s3:smbd: avoid using sconn_server_id()
[samba.git] / source3 / smbd / smb2_create.c
index e0815049a429d18ff39c56653ae1ca0fb94f5f0a..6218592e3e7dc01231a3024adf865f627e8c530b 100644 (file)
@@ -3,6 +3,7 @@
    Core SMB2 server
 
    Copyright (C) Stefan Metzmacher 2009
+   Copyright (C) Jeremy Allison 2010
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
 */
 
 #include "includes.h"
+#include "printing.h"
+#include "smbd/smbd.h"
 #include "smbd/globals.h"
 #include "../libcli/smb/smb_common.h"
+#include "../librpc/gen_ndr/ndr_security.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "messages.h"
+
+int map_smb2_oplock_levels_to_samba(uint8_t in_oplock_level)
+{
+       switch(in_oplock_level) {
+       case SMB2_OPLOCK_LEVEL_NONE:
+               return NO_OPLOCK;
+       case SMB2_OPLOCK_LEVEL_II:
+               return LEVEL_II_OPLOCK;
+       case SMB2_OPLOCK_LEVEL_EXCLUSIVE:
+               return EXCLUSIVE_OPLOCK;
+       case SMB2_OPLOCK_LEVEL_BATCH:
+               return BATCH_OPLOCK;
+       case SMB2_OPLOCK_LEVEL_LEASE:
+               DEBUG(2,("map_smb2_oplock_levels_to_samba: "
+                       "LEASE_OPLOCK_REQUESTED\n"));
+               return NO_OPLOCK;
+       default:
+               DEBUG(2,("map_smb2_oplock_levels_to_samba: "
+                       "unknown level %u\n",
+                       (unsigned int)in_oplock_level));
+               return NO_OPLOCK;
+       }
+}
+
+static uint8_t map_samba_oplock_levels_to_smb2(int oplock_type)
+{
+       if (BATCH_OPLOCK_TYPE(oplock_type)) {
+               return SMB2_OPLOCK_LEVEL_BATCH;
+       } else if (EXCLUSIVE_OPLOCK_TYPE(oplock_type)) {
+               return SMB2_OPLOCK_LEVEL_EXCLUSIVE;
+       } else if (oplock_type == LEVEL_II_OPLOCK) {
+               /*
+                * Don't use LEVEL_II_OPLOCK_TYPE here as
+                * this also includes FAKE_LEVEL_II_OPLOCKs
+                * which are internal only.
+                */
+               return SMB2_OPLOCK_LEVEL_II;
+       } else {
+               return SMB2_OPLOCK_LEVEL_NONE;
+       }
+}
 
 static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        struct tevent_context *ev,
@@ -45,16 +92,15 @@ static NTSTATUS smbd_smb2_create_recv(struct tevent_req *req,
                        uint64_t *out_allocation_size,
                        uint64_t *out_end_of_file,
                        uint32_t *out_file_attributes,
+                       uint64_t *out_file_id_persistent,
                        uint64_t *out_file_id_volatile,
                        struct smb2_create_blobs *out_context_blobs);
 
-static void smbd_smb2_request_create_done(struct tevent_req *subreq);
-NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *req)
+static void smbd_smb2_request_create_done(struct tevent_req *tsubreq);
+NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
 {
        const uint8_t *inbody;
-       int i = req->current_idx;
-       size_t expected_body_size = 0x39;
-       size_t body_size;
+       int i = smb2req->current_idx;
        uint8_t in_oplock_level;
        uint32_t in_impersonation_level;
        uint32_t in_desired_access;
@@ -78,18 +124,13 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *req)
        uint32_t dyn_offset;
        NTSTATUS status;
        bool ok;
-       struct tevent_req *subreq;
-
-       if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-               return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-       }
-
-       inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
+       struct tevent_req *tsubreq;
 
-       body_size = SVAL(inbody, 0x00);
-       if (body_size != expected_body_size) {
-               return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+       status = smbd_smb2_request_verify_sizes(smb2req, 0x39);
+       if (!NT_STATUS_IS_OK(status)) {
+               return smbd_smb2_request_error(smb2req, status);
        }
+       inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
 
        in_oplock_level         = CVAL(inbody, 0x03);
        in_impersonation_level  = IVAL(inbody, 0x04);
@@ -111,28 +152,28 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *req)
         *       overlap
         */
 
-       dyn_offset = SMB2_HDR_BODY + (body_size & 0xFFFFFFFE);
+       dyn_offset = SMB2_HDR_BODY + smb2req->in.vector[i+1].iov_len;
 
        if (in_name_offset == 0 && in_name_length == 0) {
                /* This is ok */
                name_offset = 0;
        } else if (in_name_offset < dyn_offset) {
-               return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+               return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
        } else {
                name_offset = in_name_offset - dyn_offset;
        }
 
