vfs_fruit: update handling of read-only creation of resource fork
[samba.git] / source3 / modules / vfs_fruit.c
index 50fbd6cb4470d31655d91ca0a8ef11520f74058d..caa06201308d6c5a7ccf233aa34912cc44b45e81 100644 (file)
@@ -142,6 +142,8 @@ struct fruit_config_data {
        const char *model;
        bool time_machine;
        off_t time_machine_max_size;
+       bool wipe_intentionally_left_blank_rfork;
+       bool delete_empty_adfiles;
 
        /*
         * Additional options, all enabled by default,
@@ -262,6 +264,7 @@ typedef enum {ADOUBLE_META, ADOUBLE_RSRC} adouble_type_t;
 #define ADEDLEN_VERSION     4
 #define ADEDLEN_FILLER      16
 #define AD_FILLER_TAG       "Netatalk        " /* should be 16 bytes */
+#define AD_FILLER_TAG_OSX   "Mac OS X        " /* should be 16 bytes */
 #define ADEDLEN_NENTRIES    2
 #define AD_HEADER_LEN       (ADEDLEN_MAGIC + ADEDLEN_VERSION + \
                             ADEDLEN_FILLER + ADEDLEN_NENTRIES) /* 26 */
@@ -414,6 +417,7 @@ struct adouble {
        adouble_type_t            ad_type;
        uint32_t                  ad_magic;
        uint32_t                  ad_version;
+       uint8_t                   ad_filler[ADEDLEN_FILLER];
        struct ad_entry           ad_eid[ADEID_MAX];
        char                     *ad_data;
        struct ad_xattr_header    adx_header;
@@ -465,6 +469,45 @@ static const uint32_t set_eid[] = {
        AD_DEV, AD_INO, AD_SYN, AD_ID
 };
 
+static char empty_resourcefork[] = {
+       0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1E,
+       0x54, 0x68, 0x69, 0x73, 0x20, 0x72, 0x65, 0x73,
+       0x6F, 0x75, 0x72, 0x63, 0x65, 0x20, 0x66, 0x6F,
+       0x72, 0x6B, 0x20, 0x69, 0x6E, 0x74, 0x65, 0x6E,
+       0x74, 0x69, 0x6F, 0x6E, 0x61, 0x6C, 0x6C, 0x79,
+       0x20, 0x6C, 0x65, 0x66, 0x74, 0x20, 0x62, 0x6C,
+       0x61, 0x6E, 0x6B, 0x20, 0x20, 0x20, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1E,
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x1C, 0x00, 0x1E, 0xFF, 0xFF
+};
+
 struct fio {
        /* tcon config handle */
        struct fruit_config_data *config;
@@ -837,6 +880,8 @@ static bool ad_unpack(struct adouble *ad, const size_t nentries,
                return false;
        }
 
+       memcpy(ad->ad_filler, ad->ad_data + ADEDOFF_FILLER, ADEDLEN_FILLER);
+
        adentries = RSVAL(ad->ad_data, ADEDOFF_NENTRIES);
        if (adentries != nentries) {
                DEBUG(1, ("invalid number of entries: %zu\n",
@@ -938,16 +983,75 @@ static bool ad_unpack(struct adouble *ad, const size_t nentries,
        return true;
 }
 
+static bool ad_convert_move_reso(struct adouble *ad,
+                                const struct smb_filename *smb_fname)
+{
+       char *map = MAP_FAILED;
+       size_t maplen;
+       ssize_t len;
+       int rc;
+       bool ok;
+
+       if (ad_getentrylen(ad, ADEID_RFORK) == 0) {
+               return true;
+       }
+
+       maplen = ad_getentryoff(ad, ADEID_RFORK) +
+               ad_getentrylen(ad, ADEID_RFORK);
+
+       /* FIXME: direct use of mmap(), vfs_aio_fork does it too */
+       map = mmap(NULL, maplen, PROT_READ|PROT_WRITE, MAP_SHARED,
+                  ad->ad_fd, 0);
+       if (map == MAP_FAILED) {
+               DBG_ERR("mmap AppleDouble: %s\n", strerror(errno));
+               return false;
+       }
+
+
+       memmove(map + ADEDOFF_RFORK_DOT_UND,
+               map + ad_getentryoff(ad, ADEID_RFORK),
+               ad_getentrylen(ad, ADEID_RFORK));
+
+       rc = munmap(map, maplen);
+       if (rc != 0) {
+               DBG_ERR("munmap failed: %s\n", strerror(errno));
+               return false;
+       }
+
+       ad_setentryoff(ad, ADEID_RFORK, ADEDOFF_RFORK_DOT_UND);
+
+       ok = ad_pack(ad);
+       if (!ok) {
+               DBG_WARNING("ad_pack [%s] failed\n", smb_fname->base_name);
+               return false;
+       }
+
+       len = sys_pwrite(ad->ad_fd, ad->ad_data, AD_DATASZ_DOT_UND, 0);
+       if (len != AD_DATASZ_DOT_UND) {
+               DBG_ERR("%s: bad size: %zd\n", smb_fname->base_name, len);
+               return false;
+       }
+
+       return true;
+}
+
 static bool ad_convert_xattr(struct adouble *ad,
                             const struct smb_filename *smb_fname,
-                            char *map)
+                            bool *converted_xattr)
 {
        static struct char_mappings **string_replace_cmaps = NULL;
+       char *map = MAP_FAILED;
+       size_t maplen;
        uint16_t i;
+       ssize_t len;
        int saved_errno = 0;
        NTSTATUS status;
+       int rc;
+       bool ok;
 
