6735                 /*
6736                  * Only one file needs to be copied. Append the mask back onto
6737                  * the directory.
6738                  */
6739                 TALLOC_FREE(smb_fname_src->base_name);
6740                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6741                                                            "%s/%s",
6742                                                            fname_src_dir,
6743                                                            fname_src_mask);
6744                 if (!smb_fname_src->base_name) {
6745                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6746                         goto out;
6747                 }
6748
6749                 if (dest_has_wild) {
6750                         char *fname_dst_mod = NULL;
6751                         if (!resolve_wildcards(smb_fname_dst,
6752                                                smb_fname_src->base_name,
6753                                                smb_fname_dst->base_name,
6754                                                &fname_dst_mod)) {
6755                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6756                                 goto out;
6757                         }
6758                         TALLOC_FREE(smb_fname_dst->base_name);
6759                         smb_fname_dst->base_name = fname_dst_mod;
6760                 }
6761
6762                 status = check_name(conn, smb_fname_src->base_name);
6763                 if (!NT_STATUS_IS_OK(status)) {
6764                         reply_nterror(req, status);
6765                         goto out;
6766                 }
6767
6768                 status = check_name(conn, smb_fname_dst->base_name);
6769                 if (!NT_STATUS_IS_OK(status)) {
6770                         reply_nterror(req, status);
6771                         goto out;
6772                 }
6773
6774                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6775                                    ofun, count, target_is_directory);
6776
6777                 if(!NT_STATUS_IS_OK(status)) {
6778                         reply_nterror(req, status);
6779                         goto out;
6780                 } else {
6781                         count++;
6782                 }
6783         } else {
6784                 struct smb_Dir *dir_hnd = NULL;
6785                 const char *dname = NULL;
6786                 char *talloced = NULL;
6787                 long offset = 0;
6788
6789                 /*
6790                  * There is a wildcard that requires us to actually read the
6791                  * src dir and copy each file matching the mask to the dst.
6792                  * Right now streams won't be copied, but this could
6793                  * presumably be added with a nested loop for reach dir entry.
6794                  */
6795                 SMB_ASSERT(!smb_fname_src->stream_name);
6796                 SMB_ASSERT(!smb_fname_dst->stream_name);
6797
6798                 smb_fname_src->stream_name = NULL;
6799                 smb_fname_dst->stream_name = NULL;
6800
6801                 if (strequal(fname_src_mask,"????????.???")) {
6802                         TALLOC_FREE(fname_src_mask);
6803                         fname_src_mask = talloc_strdup(ctx, "*");
6804                         if (!fname_src_mask) {
6805                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6806                                 goto out;
6807                         }
6808                 }
6809
6810                 status = check_name(conn, fname_src_dir);
6811                 if (!NT_STATUS_IS_OK(status)) {
6812                         reply_nterror(req, status);
6813                         goto out;
6814                 }
6815
6816                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6817                 if (dir_hnd == NULL) {
6818                         status = map_nt_error_from_unix(errno);
6819                         reply_nterror(req, status);
6820                         goto out;
6821                 }
6822
6823                 error = ERRbadfile;
6824
6825                 /* Iterate over the src dir copying each entry to the dst. */
6826                 while ((dname = ReadDirName(dir_hnd, &offset,
6827                                             &smb_fname_src->st, &talloced))) {
6828                         char *destname = NULL;
6829
6830                         if (ISDOT(dname) || ISDOTDOT(dname)) {
6831                                 TALLOC_FREE(talloced);
6832                                 continue;
6833                         }
6834
6835                         if (!is_visible_file(conn, fname_src_dir, dname,
6836                                              &smb_fname_src->st, false)) {
6837                                 TALLOC_FREE(talloced);
6838                                 continue;
6839                         }
6840
6841                         if(!mask_match(dname, fname_src_mask,
6842                                        conn->case_sensitive)) {
6843                                 TALLOC_FREE(talloced);
6844                                 continue;
6845                         }
6846
6847                         error = ERRnoaccess;
6848
6849                         /* Get the src smb_fname struct setup. */
6850                         TALLOC_FREE(smb_fname_src->base_name);
6851                         smb_fname_src->base_name =
6852                             talloc_asprintf(smb_fname_src, "%s/%s",
6853                                             fname_src_dir, dname);
6854
6855                         if (!smb_fname_src->base_name) {
6856                                 TALLOC_FREE(dir_hnd);
6857                                 TALLOC_FREE(talloced);
6858                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6859                                 goto out;