-       if (name_offset > req->in.vector[i+2].iov_len) {
-               return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+       if (name_offset > smb2req->in.vector[i+2].iov_len) {
+               return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
        }
 
-       name_available_length = req->in.vector[i+2].iov_len - name_offset;
+       name_available_length = smb2req->in.vector[i+2].iov_len - name_offset;
 
        if (in_name_length > name_available_length) {
-               return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+               return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
        }
 
-       in_name_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base +
+       in_name_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base +
                              name_offset;
        in_name_buffer.length = in_name_length;
 
@@ -140,22 +181,22 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *req)
                /* This is ok */
                context_offset = 0;
        } else if (in_context_offset < dyn_offset) {
-               return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+               return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
        } else {
                context_offset = in_context_offset - dyn_offset;
        }
 
-       if (context_offset > req->in.vector[i+2].iov_len) {
-               return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+       if (context_offset > smb2req->in.vector[i+2].iov_len) {
+               return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
        }
 
-       context_available_length = req->in.vector[i+2].iov_len - context_offset;
+       context_available_length = smb2req->in.vector[i+2].iov_len - context_offset;
 
        if (in_context_length > context_available_length) {
-               return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+               return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
        }
 
-       in_context_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base +
+       in_context_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base +
                                  context_offset;
        in_context_buffer.length = in_context_length;
 
@@ -163,24 +204,32 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *req)
         * Now interpret the name and context buffers
         */
 
-       ok = convert_string_talloc(req, CH_UTF16, CH_UNIX,
+       ok = convert_string_talloc(smb2req, CH_UTF16, CH_UNIX,
                                   in_name_buffer.data,
                                   in_name_buffer.length,
                                   &in_name_string,
-                                  &in_name_string_size, false);
+                                  &in_name_string_size);
        if (!ok) {
-               return smbd_smb2_request_error(req, NT_STATUS_ILLEGAL_CHARACTER);
+               return smbd_smb2_request_error(smb2req, NT_STATUS_ILLEGAL_CHARACTER);
+       }
+
+       if (in_name_buffer.length == 0) {
+               in_name_string_size = 0;
+       }
+
+       if (strlen(in_name_string) != in_name_string_size) {
+               return smbd_smb2_request_error(smb2req, NT_STATUS_OBJECT_NAME_INVALID);
        }
 
        ZERO_STRUCT(in_context_blobs);
-       status = smb2_create_blob_parse(req, in_context_buffer, &in_context_blobs);
+       status = smb2_create_blob_parse(smb2req, in_context_buffer, &in_context_blobs);
        if (!NT_STATUS_IS_OK(status)) {
-               return smbd_smb2_request_error(req, status);
+               return smbd_smb2_request_error(smb2req, status);
        }
 
-       subreq = smbd_smb2_create_send(req,
-                                      req->sconn->smb2.event_ctx,
-                                      req,
+       tsubreq = smbd_smb2_create_send(smb2req,
+                                      smb2req->sconn->ev_ctx,
+                                      smb2req,
                                       in_oplock_level,
                                       in_impersonation_level,
                                       in_desired_access,
@@ -190,19 +239,32 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *req)
                                       in_create_options,
                                       in_name_string,
                                       in_context_blobs);
-       if (subreq == NULL) {
-               return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
+       if (tsubreq == NULL) {
+               smb2req->subreq = NULL;
+               return smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
        }
-       tevent_req_set_callback(subreq, smbd_smb2_request_create_done, req);
+       tevent_req_set_callback(tsubreq, smbd_smb2_request_create_done, smb2req);
+
+       /*
+        * For now we keep the logic that we do not send STATUS_PENDING
+        * for sharing violations, so we just wait 2 seconds.
+        *
+        * TODO: we need more tests for this.
+        */
+       return smbd_smb2_request_pending_queue(smb2req, tsubreq, 2000000);
+}
 
-       return smbd_smb2_request_pending_queue(req, subreq);
+static uint64_t get_mid_from_smb2req(struct smbd_smb2_request *smb2req)
+{
+       uint8_t *reqhdr = (uint8_t *)smb2req->out.vector[smb2req->current_idx].iov_base;
+       return BVAL(reqhdr, SMB2_HDR_MESSAGE_ID);
 }
 
-static void smbd_smb2_request_create_done(struct tevent_req *subreq)
+static void smbd_smb2_request_create_done(struct tevent_req *tsubreq)
 {
-       struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
+       struct smbd_smb2_request *smb2req = tevent_req_callback_data(tsubreq,
                                        struct smbd_smb2_request);
-       int i = req->current_idx;
+       int i = smb2req->current_idx;
        uint8_t *outhdr;
        DATA_BLOB outbody;
        DATA_BLOB outdyn;
@@ -215,6 +277,7 @@ static void smbd_smb2_request_create_done(struct tevent_req *subreq)
        uint64_t out_allocation_size = 0;
        uint64_t out_end_of_file = 0;
        uint32_t out_file_attributes = 0;
+       uint64_t out_file_id_persistent = 0;
        uint64_t out_file_id_volatile = 0;
        struct smb2_create_blobs out_context_blobs;
        DATA_BLOB out_context_buffer;
@@ -222,8 +285,21 @@ static void smbd_smb2_request_create_done(struct tevent_req *subreq)
        NTSTATUS status;
        NTSTATUS error; /* transport error */
 