-       if (ad->adx_header.adx_num_attrs == 0) {
+       *converted_xattr = false;
+
+       if (ad_getentrylen(ad, ADEID_FINDERI) == ADEDLEN_FINDERI) {
                return true;
        }
 
@@ -963,6 +1067,17 @@ static bool ad_convert_xattr(struct adouble *ad,
                TALLOC_FREE(mappings);
        }
 
+       maplen = ad_getentryoff(ad, ADEID_RFORK) +
+               ad_getentrylen(ad, ADEID_RFORK);
+
+       /* FIXME: direct use of mmap(), vfs_aio_fork does it too */
+       map = mmap(NULL, maplen, PROT_READ|PROT_WRITE, MAP_SHARED,
+                  ad->ad_fd, 0);
+       if (map == MAP_FAILED) {
+               DBG_ERR("mmap AppleDouble: %s\n", strerror(errno));
+               return false;
+       }
+
        for (i = 0; i < ad->adx_header.adx_num_attrs; i++) {
                struct ad_xattr_entry *e = &ad->adx_entries[i];
                char *mapped_name = NULL;
@@ -981,14 +1096,16 @@ static bool ad_convert_xattr(struct adouble *ad,
                    !NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))
                {
                        DBG_ERR("string_replace_allocate failed\n");
-                       return -1;
+                       ok = false;
+                       goto fail;
                }
 
                tmp = mapped_name;
                mapped_name = talloc_asprintf(talloc_tos(), ":%s", tmp);
                TALLOC_FREE(tmp);
                if (mapped_name == NULL) {
-                       return -1;
+                       ok = false;
+                       goto fail;
                }
 
                stream_name = synthetic_smb_fname(talloc_tos(),
@@ -999,7 +1116,8 @@ static bool ad_convert_xattr(struct adouble *ad,
                TALLOC_FREE(mapped_name);
                if (stream_name == NULL) {
                        DBG_ERR("synthetic_smb_fname failed\n");
-                       return -1;
+                       ok = false;
+                       goto fail;
                }
 
                DBG_DEBUG("stream_name: %s\n", smb_fname_str_dbg(stream_name));
@@ -1026,7 +1144,8 @@ static bool ad_convert_xattr(struct adouble *ad,
                TALLOC_FREE(stream_name);
                if (!NT_STATUS_IS_OK(status)) {
                        DBG_ERR("SMB_VFS_CREATE_FILE failed\n");
-                       return -1;
+                       ok = false;
+                       goto fail;
                }
 