6860                         }
6861
6862                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6863                                                smb_fname_dst->base_name,
6864                                                &destname)) {
6865                                 TALLOC_FREE(talloced);
6866                                 continue;
6867                         }
6868                         if (!destname) {
6869                                 TALLOC_FREE(dir_hnd);
6870                                 TALLOC_FREE(talloced);
6871                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6872                                 goto out;
6873                         }
6874
6875                         TALLOC_FREE(smb_fname_dst->base_name);
6876                         smb_fname_dst->base_name = destname;
6877
6878                         status = check_name(conn, smb_fname_src->base_name);
6879                         if (!NT_STATUS_IS_OK(status)) {
6880                                 TALLOC_FREE(dir_hnd);
6881                                 TALLOC_FREE(talloced);
6882                                 reply_nterror(req, status);
6883                                 goto out;
6884                         }
6885
6886                         status = check_name(conn, smb_fname_dst->base_name);
6887                         if (!NT_STATUS_IS_OK(status)) {
6888                                 TALLOC_FREE(dir_hnd);
6889                                 TALLOC_FREE(talloced);
6890                                 reply_nterror(req, status);
6891                                 goto out;
6892                         }
6893
6894                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
6895                                 smb_fname_src->base_name,
6896                                 smb_fname_dst->base_name));
6897
6898                         status = copy_file(ctx, conn, smb_fname_src,
6899                                            smb_fname_dst, ofun, count,
6900                                            target_is_directory);
6901                         if (NT_STATUS_IS_OK(status)) {
6902                                 count++;
6903                         }
6904
6905                         TALLOC_FREE(talloced);
6906                 }
6907                 TALLOC_FREE(dir_hnd);
6908         }
6909
6910         if (count == 0) {
6911                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
6912                 goto out;
6913         }
6914
6915         reply_outbuf(req, 1, 0);
6916         SSVAL(req->outbuf,smb_vwv0,count);
6917  out:
6918         TALLOC_FREE(smb_fname_src);
6919         TALLOC_FREE(smb_fname_dst);
6920         TALLOC_FREE(fname_src);
6921         TALLOC_FREE(fname_dst);
6922         TALLOC_FREE(fname_src_mask);
6923         TALLOC_FREE(fname_src_dir);
6924
6925         END_PROFILE(SMBcopy);
6926         return;
6927 }
6928
6929 #undef DBGC_CLASS
6930 #define DBGC_CLASS DBGC_LOCKING
6931
6932 /****************************************************************************
6933  Get a lock pid, dealing with large count requests.
6934 ****************************************************************************/
6935
6936 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
6937                     bool large_file_format)
6938 {
6939         if(!large_file_format)
6940                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
6941         else
6942                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6943 }
6944
6945 /****************************************************************************
6946  Get a lock count, dealing with large count requests.
6947 ****************************************************************************/
6948
6949 uint64_t get_lock_count(const uint8_t *data, int data_offset,
6950                         bool large_file_format)
6951 {
6952         uint64_t count = 0;
6953
6954         if(!large_file_format) {
6955                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6956         } else {
6957
6958 #if defined(HAVE_LONGLONG)
6959                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6960                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6961 #else /* HAVE_LONGLONG */
6962
6963                 /*
6964                  * NT4.x seems to be broken in that it sends large file (64 bit)
6965                  * lockingX calls even if the CAP_LARGE_FILES was *not*
6966                  * negotiated. For boxes without large unsigned ints truncate the
6967                  * lock count by dropping the top 32 bits.
6968                  */
6969
6970                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6971                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6972                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6973                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6974                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6975                 }
6976
6977                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6978 #endif /* HAVE_LONGLONG */
6979         }
6980
6981         return count;
6982 }
6983
6984 #if !defined(HAVE_LONGLONG)
6985 /****************************************************************************
6986  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6987 ****************************************************************************/
6988
6989 static uint32 map_lock_offset(uint32 high, uint32 low)
6990 {
6991         unsigned int i;
6992         uint32 mask = 0;
6993         uint32 highcopy = high;
6994
6995         /*
6996          * Try and find out how many significant bits there are in high.
6997          */
6998
6999         for(i = 0; highcopy; i++)
7000                 highcopy >>= 1;
7001
7002         /*
7003          * We use 31 bits not 32 here as POSIX
7004          * lock offsets may not be negative.