-       status = smbd_smb2_create_recv(subreq,
-                                      req,
+       if (smb2req->cancelled) {
+               uint64_t mid = get_mid_from_smb2req(smb2req);
+               DEBUG(10,("smbd_smb2_request_create_done: cancelled mid %llu\n",
+                       (unsigned long long)mid ));
+               error = smbd_smb2_request_error(smb2req, NT_STATUS_CANCELLED);
+               if (!NT_STATUS_IS_OK(error)) {
+                       smbd_server_connection_terminate(smb2req->sconn,
+                               nt_errstr(error));
+                       return;
+               }
+               return;
+       }
+
+       status = smbd_smb2_create_recv(tsubreq,
+                                      smb2req,
                                       &out_oplock_level,
                                       &out_create_action,
                                       &out_creation_time,
@@ -233,24 +309,24 @@ static void smbd_smb2_request_create_done(struct tevent_req *subreq)
                                       &out_allocation_size,
                                       &out_end_of_file,
                                       &out_file_attributes,
+                                      &out_file_id_persistent,
                                       &out_file_id_volatile,
                                       &out_context_blobs);
-       TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               error = smbd_smb2_request_error(req, status);
+               error = smbd_smb2_request_error(smb2req, status);
                if (!NT_STATUS_IS_OK(error)) {
-                       smbd_server_connection_terminate(req->sconn,
+                       smbd_server_connection_terminate(smb2req->sconn,
                                                         nt_errstr(error));
                        return;
                }
                return;
        }
 
-       status = smb2_create_blob_push(req, &out_context_buffer, out_context_blobs);
+       status = smb2_create_blob_push(smb2req, &out_context_buffer, out_context_blobs);
        if (!NT_STATUS_IS_OK(status)) {
-               error = smbd_smb2_request_error(req, status);
+               error = smbd_smb2_request_error(smb2req, status);
                if (!NT_STATUS_IS_OK(error)) {
-                       smbd_server_connection_terminate(req->sconn,
+                       smbd_server_connection_terminate(smb2req->sconn,
                                                         nt_errstr(error));
                        return;
                }
@@ -261,13 +337,13 @@ static void smbd_smb2_request_create_done(struct tevent_req *subreq)
                out_context_buffer_offset = SMB2_HDR_BODY + 0x58;
        }
 
-       outhdr = (uint8_t *)req->out.vector[i].iov_base;
+       outhdr = (uint8_t *)smb2req->out.vector[i].iov_base;
 
-       outbody = data_blob_talloc(req->out.vector, NULL, 0x58);
+       outbody = data_blob_talloc(smb2req->out.vector, NULL, 0x58);
        if (outbody.data == NULL) {
-               error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
+               error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
                if (!NT_STATUS_IS_OK(error)) {
-                       smbd_server_connection_terminate(req->sconn,
+                       smbd_server_connection_terminate(smb2req->sconn,
                                                         nt_errstr(error));
                        return;
                }
@@ -295,7 +371,8 @@ static void smbd_smb2_request_create_done(struct tevent_req *subreq)
        SIVAL(outbody.data, 0x38,
              out_file_attributes);             /* file attributes */
        SIVAL(outbody.data, 0x3C, 0);           /* reserved */
-       SBVAL(outbody.data, 0x40, 0);           /* file id (persistent) */
+       SBVAL(outbody.data, 0x40,
+             out_file_id_persistent);          /* file id (persistent) */
        SBVAL(outbody.data, 0x48,
              out_file_id_volatile);            /* file id (volatile) */
        SIVAL(outbody.data, 0x50,
@@ -305,9 +382,9 @@ static void smbd_smb2_request_create_done(struct tevent_req *subreq)
 
        outdyn = out_context_buffer;
 