                nwritten = SMB_VFS_PWRITE(fsp,
@@ -1038,16 +1157,269 @@ static bool ad_convert_xattr(struct adouble *ad,
                        saved_errno = errno;
                        close_file(NULL, fsp, ERROR_CLOSE);
                        errno = saved_errno;
-                       return -1;
+                       ok = false;
+                       goto fail;
+               }
+
+               status = close_file(NULL, fsp, NORMAL_CLOSE);
+               if (!NT_STATUS_IS_OK(status)) {
+                       ok = false;
+                       goto fail;
                }
+               fsp = NULL;
+       }
+
+       ad_setentrylen(ad, ADEID_FINDERI, ADEDLEN_FINDERI);
+
+       ok = ad_pack(ad);
+       if (!ok) {
+               DBG_WARNING("ad_pack [%s] failed\n", smb_fname->base_name);
+               goto fail;
+       }
+
+       len = sys_pwrite(ad->ad_fd, ad->ad_data, AD_DATASZ_DOT_UND, 0);
+       if (len != AD_DATASZ_DOT_UND) {
+               DBG_ERR("%s: bad size: %zd\n", smb_fname->base_name, len);
+               ok = false;
+               goto fail;
+       }
+
+       ok = ad_convert_move_reso(ad, smb_fname);
+       if (!ok) {
+               goto fail;
+       }
+
+       *converted_xattr = true;
+       ok = true;
+
+fail:
+       rc = munmap(map, maplen);
+       if (rc != 0) {
+               DBG_ERR("munmap failed: %s\n", strerror(errno));
+               return false;
+       }
+
+       return ok;
+}
+
+static bool ad_convert_finderinfo(struct adouble *ad,
+                                 const struct smb_filename *smb_fname)
+{
+       char *p_ad = NULL;
+       AfpInfo *ai = NULL;
+       DATA_BLOB aiblob;
+       struct smb_filename *stream_name = NULL;
+       files_struct *fsp = NULL;
+       size_t size;
+       ssize_t nwritten;
+       NTSTATUS status;
+       int saved_errno = 0;
+       int cmp;
+
+       cmp = memcmp(ad->ad_filler, AD_FILLER_TAG_OSX, ADEDLEN_FILLER);
+       if (cmp != 0) {
+               return true;
+       }
+
+       p_ad = ad_get_entry(ad, ADEID_FINDERI);
+       if (p_ad == NULL) {
+               return false;
+       }
+
+       ai = afpinfo_new(talloc_tos());
+       if (ai == NULL) {
+               return false;
+       }
+
+       memcpy(ai->afpi_FinderInfo, p_ad, ADEDLEN_FINDERI);
+
+       aiblob = data_blob_talloc(talloc_tos(), NULL, AFP_INFO_SIZE);
+       if (aiblob.data == NULL) {
+               TALLOC_FREE(ai);
+               return false;
+       }
+
+       size = afpinfo_pack(ai, (char *)aiblob.data);
+       TALLOC_FREE(ai);
+       if (size != AFP_INFO_SIZE) {
+               return false;
+       }
+
+       stream_name = synthetic_smb_fname(talloc_tos(),
+                                         smb_fname->base_name,
+                                         AFPINFO_STREAM,
+                                         NULL,
+                                         smb_fname->flags);
+       if (stream_name == NULL) {
+               data_blob_free(&aiblob);
+               DBG_ERR("synthetic_smb_fname failed\n");
+               return false;
+       }
+
+       DBG_DEBUG("stream_name: %s\n", smb_fname_str_dbg(stream_name));
+
+       status = SMB_VFS_CREATE_FILE(
+               ad->ad_handle->conn,            /* conn */
+               NULL,                           /* req */
+               0,                              /* root_dir_fid */
+               stream_name,                    /* fname */
+               FILE_GENERIC_WRITE,             /* access_mask */
+               FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
+               FILE_OPEN_IF,                   /* create_disposition */
+               0,                              /* create_options */
+               0,                              /* file_attributes */
+               INTERNAL_OPEN_ONLY,             /* oplock_request */
+               NULL,                           /* lease */
+               0,                              /* allocation_size */
+               0,                              /* private_flags */
+               NULL,                           /* sd */
+               NULL,                           /* ea_list */
+               &fsp,                           /* result */
+               NULL,                           /* psbuf */
+               NULL, NULL);                    /* create context */
+       TALLOC_FREE(stream_name);
+       if (!NT_STATUS_IS_OK(status)) {
+               DBG_ERR("SMB_VFS_CREATE_FILE failed\n");
+               return false;
+       }
+
+       nwritten = SMB_VFS_PWRITE(fsp,
+                                 aiblob.data,
+                                 aiblob.length,
+                                 0);
+       if (nwritten == -1) {
+               DBG_ERR("SMB_VFS_PWRITE failed\n");
+               saved_errno = errno;
+               close_file(NULL, fsp, ERROR_CLOSE);
+               errno = saved_errno;
+               return false;
+       }
+
+       status = close_file(NULL, fsp, NORMAL_CLOSE);
+       if (!NT_STATUS_IS_OK(status)) {
+               return false;
+       }
+       fsp = NULL;
+
+       return true;
+}
+
+static bool ad_convert_truncate(struct adouble *ad,
+                               const struct smb_filename *smb_fname)
+{
+       int rc;
+
+       /*
+        * FIXME: direct ftruncate(), but we don't have a fsp for the
+        * VFS call
+        */
+       rc = ftruncate(ad->ad_fd, ADEDOFF_RFORK_DOT_UND +
+                      ad_getentrylen(ad, ADEID_RFORK));
+       if (rc != 0) {
+               return false;
+       }
+
+       return true;
+}
+
+static bool ad_convert_blank_rfork(struct adouble *ad,
+                                  bool *blank)
+{
+       struct fruit_config_data *config = NULL;
+       uint8_t *map = MAP_FAILED;
+       size_t maplen;
+       int cmp;
+       ssize_t len;
+       int rc;
+       bool ok;
+
+       *blank = false;
+
+       SMB_VFS_HANDLE_GET_DATA(ad->ad_handle, config,
+                               struct fruit_config_data, return false);
+
+       if (!config->wipe_intentionally_left_blank_rfork) {
+               return true;
+       }
+
+       if (ad_getentrylen(ad, ADEID_RFORK) != sizeof(empty_resourcefork)) {
+               return true;
+       }
+
+       maplen = ad_getentryoff(ad, ADEID_RFORK) +
+               ad_getentrylen(ad, ADEID_RFORK);
+
+       /* FIXME: direct use of mmap(), vfs_aio_fork does it too */
+       map = mmap(NULL, maplen, PROT_READ|PROT_WRITE, MAP_SHARED,
+                  ad->ad_fd, 0);
+       if (map == MAP_FAILED) {
+               DBG_ERR("mmap AppleDouble: %s\n", strerror(errno));
+               return false;
+       }
+
+       cmp = memcmp(map + ADEDOFF_RFORK_DOT_UND,
+                    empty_resourcefork,
+                    sizeof(empty_resourcefork));
+       rc = munmap(map, maplen);
+       if (rc != 0) {
+               DBG_ERR("munmap failed: %s\n", strerror(errno));
+               return false;
+       }
+
+       if (cmp != 0) {
+               return true;
+       }
+
+       ad_setentrylen(ad, ADEID_RFORK, 0);
+
+       ok = ad_pack(ad);
+       if (!ok) {
+               return false;
+       }
+
+       len = sys_pwrite(ad->ad_fd, ad->ad_data, AD_DATASZ_DOT_UND, 0);
+       if (len != AD_DATASZ_DOT_UND) {
+               return false;
+       }
+
+       *blank = true;
+       return true;
+}
+
+static bool ad_convert_delete_adfile(struct adouble *ad,
+                                    const struct smb_filename *smb_fname)
+{
+       struct fruit_config_data *config = NULL;
+       struct smb_filename *ad_name = NULL;
+       int rc;
+
+       if (ad_getentrylen(ad, ADEID_RFORK) > 0) {
+               return true;
+       }
+
+       SMB_VFS_HANDLE_GET_DATA(ad->ad_handle, config,
+                               struct fruit_config_data, return false);
+
+       if (!config->delete_empty_adfiles) {
+               return true;
+       }
+
+       rc = adouble_path(talloc_tos(), smb_fname, &ad_name);
+       if (rc != 0) {
+               return false;
+       }
 