7005          */
7006
7007         mask = (~0) << (31 - i);
7008
7009         if(low & mask)
7010                 return 0; /* Fail. */
7011
7012         high <<= (31 - i);
7013
7014         return (high|low);
7015 }
7016 #endif /* !defined(HAVE_LONGLONG) */
7017
7018 /****************************************************************************
7019  Get a lock offset, dealing with large offset requests.
7020 ****************************************************************************/
7021
7022 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7023                          bool large_file_format, bool *err)
7024 {
7025         uint64_t offset = 0;
7026
7027         *err = False;
7028
7029         if(!large_file_format) {
7030                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7031         } else {
7032
7033 #if defined(HAVE_LONGLONG)
7034                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7035                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7036 #else /* HAVE_LONGLONG */
7037
7038                 /*
7039                  * NT4.x seems to be broken in that it sends large file (64 bit)
7040                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7041                  * negotiated. For boxes without large unsigned ints mangle the
7042                  * lock offset by mapping the top 32 bits onto the lower 32.
7043                  */
7044
7045                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7046                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7047                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7048                         uint32 new_low = 0;
7049
7050                         if((new_low = map_lock_offset(high, low)) == 0) {
7051                                 *err = True;
7052                                 return (uint64_t)-1;
7053                         }
7054
7055                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7056                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7057                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7058                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7059                 }
7060
7061                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7062 #endif /* HAVE_LONGLONG */
7063         }
7064
7065         return offset;
7066 }
7067
7068 NTSTATUS smbd_do_locking(struct smb_request *req,
7069                          files_struct *fsp,
7070                          uint8_t type,
7071                          int32_t timeout,
7072                          uint16_t num_ulocks,
7073                          struct smbd_lock_element *ulocks,
7074                          uint16_t num_locks,
7075                          struct smbd_lock_element *locks,
7076                          bool *async)
7077 {
7078         connection_struct *conn = req->conn;
7079         int i;
7080         NTSTATUS status = NT_STATUS_OK;
7081
7082         *async = false;
7083
7084         /* Data now points at the beginning of the list
7085            of smb_unlkrng structs */
7086         for(i = 0; i < (int)num_ulocks; i++) {
7087                 struct smbd_lock_element *e = &ulocks[i];
7088
7089                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7090                           "pid %u, file %s\n",
7091                           (double)e->offset,
7092                           (double)e->count,
7093                           (unsigned int)e->smblctx,
7094                           fsp_str_dbg(fsp)));
7095
7096                 if (e->brltype != UNLOCK_LOCK) {
7097                         /* this can only happen with SMB2 */
7098                         return NT_STATUS_INVALID_PARAMETER;
7099                 }
7100
7101                 status = do_unlock(smbd_messaging_context(),
7102                                 fsp,
7103                                 e->smblctx,
7104                                 e->count,
7105                                 e->offset,
7106                                 WINDOWS_LOCK);
7107
7108                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7109                     nt_errstr(status)));
7110
7111                 if (!NT_STATUS_IS_OK(status)) {
7112                         return status;
7113                 }
7114         }
7115
7116         /* Setup the timeout in seconds. */
7117
7118         if (!lp_blocking_locks(SNUM(conn))) {
7119                 timeout = 0;
7120         }
7121
7122         /* Data now points at the beginning of the list
7123            of smb_lkrng structs */
7124
7125         for(i = 0; i < (int)num_locks; i++) {
7126                 struct smbd_lock_element *e = &locks[i];
7127
7128                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7129                           "%llu, file %s timeout = %d\n",
7130                           (double)e->offset,
7131                           (double)e->count,
7132                           (unsigned long long)e->smblctx,
7133                           fsp_str_dbg(fsp),
7134                           (int)timeout));
7135
7136                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7137                         struct blocking_lock_record *blr = NULL;
7138
7139                         if (num_locks > 1) {
7140                                 /*
7141                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7142                                  * if the lock vector contains one entry. When given mutliple cancel
7143                                  * requests in a single PDU we expect the server to return an
7144                                  * error. Windows servers seem to accept the request but only
7145                                  * cancel the first lock.
7146                                  * JRA - Do what Windows does (tm) :-).