-       error = smbd_smb2_request_done(req, outbody, &outdyn);
+       error = smbd_smb2_request_done(smb2req, outbody, &outdyn);
        if (!NT_STATUS_IS_OK(error)) {
-               smbd_server_connection_terminate(req->sconn,
+               smbd_server_connection_terminate(smb2req->sconn,
                                                 nt_errstr(error));
                return;
        }
@@ -315,6 +392,12 @@ static void smbd_smb2_request_create_done(struct tevent_req *subreq)
 
 struct smbd_smb2_create_state {
        struct smbd_smb2_request *smb2req;
+       struct smb_request *smb1req;
+       struct timed_event *te;
+       struct tevent_immediate *im;
+       struct timeval request_time;
+       struct file_id id;
+       DATA_BLOB private_data;
        uint8_t out_oplock_level;
        uint32_t out_create_action;
        NTTIME out_creation_time;
@@ -324,6 +407,7 @@ struct smbd_smb2_create_state {
        uint64_t out_allocation_size;
        uint64_t out_end_of_file;
        uint32_t out_file_attributes;
+       uint64_t out_file_id_persistent;
        uint64_t out_file_id_volatile;
        struct smb2_create_blobs out_context_blobs;
 };
@@ -341,33 +425,52 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        const char *in_name,
                        struct smb2_create_blobs in_context_blobs)
 {
-       struct tevent_req *req;
-       struct smbd_smb2_create_state *state;
+       struct tevent_req *req = NULL;
+       struct smbd_smb2_create_state *state = NULL;
        NTSTATUS status;
-       struct smb_request *smbreq;
-       files_struct *result;
+       struct smb_request *smb1req = NULL;
+       files_struct *result = NULL;
        int info;
-       SMB_STRUCT_STAT sbuf;
+       struct timespec write_time_ts;
        struct smb2_create_blobs out_context_blobs;
+       int requested_oplock_level;
 
        ZERO_STRUCT(out_context_blobs);
 
-       req = tevent_req_create(mem_ctx, &state,
-                               struct smbd_smb2_create_state);
-       if (req == NULL) {
-               return NULL;
+       if(lp_fake_oplocks(SNUM(smb2req->tcon->compat_conn))) {
+               requested_oplock_level = SMB2_OPLOCK_LEVEL_NONE;
+       } else {
+               requested_oplock_level = in_oplock_level;
        }
-       state->smb2req = smb2req;
 
-       DEBUG(10,("smbd_smb2_create: name[%s]\n",
-                 in_name));
 
-       smbreq = smbd_smb2_fake_smb_request(smb2req);
-       if (tevent_req_nomem(smbreq, req)) {
-               return tevent_req_post(req, ev);
+       if (smb2req->subreq == NULL) {
+               /* New create call. */
+               req = tevent_req_create(mem_ctx, &state,
+                               struct smbd_smb2_create_state);
+               if (req == NULL) {
+                       return NULL;
+               }
+               state->smb2req = smb2req;
+
+               smb1req = smbd_smb2_fake_smb_request(smb2req);
+               if (tevent_req_nomem(smb1req, req)) {
+                       return tevent_req_post(req, ev);
+               }
+               state->smb1req = smb1req;
+               DEBUG(10,("smbd_smb2_create: name[%s]\n",
+                       in_name));
+       } else {
+               /* Re-entrant create call. */
+               req = smb2req->subreq;
+               state = tevent_req_data(req,
+                               struct smbd_smb2_create_state);
+               smb1req = state->smb1req;
+               DEBUG(10,("smbd_smb2_create_send: reentrant for file %s\n",
+                       in_name ));
        }
 
-       if (IS_IPC(smbreq->conn)) {
+       if (IS_IPC(smb1req->conn)) {
                const char *pipe_name = in_name;
 
                if (!lp_nt_pipe_support()) {
@@ -380,28 +483,23 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        pipe_name++;
                }
 
-               status = open_np_file(smbreq, pipe_name, &result);
+               status = open_np_file(smb1req, pipe_name, &result);
                if (!NT_STATUS_IS_OK(status)) {
                        tevent_req_nterror(req, status);
                        return tevent_req_post(req, ev);
                }
                info = FILE_WAS_OPENED;
-               ZERO_STRUCT(sbuf);
-       } else if (CAN_PRINT(smbreq->conn)) {
-               status = file_new(smbreq, smbreq->conn, &result);
+       } else if (CAN_PRINT(smb1req->conn)) {
+               status = file_new(smb1req, smb1req->conn, &result);
                if(!NT_STATUS_IS_OK(status)) {
                        tevent_req_nterror(req, status);
                        return tevent_req_post(req, ev);
                }
 
-               status = print_fsp_open(smbreq,
-                                       smbreq->conn,
-                                       in_name,
-                                       smbreq->vuid,
-                                       result,
-                                       &sbuf);
+               status = print_spool_open(result, in_name,
+                                         smb1req->vuid);
                if (!NT_STATUS_IS_OK(status)) {
-                       file_free(smbreq, result);
+                       file_free(smb1req, result);
                        tevent_req_nterror(req, status);
                        return tevent_req_post(req, ev);
                }
@@ -446,7 +544,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 
                if (exta) {
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req,NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -461,7 +559,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 
                if (mxac) {
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -479,7 +577,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        enum ndr_err_code ndr_err;
 
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -489,7 +587,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        }
 