-               status = close_file(NULL, fsp, NORMAL_CLOSE);
-               if (!NT_STATUS_IS_OK(status)) {
-                       return -1;
-               }
-               fsp = NULL;
+       rc = SMB_VFS_NEXT_UNLINK(ad->ad_handle, ad_name);
+       if (rc != 0) {
+               DBG_ERR("Unlinking [%s] failed: %s\n",
+                       smb_fname_str_dbg(ad_name), strerror(errno));
+               TALLOC_FREE(ad_name);
+               return false;
        }
 
+       DBG_WARNING("Unlinked [%s] after conversion\n", smb_fname_str_dbg(ad_name));
+       TALLOC_FREE(ad_name);
+
        return true;
 }
 
@@ -1055,60 +1427,48 @@ static bool ad_convert_xattr(struct adouble *ad,
  * Convert from Apple's ._ file to Netatalk
  *
  * Apple's AppleDouble may contain a FinderInfo entry longer then 32
- * bytes containing packed xattrs. Netatalk can't deal with that, so
- * we simply discard the packed xattrs.
+ * bytes containing packed xattrs.
  *
  * @return -1 in case an error occurred, 0 if no conversion was done, 1
  * otherwise
  **/
 static int ad_convert(struct adouble *ad,
-                     const struct smb_filename *smb_fname,
-                     int fd)
+                     const struct smb_filename *smb_fname)
 {
-       int rc = 0;
-       char *map = MAP_FAILED;
-       size_t origlen;
        bool ok;
+       bool converted_xattr = false;
+       bool blank;
 
-       origlen = ad_getentryoff(ad, ADEID_RFORK) +
-               ad_getentrylen(ad, ADEID_RFORK);
-
-       /* FIXME: direct use of mmap(), vfs_aio_fork does it too */
-       map = mmap(NULL, origlen, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
-       if (map == MAP_FAILED) {
-               DEBUG(2, ("mmap AppleDouble: %s\n", strerror(errno)));
-               rc = -1;
-               goto exit;
+       ok = ad_convert_xattr(ad, smb_fname, &converted_xattr);
+       if (!ok) {
+               return -1;
        }
 
-       ok = ad_convert_xattr(ad, smb_fname, map);
+       ok = ad_convert_blank_rfork(ad, &blank);
        if (!ok) {
-               munmap(map, origlen);
                return -1;
        }
 
-       if (ad_getentrylen(ad, ADEID_RFORK) > 0) {
-               memmove(map + ad_getentryoff(ad, ADEID_FINDERI) + ADEDLEN_FINDERI,
-                       map + ad_getentryoff(ad, ADEID_RFORK),
-                       ad_getentrylen(ad, ADEID_RFORK));
+       if (converted_xattr || blank) {
+               ok = ad_convert_truncate(ad, smb_fname);
+               if (!ok) {
+                       return -1;
+               }
        }
 
-       ad_setentrylen(ad, ADEID_FINDERI, ADEDLEN_FINDERI);
-       ad_setentryoff(ad, ADEID_RFORK,
-                      ad_getentryoff(ad, ADEID_FINDERI) + ADEDLEN_FINDERI);
-
-       /*
-        * FIXME: direct ftruncate(), but we don't have a fsp for the
-        * VFS call
-        */
-       rc = ftruncate(fd, ad_getentryoff(ad, ADEID_RFORK)
-                      + ad_getentrylen(ad, ADEID_RFORK));
+       ok = ad_convert_finderinfo(ad, smb_fname);
+       if (!ok) {
+               DBG_ERR("Failed to convert [%s]\n",
+                       smb_fname_str_dbg(smb_fname));
+               return -1;
+       }
 
-exit:
-       if (map != MAP_FAILED) {
-               munmap(map, origlen);
+       ok = ad_convert_delete_adfile(ad, smb_fname);
+       if (!ok) {
+               return -1;
        }
-       return rc;
+
+       return 0;
 }
 
 /**
@@ -1304,15 +1664,8 @@ static ssize_t ad_read_rsrc_adouble(struct adouble *ad,
 {
        SMB_STRUCT_STAT sbuf;
        char *p_ad = NULL;
-       AfpInfo *ai = NULL;
-       DATA_BLOB aiblob;
-       struct smb_filename *stream_name = NULL;
-       files_struct *fsp = NULL;
-       ssize_t len;
        size_t size;
-       ssize_t nwritten;
-       NTSTATUS status;
-       int saved_errno = 0;
+       ssize_t len;
        int ret;
        bool ok;
 
@@ -1368,115 +1721,17 @@ static ssize_t ad_read_rsrc_adouble(struct adouble *ad,
                return -1;
        }
 
-       if (ad_getentrylen(ad, ADEID_FINDERI) == ADEDLEN_FINDERI) {
-               return len;
-       }
-
        /*
         * Try to fixup AppleDouble files created by OS X with xattrs
-        * appended to the ADEID_FINDERI entry. We simply remove the
-        * xattrs blob, this means any fancy xattr that was stored
-        * there is lost.
+        * appended to the ADEID_FINDERI entry.
         */
 
