source3/smbd/open.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    file opening and share modes
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Jeremy Allison 2001-2004
   6    Copyright (C) Volker Lendecke 2005
   7    Copyright (C) Ralph Boehme 2017
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "smb1_utils.h"
  25 #include "system/filesys.h"
  26 #include "lib/util/server_id.h"
  27 #include "printing.h"
  28 #include "smbd/smbd.h"
  29 #include "smbd/globals.h"
  30 #include "fake_file.h"
  31 #include "../libcli/security/security.h"
  32 #include "../librpc/gen_ndr/ndr_security.h"
  33 #include "../librpc/gen_ndr/ndr_open_files.h"
  34 #include "../librpc/gen_ndr/idmap.h"
  35 #include "../librpc/gen_ndr/ioctl.h"
  36 #include "passdb/lookup_sid.h"
  37 #include "auth.h"
  38 #include "serverid.h"
  39 #include "messages.h"
  40 #include "source3/lib/dbwrap/dbwrap_watch.h"
  41 #include "locking/leases_db.h"
  42 #include "librpc/gen_ndr/ndr_leases_db.h"
  43 #include "lib/util/time_basic.h"
  44
  45 extern const struct generic_mapping file_generic_mapping;
  46
  47 struct deferred_open_record {
  48         struct smbXsrv_connection *xconn;
  49         uint64_t mid;
  50
  51         bool async_open;
  52
  53         /*
  54          * Timer for async opens, needed because they don't use a watch on
  55          * a locking.tdb record. This is currently only used for real async
  56          * opens and just terminates smbd if the async open times out.
  57          */
  58         struct tevent_timer *te;
  59
  60         /*
  61          * For the samba kernel oplock case we use both a timeout and
  62          * a watch on locking.tdb. This way in case it's smbd holding
  63          * the kernel oplock we get directly notified for the retry
  64          * once the kernel oplock is properly broken. Store the req
  65          * here so that it can be timely discarded once the timer
  66          * above fires.
  67          */
  68         struct tevent_req *watch_req;
  69 };
  70
  71 /****************************************************************************
  72  If the requester wanted DELETE_ACCESS and was rejected because
  73  the file ACL didn't include DELETE_ACCESS, see if the parent ACL
  74  overrides this.
  75 ****************************************************************************/
  76
  77 static bool parent_override_delete(connection_struct *conn,
  78                                         const struct smb_filename *smb_fname,
  79                                         uint32_t access_mask,
  80                                         uint32_t rejected_mask)
  81 {
  82         if ((access_mask & DELETE_ACCESS) &&
  83                     (rejected_mask & DELETE_ACCESS) &&
  84                     can_delete_file_in_directory(conn, smb_fname)) {
  85                 return true;
  86         }
  87         return false;
  88 }
  89
  90 /****************************************************************************
  91  Check if we have open rights.
  92 ****************************************************************************/
  93
  94 NTSTATUS smbd_check_access_rights(struct connection_struct *conn,
  95                                 const struct smb_filename *smb_fname,
  96                                 bool use_privs,
  97                                 uint32_t access_mask)
  98 {
  99         /* Check if we have rights to open. */
 100         NTSTATUS status;
 101         struct security_descriptor *sd = NULL;
 102         uint32_t rejected_share_access;
 103         uint32_t rejected_mask = access_mask;
 104         uint32_t do_not_check_mask = 0;
 105
 106         rejected_share_access = access_mask & ~(conn->share_access);
 107
 108         if (rejected_share_access) {
 109                 DEBUG(10, ("smbd_check_access_rights: rejected share access 0x%x "
 110                         "on %s (0x%x)\n",
 111                         (unsigned int)access_mask,
 112                         smb_fname_str_dbg(smb_fname),
 113                         (unsigned int)rejected_share_access ));
 114                 return NT_STATUS_ACCESS_DENIED;
 115         }
 116
 117         if (!use_privs && get_current_uid(conn) == (uid_t)0) {
 118                 /* I'm sorry sir, I didn't know you were root... */
 119                 DEBUG(10,("smbd_check_access_rights: root override "
 120                         "on %s. Granting 0x%x\n",
 121                         smb_fname_str_dbg(smb_fname),
 122                         (unsigned int)access_mask ));
 123                 return NT_STATUS_OK;
 124         }
 125
 126         if ((access_mask & DELETE_ACCESS) && !lp_acl_check_permissions(SNUM(conn))) {
 127                 DEBUG(10,("smbd_check_access_rights: not checking ACL "
 128                         "on DELETE_ACCESS on file %s. Granting 0x%x\n",
 129                         smb_fname_str_dbg(smb_fname),
 130                         (unsigned int)access_mask ));
 131                 return NT_STATUS_OK;
 132         }
 133
 134         if (access_mask == DELETE_ACCESS &&
 135                         VALID_STAT(smb_fname->st) &&
 136                         S_ISLNK(smb_fname->st.st_ex_mode)) {
 137                 /* We can always delete a symlink. */
 138                 DEBUG(10,("smbd_check_access_rights: not checking ACL "
 139                         "on DELETE_ACCESS on symlink %s.\n",
 140                         smb_fname_str_dbg(smb_fname) ));
 141                 return NT_STATUS_OK;
 142         }
 143
 144         status = SMB_VFS_GET_NT_ACL(conn, smb_fname,
 145                         (SECINFO_OWNER |
 146                         SECINFO_GROUP |
 147                          SECINFO_DACL), talloc_tos(), &sd);
 148
 149         if (!NT_STATUS_IS_OK(status)) {
 150                 DEBUG(10, ("smbd_check_access_rights: Could not get acl "
 151                         "on %s: %s\n",
 152                         smb_fname_str_dbg(smb_fname),
 153                         nt_errstr(status)));
 154
 155                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 156                         goto access_denied;
 157                 }
 158
 159                 return status;
 160         }
 161
 162         /*
 163          * If we can access the path to this file, by
 164          * default we have FILE_READ_ATTRIBUTES from the
 165          * containing directory. See the section:
 166          * "Algorithm to Check Access to an Existing File"
 167          * in MS-FSA.pdf.
 168          *
 169          * se_file_access_check() also takes care of
 170          * owner WRITE_DAC and READ_CONTROL.
 171          */
 172         do_not_check_mask = FILE_READ_ATTRIBUTES;
 173
 174         /*
 175          * Samba 3.6 and earlier granted execute access even
 176          * if the ACL did not contain execute rights.
 177          * Samba 4.0 is more correct and checks it.
 178          * The compatibilty mode allows one to skip this check
 179          * to smoothen upgrades.
 180          */
 181         if (lp_acl_allow_execute_always(SNUM(conn))) {
 182                 do_not_check_mask |= FILE_EXECUTE;
 183         }
 184
 185         status = se_file_access_check(sd,
 186                                 get_current_nttok(conn),
 187                                 use_privs,
 188                                 (access_mask & ~do_not_check_mask),
 189                                 &rejected_mask);
 190
 191         DEBUG(10,("smbd_check_access_rights: file %s requesting "
 192                 "0x%x returning 0x%x (%s)\n",
 193                 smb_fname_str_dbg(smb_fname),
 194                 (unsigned int)access_mask,
 195                 (unsigned int)rejected_mask,
 196                 nt_errstr(status) ));
 197
 198         if (!NT_STATUS_IS_OK(status)) {
 199                 if (DEBUGLEVEL >= 10) {
 200                         DEBUG(10,("smbd_check_access_rights: acl for %s is:\n",
 201                                 smb_fname_str_dbg(smb_fname) ));
 202                         NDR_PRINT_DEBUG(security_descriptor, sd);
 203                 }
 204         }
 205
 206         TALLOC_FREE(sd);
 207
 208         if (NT_STATUS_IS_OK(status) ||
 209                         !NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 210                 return status;
 211         }
 212
 213         /* Here we know status == NT_STATUS_ACCESS_DENIED. */
 214
 215   access_denied:
 216
 217         if ((access_mask & FILE_WRITE_ATTRIBUTES) &&
 218                         (rejected_mask & FILE_WRITE_ATTRIBUTES) &&
 219                         !lp_store_dos_attributes(SNUM(conn)) &&
 220                         (lp_map_readonly(SNUM(conn)) ||
 221                         lp_map_archive(SNUM(conn)) ||
 222                         lp_map_hidden(SNUM(conn)) ||
 223                         lp_map_system(SNUM(conn)))) {
 224                 rejected_mask &= ~FILE_WRITE_ATTRIBUTES;
 225
 226                 DEBUG(10,("smbd_check_access_rights: "
 227                         "overrode "
 228                         "FILE_WRITE_ATTRIBUTES "
 229                         "on file %s\n",
 230                         smb_fname_str_dbg(smb_fname)));
 231         }
 232
 233         if (parent_override_delete(conn,
 234                                 smb_fname,
 235                                 access_mask,
 236                                 rejected_mask)) {
 237                 /* Were we trying to do an open
 238                  * for delete and didn't get DELETE
 239                  * access (only) ? Check if the
 240                  * directory allows DELETE_CHILD.