7147                                  */
7148
7149 #if 0
7150                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7151                                 return NT_STATUS_DOS(ERRDOS,
7152                                                 ERRcancelviolation);
7153 #else
7154                                 /* Windows behavior. */
7155                                 if (i != 0) {
7156                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7157                                                 "cancel request\n"));
7158                                         continue;
7159                                 }
7160 #endif
7161                         }
7162
7163                         if (lp_blocking_locks(SNUM(conn))) {
7164
7165                                 /* Schedule a message to ourselves to
7166                                    remove the blocking lock record and
7167                                    return the right error. */
7168
7169                                 blr = blocking_lock_cancel_smb1(fsp,
7170                                                 e->smblctx,
7171                                                 e->offset,
7172                                                 e->count,
7173                                                 WINDOWS_LOCK,
7174                                                 type,
7175                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7176                                 if (blr == NULL) {
7177                                         return NT_STATUS_DOS(
7178                                                         ERRDOS,
7179                                                         ERRcancelviolation);
7180                                 }
7181                         }
7182                         /* Remove a matching pending lock. */
7183                         status = do_lock_cancel(fsp,
7184                                                 e->smblctx,
7185                                                 e->count,
7186                                                 e->offset,
7187                                                 WINDOWS_LOCK,
7188                                                 blr);
7189                 } else {
7190                         bool blocking_lock = timeout ? true : false;
7191                         bool defer_lock = false;
7192                         struct byte_range_lock *br_lck;
7193                         uint64_t block_smblctx;
7194
7195                         br_lck = do_lock(smbd_messaging_context(),
7196                                         fsp,
7197                                         e->smblctx,
7198                                         e->count,
7199                                         e->offset,
7200                                         e->brltype,
7201                                         WINDOWS_LOCK,
7202                                         blocking_lock,
7203                                         &status,
7204                                         &block_smblctx,
7205                                         NULL);
7206
7207                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7208                                 /* Windows internal resolution for blocking locks seems
7209                                    to be about 200ms... Don't wait for less than that. JRA. */
7210                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7211                                         timeout = lp_lock_spin_time();
7212                                 }
7213                                 defer_lock = true;
7214                         }
7215
7216                         /* If a lock sent with timeout of zero would fail, and
7217                          * this lock has been requested multiple times,
7218                          * according to brl_lock_failed() we convert this
7219                          * request to a blocking lock with a timeout of between
7220                          * 150 - 300 milliseconds.
7221                          *
7222                          * If lp_lock_spin_time() has been set to 0, we skip
7223                          * this blocking retry and fail immediately.
7224                          *
7225                          * Replacement for do_lock_spin(). JRA. */
7226
7227                         if (!smbd_server_conn->using_smb2 &&
7228                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7229                             lp_lock_spin_time() && !blocking_lock &&
7230                             NT_STATUS_EQUAL((status),
7231                                 NT_STATUS_FILE_LOCK_CONFLICT))
7232                         {
7233                                 defer_lock = true;
7234                                 timeout = lp_lock_spin_time();
7235                         }
7236
7237                         if (br_lck && defer_lock) {
7238                                 /*
7239                                  * A blocking lock was requested. Package up
7240                                  * this smb into a queued request and push it
7241                                  * onto the blocking lock queue.
7242                                  */
7243                                 if(push_blocking_lock_request(br_lck,
7244                                                         req,
7245                                                         fsp,
7246                                                         timeout,
7247                                                         i,
7248                                                         e->smblctx,
7249                                                         e->brltype,
7250                                                         WINDOWS_LOCK,
7251                                                         e->offset,
7252                                                         e->count,
7253                                                         block_smblctx)) {
7254                                         TALLOC_FREE(br_lck);
7255                                         *async = true;
7256                                         return NT_STATUS_OK;
7257                                 }
7258                         }
7259
7260                         TALLOC_FREE(br_lck);
7261                 }
7262
7263                 if (!NT_STATUS_IS_OK(status)) {
7264                         break;
7265                 }
7266         }
7267
7268         /* If any of the above locks failed, then we must unlock
7269            all of the previous locks (X/Open spec). */
7270
7271         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7272
7273                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7274                         i = -1; /* we want to skip the for loop */
7275                 }
7276
7277                 /*
7278                  * Ensure we don't do a remove on the lock that just failed,
7279                  * as under POSIX rules, if we have a lock already there, we
7280                  * will delete it (and we shouldn't) .....