-       ret = ad_convert(ad, smb_fname, ad->ad_fd);
+       ret = ad_convert(ad, smb_fname);
        if (ret != 0) {
                DBG_WARNING("Failed to convert [%s]\n", smb_fname->base_name);
                return len;
        }
 
-       ok = ad_pack(ad);
-       if (!ok) {
-               DBG_WARNING("ad_pack [%s] failed\n", smb_fname->base_name);
-               return -1;
-       }
-
-       len = sys_pwrite(ad->ad_fd, ad->ad_data, AD_DATASZ_DOT_UND, 0);
-       if (len != AD_DATASZ_DOT_UND) {
-               DBG_ERR("%s: bad size: %zd\n", smb_fname->base_name, len);
-               return -1;
-       }
-
-       p_ad = ad_get_entry(ad, ADEID_FINDERI);
-       if (p_ad == NULL) {
-               return -1;
-       }
-
-       ai = afpinfo_new(talloc_tos());
-       if (ai == NULL) {
-               return -1;
-       }
-
-       memcpy(ai->afpi_FinderInfo, p_ad, ADEDLEN_FINDERI);
-
-       aiblob = data_blob_talloc(talloc_tos(), NULL, AFP_INFO_SIZE);
-       if (aiblob.data == NULL) {
-               TALLOC_FREE(ai);
-               return -1;
-       }
-
-       size = afpinfo_pack(ai, (char *)aiblob.data);
-       TALLOC_FREE(ai);
-       if (size != AFP_INFO_SIZE) {
-               return -1;
-       }
-
-       stream_name = synthetic_smb_fname(talloc_tos(),
-                                         smb_fname->base_name,
-                                         AFPINFO_STREAM,
-                                         NULL,
-                                         smb_fname->flags);
-       if (stream_name == NULL) {
-               data_blob_free(&aiblob);
-               DBG_ERR("synthetic_smb_fname failed\n");
-               return -1;
-       }
-
-       DBG_DEBUG("stream_name: %s\n", smb_fname_str_dbg(stream_name));
-
-       status = SMB_VFS_CREATE_FILE(
-               ad->ad_handle->conn,            /* conn */
-               NULL,                           /* req */
-               0,                              /* root_dir_fid */
-               stream_name,                    /* fname */
-               FILE_GENERIC_WRITE,             /* access_mask */
-               FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
-               FILE_OPEN_IF,                   /* create_disposition */
-               0,                              /* create_options */
-               0,                              /* file_attributes */
-               INTERNAL_OPEN_ONLY,             /* oplock_request */
-               NULL,                           /* lease */
-               0,                              /* allocation_size */
-               0,                              /* private_flags */
-               NULL,                           /* sd */
-               NULL,                           /* ea_list */
-               &fsp,                           /* result */
-               NULL,                           /* psbuf */
-               NULL, NULL);                    /* create context */
-       TALLOC_FREE(stream_name);
-       if (!NT_STATUS_IS_OK(status)) {
-               DBG_ERR("SMB_VFS_CREATE_FILE failed\n");
-               return -1;
-       }
-
-       nwritten = SMB_VFS_PWRITE(fsp,
-                                 aiblob.data,
-                                 aiblob.length,
-                                 0);
-       if (nwritten == -1) {
-               DBG_ERR("SMB_VFS_PWRITE failed\n");
-               saved_errno = errno;
-               close_file(NULL, fsp, ERROR_CLOSE);
-               errno = saved_errno;
-               return -1;
-       }
-
-       status = close_file(NULL, fsp, NORMAL_CLOSE);
-       if (!NT_STATUS_IS_OK(status)) {
-               return -1;
-       }
-       fsp = NULL;
-
        return len;
 }
 
@@ -1992,6 +2247,14 @@ static int init_fruit_config(vfs_handle_struct *handle)
                config->time_machine_max_size = conv_str_size(tm_size_str);
        }
 
+       config->wipe_intentionally_left_blank_rfork = lp_parm_bool(
+               SNUM(handle->conn), FRUIT_PARAM_TYPE_NAME,
+               "wipe_intentionally_left_blank_rfork", false);
+
+       config->delete_empty_adfiles = lp_parm_bool(
+               SNUM(handle->conn), FRUIT_PARAM_TYPE_NAME,
+               "delete_empty_adfiles", false);
+
        SMB_VFS_HANDLE_SET_DATA(handle, config,
                                NULL, struct fruit_config_data,
                                return -1);
@@ -2331,7 +2594,7 @@ static off_t access_to_netatalk_brl(enum apple_fork fork_type,
 static off_t denymode_to_netatalk_brl(enum apple_fork fork_type,
                                      uint32_t deny_mode)
 {
-       off_t offset;
+       off_t offset = 0;
 
        switch (deny_mode) {
        case DENY_READ:
@@ -2386,7 +2649,6 @@ static NTSTATUS fruit_check_access(vfs_handle_struct *handle,
                                   uint32_t deny_mode)
 {
        NTSTATUS status = NT_STATUS_OK;
-       struct byte_range_lock *br_lck = NULL;
        bool open_for_reading, open_for_writing, deny_read, deny_write;
        off_t off;
        bool have_read = false;
@@ -2444,6 +2706,8 @@ static NTSTATUS fruit_check_access(vfs_handle_struct *handle,
 