 241                  * See here:
 242                  * http://blogs.msdn.com/oldnewthing/archive/2004/06/04/148426.aspx
 243                  * for details. */
 244
 245                 rejected_mask &= ~DELETE_ACCESS;
 246
 247                 DEBUG(10,("smbd_check_access_rights: "
 248                         "overrode "
 249                         "DELETE_ACCESS on "
 250                         "file %s\n",
 251                         smb_fname_str_dbg(smb_fname)));
 252         }
 253
 254         if (rejected_mask != 0) {
 255                 return NT_STATUS_ACCESS_DENIED;
 256         }
 257         return NT_STATUS_OK;
 258 }
 259
 260 NTSTATUS check_parent_access(struct connection_struct *conn,
 261                                 struct smb_filename *smb_fname,
 262                                 uint32_t access_mask)
 263 {
 264         NTSTATUS status;
 265         char *parent_dir = NULL;
 266         struct security_descriptor *parent_sd = NULL;
 267         uint32_t access_granted = 0;
 268         struct smb_filename *parent_smb_fname = NULL;
 269         struct share_mode_lock *lck = NULL;
 270         struct file_id id = {0};
 271         uint32_t name_hash;
 272         bool delete_on_close_set;
 273         int ret;
 274         TALLOC_CTX *frame = talloc_stackframe();
 275
 276         if (!parent_dirname(frame,
 277                                 smb_fname->base_name,
 278                                 &parent_dir,
 279                                 NULL)) {
 280                 status = NT_STATUS_NO_MEMORY;
 281                 goto out;
 282         }
 283
 284         parent_smb_fname = synthetic_smb_fname(frame,
 285                                 parent_dir,
 286                                 NULL,
 287                                 NULL,
 288                                 smb_fname->flags);
 289         if (parent_smb_fname == NULL) {
 290                 status = NT_STATUS_NO_MEMORY;
 291                 goto out;
 292         }
 293
 294         if (get_current_uid(conn) == (uid_t)0) {
 295                 /* I'm sorry sir, I didn't know you were root... */
 296                 DEBUG(10,("check_parent_access: root override "
 297                         "on %s. Granting 0x%x\n",
 298                         smb_fname_str_dbg(smb_fname),
 299                         (unsigned int)access_mask ));
 300                 status = NT_STATUS_OK;
 301                 goto out;
 302         }
 303
 304         status = SMB_VFS_GET_NT_ACL(conn,
 305                                 parent_smb_fname,
 306                                 SECINFO_DACL,
 307                                 frame,
 308                                 &parent_sd);
 309
 310         if (!NT_STATUS_IS_OK(status)) {
 311                 DEBUG(5,("check_parent_access: SMB_VFS_GET_NT_ACL failed for "
 312                         "%s with error %s\n",
 313                         parent_dir,
 314                         nt_errstr(status)));
 315                 goto out;
 316         }
 317
 318         /*
 319          * If we can access the path to this file, by
 320          * default we have FILE_READ_ATTRIBUTES from the
 321          * containing directory. See the section:
 322          * "Algorithm to Check Access to an Existing File"
 323          * in MS-FSA.pdf.
 324          *
 325          * se_file_access_check() also takes care of
 326          * owner WRITE_DAC and READ_CONTROL.
 327          */
 328         status = se_file_access_check(parent_sd,
 329                                 get_current_nttok(conn),
 330                                 false,
 331                                 (access_mask & ~FILE_READ_ATTRIBUTES),
 332                                 &access_granted);
 333         if(!NT_STATUS_IS_OK(status)) {
 334                 DEBUG(5,("check_parent_access: access check "
 335                         "on directory %s for "
 336                         "path %s for mask 0x%x returned (0x%x) %s\n",
 337                         parent_dir,
 338                         smb_fname->base_name,
 339                         access_mask,
 340                         access_granted,
 341                         nt_errstr(status) ));
 342                 goto out;
 343         }
 344
 345         if (!(access_mask & (SEC_DIR_ADD_FILE | SEC_DIR_ADD_SUBDIR))) {
 346                 status = NT_STATUS_OK;
 347                 goto out;
 348         }
 349         if (!lp_check_parent_directory_delete_on_close(SNUM(conn))) {
 350                 status = NT_STATUS_OK;
 351                 goto out;
 352         }
 353
 354         /* Check if the directory has delete-on-close set */
 355         ret = SMB_VFS_STAT(conn, parent_smb_fname);
 356         if (ret != 0) {
 357                 status = map_nt_error_from_unix(errno);
 358                 goto out;
 359         }
 360
 361         id = SMB_VFS_FILE_ID_CREATE(conn, &parent_smb_fname->st);
 362
 363         status = file_name_hash(conn, parent_smb_fname->base_name, &name_hash);
 364         if (!NT_STATUS_IS_OK(status)) {
 365                 goto out;
 366         }
 367
 368         lck = get_existing_share_mode_lock(frame, id);
 369         if (lck == NULL) {
 370                 status = NT_STATUS_OK;
 371                 goto out;
 372         }
 373
 374         delete_on_close_set = is_delete_on_close_set(lck, name_hash);
 375         if (delete_on_close_set) {
 376                 status = NT_STATUS_DELETE_PENDING;
 377                 goto out;
 378         }
 379
 380         status = NT_STATUS_OK;
 381
 382 out:
 383         TALLOC_FREE(frame);
 384         return status;
 385 }
 386
 387 /****************************************************************************
 388  Ensure when opening a base file for a stream open that we have permissions
 389  to do so given the access mask on the base file.
 390 ****************************************************************************/
 391
 392 static NTSTATUS check_base_file_access(struct connection_struct *conn,
 393                                 struct smb_filename *smb_fname,
 394                                 uint32_t access_mask)
 395 {
 396         NTSTATUS status;
 397
 398         status = smbd_calculate_access_mask(conn, smb_fname,
 399                                         false,
 400                                         access_mask,
 401                                         &access_mask);
 402         if (!NT_STATUS_IS_OK(status)) {
 403                 DEBUG(10, ("smbd_calculate_access_mask "
 404                         "on file %s returned %s\n",
 405                         smb_fname_str_dbg(smb_fname),
 406                         nt_errstr(status)));
 407                 return status;
 408         }
 409
 410         if (access_mask & (FILE_WRITE_DATA|FILE_APPEND_DATA)) {
 411                 uint32_t dosattrs;
 412                 if (!CAN_WRITE(conn)) {
 413                         return NT_STATUS_ACCESS_DENIED;
 414                 }
 415                 dosattrs = dos_mode(conn, smb_fname);
 416                 if (IS_DOS_READONLY(dosattrs)) {
 417                         return NT_STATUS_ACCESS_DENIED;
 418                 }
 419         }
 420
 421         return smbd_check_access_rights(conn,
 422                                         smb_fname,
 423                                         false,
 424                                         access_mask);
 425 }
 426
 427 /****************************************************************************
 428  Handle differing symlink errno's
 429 ****************************************************************************/
 430
 431 static int link_errno_convert(int err)
 432 {
 433 #if defined(ENOTSUP) && defined(OSF1)
 434         /* handle special Tru64 errno */
 435         if (err == ENOTSUP) {
 436                 err = ELOOP;
 437         }
 438 #endif /* ENOTSUP */
 439 #ifdef EFTYPE
 440         /* fix broken NetBSD errno */
 441         if (err == EFTYPE) {
 442                 err = ELOOP;
 443         }
 444 #endif /* EFTYPE */
 445         /* fix broken FreeBSD errno */
 446         if (err == EMLINK) {
 447                 err = ELOOP;
 448         }
 449         return err;
 450 }
 451
 452 static int non_widelink_open(struct connection_struct *conn,
 453                         const struct smb_filename *conn_rootdir_fname,
 454                         files_struct *fsp,
 455                         struct smb_filename *smb_fname,
 456                         int flags,
 457                         mode_t mode,
 458                         unsigned int link_depth);
 459
 460 /****************************************************************************
 461  Follow a symlink in userspace.
 462 ****************************************************************************/
 463
 464 static int process_symlink_open(struct connection_struct *conn,
 465                         const struct smb_filename *conn_rootdir_fname,
 466                         files_struct *fsp,
 467                         struct smb_filename *smb_fname,
 468                         int flags,
 469                         mode_t mode,
 470                         unsigned int link_depth)
 471 {
 472         int fd = -1;
 473         char *link_target = NULL;
 474         struct smb_filename target_fname = {0};
 475         int link_len = -1;
 476         struct smb_filename *oldwd_fname = NULL;
 477         size_t rootdir_len = 0;
 478         struct smb_filename *resolved_fname = NULL;
 479         char *resolved_name = NULL;
 480         bool matched = false;
 481         int saved_errno = 0;
 482
 483         /*
 484          * Ensure we don't get stuck in a symlink loop.
 485          */
 486         link_depth++;
 487         if (link_depth >= 20) {
 488                 errno = ELOOP;
 489                 goto out;
 490         }
 491
 492         /* Allocate space for the link target. */
 493         link_target = talloc_array(talloc_tos(), char, PATH_MAX);
 494         if (link_target == NULL) {
 495                 errno = ENOMEM;
 496                 goto out;
 497         }
 498
 499         /* Read the link target. */
 500         link_len = SMB_VFS_READLINKAT(conn,
 501                                 conn->cwd_fsp,
 502                                 smb_fname,
 503                                 link_target,
 504                                 PATH_MAX - 1);
 505         if (link_len == -1) {
 506                 goto out;
 507         }
 508
 509         /* Ensure it's at least null terminated. */
 510         link_target[link_len] = '\0';
 511         target_fname = (struct smb_filename){ .base_name = link_target };
 512
 513         /* Convert to an absolute path. */
 514         resolved_fname = SMB_VFS_REALPATH(conn, talloc_tos(), &target_fname);
 515         if (resolved_fname == NULL) {
 516                 goto out;
 517         }
 518         resolved_name = resolved_fname->base_name;
 519
 520         /*
 521          * We know conn_rootdir starts with '/' and
 522          * does not end in '/'. FIXME ! Should we
 523          * smb_assert this ?
 524          */
 525         rootdir_len = strlen(conn_rootdir_fname->base_name);
 526
 527         matched = (strncmp(conn_rootdir_fname->base_name,
 528                                 resolved_name,
 529                                 rootdir_len) == 0);
 530         if (!matched) {
 531                 errno = EACCES;
 532                 goto out;
 533         }
 534
 535         /*
 536          * Turn into a path relative to the share root.