7281                  */
7282                 for(i--; i >= 0; i--) {
7283                         struct smbd_lock_element *e = &locks[i];
7284
7285                         do_unlock(smbd_messaging_context(),
7286                                 fsp,
7287                                 e->smblctx,
7288                                 e->count,
7289                                 e->offset,
7290                                 WINDOWS_LOCK);
7291                 }
7292                 return status;
7293         }
7294
7295         DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7296                   fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7297
7298         return NT_STATUS_OK;
7299 }
7300
7301 /****************************************************************************
7302  Reply to a lockingX request.
7303 ****************************************************************************/
7304
7305 void reply_lockingX(struct smb_request *req)
7306 {
7307         connection_struct *conn = req->conn;
7308         files_struct *fsp;
7309         unsigned char locktype;
7310         unsigned char oplocklevel;
7311         uint16 num_ulocks;
7312         uint16 num_locks;
7313         int32 lock_timeout;
7314         int i;
7315         const uint8_t *data;
7316         bool large_file_format;
7317         bool err;
7318         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7319         struct smbd_lock_element *ulocks;
7320         struct smbd_lock_element *locks;
7321         bool async = false;
7322
7323         START_PROFILE(SMBlockingX);
7324
7325         if (req->wct < 8) {
7326                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7327                 END_PROFILE(SMBlockingX);
7328                 return;
7329         }
7330
7331         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7332         locktype = CVAL(req->vwv+3, 0);
7333         oplocklevel = CVAL(req->vwv+3, 1);
7334         num_ulocks = SVAL(req->vwv+6, 0);
7335         num_locks = SVAL(req->vwv+7, 0);
7336         lock_timeout = IVAL(req->vwv+4, 0);
7337         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7338
7339         if (!check_fsp(conn, req, fsp)) {
7340                 END_PROFILE(SMBlockingX);
7341                 return;
7342         }
7343
7344         data = req->buf;
7345
7346         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7347                 /* we don't support these - and CANCEL_LOCK makes w2k
7348                    and XP reboot so I don't really want to be
7349                    compatible! (tridge) */
7350                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7351                 END_PROFILE(SMBlockingX);
7352                 return;
7353         }
7354
7355         /* Check if this is an oplock break on a file
7356            we have granted an oplock on.
7357         */
7358         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7359                 /* Client can insist on breaking to none. */
7360                 bool break_to_none = (oplocklevel == 0);
7361                 bool result;
7362
7363                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7364                          "for fnum = %d\n", (unsigned int)oplocklevel,
7365                          fsp->fnum ));
7366
7367                 /*
7368                  * Make sure we have granted an exclusive or batch oplock on
7369                  * this file.
7370                  */
7371
7372                 if (fsp->oplock_type == 0) {
7373
7374                         /* The Samba4 nbench simulator doesn't understand
7375                            the difference between break to level2 and break
7376                            to none from level2 - it sends oplock break
7377                            replies in both cases. Don't keep logging an error
7378                            message here - just ignore it. JRA. */
7379
7380                         DEBUG(5,("reply_lockingX: Error : oplock break from "
7381                                  "client for fnum = %d (oplock=%d) and no "
7382                                  "oplock granted on this file (%s).\n",
7383                                  fsp->fnum, fsp->oplock_type,
7384                                  fsp_str_dbg(fsp)));
7385
7386                         /* if this is a pure oplock break request then don't
7387                          * send a reply */
7388                         if (num_locks == 0 && num_ulocks == 0) {
7389                                 END_PROFILE(SMBlockingX);
7390                                 return;
7391                         } else {
7392                                 END_PROFILE(SMBlockingX);
7393                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7394                                 return;
7395                         }
7396                 }
7397
7398                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7399                     (break_to_none)) {
7400                         result = remove_oplock(fsp);
7401                 } else {
7402                         result = downgrade_oplock(fsp);
7403                 }
7404
7405                 if (!result) {
7406                         DEBUG(0, ("reply_lockingX: error in removing "
7407                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
7408                         /* Hmmm. Is this panic justified? */
7409                         smb_panic("internal tdb error");
7410                 }
7411
7412                 reply_to_oplock_break_requests(fsp);
7413
7414                 /* if this is a pure oplock break request then don't send a
7415                  * reply */
7416                 if (num_locks == 0 && num_ulocks == 0) {
7417                         /* Sanity check - ensure a pure oplock break is not a
7418                            chained request. */
7419                         if(CVAL(req->vwv+0, 0) != 0xff)
7420                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
7421                                          "break is a chained %d request !\n",
7422                                          (unsigned int)CVAL(req->vwv+0, 0)));
7423                         END_PROFILE(SMBlockingX);
7424                         return;
7425                 }
7426         }
7427
7428         if (req->buflen <
7429             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7430                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7431                 END_PROFILE(SMBlockingX);
7432                 return;
7433         }
7434
7435         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7436         if (ulocks == NULL) {
7437                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7438                 END_PROFILE(SMBlockingX);
7439                 return;
7440         }
7441
7442         locks = talloc_array(req, struct smbd_lock_element, num_locks);
7443         if (locks == NULL) {
7444                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7445                 END_PROFILE(SMBlockingX);
7446                 return;
7447         }
7448
7449         /* Data now points at the beginning of the list
7450            of smb_unlkrng structs */
7451         for(i = 0; i < (int)num_ulocks; i++) {
7452                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7453                 ulocks[i].count = get_lock_count(data, i, large_file_format);
7454                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7455                 ulocks[i].brltype = UNLOCK_LOCK;
7456
7457                 /*
7458                  * There is no error code marked "stupid client bug".... :-).