                /* Set locks */
                if ((access_mask & FILE_READ_DATA) && have_read) {
+                       struct byte_range_lock *br_lck = NULL;
+
                        off = access_to_netatalk_brl(fork_type, FILE_READ_DATA);
                        br_lck = do_lock(
                                handle->conn->sconn->msg_ctx, fsp,
@@ -2451,13 +2715,16 @@ static NTSTATUS fruit_check_access(vfs_handle_struct *handle,
                                READ_LOCK, POSIX_LOCK, false,
                                &status, NULL);
 
+                       TALLOC_FREE(br_lck);
+
                        if (!NT_STATUS_IS_OK(status))  {
                                return status;
                        }
-                       TALLOC_FREE(br_lck);
                }
 
                if ((deny_mode & DENY_READ) && have_read) {
+                       struct byte_range_lock *br_lck = NULL;
+
                        off = denymode_to_netatalk_brl(fork_type, DENY_READ);
                        br_lck = do_lock(
                                handle->conn->sconn->msg_ctx, fsp,
@@ -2465,10 +2732,11 @@ static NTSTATUS fruit_check_access(vfs_handle_struct *handle,
                                READ_LOCK, POSIX_LOCK, false,
                                &status, NULL);
 
+                       TALLOC_FREE(br_lck);
+
                        if (!NT_STATUS_IS_OK(status)) {
                                return status;
                        }
-                       TALLOC_FREE(br_lck);
                }
        }
 
@@ -2494,6 +2762,8 @@ static NTSTATUS fruit_check_access(vfs_handle_struct *handle,
 
                /* Set locks */
                if ((access_mask & FILE_WRITE_DATA) && have_read) {
+                       struct byte_range_lock *br_lck = NULL;
+
                        off = access_to_netatalk_brl(fork_type, FILE_WRITE_DATA);
                        br_lck = do_lock(
                                handle->conn->sconn->msg_ctx, fsp,
@@ -2501,13 +2771,15 @@ static NTSTATUS fruit_check_access(vfs_handle_struct *handle,
                                READ_LOCK, POSIX_LOCK, false,
                                &status, NULL);
 
+                       TALLOC_FREE(br_lck);
+
                        if (!NT_STATUS_IS_OK(status)) {
                                return status;
                        }
-                       TALLOC_FREE(br_lck);
-
                }
                if ((deny_mode & DENY_WRITE) && have_read) {
+                       struct byte_range_lock *br_lck = NULL;
+
                        off = denymode_to_netatalk_brl(fork_type, DENY_WRITE);
                        br_lck = do_lock(
                                handle->conn->sconn->msg_ctx, fsp,
@@ -2515,15 +2787,14 @@ static NTSTATUS fruit_check_access(vfs_handle_struct *handle,
                                READ_LOCK, POSIX_LOCK, false,
                                &status, NULL);
 
+                       TALLOC_FREE(br_lck);
+
                        if (!NT_STATUS_IS_OK(status)) {
                                return status;
                        }
-                       TALLOC_FREE(br_lck);
                }
        }
 
-       TALLOC_FREE(br_lck);
-
        return status;
 }
 
@@ -2954,10 +3225,54 @@ static NTSTATUS readdir_attr_macmeta(struct vfs_handle_struct *handle,
        return status;
 }
 
+static NTSTATUS remove_virtual_nfs_aces(struct security_descriptor *psd)
+{
+       NTSTATUS status;
+       uint32_t i;
+
+       if (psd->dacl == NULL) {
+               return NT_STATUS_OK;
+       }
+
+       for (i = 0; i < psd->dacl->num_aces; i++) {
+               /* MS NFS style mode/uid/gid */
+               int cmp = dom_sid_compare_domain(
+                               &global_sid_Unix_NFS,
+                               &psd->dacl->aces[i].trustee);
+               if (cmp != 0) {
+                       /* Normal ACE entry. */
+                       continue;
+               }
+
+               /*
+                * security_descriptor_dacl_del()
+                * *must* return NT_STATUS_OK as we know
+                * we have something to remove.
+                */
+
+               status = security_descriptor_dacl_del(psd,
+                               &psd->dacl->aces[i].trustee);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DBG_WARNING("failed to remove MS NFS style ACE: %s\n",
+                               nt_errstr(status));
+                       return status;
+               }
+
+               /*
+                * security_descriptor_dacl_del() may delete more
+                * then one entry subsequent to this one if the
+                * SID matches, but we only need to ensure that
+                * we stay looking at the same element in the array.
+                */
+               i--;
+       }
+       return NT_STATUS_OK;
+}
+
 /* Search MS NFS style ACE with UNIX mode */
 static NTSTATUS check_ms_nfs(vfs_handle_struct *handle,
                             files_struct *fsp,
-                            const struct security_descriptor *psd,
+                            struct security_descriptor *psd,
                             mode_t *pmode,
                             bool *pdo_chmod)
 {
@@ -2991,7 +3306,12 @@ static NTSTATUS check_ms_nfs(vfs_handle_struct *handle,
                }
        }
 
-       return NT_STATUS_OK;
+       /*
+        * Remove any incoming virtual ACE entries generated by
+        * fruit_fget_nt_acl().
+        */
+
+       return remove_virtual_nfs_aces(psd);
 }
 
 /****************************************************************************
@@ -3255,12 +3575,9 @@ static int fruit_open_rsrc_adouble(vfs_handle_struct *handle,
                goto exit;
        }
 