 537          */
 538         if (resolved_name[rootdir_len] == '\0') {
 539                 /* Link to the root of the share. */
 540                 TALLOC_FREE(smb_fname->base_name);
 541                 smb_fname->base_name = talloc_strdup(smb_fname, ".");
 542         } else if (resolved_name[rootdir_len] == '/') {
 543                 TALLOC_FREE(smb_fname->base_name);
 544                 smb_fname->base_name = talloc_strdup(smb_fname,
 545                                         &resolved_name[rootdir_len+1]);
 546         } else {
 547                 errno = EACCES;
 548                 goto out;
 549         }
 550
 551         if (smb_fname->base_name == NULL) {
 552                 errno = ENOMEM;
 553                 goto out;
 554         }
 555
 556         oldwd_fname = vfs_GetWd(talloc_tos(), conn);
 557         if (oldwd_fname == NULL) {
 558                 goto out;
 559         }
 560
 561         /* Ensure we operate from the root of the share. */
 562         if (vfs_ChDir(conn, conn_rootdir_fname) == -1) {
 563                 goto out;
 564         }
 565
 566         /* And do it all again.. */
 567         fd = non_widelink_open(conn,
 568                                 conn_rootdir_fname,
 569                                 fsp,
 570                                 smb_fname,
 571                                 flags,
 572                                 mode,
 573                                 link_depth);
 574         if (fd == -1) {
 575                 saved_errno = errno;
 576         }
 577
 578   out:
 579
 580         TALLOC_FREE(resolved_fname);
 581         TALLOC_FREE(link_target);
 582         if (oldwd_fname != NULL) {
 583                 int ret = vfs_ChDir(conn, oldwd_fname);
 584                 if (ret == -1) {
 585                         smb_panic("unable to get back to old directory\n");
 586                 }
 587                 TALLOC_FREE(oldwd_fname);
 588         }
 589         if (saved_errno != 0) {
 590                 errno = saved_errno;
 591         }
 592         return fd;
 593 }
 594
 595 /****************************************************************************
 596  Non-widelink open.
 597 ****************************************************************************/
 598
 599 static int non_widelink_open(struct connection_struct *conn,
 600                         const struct smb_filename *conn_rootdir_fname,
 601                         files_struct *fsp,
 602                         struct smb_filename *smb_fname,
 603                         int flags,
 604                         mode_t mode,
 605                         unsigned int link_depth)
 606 {
 607         NTSTATUS status;
 608         int fd = -1;
 609         struct smb_filename *smb_fname_rel = NULL;
 610         int saved_errno = 0;
 611         struct smb_filename *oldwd_fname = NULL;
 612         char *parent_dir = NULL;
 613         struct smb_filename parent_dir_fname = {0};
 614         const char *final_component = NULL;
 615         bool is_directory = false;
 616         bool ok;
 617
 618 #ifdef O_DIRECTORY
 619         if (flags & O_DIRECTORY) {
 620                 is_directory = true;
 621         }
 622 #endif
 623
 624         if (is_directory) {
 625                 parent_dir = talloc_strdup(talloc_tos(), smb_fname->base_name);
 626                 if (parent_dir == NULL) {
 627                         saved_errno = errno;
 628                         goto out;
 629                 }
 630
 631                 final_component = ".";
 632         } else {
 633                 ok = parent_dirname(talloc_tos(),
 634                                     smb_fname->base_name,
 635                                     &parent_dir,
 636                                     &final_component);
 637                 if (!ok) {
 638                         saved_errno = errno;
 639                         goto out;
 640                 }
 641         }
 642
 643         parent_dir_fname = (struct smb_filename) { .base_name = parent_dir };
 644
 645         oldwd_fname = vfs_GetWd(talloc_tos(), conn);
 646         if (oldwd_fname == NULL) {
 647                 goto out;
 648         }
 649
 650         /* Pin parent directory in place. */
 651         if (vfs_ChDir(conn, &parent_dir_fname) == -1) {
 652                 goto out;
 653         }
 654
 655         smb_fname_rel = synthetic_smb_fname(talloc_tos(),
 656                                 final_component,
 657                                 smb_fname->stream_name,
 658                                 &smb_fname->st,
 659                                 smb_fname->flags);
 660         if (smb_fname_rel == NULL) {
 661                 saved_errno = ENOMEM;
 662                 goto out;
 663         }
 664
 665         /* Ensure the relative path is below the share. */
 666         status = check_reduced_name(conn, &parent_dir_fname, smb_fname_rel);
 667         if (!NT_STATUS_IS_OK(status)) {
 668                 saved_errno = map_errno_from_nt_status(status);
 669                 goto out;
 670         }
 671
 672         flags |= O_NOFOLLOW;
 673
 674         {
 675                 struct smb_filename *tmp_name = fsp->fsp_name;
 676                 fsp->fsp_name = smb_fname_rel;
 677                 fd = SMB_VFS_OPEN(conn, smb_fname_rel, fsp, flags, mode);
 678                 fsp->fsp_name = tmp_name;
 679         }
 680
 681         if (fd == -1) {
 682                 saved_errno = link_errno_convert(errno);
 683                 /*
 684                  * Trying to open a symlink to a directory with O_NOFOLLOW and
 685                  * O_DIRECTORY can return either of ELOOP and ENOTDIR. So
 686                  * ENOTDIR really means: might be a symlink, but we're not sure.
 687                  * In this case, we just assume there's a symlink. If we were
 688                  * wrong, process_symlink_open() will return EINVAL. We check
 689                  * this below, and fall back to returning the initial
 690                  * saved_errno.
 691                  *
 692                  * BUG: https://bugzilla.samba.org/show_bug.cgi?id=12860
 693                  */
 694                 if (saved_errno == ELOOP || saved_errno == ENOTDIR) {
 695                         if (fsp->posix_flags & FSP_POSIX_FLAGS_OPEN) {
 696                                 /* Never follow symlinks on posix open. */
 697                                 goto out;
 698                         }
 699                         if (!lp_follow_symlinks(SNUM(conn))) {
 700                                 /* Explicitly no symlinks. */
 701                                 goto out;
 702                         }
 703                         /*
 704                          * We may have a symlink. Follow in userspace
 705                          * to ensure it's under the share definition.
 706                          */
 707                         fd = process_symlink_open(conn,
 708                                         conn_rootdir_fname,
 709                                         fsp,
 710                                         smb_fname_rel,
 711                                         flags,
 712                                         mode,
 713                                         link_depth);
 714                         if (fd == -1) {
 715                                 if (saved_errno == ENOTDIR &&
 716                                                 errno == EINVAL) {
 717                                         /*
 718                                          * O_DIRECTORY on neither a directory,
 719                                          * nor a symlink. Just return
 720                                          * saved_errno from initial open()
 721                                          */
 722                                         goto out;
 723                                 }
 724                                 saved_errno =
 725                                         link_errno_convert(errno);
 726                         }
 727                 }
 728         }
 729
 730   out:
 731
 732         TALLOC_FREE(parent_dir);
 733         TALLOC_FREE(smb_fname_rel);
 734
 735         if (oldwd_fname != NULL) {
 736                 int ret = vfs_ChDir(conn, oldwd_fname);
 737                 if (ret == -1) {
 738                         smb_panic("unable to get back to old directory\n");
 739                 }
 740                 TALLOC_FREE(oldwd_fname);
 741         }
 742         if (saved_errno != 0) {
 743                 errno = saved_errno;
 744         }
 745         return fd;
 746 }
 747
 748 /****************************************************************************
 749  fd support routines - attempt to do a dos_open.
 750 ****************************************************************************/
 751
 752 NTSTATUS fd_open(struct connection_struct *conn,
 753                  files_struct *fsp,
 754                  int flags,
 755                  mode_t mode)
 756 {
 757         struct smb_filename *smb_fname = fsp->fsp_name;
 758         NTSTATUS status = NT_STATUS_OK;
 759
 760         /*
 761          * Never follow symlinks on a POSIX client. The
 762          * client should be doing this.
 763          */
 764
 765         if ((fsp->posix_flags & FSP_POSIX_FLAGS_OPEN) || !lp_follow_symlinks(SNUM(conn))) {
 766                 flags |= O_NOFOLLOW;
 767         }
 768
 769         /* Ensure path is below share definition. */
 770         if (!lp_widelinks(SNUM(conn))) {
 771                 struct smb_filename *conn_rootdir_fname = NULL;
 772                 const char *conn_rootdir = SMB_VFS_CONNECTPATH(conn,
 773                                                 smb_fname);
 774                 int saved_errno = 0;
 775
 776                 if (conn_rootdir == NULL) {
 777                         return NT_STATUS_NO_MEMORY;
 778                 }
 779                 conn_rootdir_fname = synthetic_smb_fname(talloc_tos(),
 780                                                 conn_rootdir,
 781                                                 NULL,
 782                                                 NULL,
 783                                                 0);
 784                 if (conn_rootdir_fname == NULL) {
 785                         return NT_STATUS_NO_MEMORY;
 786                 }
 787
 788                 /*
 789                  * Only follow symlinks within a share
 790                  * definition.
 791                  */
 792                 fsp->fh->fd = non_widelink_open(conn,
 793                                         conn_rootdir_fname,
 794                                         fsp,
 795                                         smb_fname,
 796                                         flags,
 797                                         mode,
 798                                         0);
 799                 if (fsp->fh->fd == -1) {
 800                         saved_errno = errno;
 801                 }
 802                 TALLOC_FREE(conn_rootdir_fname);
 803                 if (saved_errno != 0) {
 804                         errno = saved_errno;
 805                 }
 806         } else {
 807                 fsp->fh->fd = SMB_VFS_OPEN(conn, smb_fname, fsp, flags, mode);
 808         }
 809
 810         if (fsp->fh->fd == -1) {
 811                 int posix_errno = link_errno_convert(errno);
 812                 status = map_nt_error_from_unix(posix_errno);
 813                 if (errno == EMFILE) {
 814                         static time_t last_warned = 0L;
 815
 816                         if (time((time_t *) NULL) > last_warned) {
 817                                 DEBUG(0,("Too many open files, unable "
 818                                         "to open more!  smbd's max "
 819                                         "open files = %d\n",
 820                                         lp_max_open_files()));
 821                                 last_warned = time((time_t *) NULL);
 822                         }
 823                 }
 824
 825         }
 826
 827         DEBUG(10,("fd_open: name %s, flags = 0%o mode = 0%o, fd = %d. %s\n",
 828                   smb_fname_str_dbg(smb_fname), flags, (int)mode, fsp->fh->fd,
 829                 (fsp->fh->fd == -1) ? strerror(errno) : "" ));
 830
 831         return status;
 832 }
 833
 834 /****************************************************************************
 835  Close the file associated with a fsp.
 836 ****************************************************************************/
 837
 838 NTSTATUS fd_close(files_struct *fsp)
 839 {
 840         int ret;
 841
 842         if (fsp->dptr) {
 843                 dptr_CloseDir(fsp);
 844         }
 845         if (fsp->fh->fd == -1) {
 846                 /*
 847                  * Either a directory where the dptr_CloseDir() already closed
 848                  * the fd or a stat open.