                        ndr_err = ndr_pull_struct_blob(&secd->data,
-                               sec_desc, NULL, sec_desc,
+                               sec_desc, sec_desc,
                                (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
                        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                                DEBUG(2,("ndr_pull_security_descriptor failed: %s\n",
@@ -501,7 +599,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 
                if (dhnq) {
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -527,7 +625,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 
                if (alsi) {
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -544,7 +642,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        struct tm *tm;
 
                        if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                return tevent_req_post(req, ev);
                        }
 
@@ -583,16 +681,23 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                in_create_options &= ~(0x10);/* NTCREATEX_OPTIONS_SYNC_ALERT */
                in_create_options &= ~(0x20);/* NTCREATEX_OPTIONS_ASYNC_ALERT */
 
-               /* convert '\\' into '/' */
-               status = check_path_syntax(fname);
-               if (!NT_STATUS_IS_OK(status)) {
-                       tevent_req_nterror(req, status);
-                       return tevent_req_post(req, ev);
+                /*
+                * For a DFS path the function parse_dfs_path()
+                * will do the path processing.
+                */
+
+               if (!(smb1req->flags2 & FLAGS2_DFS_PATHNAMES)) {
+                       /* convert '\\' into '/' */
+                       status = check_path_syntax(fname);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               tevent_req_nterror(req, status);
+                               return tevent_req_post(req, ev);
+                       }
                }
 
                status = filename_convert(req,
-                                         smbreq->conn,
-                                         smbreq->flags2 & FLAGS2_DFS_PATHNAMES,
+                                         smb1req->conn,
+                                         smb1req->flags2 & FLAGS2_DFS_PATHNAMES,
                                          fname,
                                          0,
                                          NULL,
@@ -602,8 +707,10 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        return tevent_req_post(req, ev);
                }
 
-               status = SMB_VFS_CREATE_FILE(smbreq->conn,
-                                            smbreq,
+               in_file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
+
+               status = SMB_VFS_CREATE_FILE(smb1req->conn,
+                                            smb1req,
                                             0, /* root_dir_fid */
                                             smb_fname,
                                             in_desired_access,
@@ -611,13 +718,17 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                                             in_create_disposition,
                                             in_create_options,
                                             in_file_attributes,
-                                            0, /* oplock_request */
+                                            map_smb2_oplock_levels_to_samba(requested_oplock_level),
                                             allocation_size,
+                                            0, /* private_flags */
                                             sec_desc,
                                             ea_list,
                                             &result,
                                             &info);
                if (!NT_STATUS_IS_OK(status)) {
+                       if (open_was_deferred(smb1req->sconn, smb1req->mid)) {
+                               return req;
+                       }
                        tevent_req_nterror(req, status);
                        return tevent_req_post(req, ev);
                }
@@ -632,8 +743,13 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                                uint32_t max_access_granted;
                                DATA_BLOB blob = data_blob_const(p, sizeof(p));
 
-                               status = smbd_check_open_rights(smbreq->conn,
+                               status = smbd_calculate_access_mask(smb1req->conn,
                                                        result->fsp_name,
+                                                       /*
+                                                        * at this stage
+                                                        * it exists
+                                                        */
+                                                       true,
                                                        SEC_FLAG_MAXIMUM_ALLOWED,
                                                        &max_access_granted);
 
@@ -653,13 +769,18 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 
                if (qfid) {
                        uint8_t p[32];
+                       uint64_t file_index = get_FileIndex(result->conn,
+                                                       &result->fsp_name->st);
                        DATA_BLOB blob = data_blob_const(p, sizeof(p));
 
                        ZERO_STRUCT(p);
 
-                       /* TODO: maybe use result->file_id */
-                       SIVAL(p, 0, result->fsp_name->st.st_ex_ino);/* FileIndexLow */
-                       SIVAL(p, 4, result->fsp_name->st.st_ex_dev);/* FileIndexHigh */
+                       /* From conversations with Microsoft engineers at
+                          the MS plugfest. The first 8 bytes are the "volume index"
+                          == inode, the second 8 bytes are the "volume id",
+                          == dev. This will be updated in the SMB2 doc. */
+                       SBVAL(p, 0, file_index);
+                       SIVAL(p, 8, result->fsp_name->st.st_ex_dev);/* FileIndexHigh */
 
                        status = smb2_create_blob_add(state, &out_context_blobs,
                                                      SMB2_CREATE_TAG_QFID,
@@ -669,30 +790,50 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                                return tevent_req_post(req, ev);
                        }
                }
-
-               sbuf = result->fsp_name->st;
        }
 
-       smb2req->compat_chain_fsp = smbreq->chain_fsp;
+       smb2req->compat_chain_fsp = smb1req->chain_fsp;
+
+       if(lp_fake_oplocks(SNUM(smb2req->tcon->compat_conn))) {
+               state->out_oplock_level = in_oplock_level;
+       } else {
+               state->out_oplock_level = map_samba_oplock_levels_to_smb2(result->oplock_type);
+       }
 