7459                  */
7460                 if(err) {
7461                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7462                         END_PROFILE(SMBlockingX);
7463                         return;
7464                 }
7465         }
7466
7467         /* Now do any requested locks */
7468         data += ((large_file_format ? 20 : 10)*num_ulocks);
7469
7470         /* Data now points at the beginning of the list
7471            of smb_lkrng structs */
7472
7473         for(i = 0; i < (int)num_locks; i++) {
7474                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7475                 locks[i].count = get_lock_count(data, i, large_file_format);
7476                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7477
7478                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7479                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7480                                 locks[i].brltype = PENDING_READ_LOCK;
7481                         } else {
7482                                 locks[i].brltype = READ_LOCK;
7483                         }
7484                 } else {
7485                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7486                                 locks[i].brltype = PENDING_WRITE_LOCK;
7487                         } else {
7488                                 locks[i].brltype = WRITE_LOCK;
7489                         }
7490                 }
7491
7492                 /*
7493                  * There is no error code marked "stupid client bug".... :-).
7494                  */
7495                 if(err) {
7496                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7497                         END_PROFILE(SMBlockingX);
7498                         return;
7499                 }
7500         }
7501
7502         status = smbd_do_locking(req, fsp,
7503                                  locktype, lock_timeout,
7504                                  num_ulocks, ulocks,
7505                                  num_locks, locks,
7506                                  &async);
7507         if (!NT_STATUS_IS_OK(status)) {
7508                 END_PROFILE(SMBlockingX);
7509                 reply_nterror(req, status);
7510                 return;
7511         }
7512         if (async) {
7513                 END_PROFILE(SMBlockingX);
7514                 return;
7515         }
7516
7517         reply_outbuf(req, 2, 0);
7518
7519         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7520                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7521
7522         END_PROFILE(SMBlockingX);
7523         chain_reply(req);
7524 }
7525
7526 #undef DBGC_CLASS
7527 #define DBGC_CLASS DBGC_ALL
7528
7529 /****************************************************************************
7530  Reply to a SMBreadbmpx (read block multiplex) request.
7531  Always reply with an error, if someone has a platform really needs this,
7532  please contact vl@samba.org
7533 ****************************************************************************/
7534
7535 void reply_readbmpx(struct smb_request *req)
7536 {
7537         START_PROFILE(SMBreadBmpx);
7538         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7539         END_PROFILE(SMBreadBmpx);
7540         return;
7541 }
7542
7543 /****************************************************************************
7544  Reply to a SMBreadbs (read block multiplex secondary) request.
7545  Always reply with an error, if someone has a platform really needs this,
7546  please contact vl@samba.org
7547 ****************************************************************************/
7548
7549 void reply_readbs(struct smb_request *req)
7550 {
7551         START_PROFILE(SMBreadBs);
7552         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7553         END_PROFILE(SMBreadBs);
7554         return;
7555 }
7556
7557 /****************************************************************************
7558  Reply to a SMBsetattrE.
7559 ****************************************************************************/
7560
7561 void reply_setattrE(struct smb_request *req)
7562 {
7563         connection_struct *conn = req->conn;
7564         struct smb_file_time ft;
7565         files_struct *fsp;
7566         NTSTATUS status;
7567
7568         START_PROFILE(SMBsetattrE);
7569         ZERO_STRUCT(ft);
7570
7571         if (req->wct < 7) {
7572                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7573                 goto out;
7574         }
7575
7576         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7577
7578         if(!fsp || (fsp->conn != conn)) {
7579                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7580                 goto out;
7581         }
7582
7583         /*
7584          * Convert the DOS times into unix times.