 849                  */
 850                 return NT_STATUS_OK;
 851         }
 852         if (fsp->fh->ref_count > 1) {
 853                 return NT_STATUS_OK; /* Shared handle. Only close last reference. */
 854         }
 855
 856         ret = SMB_VFS_CLOSE(fsp);
 857         fsp->fh->fd = -1;
 858         if (ret == -1) {
 859                 return map_nt_error_from_unix(errno);
 860         }
 861         return NT_STATUS_OK;
 862 }
 863
 864 /****************************************************************************
 865  Change the ownership of a file to that of the parent directory.
 866  Do this by fd if possible.
 867 ****************************************************************************/
 868
 869 void change_file_owner_to_parent(connection_struct *conn,
 870                                         const char *inherit_from_dir,
 871                                         files_struct *fsp)
 872 {
 873         struct smb_filename *smb_fname_parent;
 874         int ret;
 875
 876         smb_fname_parent = synthetic_smb_fname(talloc_tos(),
 877                                         inherit_from_dir,
 878                                         NULL,
 879                                         NULL,
 880                                         0);
 881         if (smb_fname_parent == NULL) {
 882                 return;
 883         }
 884
 885         ret = SMB_VFS_STAT(conn, smb_fname_parent);
 886         if (ret == -1) {
 887                 DEBUG(0,("change_file_owner_to_parent: failed to stat parent "
 888                          "directory %s. Error was %s\n",
 889                          smb_fname_str_dbg(smb_fname_parent),
 890                          strerror(errno)));
 891                 TALLOC_FREE(smb_fname_parent);
 892                 return;
 893         }
 894
 895         if (smb_fname_parent->st.st_ex_uid == fsp->fsp_name->st.st_ex_uid) {
 896                 /* Already this uid - no need to change. */
 897                 DEBUG(10,("change_file_owner_to_parent: file %s "
 898                         "is already owned by uid %d\n",
 899                         fsp_str_dbg(fsp),
 900                         (int)fsp->fsp_name->st.st_ex_uid ));
 901                 TALLOC_FREE(smb_fname_parent);
 902                 return;
 903         }
 904
 905         become_root();
 906         ret = SMB_VFS_FCHOWN(fsp, smb_fname_parent->st.st_ex_uid, (gid_t)-1);
 907         unbecome_root();
 908         if (ret == -1) {
 909                 DEBUG(0,("change_file_owner_to_parent: failed to fchown "
 910                          "file %s to parent directory uid %u. Error "
 911                          "was %s\n", fsp_str_dbg(fsp),
 912                          (unsigned int)smb_fname_parent->st.st_ex_uid,
 913                          strerror(errno) ));
 914         } else {
 915                 DEBUG(10,("change_file_owner_to_parent: changed new file %s to "
 916                         "parent directory uid %u.\n", fsp_str_dbg(fsp),
 917                         (unsigned int)smb_fname_parent->st.st_ex_uid));
 918                 /* Ensure the uid entry is updated. */
 919                 fsp->fsp_name->st.st_ex_uid = smb_fname_parent->st.st_ex_uid;
 920         }
 921
 922         TALLOC_FREE(smb_fname_parent);
 923 }
 924
 925 static NTSTATUS change_dir_owner_to_parent(connection_struct *conn,
 926                                         const char *inherit_from_dir,
 927                                         struct smb_filename *smb_dname,
 928                                         SMB_STRUCT_STAT *psbuf)
 929 {
 930         struct smb_filename *smb_fname_parent;
 931         struct smb_filename *smb_fname_cwd = NULL;
 932         struct smb_filename *saved_dir_fname = NULL;
 933         TALLOC_CTX *ctx = talloc_tos();
 934         NTSTATUS status = NT_STATUS_OK;
 935         int ret;
 936
 937         smb_fname_parent = synthetic_smb_fname(ctx,
 938                                         inherit_from_dir,
 939                                         NULL,
 940                                         NULL,
 941                                         0);
 942         if (smb_fname_parent == NULL) {
 943                 return NT_STATUS_NO_MEMORY;
 944         }
 945
 946         ret = SMB_VFS_STAT(conn, smb_fname_parent);
 947         if (ret == -1) {
 948                 status = map_nt_error_from_unix(errno);
 949                 DEBUG(0,("change_dir_owner_to_parent: failed to stat parent "
 950                          "directory %s. Error was %s\n",
 951                          smb_fname_str_dbg(smb_fname_parent),
 952                          strerror(errno)));
 953                 goto out;
 954         }
 955
 956         /* We've already done an lstat into psbuf, and we know it's a
 957            directory. If we can cd into the directory and the dev/ino
 958            are the same then we can safely chown without races as
 959            we're locking the directory in place by being in it.  This
 960            should work on any UNIX (thanks tridge :-). JRA.
 961         */
 962
 963         saved_dir_fname = vfs_GetWd(ctx,conn);
 964         if (!saved_dir_fname) {
 965                 status = map_nt_error_from_unix(errno);
 966                 DEBUG(0,("change_dir_owner_to_parent: failed to get "
 967                          "current working directory. Error was %s\n",
 968                          strerror(errno)));
 969                 goto out;
 970         }
 971
 972         /* Chdir into the new path. */
 973         if (vfs_ChDir(conn, smb_dname) == -1) {
 974                 status = map_nt_error_from_unix(errno);
 975                 DEBUG(0,("change_dir_owner_to_parent: failed to change "
 976                          "current working directory to %s. Error "
 977                          "was %s\n", smb_dname->base_name, strerror(errno) ));
 978                 goto chdir;
 979         }
 980
 981         smb_fname_cwd = synthetic_smb_fname(ctx, ".", NULL, NULL, 0);
 982         if (smb_fname_cwd == NULL) {
 983                 status = NT_STATUS_NO_MEMORY;
 984                 goto chdir;
 985         }
 986
 987         ret = SMB_VFS_STAT(conn, smb_fname_cwd);
 988         if (ret == -1) {
 989                 status = map_nt_error_from_unix(errno);
 990                 DEBUG(0,("change_dir_owner_to_parent: failed to stat "
 991                          "directory '.' (%s) Error was %s\n",
 992                          smb_dname->base_name, strerror(errno)));
 993                 goto chdir;
 994         }
 995
 996         /* Ensure we're pointing at the same place. */
 997         if (smb_fname_cwd->st.st_ex_dev != psbuf->st_ex_dev ||
 998             smb_fname_cwd->st.st_ex_ino != psbuf->st_ex_ino) {
 999                 DEBUG(0,("change_dir_owner_to_parent: "
1000                          "device/inode on directory %s changed. "
1001                          "Refusing to chown !\n",
1002                         smb_dname->base_name ));
1003                 status = NT_STATUS_ACCESS_DENIED;
1004                 goto chdir;
1005         }
1006
1007         if (smb_fname_parent->st.st_ex_uid == smb_fname_cwd->st.st_ex_uid) {
1008                 /* Already this uid - no need to change. */
1009                 DEBUG(10,("change_dir_owner_to_parent: directory %s "
1010                         "is already owned by uid %d\n",
1011                         smb_dname->base_name,
1012                         (int)smb_fname_cwd->st.st_ex_uid ));
1013                 status = NT_STATUS_OK;
1014                 goto chdir;
1015         }
1016
1017         become_root();
1018         ret = SMB_VFS_LCHOWN(conn,
1019                         smb_fname_cwd,
1020                         smb_fname_parent->st.st_ex_uid,
1021                         (gid_t)-1);
1022         unbecome_root();
1023         if (ret == -1) {
1024                 status = map_nt_error_from_unix(errno);
1025                 DEBUG(10,("change_dir_owner_to_parent: failed to chown "
1026                           "directory %s to parent directory uid %u. "
1027                           "Error was %s\n",
1028                           smb_dname->base_name,
1029                           (unsigned int)smb_fname_parent->st.st_ex_uid,
1030                           strerror(errno) ));
1031         } else {
1032                 DEBUG(10,("change_dir_owner_to_parent: changed ownership of new "
1033                         "directory %s to parent directory uid %u.\n",
1034                         smb_dname->base_name,
1035                         (unsigned int)smb_fname_parent->st.st_ex_uid ));
1036                 /* Ensure the uid entry is updated. */
1037                 psbuf->st_ex_uid = smb_fname_parent->st.st_ex_uid;
1038         }
1039
1040  chdir:
1041         vfs_ChDir(conn, saved_dir_fname);
1042  out:
1043         TALLOC_FREE(saved_dir_fname);
1044         TALLOC_FREE(smb_fname_parent);
1045         TALLOC_FREE(smb_fname_cwd);
1046         return status;
1047 }
1048
1049 /****************************************************************************
1050  Open a file - returning a guaranteed ATOMIC indication of if the
1051  file was created or not.