-       state->out_oplock_level = 0;
        if ((in_create_disposition == FILE_SUPERSEDE)
            && (info == FILE_WAS_OVERWRITTEN)) {
                state->out_create_action = FILE_WAS_SUPERSEDED;
        } else {
                state->out_create_action = info;
        }
-       unix_timespec_to_nt_time(&state->out_creation_time, sbuf.st_ex_btime);
-       unix_timespec_to_nt_time(&state->out_last_access_time, sbuf.st_ex_atime);
-       unix_timespec_to_nt_time(&state->out_last_write_time,sbuf.st_ex_mtime);
-       unix_timespec_to_nt_time(&state->out_change_time, sbuf.st_ex_ctime);
-       state->out_allocation_size      = sbuf.st_ex_blksize * sbuf.st_ex_blocks;
-       state->out_end_of_file          = sbuf.st_ex_size;
-       state->out_file_attributes      = dos_mode(result->conn,
-                                                  result->fsp_name);
+       state->out_file_attributes = dos_mode(result->conn,
+                                          result->fsp_name);
+       /* Deal with other possible opens having a modified
+          write time. JRA. */
+       ZERO_STRUCT(write_time_ts);
+       get_file_infos(result->file_id, 0, NULL, &write_time_ts);
+       if (!null_timespec(write_time_ts)) {
+               update_stat_ex_mtime(&result->fsp_name->st, write_time_ts);
+       }
+
+       unix_timespec_to_nt_time(&state->out_creation_time,
+                       get_create_timespec(smb1req->conn, result,
+                                       result->fsp_name));
+       unix_timespec_to_nt_time(&state->out_last_access_time,
+                       result->fsp_name->st.st_ex_atime);
+       unix_timespec_to_nt_time(&state->out_last_write_time,
+                       result->fsp_name->st.st_ex_mtime);
+       unix_timespec_to_nt_time(&state->out_change_time,
+                       get_change_timespec(smb1req->conn, result,
+                                       result->fsp_name));
+       state->out_allocation_size =
+                       SMB_VFS_GET_ALLOC_SIZE(smb1req->conn, result,
+                                              &(result->fsp_name->st));
+       state->out_end_of_file = result->fsp_name->st.st_ex_size;
        if (state->out_file_attributes == 0) {
                state->out_file_attributes = FILE_ATTRIBUTE_NORMAL;
        }
+       state->out_file_id_persistent = result->fnum;
        state->out_file_id_volatile = result->fnum;
        state->out_context_blobs = out_context_blobs;
 
@@ -711,6 +852,7 @@ static NTSTATUS smbd_smb2_create_recv(struct tevent_req *req,
                        uint64_t *out_allocation_size,
                        uint64_t *out_end_of_file,
                        uint32_t *out_file_attributes,
+                       uint64_t *out_file_id_persistent,
                        uint64_t *out_file_id_volatile,
                        struct smb2_create_blobs *out_context_blobs)
 {
@@ -732,6 +874,7 @@ static NTSTATUS smbd_smb2_create_recv(struct tevent_req *req,
        *out_allocation_size    = state->out_allocation_size;
        *out_end_of_file        = state->out_end_of_file;
        *out_file_attributes    = state->out_file_attributes;
+       *out_file_id_persistent = state->out_file_id_persistent;
        *out_file_id_volatile   = state->out_file_id_volatile;
        *out_context_blobs      = state->out_context_blobs;
 