-       /* Sanitize flags */
-       if (flags & O_WRONLY) {
-               /* We always need read access for the metadata header too */
-               flags &= ~O_WRONLY;
-               flags |= O_RDWR;
-       }
+       /* We always need read/write access for the metadata header too */
+       flags &= ~(O_RDONLY | O_WRONLY);
+       flags |= O_RDWR;
 
        hostfd = SMB_VFS_NEXT_OPEN(handle, smb_fname_base, fsp,
                                   flags, mode);
@@ -3347,20 +3664,6 @@ static int fruit_open_rsrc(vfs_handle_struct *handle,
        SMB_VFS_HANDLE_GET_DATA(handle, config,
                                struct fruit_config_data, return -1);
 
-       if (((flags & O_ACCMODE) == O_RDONLY)
-           && (flags & O_CREAT)
-           && !VALID_STAT(fsp->fsp_name->st))
-       {
-               /*
-                * This means the stream doesn't exist. macOS SMB server fails
-                * this with NT_STATUS_OBJECT_NAME_NOT_FOUND, so must we. Cf bug
-                * 12565 and the test for this combination in
-                * test_rfork_create().
-                */
-               errno = ENOENT;
-               return -1;
-       }
-
        switch (config->rsrc) {
        case FRUIT_RSRC_STREAM:
                fd = SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
@@ -3953,6 +4256,11 @@ static ssize_t fruit_pread_meta(vfs_handle_struct *handle,
                return 0;
        }
 
+       if (fio == NULL) {
+               DBG_ERR("Failed to fetch fsp extension");
+               return -1;
+       }
+
        /* Yes, macOS always reads from offset 0 */
        offset = 0;
        to_return = MIN(n, AFP_INFO_SIZE);
@@ -4016,6 +4324,11 @@ static ssize_t fruit_pread_rsrc(vfs_handle_struct *handle,
        struct fio *fio = (struct fio *)VFS_FETCH_FSP_EXTENSION(handle, fsp);
        ssize_t nread;
 
+       if (fio == NULL) {
+               errno = EINVAL;
+               return -1;
+       }
+
        switch (fio->config->rsrc) {
        case FRUIT_RSRC_STREAM:
                nread = fruit_pread_rsrc_stream(handle, fsp, data, n, offset);
@@ -4274,6 +4587,11 @@ static ssize_t fruit_pwrite_meta(vfs_handle_struct *handle,
                return -1;
        }
 
+       if (fio == NULL) {
+               DBG_ERR("Failed to fetch fsp extension");
+               return -1;
+       }
+
        switch (fio->config->meta) {
        case FRUIT_META_STREAM:
                nwritten = fruit_pwrite_meta_stream(handle, fsp, data,
@@ -4351,6 +4669,11 @@ static ssize_t fruit_pwrite_rsrc(vfs_handle_struct *handle,
        struct fio *fio = (struct fio *)VFS_FETCH_FSP_EXTENSION(handle, fsp);
        ssize_t nwritten;
 
+       if (fio == NULL) {
+               DBG_ERR("Failed to fetch fsp extension");
+               return -1;
+       }
+
        switch (fio->config->rsrc) {
        case FRUIT_RSRC_STREAM:
                nwritten = fruit_pwrite_rsrc_stream(handle, fsp, data, n, offset);
@@ -5437,6 +5760,11 @@ static int fruit_ftruncate_rsrc(struct vfs_handle_struct *handle,
        struct fio *fio = (struct fio *)VFS_FETCH_FSP_EXTENSION(handle, fsp);
        int ret;
 
+       if (fio == NULL) {
+               DBG_ERR("Failed to fetch fsp extension");
+               return -1;
+       }
+
        switch (fio->config->rsrc) {
        case FRUIT_RSRC_XATTR:
                ret = fruit_ftruncate_rsrc_xattr(handle, fsp, offset);
@@ -5488,6 +5816,13 @@ static int fruit_ftruncate(struct vfs_handle_struct *handle,
                  (intmax_t)offset);
 
        if (fio == NULL) {
+               if (offset == 0 &&
+                   global_fruit_config.nego_aapl &&
+                   is_ntfs_stream_smb_fname(fsp->fsp_name) &&
+                   !is_ntfs_default_stream_smb_fname(fsp->fsp_name))
+               {
+                       return SMB_VFS_NEXT_UNLINK(handle, fsp->fsp_name);
+               }
                return SMB_VFS_NEXT_FTRUNCATE(handle, fsp, offset);
        }
 
@@ -5687,7 +6022,6 @@ static NTSTATUS fruit_fget_nt_acl(vfs_handle_struct *handle,
        struct security_ace ace;
        struct dom_sid sid;
        struct fruit_config_data *config;
-       bool remove_ok = false;
 
        SMB_VFS_HANDLE_GET_DATA(handle, config,
                                struct fruit_config_data,
@@ -5709,18 +6043,16 @@ static NTSTATUS fruit_fget_nt_acl(vfs_handle_struct *handle,
                return NT_STATUS_OK;
        }
 