1052 ****************************************************************************/
1053
1054 static NTSTATUS fd_open_atomic(struct connection_struct *conn,
1055                         files_struct *fsp,
1056                         int flags,
1057                         mode_t mode,
1058                         bool *file_created)
1059 {
1060         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1061         NTSTATUS retry_status;
1062         bool file_existed = VALID_STAT(fsp->fsp_name->st);
1063         int curr_flags;
1064
1065         if (!(flags & O_CREAT)) {
1066                 /*
1067                  * We're not creating the file, just pass through.
1068                  */
1069                 status = fd_open(conn, fsp, flags, mode);
1070                 *file_created = false;
1071                 return status;
1072         }
1073
1074         if (flags & O_EXCL) {
1075                 /*
1076                  * Fail if already exists, just pass through.
1077                  */
1078                 status = fd_open(conn, fsp, flags, mode);
1079
1080                 /*
1081                  * Here we've opened with O_CREAT|O_EXCL. If that went
1082                  * NT_STATUS_OK, we *know* we created this file.
1083                  */
1084                 *file_created = NT_STATUS_IS_OK(status);
1085
1086                 return status;
1087         }
1088
1089         /*
1090          * Now it gets tricky. We have O_CREAT, but not O_EXCL.
1091          * To know absolutely if we created the file or not,
1092          * we can never call O_CREAT without O_EXCL. So if
1093          * we think the file existed, try without O_CREAT|O_EXCL.
1094          * If we think the file didn't exist, try with
1095          * O_CREAT|O_EXCL.
1096          *
1097          * The big problem here is dangling symlinks. Opening
1098          * without O_NOFOLLOW means both bad symlink
1099          * and missing path return -1, ENOENT from open(). As POSIX
1100          * is pathname based it's not possible to tell
1101          * the difference between these two cases in a
1102          * non-racy way, so change to try only two attempts before
1103          * giving up.
1104          *
1105          * We don't have this problem for the O_NOFOLLOW
1106          * case as it just returns NT_STATUS_OBJECT_PATH_NOT_FOUND
1107          * mapped from the ELOOP POSIX error.
1108          */
1109
1110         if (file_existed) {
1111                 curr_flags = flags & ~(O_CREAT);
1112                 retry_status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
1113         } else {
1114                 curr_flags = flags | O_EXCL;
1115                 retry_status = NT_STATUS_OBJECT_NAME_COLLISION;
1116         }
1117
1118         status = fd_open(conn, fsp, curr_flags, mode);
1119         if (NT_STATUS_IS_OK(status)) {
1120                 *file_created = !file_existed;
1121                 return NT_STATUS_OK;
1122         }
1123         if (NT_STATUS_EQUAL(status, retry_status)) {
1124
1125                 file_existed = !file_existed;
1126
1127                 DBG_DEBUG("File %s %s. Retry.\n",
1128                           fsp_str_dbg(fsp),
1129                           file_existed ? "existed" : "did not exist");
1130
1131                 if (file_existed) {
1132                         curr_flags = flags & ~(O_CREAT);
1133                 } else {
1134                         curr_flags = flags | O_EXCL;
1135                 }
1136
1137                 status = fd_open(conn, fsp, curr_flags, mode);
1138         }
1139
1140         *file_created = (NT_STATUS_IS_OK(status) && !file_existed);
1141         return status;
1142 }
1143
1144 /****************************************************************************
1145  Open a file.
1146 ****************************************************************************/
1147
1148 static NTSTATUS open_file(files_struct *fsp,
1149                           connection_struct *conn,
1150                           struct smb_request *req,
1151                           const char *parent_dir,
1152                           int flags,
1153                           mode_t unx_mode,
1154                           uint32_t access_mask, /* client requested access mask. */
1155                           uint32_t open_access_mask, /* what we're actually using in the open. */
1156                           bool *p_file_created)
1157 {
1158         struct smb_filename *smb_fname = fsp->fsp_name;
1159         NTSTATUS status = NT_STATUS_OK;
1160         int accmode = (flags & O_ACCMODE);
1161         int local_flags = flags;
1162         bool file_existed = VALID_STAT(fsp->fsp_name->st);
1163
1164         fsp->fh->fd = -1;
1165         errno = EPERM;
1166
1167         /* Check permissions */
1168
1169         /*
1170          * This code was changed after seeing a client open request
1171          * containing the open mode of (DENY_WRITE/read-only) with
1172          * the 'create if not exist' bit set. The previous code
1173          * would fail to open the file read only on a read-only share
1174          * as it was checking the flags parameter  directly against O_RDONLY,
1175          * this was failing as the flags parameter was set to O_RDONLY|O_CREAT.
1176          * JRA.
1177          */
1178
1179         if (!CAN_WRITE(conn)) {
1180                 /* It's a read-only share - fail if we wanted to write. */
1181                 if(accmode != O_RDONLY || (flags & O_TRUNC) || (flags & O_APPEND)) {
1182                         DEBUG(3,("Permission denied opening %s\n",
1183                                  smb_fname_str_dbg(smb_fname)));
1184                         return NT_STATUS_ACCESS_DENIED;
1185                 }
1186                 if (flags & O_CREAT) {
1187                         /* We don't want to write - but we must make sure that
1188                            O_CREAT doesn't create the file if we have write
1189                            access into the directory.
1190                         */
1191                         flags &= ~(O_CREAT|O_EXCL);
1192                         local_flags &= ~(O_CREAT|O_EXCL);
1193                 }
1194         }
1195
1196         /*
1197          * This little piece of insanity is inspired by the
1198          * fact that an NT client can open a file for O_RDONLY,
1199          * but set the create disposition to FILE_EXISTS_TRUNCATE.
1200          * If the client *can* write to the file, then it expects to
1201          * truncate the file, even though it is opening for readonly.
1202          * Quicken uses this stupid trick in backup file creation...
1203          * Thanks *greatly* to "David W. Chapman Jr." <dwcjr@inethouston.net>
1204          * for helping track this one down. It didn't bite us in 2.0.x
1205          * as we always opened files read-write in that release. JRA.
1206          */
1207
1208         if ((accmode == O_RDONLY) && ((flags & O_TRUNC) == O_TRUNC)) {
1209                 DEBUG(10,("open_file: truncate requested on read-only open "
1210                           "for file %s\n", smb_fname_str_dbg(smb_fname)));
1211                 local_flags = (flags & ~O_ACCMODE)|O_RDWR;
1212         }
1213
1214         if ((open_access_mask & (FILE_READ_DATA|FILE_WRITE_DATA|
1215                                  FILE_APPEND_DATA|FILE_EXECUTE|
1216                                  WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|
1217                                  READ_CONTROL_ACCESS))||
1218             (!file_existed && (local_flags & O_CREAT)) ||
1219             ((local_flags & O_TRUNC) == O_TRUNC) ) {
1220                 const char *wild;
1221                 int ret;
1222
1223 #if defined(O_NONBLOCK) && defined(S_ISFIFO)
1224                 /*
1225                  * We would block on opening a FIFO with no one else on the
1226                  * other end. Do what we used to do and add O_NONBLOCK to the
1227                  * open flags. JRA.
1228                  */
1229
1230                 if (file_existed && S_ISFIFO(smb_fname->st.st_ex_mode)) {
1231                         local_flags &= ~O_TRUNC; /* Can't truncate a FIFO. */
1232                         local_flags |= O_NONBLOCK;
1233                 }
1234 #endif
1235
1236                 /* Don't create files with Microsoft wildcard characters. */
1237                 if (fsp->base_fsp) {
1238                         /*
1239                          * wildcard characters are allowed in stream names
1240                          * only test the basefilename
1241                          */
1242                         wild = fsp->base_fsp->fsp_name->base_name;
1243                 } else {
1244                         wild = smb_fname->base_name;
1245                 }
1246                 if ((local_flags & O_CREAT) && !file_existed &&
1247                     !(fsp->posix_flags & FSP_POSIX_FLAGS_PATHNAMES) &&
1248                     ms_has_wild(wild))  {
1249                         return NT_STATUS_OBJECT_NAME_INVALID;
1250                 }
1251
1252                 /* Can we access this file ? */
1253                 if (!fsp->base_fsp) {
1254                         /* Only do this check on non-stream open. */
1255                         if (file_existed) {
1256                                 status = smbd_check_access_rights(conn,
1257                                                 smb_fname,
1258                                                 false,
1259                                                 access_mask);
1260
1261                                 if (!NT_STATUS_IS_OK(status)) {
1262                                         DEBUG(10, ("open_file: "
1263                                                    "smbd_check_access_rights "
1264                                                    "on file %s returned %s\n",
1265                                                    smb_fname_str_dbg(smb_fname),
1266                                                    nt_errstr(status)));
1267                                 }
1268
1269                                 if (!NT_STATUS_IS_OK(status) &&
1270                                     !NT_STATUS_EQUAL(status,
1271                                         NT_STATUS_OBJECT_NAME_NOT_FOUND))
1272                                 {
1273                                         return status;
1274                                 }
1275
1276                                 if (NT_STATUS_EQUAL(status,
1277                                         NT_STATUS_OBJECT_NAME_NOT_FOUND))
1278                                 {
1279                                         DEBUG(10, ("open_file: "
1280                                                 "file %s vanished since we "
1281                                                 "checked for existence.\n",
1282                                                 smb_fname_str_dbg(smb_fname)));
1283                                         file_existed = false;
1284                                         SET_STAT_INVALID(fsp->fsp_name->st);
1285                                 }
1286                         }
1287
1288                         if (!file_existed) {
1289                                 if (!(local_flags & O_CREAT)) {
1290                                         /* File didn't exist and no O_CREAT. */
1291                                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1292                                 }
1293
1294                                 status = check_parent_access(conn,
1295                                                              smb_fname,
1296                                                              SEC_DIR_ADD_FILE);
1297                                 if (!NT_STATUS_IS_OK(status)) {
1298                                         DEBUG(10, ("open_file: "
1299                                                    "check_parent_access on "
1300                                                    "file %s returned %s\n",
1301                                                    smb_fname_str_dbg(smb_fname),
1302                                                    nt_errstr(status) ));
1303                                         return status;
1304                                 }
1305                         }
1306                 }
1307
1308                 /*
1309                  * Actually do the open - if O_TRUNC is needed handle it
1310                  * below under the share mode lock.