@@ -740,3 +883,350 @@ static NTSTATUS smbd_smb2_create_recv(struct tevent_req *req,
        tevent_req_received(req);
        return NT_STATUS_OK;
 }
+
+/*********************************************************
+ Code for dealing with deferred opens.
+*********************************************************/
+
+bool get_deferred_open_message_state_smb2(struct smbd_smb2_request *smb2req,
+                       struct timeval *p_request_time,
+                       void **pp_state)
+{
+       struct smbd_smb2_create_state *state = NULL;
+       struct tevent_req *req = NULL;
+
+       if (!smb2req) {
+               return false;
+       }
+       if (smb2req->subreq == NULL) {
+               return false;
+       }
+       req = smb2req->subreq;
+       if (!req) {
+               return false;
+       }
+       state = tevent_req_data(req, struct smbd_smb2_create_state);
+       if (!state) {
+               return false;
+       }
+       if (p_request_time) {
+               *p_request_time = state->request_time;
+       }
+       if (pp_state) {
+               *pp_state = (void *)state->private_data.data;
+       }
+       return true;
+}
+
+/*********************************************************
+ Re-process this call early - requested by message or
+ close.
+*********************************************************/
+
+static struct smbd_smb2_request *find_open_smb2req(
+       struct smbd_server_connection *sconn, uint64_t mid)
+{
+       struct smbd_smb2_request *smb2req;
+
+       for (smb2req = sconn->smb2.requests; smb2req; smb2req = smb2req->next) {
+               uint64_t message_id;
+               if (smb2req->subreq == NULL) {
+                       /* This message has been processed. */
+                       continue;
+               }
+               if (!tevent_req_is_in_progress(smb2req->subreq)) {
+                       /* This message has been processed. */
+                       continue;
+               }
+               message_id = get_mid_from_smb2req(smb2req);
+               if (message_id == mid) {
+                       return smb2req;
+               }
+       }
+       return NULL;
+}
+
+bool open_was_deferred_smb2(struct smbd_server_connection *sconn, uint64_t mid)
+{
+       struct smbd_smb2_create_state *state = NULL;
+       struct smbd_smb2_request *smb2req;
+
+       smb2req = find_open_smb2req(sconn, mid);
+
+       if (!smb2req) {
+               DEBUG(10,("open_was_deferred_smb2: mid %llu smb2req == NULL\n",
+                       (unsigned long long)mid));
+               return false;
+       }
+       if (!smb2req->subreq) {
+               return false;
+       }
+       if (!tevent_req_is_in_progress(smb2req->subreq)) {
+               return false;
+       }
+       state = tevent_req_data(smb2req->subreq,
+                       struct smbd_smb2_create_state);
+       if (!state) {
+               return false;
+       }
+       /* It's not in progress if there's no timeout event. */
+       if (!state->te) {
+               return false;
+       }
+
+       DEBUG(10,("open_was_deferred_smb2: mid = %llu\n",
+                       (unsigned long long)mid));
+
+       return true;
+}
+
+static void remove_deferred_open_message_smb2_internal(struct smbd_smb2_request *smb2req,
+                                                       uint64_t mid)
+{
+       struct smbd_smb2_create_state *state = NULL;
+
+       if (!smb2req->subreq) {
+               return;
+       }
+       if (!tevent_req_is_in_progress(smb2req->subreq)) {
+               return;
+       }
+       state = tevent_req_data(smb2req->subreq,
+                       struct smbd_smb2_create_state);
+       if (!state) {
+               return;
+       }
+
+       DEBUG(10,("remove_deferred_open_message_smb2_internal: "
+               "mid %llu\n",
+               (unsigned long long)mid ));
+
+       /* Ensure we don't have any outstanding timer event. */
+       TALLOC_FREE(state->te);
+       /* Ensure we don't have any outstanding immediate event. */
+       TALLOC_FREE(state->im);
+}
+
+void remove_deferred_open_message_smb2(
+       struct smbd_server_connection *sconn, uint64_t mid)
+{
+       struct smbd_smb2_request *smb2req;
+
+       smb2req = find_open_smb2req(sconn, mid);
+
+       if (!smb2req) {
+               DEBUG(10,("remove_deferred_open_message_smb2: "
+                       "can't find mid %llu\n",
+                       (unsigned long long)mid ));
+               return;
+       }
+       remove_deferred_open_message_smb2_internal(smb2req, mid);
+}
+
+static void smbd_smb2_create_request_dispatch_immediate(struct tevent_context *ctx,
+                                       struct tevent_immediate *im,
+                                       void *private_data)
+{
+       struct smbd_smb2_request *smb2req = talloc_get_type_abort(private_data,
+                                       struct smbd_smb2_request);
+       struct smbd_server_connection *sconn = smb2req->sconn;
+       uint64_t mid = get_mid_from_smb2req(smb2req);
+       NTSTATUS status;
+
+       DEBUG(10,("smbd_smb2_create_request_dispatch_immediate: "
+               "re-dispatching mid %llu\n",
+               (unsigned long long)mid ));
+
+       status = smbd_smb2_request_dispatch(smb2req);
+       if (!NT_STATUS_IS_OK(status)) {
+               smbd_server_connection_terminate(sconn, nt_errstr(status));
+               return;
+       }
+}
+
+void schedule_deferred_open_message_smb2(
+       struct smbd_server_connection *sconn, uint64_t mid)
+{
+       struct smbd_smb2_create_state *state = NULL;
+       struct smbd_smb2_request *smb2req;
+
+       smb2req = find_open_smb2req(sconn, mid);
+
+       if (!smb2req) {
+               DEBUG(10,("schedule_deferred_open_message_smb2: "
+                       "can't find mid %llu\n",
+                       (unsigned long long)mid ));