7585          */
7586
7587         ft.atime = convert_time_t_to_timespec(
7588             srv_make_unix_date2(req->vwv+3));
7589         ft.mtime = convert_time_t_to_timespec(
7590             srv_make_unix_date2(req->vwv+5));
7591         ft.create_time = convert_time_t_to_timespec(
7592             srv_make_unix_date2(req->vwv+1));
7593
7594         reply_outbuf(req, 0, 0);
7595
7596         /*
7597          * Patch from Ray Frush <frush@engr.colostate.edu>
7598          * Sometimes times are sent as zero - ignore them.
7599          */
7600
7601         /* Ensure we have a valid stat struct for the source. */
7602         status = vfs_stat_fsp(fsp);
7603         if (!NT_STATUS_IS_OK(status)) {
7604                 reply_nterror(req, status);
7605                 goto out;
7606         }
7607
7608         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7609         if (!NT_STATUS_IS_OK(status)) {
7610                 reply_nterror(req, status);
7611                 goto out;
7612         }
7613
7614         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7615                " createtime=%u\n",
7616                 fsp->fnum,
7617                 (unsigned int)ft.atime.tv_sec,
7618                 (unsigned int)ft.mtime.tv_sec,
7619                 (unsigned int)ft.create_time.tv_sec
7620                 ));
7621  out:
7622         END_PROFILE(SMBsetattrE);
7623         return;
7624 }
7625
7626
7627 /* Back from the dead for OS/2..... JRA. */
7628
7629 /****************************************************************************
7630  Reply to a SMBwritebmpx (write block multiplex primary) request.
7631  Always reply with an error, if someone has a platform really needs this,
7632  please contact vl@samba.org
7633 ****************************************************************************/
7634
7635 void reply_writebmpx(struct smb_request *req)
7636 {
7637         START_PROFILE(SMBwriteBmpx);
7638         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7639         END_PROFILE(SMBwriteBmpx);
7640         return;
7641 }
7642
7643 /****************************************************************************
7644  Reply to a SMBwritebs (write block multiplex secondary) request.
7645  Always reply with an error, if someone has a platform really needs this,
7646  please contact vl@samba.org
7647 ****************************************************************************/
7648
7649 void reply_writebs(struct smb_request *req)
7650 {
7651         START_PROFILE(SMBwriteBs);
7652         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7653         END_PROFILE(SMBwriteBs);
7654         return;
7655 }
7656
7657 /****************************************************************************
7658  Reply to a SMBgetattrE.
7659 ****************************************************************************/
7660
7661 void reply_getattrE(struct smb_request *req)
7662 {
7663         connection_struct *conn = req->conn;
7664         int mode;
7665         files_struct *fsp;
7666         struct timespec create_ts;
7667
7668         START_PROFILE(SMBgetattrE);
7669
7670         if (req->wct < 1) {
7671                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7672                 END_PROFILE(SMBgetattrE);
7673                 return;
7674         }
7675
7676         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7677
7678         if(!fsp || (fsp->conn != conn)) {
7679                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7680                 END_PROFILE(SMBgetattrE);
7681                 return;
7682         }
7683
7684         /* Do an fstat on this file */
7685         if(fsp_stat(fsp)) {
7686                 reply_nterror(req, map_nt_error_from_unix(errno));
7687                 END_PROFILE(SMBgetattrE);
7688                 return;
7689         }
7690
7691         mode = dos_mode(conn, fsp->fsp_name);
7692
7693         /*
7694          * Convert the times into dos times. Set create
7695          * date to be last modify date as UNIX doesn't save
7696          * this.
7697          */
7698
7699         reply_outbuf(req, 11, 0);
7700
7701         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7702         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7703         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7704                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7705         /* Should we check pending modtime here ? JRA */
7706         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7707                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7708
7709         if (mode & aDIR) {
7710                 SIVAL(req->outbuf, smb_vwv6, 0);
7711                 SIVAL(req->outbuf, smb_vwv8, 0);
7712         } else {
7713                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7714                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7715                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7716         }
7717         SSVAL(req->outbuf,smb_vwv10, mode);
7718
7719         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7720
7721         END_PROFILE(SMBgetattrE);
7722         return;
7723 }