+       /* First remove any existing ACE's with NFS style mode/uid/gid SIDs. */
+       status = remove_virtual_nfs_aces(*ppdesc);
+       if (!NT_STATUS_IS_OK(status)) {
+               DBG_WARNING("failed to remove MS NFS style ACEs\n");
+               return status;
+       }
+
        /* MS NFS style mode */
        sid_compose(&sid, &global_sid_Unix_NFS_Mode, fsp->fsp_name->st.st_ex_mode);
        init_sec_ace(&ace, &sid, SEC_ACE_TYPE_ACCESS_DENIED, 0, 0);
-
-       /* First remove any existing ACE's with this SID. */
-       status = security_descriptor_dacl_del(*ppdesc, &sid);
-       remove_ok = (NT_STATUS_IS_OK(status) ||
-                    NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND));
-       if (!remove_ok) {
-               DBG_WARNING("failed to remove MS NFS_mode style ACE\n");
-               return status;
-       }
        status = security_descriptor_dacl_add(*ppdesc, &ace);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(1,("failed to add MS NFS style ACE\n"));
@@ -5730,15 +6062,6 @@ static NTSTATUS fruit_fget_nt_acl(vfs_handle_struct *handle,
        /* MS NFS style uid */
        sid_compose(&sid, &global_sid_Unix_NFS_Users, fsp->fsp_name->st.st_ex_uid);
        init_sec_ace(&ace, &sid, SEC_ACE_TYPE_ACCESS_DENIED, 0, 0);
-
-       /* First remove any existing ACE's with this SID. */
-       status = security_descriptor_dacl_del(*ppdesc, &sid);
-       remove_ok = (NT_STATUS_IS_OK(status) ||
-                    NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND));
-       if (!remove_ok) {
-               DBG_WARNING("failed to remove MS NFS_users style ACE\n");
-               return status;
-       }
        status = security_descriptor_dacl_add(*ppdesc, &ace);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(1,("failed to add MS NFS style ACE\n"));
@@ -5748,15 +6071,6 @@ static NTSTATUS fruit_fget_nt_acl(vfs_handle_struct *handle,
        /* MS NFS style gid */
        sid_compose(&sid, &global_sid_Unix_NFS_Groups, fsp->fsp_name->st.st_ex_gid);
        init_sec_ace(&ace, &sid, SEC_ACE_TYPE_ACCESS_DENIED, 0, 0);
-
-       /* First remove any existing ACE's with this SID. */
-       status = security_descriptor_dacl_del(*ppdesc, &sid);
-       remove_ok = (NT_STATUS_IS_OK(status) ||
-                    NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND));
-       if (!remove_ok) {
-               DBG_WARNING("failed to remove MS NFS_groups style ACE\n");
-               return status;
-       }
        status = security_descriptor_dacl_add(*ppdesc, &ace);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(1,("failed to add MS NFS style ACE\n"));
@@ -5769,24 +6083,53 @@ static NTSTATUS fruit_fget_nt_acl(vfs_handle_struct *handle,
 static NTSTATUS fruit_fset_nt_acl(vfs_handle_struct *handle,
                                  files_struct *fsp,
                                  uint32_t security_info_sent,
-                                 const struct security_descriptor *psd)
+                                 const struct security_descriptor *orig_psd)
 {
        NTSTATUS status;
        bool do_chmod;
        mode_t ms_nfs_mode = 0;
        int result;
+       struct security_descriptor *psd = NULL;
+       uint32_t orig_num_aces = 0;
+
+       if (orig_psd->dacl != NULL) {
+               orig_num_aces = orig_psd->dacl->num_aces;
+       }
+
+       psd = security_descriptor_copy(talloc_tos(), orig_psd);
+       if (psd == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
 
        DBG_DEBUG("fruit_fset_nt_acl: %s\n", fsp_str_dbg(fsp));
 
        status = check_ms_nfs(handle, fsp, psd, &ms_nfs_mode, &do_chmod);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(1, ("fruit_fset_nt_acl: check_ms_nfs failed%s\n", fsp_str_dbg(fsp)));
+               TALLOC_FREE(psd);
                return status;
        }
 
+       /*
+        * If only ms_nfs ACE entries were sent, ensure we set the DACL
+        * sent/present flags correctly now we've removed them.
+        */
+
+       if (orig_num_aces != 0) {
+               /*
+                * Are there any ACE's left ?
+                */
+               if (psd->dacl->num_aces == 0) {
+                       /* No - clear the DACL sent/present flags. */
+                       security_info_sent &= ~SECINFO_DACL;
+                       psd->type &= ~SEC_DESC_DACL_PRESENT;
+               }
+       }
+
        status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(1, ("fruit_fset_nt_acl: SMB_VFS_NEXT_FSET_NT_ACL failed%s\n", fsp_str_dbg(fsp)));
+               TALLOC_FREE(psd);
                return status;
        }
 
@@ -5804,10 +6147,12 @@ static NTSTATUS fruit_fset_nt_acl(vfs_handle_struct *handle,
                                  result, (unsigned)ms_nfs_mode,
                                  strerror(errno)));
                        status = map_nt_error_from_unix(errno);
+                       TALLOC_FREE(psd);
                        return status;
                }
        }
 
+       TALLOC_FREE(psd);
        return NT_STATUS_OK;
 }
 
@@ -6456,12 +6801,12 @@ static bool fruit_tmsize_do_dirent(vfs_handle_struct *handle,
                return true;
        }
 
-       tm_size = bandsize * nbands;
-       if (tm_size > UINT64_MAX) {
+       if (bandsize > SIZE_MAX/nbands) {
                DBG_ERR("tmsize overflow: bandsize [%zu] nbands [%zu]\n",
                        bandsize, nbands);
                return false;
        }
+       tm_size = bandsize * nbands;
 
        if (state->total_size + tm_size < state->total_size) {
                DBG_ERR("tmsize overflow: bandsize [%zu] nbands [%zu]\n",