+               return;
+       }
+       if (!smb2req->subreq) {
+               return;
+       }
+       if (!tevent_req_is_in_progress(smb2req->subreq)) {
+               return;
+       }
+       state = tevent_req_data(smb2req->subreq,
+                       struct smbd_smb2_create_state);
+       if (!state) {
+               return;
+       }
+
+       /* Ensure we don't have any outstanding timer event. */
+       TALLOC_FREE(state->te);
+       /* Ensure we don't have any outstanding immediate event. */
+       TALLOC_FREE(state->im);
+
+       /*
+        * This is subtle. We must null out the callback
+        * before resheduling, else the first call to
+        * tevent_req_nterror() causes the _receive()
+        * function to be called, this causing tevent_req_post()
+        * to crash.
+        */
+       tevent_req_set_callback(smb2req->subreq, NULL, NULL);
+
+       state->im = tevent_create_immediate(smb2req);
+       if (!state->im) {
+               smbd_server_connection_terminate(smb2req->sconn,
+                       nt_errstr(NT_STATUS_NO_MEMORY));
+               return;
+       }
+
+       DEBUG(10,("schedule_deferred_open_message_smb2: "
+               "re-processing mid %llu\n",
+               (unsigned long long)mid ));
+
+       tevent_schedule_immediate(state->im,
+                       smb2req->sconn->ev_ctx,
+                       smbd_smb2_create_request_dispatch_immediate,
+                       smb2req);
+}
+
+/*********************************************************
+ Re-process this call.
+*********************************************************/
+
+static void smb2_deferred_open_timer(struct event_context *ev,
+                                       struct timed_event *te,
+                                       struct timeval _tval,
+                                       void *private_data)
+{
+       NTSTATUS status;
+       struct smbd_smb2_create_state *state = NULL;
+       struct smbd_smb2_request *smb2req = talloc_get_type(private_data,
+                                               struct smbd_smb2_request);
+
+       DEBUG(10,("smb2_deferred_open_timer: [idx=%d], %s\n",
+               smb2req->current_idx,
+               tevent_req_default_print(smb2req->subreq, talloc_tos()) ));
+
+       state = tevent_req_data(smb2req->subreq,
+                       struct smbd_smb2_create_state);
+       if (!state) {
+               return;
+       }
+       /*
+        * Null this out, don't talloc_free. It will
+        * be talloc_free'd by the tevent library when
+        * this returns.
+        */
+       state->te = NULL;
+       /* Ensure we don't have any outstanding immediate event. */
+       TALLOC_FREE(state->im);
+
+       /*
+        * This is subtle. We must null out the callback
+        * before resheduling, else the first call to
+        * tevent_req_nterror() causes the _receive()
+        * function to be called, this causing tevent_req_post()
+        * to crash.
+        */
+       tevent_req_set_callback(smb2req->subreq, NULL, NULL);
+
+       status = smbd_smb2_request_dispatch(smb2req);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               smbd_server_connection_terminate(smb2req->sconn,
+                               nt_errstr(status));
+       }
+}
+
+static bool smbd_smb2_create_cancel(struct tevent_req *req)
+{
+       struct smbd_smb2_request *smb2req = NULL;
+       struct smbd_smb2_create_state *state = tevent_req_data(req,
+                               struct smbd_smb2_create_state);
+       uint64_t mid;
+
+       if (!state) {
+               return false;
+       }
+
+       if (!state->smb2req) {
+               return false;
+       }
+
+       smb2req = state->smb2req;
+       mid = get_mid_from_smb2req(smb2req);
+
+       remove_deferred_open_entry(state->id, mid,
+                                  messaging_server_id(smb2req->sconn->msg_ctx));
+       remove_deferred_open_message_smb2_internal(smb2req, mid);
+       smb2req->cancelled = true;
+
+       tevent_req_done(req);
+       return true;
+}
+
+bool push_deferred_open_message_smb2(struct smbd_smb2_request *smb2req,
+                                struct timeval request_time,
+                                struct timeval timeout,
+                               struct file_id id,
+                                char *private_data,
+                                size_t priv_len)
+{
+       struct tevent_req *req = NULL;
+       struct smbd_smb2_create_state *state = NULL;
+       struct timeval end_time;
+
+       if (!smb2req) {
+               return false;
+       }
+       req = smb2req->subreq;
+       if (!req) {
+               return false;
+       }
+       state = tevent_req_data(req, struct smbd_smb2_create_state);
+       if (!state) {
+               return false;
+       }
+       state->id = id;
+       state->request_time = request_time;
+       state->private_data = data_blob_talloc(state, private_data,
+                                               priv_len);
+       if (!state->private_data.data) {
+               return false;
+       }
+
+       /* Re-schedule us to retry on timer expiry. */
+       end_time = timeval_sum(&request_time, &timeout);
+
+       DEBUG(10,("push_deferred_open_message_smb2: "
+               "timeout at %s\n",
+               timeval_string(talloc_tos(),
+                               &end_time,
+                               true) ));
+
+       state->te = tevent_add_timer(smb2req->sconn->ev_ctx,
+                               state,
+                               end_time,
+                               smb2_deferred_open_timer,
+                               smb2req);
+        if (!state->te) {
+               return false;
+       }
+
+       /* allow this request to be canceled */
+       tevent_req_set_cancel_fn(req, smbd_smb2_create_cancel);
+
+       return true;
+}