1311                  */
1312                 status = fd_open_atomic(conn, fsp, local_flags & ~O_TRUNC,
1313                                 unx_mode, p_file_created);
1314                 if (!NT_STATUS_IS_OK(status)) {
1315                         DEBUG(3,("Error opening file %s (%s) (local_flags=%d) "
1316                                  "(flags=%d)\n", smb_fname_str_dbg(smb_fname),
1317                                  nt_errstr(status),local_flags,flags));
1318                         return status;
1319                 }
1320
1321                 if (local_flags & O_NONBLOCK) {
1322                         /*
1323                          * GPFS can return ETIMEDOUT for pread on
1324                          * nonblocking file descriptors when files
1325                          * migrated to tape need to be recalled. I
1326                          * could imagine this happens elsewhere
1327                          * too. With blocking file descriptors this
1328                          * does not happen.
1329                          */
1330                         ret = set_blocking(fsp->fh->fd, true);
1331                         if (ret == -1) {
1332                                 status = map_nt_error_from_unix(errno);
1333                                 DBG_WARNING("Could not set fd to blocking: "
1334                                             "%s\n", strerror(errno));
1335                                 fd_close(fsp);
1336                                 return status;
1337                         }
1338                 }
1339
1340                 ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
1341                 if (ret == -1) {
1342                         /* If we have an fd, this stat should succeed. */
1343                         DEBUG(0,("Error doing fstat on open file %s "
1344                                 "(%s)\n",
1345                                 smb_fname_str_dbg(smb_fname),
1346                                 strerror(errno) ));
1347                         status = map_nt_error_from_unix(errno);
1348                         fd_close(fsp);
1349                         return status;
1350                 }
1351
1352                 if (*p_file_created) {
1353                         /* We created this file. */
1354
1355                         bool need_re_stat = false;
1356                         /* Do all inheritance work after we've
1357                            done a successful fstat call and filled
1358                            in the stat struct in fsp->fsp_name. */
1359
1360                         /* Inherit the ACL if required */
1361                         if (lp_inherit_permissions(SNUM(conn))) {
1362                                 inherit_access_posix_acl(conn, parent_dir,
1363                                                          smb_fname,
1364                                                          unx_mode);
1365                                 need_re_stat = true;
1366                         }
1367
1368                         /* Change the owner if required. */
1369                         if (lp_inherit_owner(SNUM(conn)) != INHERIT_OWNER_NO) {
1370                                 change_file_owner_to_parent(conn, parent_dir,
1371                                                             fsp);
1372                                 need_re_stat = true;
1373                         }
1374
1375                         if (need_re_stat) {
1376                                 ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
1377                                 /* If we have an fd, this stat should succeed. */
1378                                 if (ret == -1) {
1379                                         DEBUG(0,("Error doing fstat on open file %s "
1380                                                  "(%s)\n",
1381                                                  smb_fname_str_dbg(smb_fname),
1382                                                  strerror(errno) ));
1383                                 }
1384                         }
1385
1386                         notify_fname(conn, NOTIFY_ACTION_ADDED,
1387                                      FILE_NOTIFY_CHANGE_FILE_NAME,
1388                                      smb_fname->base_name);
1389                 }
1390         } else {
1391                 fsp->fh->fd = -1; /* What we used to call a stat open. */
1392                 if (!file_existed) {
1393                         /* File must exist for a stat open. */
1394                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1395                 }
1396
1397                 status = smbd_check_access_rights(conn,
1398                                 smb_fname,
1399                                 false,
1400                                 access_mask);
1401
1402                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND) &&
1403                                 (fsp->posix_flags & FSP_POSIX_FLAGS_OPEN) &&
1404                                 S_ISLNK(smb_fname->st.st_ex_mode)) {
1405                         /* This is a POSIX stat open for delete
1406                          * or rename on a symlink that points
1407                          * nowhere. Allow. */
1408                         DEBUG(10,("open_file: allowing POSIX "
1409                                   "open on bad symlink %s\n",
1410                                   smb_fname_str_dbg(smb_fname)));
1411                         status = NT_STATUS_OK;
1412                 }
1413
1414                 if (!NT_STATUS_IS_OK(status)) {
1415                         DEBUG(10,("open_file: "
1416                                 "smbd_check_access_rights on file "
1417                                 "%s returned %s\n",
1418                                 smb_fname_str_dbg(smb_fname),
1419                                 nt_errstr(status) ));
1420                         return status;
1421                 }
1422         }
1423
1424         /*
1425          * POSIX allows read-only opens of directories. We don't
1426          * want to do this (we use a different code path for this)
1427          * so catch a directory open and return an EISDIR. JRA.
1428          */
1429
1430         if(S_ISDIR(smb_fname->st.st_ex_mode)) {
1431                 fd_close(fsp);
1432                 errno = EISDIR;
1433                 return NT_STATUS_FILE_IS_A_DIRECTORY;
1434         }
1435
1436         fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1437         fsp->vuid = req ? req->vuid : UID_FIELD_INVALID;
1438         fsp->file_pid = req ? req->smbpid : 0;
1439         fsp->can_lock = True;
1440         fsp->can_read = ((access_mask & FILE_READ_DATA) != 0);
1441         fsp->can_write =
1442                 CAN_WRITE(conn) &&
1443                 ((access_mask & (FILE_WRITE_DATA | FILE_APPEND_DATA)) != 0);
1444         fsp->print_file = NULL;
1445         fsp->modified = False;
1446         fsp->sent_oplock_break = NO_BREAK_SENT;
1447         fsp->is_directory = False;
1448         if (conn->aio_write_behind_list &&
1449             is_in_path(smb_fname->base_name, conn->aio_write_behind_list,
1450                        conn->case_sensitive)) {
1451                 fsp->aio_write_behind = True;
1452         }
1453
1454         fsp->wcp = NULL; /* Write cache pointer. */
1455
1456         DEBUG(2,("%s opened file %s read=%s write=%s (numopen=%d)\n",
1457                  conn->session_info->unix_info->unix_name,
1458                  smb_fname_str_dbg(smb_fname),
1459                  BOOLSTR(fsp->can_read), BOOLSTR(fsp->can_write),
1460                  conn->num_files_open));
1461
1462         errno = 0;
1463         return NT_STATUS_OK;
1464 }
1465
1466 static bool mask_conflict(
1467         uint32_t new_access,
1468         uint32_t existing_access,
1469         uint32_t access_mask,
1470         uint32_t new_sharemode,
1471         uint32_t existing_sharemode,
1472         uint32_t sharemode_mask)
1473 {
1474         bool want_access = (new_access & access_mask);
1475         bool allow_existing = (existing_sharemode & sharemode_mask);
1476         bool have_access = (existing_access & access_mask);
1477         bool allow_new = (new_sharemode & sharemode_mask);
1478
1479         if (want_access && !allow_existing) {
1480                 DBG_DEBUG("Access request 0x%"PRIx32"/0x%"PRIx32" conflicts "
1481                           "with existing sharemode 0x%"PRIx32"/0x%"PRIx32"\n",
1482                           new_access,
1483                           access_mask,
1484                           existing_sharemode,
1485                           sharemode_mask);
1486                 return true;
1487         }
1488         if (have_access && !allow_new) {
1489                 DBG_DEBUG("Sharemode request 0x%"PRIx32"/0x%"PRIx32" conflicts "
1490                           "with existing access 0x%"PRIx32"/0x%"PRIx32"\n",
1491                           new_sharemode,
1492                           sharemode_mask,
1493                           existing_access,
1494                           access_mask);
1495                 return true;
1496         }
1497         return false;
1498 }
1499
1500 /****************************************************************************
1501  Check if we can open a file with a share mode.
1502  Returns True if conflict, False if not.
1503 ****************************************************************************/
1504
1505 static bool share_conflict(uint32_t e_access_mask,
1506                            uint32_t e_share_access,
1507                            uint32_t access_mask,
1508                            uint32_t share_access)
1509 {
1510         const uint32_t conflicting_access =
1511                 FILE_WRITE_DATA|
1512                 FILE_APPEND_DATA|
1513                 FILE_READ_DATA|
1514                 FILE_EXECUTE|
1515                 DELETE_ACCESS;
1516         bool conflict;
1517
1518         DBG_DEBUG("existing access_mask = 0x%"PRIx32", "
1519                   "existing share access = 0x%"PRIx32", "
1520                   "access_mask = 0x%"PRIx32", "
1521                   "share_access = 0x%"PRIx32"\n",
1522                   e_access_mask,
1523                   e_share_access,
1524                   access_mask,
1525                   share_access);
1526
1527         if ((e_access_mask & conflicting_access) == 0) {
1528                 DBG_DEBUG("No conflict due to "
1529                           "existing access_mask = 0x%"PRIx32"\n",
1530                           e_access_mask);
1531                 return false;
1532         }
1533         if ((access_mask & conflicting_access) == 0) {
1534                 DBG_DEBUG("No conflict due to access_mask = 0x%"PRIx32"\n",
1535                           access_mask);
1536                 return false;
1537         }
1538
1539         conflict = mask_conflict(
1540                 access_mask, e_access_mask, FILE_WRITE_DATA | FILE_APPEND_DATA,
1541                 share_access, e_share_access, FILE_SHARE_WRITE);
1542         conflict |= mask_conflict(
1543                 access_mask, e_access_mask, FILE_READ_DATA | FILE_EXECUTE,
1544                 share_access, e_share_access, FILE_SHARE_READ);
1545         conflict |= mask_conflict(
1546                 access_mask, e_access_mask, DELETE_ACCESS,
1547                 share_access, e_share_access, FILE_SHARE_DELETE);
1548
1549         DBG_DEBUG("conflict=%s\n", conflict ? "true" : "false");
1550         return conflict;
1551 }
1552
1553 #if defined(DEVELOPER)
1554
1555 struct validate_my_share_entries_state {
1556         struct smbd_server_connection *sconn;
1557         struct file_id fid;
1558         struct server_id self;
1559 };
1560
1561 static bool validate_my_share_entries_fn(
1562         struct share_mode_entry *e,
1563         bool *modified,
1564         void *private_data)
1565 {
1566         struct validate_my_share_entries_state *state = private_data;
1567         files_struct *fsp;
1568
1569         if (!serverid_equal(&state->self, &e->pid)) {
1570                 return false;
1571         }
1572
1573         if (e->op_mid == 0) {
1574                 /* INTERNAL_OPEN_ONLY */
1575                 return false;
1576         }
1577
1578         fsp = file_find_dif(state->sconn, state->fid, e->share_file_id);
1579         if (!fsp) {
1580                 DBG_ERR("PANIC : %s\n",
1581                         share_mode_str(talloc_tos(), 0, &state->fid, e));
1582                 smb_panic("validate_my_share_entries: Cannot match a "
1583                           "share entry with an open file\n");
1584         }
1585
1586         if (((uint16_t)fsp->oplock_type) != e->op_type) {
1587                 goto panic;
1588         }
1589
1590         return false;
1591
1592  panic:
1593         {
1594                 char *str;
1595                 DBG_ERR("validate_my_share_entries: PANIC : %s\n",
1596                         share_mode_str(talloc_tos(), 0, &state->fid, e));
1597                 str = talloc_asprintf(talloc_tos(),
1598                         "validate_my_share_entries: "
1599                         "file %s, oplock_type = 0x%x, op_type = 0x%x\n",
1600                          fsp->fsp_name->base_name,
1601                          (unsigned int)fsp->oplock_type,
1602                          (unsigned int)e->op_type);
1603                 smb_panic(str);
1604         }
1605
1606         return false;
1607 }
1608 #endif
1609
1610 bool is_stat_open(uint32_t access_mask)
1611 {
1612         const uint32_t stat_open_bits =
1613                 (SYNCHRONIZE_ACCESS|
1614                  FILE_READ_ATTRIBUTES|
1615                  FILE_WRITE_ATTRIBUTES);
1616
1617         return (((access_mask &  stat_open_bits) != 0) &&
1618                 ((access_mask & ~stat_open_bits) == 0));
1619 }
1620
1621 struct has_delete_on_close_state {
1622         bool ret;
1623 };
1624
1625 static bool has_delete_on_close_fn(
1626         struct share_mode_entry *e,
1627         bool *modified,
1628         void *private_data)
1629 {
1630         struct has_delete_on_close_state *state = private_data;
1631         state->ret = !share_entry_stale_pid(e);
1632         return state->ret;
1633 }
1634
1635 static bool has_delete_on_close(struct share_mode_lock *lck,
1636                                 uint32_t name_hash)
1637 {
1638         struct has_delete_on_close_state state = { .ret = false };
1639         bool ok;
1640
1641         if (!is_delete_on_close_set(lck, name_hash)) {
1642                 return false;
1643         }
1644
1645         ok= share_mode_forall_entries(lck, has_delete_on_close_fn, &state);
1646         if (!ok) {
1647                 DBG_DEBUG("share_mode_forall_entries failed\n");
1648                 return false;
1649         }
1650         return state.ret;
1651 }
1652
1653 /****************************************************************************
1654  Deal with share modes
1655  Invariant: Share mode must be locked on entry and exit.
1656  Returns -1 on error, or number of share modes on success (may be zero).
1657 ****************************************************************************/
1658
1659 struct open_mode_check_state {
1660         uint32_t access_mask;
1661         uint32_t share_access;
1662         bool conflict;
1663 };
1664
1665 static bool open_mode_check_fn(
1666         struct share_mode_entry *e,
1667         bool *modified,
1668         void *private_data)
1669 {
1670         struct open_mode_check_state *state = private_data;
1671         bool disconnected, conflict, stale;
1672
1673         disconnected = server_id_is_disconnected(&e->pid);
1674         if (disconnected) {
1675                 return false;
1676         }
1677
1678         conflict = share_conflict(
1679                 e->access_mask,
1680                 e->share_access,
1681                 state->access_mask,
1682                 state->share_access);
1683         if (!conflict) {
1684                 return false;
1685         }
1686         stale = share_entry_stale_pid(e);
1687         if (stale) {
1688                 return false;
1689         }
1690
1691         state->conflict = true;
1692         return true;
1693 }
1694
1695 static NTSTATUS open_mode_check(connection_struct *conn,
1696                                 struct share_mode_lock *lck,
1697                                 uint32_t access_mask,
1698                                 uint32_t share_access)
1699 {
1700         struct open_mode_check_state state = {
1701                 .access_mask = access_mask, .share_access = share_access,
1702         };
1703         bool ok;
1704
1705         if (is_stat_open(access_mask)) {
1706                 /* Stat open that doesn't trigger oplock breaks or share mode
1707                  * checks... ! JRA. */
1708                 return NT_STATUS_OK;
1709         }
1710
1711         /*
1712          * Check if the share modes will give us access.
1713          */
1714
1715 #if defined(DEVELOPER)
1716         {
1717                 struct validate_my_share_entries_state validate_state = {
1718                         .sconn = conn->sconn,
1719                         .fid = lck->data->id,
1720                         .self = messaging_server_id(conn->sconn->msg_ctx),
1721                 };
1722                 ok = share_mode_forall_entries(
1723                         lck, validate_my_share_entries_fn, &validate_state);
1724                 SMB_ASSERT(ok);
1725         }
1726 #endif
1727
1728         ok = share_mode_forall_entries(lck, open_mode_check_fn, &state);
1729         if (!ok) {
1730                 DBG_DEBUG("share_mode_forall_entries failed\n");
1731                 return NT_STATUS_INTERNAL_ERROR;
1732         }
1733         if (state.conflict) {
1734                 return NT_STATUS_SHARING_VIOLATION;
1735         }
1736
1737         return NT_STATUS_OK;
1738 }
1739
1740 /*
1741  * Send a break message to the oplock holder and delay the open for
1742  * our client.
1743  */
1744
1745 NTSTATUS send_break_message(struct messaging_context *msg_ctx,
1746                             const struct file_id *id,
1747                             const struct share_mode_entry *exclusive,
1748                             uint16_t break_to)
1749 {
1750         struct oplock_break_message msg = {
1751                 .id = *id,
1752                 .share_file_id = exclusive->share_file_id,
1753                 .break_to = break_to,
1754         };
1755         enum ndr_err_code ndr_err;
1756         DATA_BLOB blob;
1757         NTSTATUS status;
1758
1759         if (DEBUGLVL(10)) {
1760                 struct server_id_buf buf;
1761                 DBG_DEBUG("Sending break message to %s\n",
1762                           server_id_str_buf(exclusive->pid, &buf));
1763                 NDR_PRINT_DEBUG(oplock_break_message, &msg);
1764         }
1765
1766         ndr_err = ndr_push_struct_blob(
1767                 &blob,
1768                 talloc_tos(),
1769                 &msg,
1770                 (ndr_push_flags_fn_t)ndr_push_oplock_break_message);
1771         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1772                 DBG_WARNING("ndr_push_oplock_break_message failed: %s\n",
1773                             ndr_errstr(ndr_err));
1774                 return ndr_map_error2ntstatus(ndr_err);
1775         }
1776
1777         status = messaging_send(
1778                 msg_ctx, exclusive->pid, MSG_SMB_BREAK_REQUEST, &blob);
1779         TALLOC_FREE(blob.data);
1780         if (!NT_STATUS_IS_OK(status)) {
1781                 DEBUG(3, ("Could not send oplock break message: %s\n",
1782                           nt_errstr(status)));
1783         }
1784
1785         return status;
1786 }
1787
1788 struct validate_oplock_types_state {
1789         bool valid;
1790         bool batch;
1791         bool ex_or_batch;
1792         bool level2;
1793         bool no_oplock;
1794         uint32_t num_non_stat_opens;
1795 };
1796
1797 static bool validate_oplock_types_fn(
1798         struct share_mode_entry *e,
1799         bool *modified,
1800         void *private_data)
1801 {
1802         struct validate_oplock_types_state *state = private_data;
1803
1804         if (e->op_mid == 0) {
1805                 /* INTERNAL_OPEN_ONLY */
1806                 return false;
1807         }
1808
1809         if (e->op_type == NO_OPLOCK && is_stat_open(e->access_mask)) {
1810                 /*
1811                  * We ignore stat opens in the table - they always
1812                  * have NO_OPLOCK and never get or cause breaks. JRA.
1813                  */
1814                 return false;
1815         }
1816
1817         state->num_non_stat_opens += 1;
1818
1819         if (BATCH_OPLOCK_TYPE(e->op_type)) {
1820                 /* batch - can only be one. */
1821                 if (share_entry_stale_pid(e)) {
1822                         DBG_DEBUG("Found stale batch oplock\n");
1823                         return false;
1824                 }
1825                 if (state->ex_or_batch ||
1826                     state->batch ||
1827                     state->level2 ||
1828                     state->no_oplock) {
1829                         DBG_ERR("Bad batch oplock entry\n");
1830                         state->valid = false;
1831                         return true;
1832                 }
1833                 state->batch = true;
1834         }
1835
1836         if (EXCLUSIVE_OPLOCK_TYPE(e->op_type)) {
1837                 if (share_entry_stale_pid(e)) {
1838                         DBG_DEBUG("Found stale duplicate oplock\n");
1839                         return false;
1840                 }
1841                 /* Exclusive or batch - can only be one. */
1842                 if (state->ex_or_batch ||
1843                     state->level2 ||
1844                     state->no_oplock) {
1845                         DBG_ERR("Bad exclusive or batch oplock entry\n");
1846                         state->valid = false;
1847                         return true;
1848                 }
1849                 state->ex_or_batch = true;
1850         }
1851
1852         if (LEVEL_II_OPLOCK_TYPE(e->op_type)) {
1853                 if (state->batch || state->ex_or_batch) {
1854                         if (share_entry_stale_pid(e)) {
1855                                 DBG_DEBUG("Found stale LevelII oplock\n");
1856                                 return false;
1857                         }
1858                         DBG_DEBUG("Bad levelII oplock entry\n");
1859                         state->valid = false;
1860                         return true;
1861                 }
1862                 state->level2 = true;
1863         }
1864
1865         if (e->op_type == NO_OPLOCK) {
1866                 if (state->batch || state->ex_or_batch) {
1867                         if (share_entry_stale_pid(e)) {
1868                                 DBG_DEBUG("Found stale NO_OPLOCK entry\n");
1869                                 return false;
1870                         }
1871                         DBG_ERR("Bad no oplock entry\n");
1872                         state->valid = false;
1873                         return true;
1874                 }
1875                 state->no_oplock = true;
1876         }
1877
1878         return false;
1879 }
1880
1881 /*
1882  * Do internal consistency checks on the share mode for a file.
1883  */
1884
1885 static bool validate_oplock_types(struct share_mode_lock *lck)
1886 {
1887         struct validate_oplock_types_state state = { .valid = true };
1888         bool ok;
1889
1890         ok = share_mode_forall_entries(lck, validate_oplock_types_fn, &state);
1891         if (!ok) {
1892                 DBG_DEBUG("share_mode_forall_entries failed\n");
1893                 return false;
1894         }
1895         if (!state.valid) {
1896                 DBG_DEBUG("Got invalid oplock configuration\n");
1897                 return false;
1898         }
1899
1900         remove_stale_share_mode_entries(lck->data);
1901
1902         if ((state.batch || state.ex_or_batch) &&
1903             (state.num_non_stat_opens != 1)) {
1904                 DBG_WARNING("got batch (%d) or ex (%d) non-exclusively "
1905                             "(%"PRIu32")\n",
1906                             (int)state.batch,
1907                             (int)state.ex_or_batch,
1908                             state.num_non_stat_opens);
1909                 return false;
1910         }
1911
1912         return true;
1913 }
1914
1915 static bool is_same_lease(const files_struct *fsp,
1916                           const struct share_mode_entry *e,
1917                           const struct smb2_lease *lease)
1918 {
1919         if (e->op_type != LEASE_OPLOCK) {
1920                 return false;
1921         }
1922         if (lease == NULL) {
1923                 return false;
1924         }
1925
1926         return smb2_lease_equal(fsp_client_guid(fsp),
1927                                 &lease->lease_key,
1928                                 &e->client_guid,
1929                                 &e->lease_key);
1930 }
1931
1932 static bool file_has_brlocks(files_struct *fsp)
1933 {
1934         struct byte_range_lock *br_lck;
1935
1936         br_lck = brl_get_locks_readonly(fsp);
1937         if (!br_lck)
1938                 return false;
1939
1940         return (brl_num_locks(br_lck) > 0);
1941 }
1942
1943 struct fsp_lease *find_fsp_lease(struct files_struct *new_fsp,
1944                                  const struct smb2_lease_key *key,
1945                                  uint32_t current_state,
1946                                  uint16_t lease_version,
1947                                  uint16_t lease_epoch)
1948 {
1949         struct files_struct *fsp;
1950
1951         /*
1952          * TODO: Measure how expensive this loop is with thousands of open
1953          * handles...
1954          */
1955
1956         for (fsp = file_find_di_first(new_fsp->conn->sconn, new_fsp->file_id);
1957              fsp != NULL;
1958              fsp = file_find_di_next(fsp)) {
1959
1960                 if (fsp == new_fsp) {
1961                         continue;
1962                 }
1963                 if (fsp->oplock_type != LEASE_OPLOCK) {
1964                         continue;
1965                 }
1966                 if (smb2_lease_key_equal(&fsp->lease->lease.lease_key, key)) {
1967                         fsp->lease->ref_count += 1;
1968                         return fsp->lease;
1969                 }
1970         }
1971
1972         /* Not found - must be leased in another smbd. */
1973         new_fsp->lease = talloc_zero(new_fsp->conn->sconn, struct fsp_lease);
1974         if (new_fsp->lease == NULL) {
1975                 return NULL;
1976         }
1977         new_fsp->lease->ref_count = 1;
1978         new_fsp->lease->sconn = new_fsp->conn->sconn;
1979         new_fsp->lease->lease.lease_key = *key;
1980         new_fsp->lease->lease.lease_state = current_state;
1981         /*
1982          * We internally treat all leases as V2 and update
1983          * the epoch, but when sending breaks it matters if
1984          * the requesting lease was v1 or v2.
1985          */
1986         new_fsp->lease->lease.lease_version = lease_version;
1987         new_fsp->lease->lease.lease_epoch = lease_epoch;
1988         return new_fsp->lease;
1989 }
1990
1991 static NTSTATUS try_lease_upgrade(struct files_struct *fsp,
1992                                   struct share_mode_lock *lck,
1993                                   const struct GUID *client_guid,
1994                                   const struct smb2_lease *lease,
1995                                   uint32_t granted)
1996 {
1997         bool do_upgrade;
1998         uint32_t current_state, breaking_to_requested, breaking_to_required;
1999         bool breaking;
2000         uint16_t lease_version, epoch;
2001         uint32_t existing, requested;
2002         NTSTATUS status;
2003
2004         status = leases_db_get(
2005                 client_guid,
2006                 &lease->lease_key,
2007                 &fsp->file_id,
2008                 &current_state,
2009                 &breaking,
2010                 &breaking_to_requested,
2011                 &breaking_to_required,
2012                 &lease_version,
2013                 &epoch);
2014         if (!NT_STATUS_IS_OK(status)) {
2015                 return status;
2016         }
2017
2018         fsp->lease = find_fsp_lease(
2019                 fsp,
2020                 &lease->lease_key,
2021                 current_state,
2022                 lease_version,
2023                 epoch);
2024         if (fsp->lease == NULL) {
2025                 DEBUG(1, ("Did not find existing lease for file %s\n",
2026                           fsp_str_dbg(fsp)));
2027                 return NT_STATUS_NO_MEMORY;
2028         }
2029
2030         /*
2031          * Upgrade only if the requested lease is a strict upgrade.
2032          */
2033         existing = current_state;
2034         requested = lease->lease_state;
2035
2036         /*
2037          * Tricky: This test makes sure that "requested" is a
2038          * strict bitwise superset of "existing".
2039          */
2040         do_upgrade = ((existing & requested) == existing);
2041
2042         /*
2043          * Upgrade only if there's a change.
2044          */
2045         do_upgrade &= (granted != existing);
2046
2047         /*
2048          * Upgrade only if other leases don't prevent what was asked
2049          * for.
2050          */
2051         do_upgrade &= (granted == requested);
2052
2053         /*
2054          * only upgrade if we are not in breaking state
2055          */
2056         do_upgrade &= !breaking;
2057
2058         DEBUG(10, ("existing=%"PRIu32", requested=%"PRIu32", "
2059                    "granted=%"PRIu32", do_upgrade=%d\n",
2060                    existing, requested, granted, (int)do_upgrade));
2061
2062         if (do_upgrade) {
2063                 NTSTATUS set_status;
2064
2065                 current_state = granted;
2066                 epoch += 1;
2067
2068                 set_status = leases_db_set(
2069                         client_guid,
2070                         &lease->lease_key,
2071                         current_state,
2072                         breaking,
2073                         breaking_to_requested,
2074                         breaking_to_required,
2075                         lease_version,
2076                         epoch);
2077
2078                 if (!NT_STATUS_IS_OK(set_status)) {
2079                         DBG_DEBUG("leases_db_set failed: %s\n",
2080                                   nt_errstr(set_status));
2081                         return set_status;
2082                 }
2083         }
2084
2085         fsp_lease_update(fsp);
2086
2087         return NT_STATUS_OK;
2088 }
2089
2090 static NTSTATUS grant_new_fsp_lease(struct files_struct *fsp,
2091                                     struct share_mode_lock *lck,
2092                                     const struct GUID *client_guid,
2093                                     const struct smb2_lease *lease,
2094                                     uint32_t granted)
2095 {
2096         struct share_mode_data *d = lck->data;
2097         NTSTATUS status;
2098
2099         fsp->lease = talloc_zero(fsp->conn->sconn, struct fsp_lease);
2100         if (fsp->lease == NULL) {
2101                 return NT_STATUS_INSUFFICIENT_RESOURCES;
2102         }
2103         fsp->lease->ref_count = 1;
2104         fsp->lease->sconn = fsp->conn->sconn;
2105         fsp->lease->lease.lease_version = lease->lease_version;
2106         fsp->lease->lease.lease_key = lease->lease_key;
2107         fsp->lease->lease.lease_state = granted;
2108         fsp->lease->lease.lease_epoch = lease->lease_epoch + 1;
2109
2110         status = leases_db_add(client_guid,
2111                                &lease->lease_key,
2112                                &fsp->file_id,
2113                                fsp->lease->lease.lease_state,
2114                                fsp->lease->lease.lease_version,
2115                                fsp->lease->lease.lease_epoch,
2116                                fsp->conn->connectpath,
2117                                fsp->fsp_name->base_name,
2118                                fsp->fsp_name->stream_name);
2119         if (!NT_STATUS_IS_OK(status)) {
2120                 DEBUG(10, ("%s: leases_db_add failed: %s\n", __func__,
2121                            nt_errstr(status)));
2122                 TALLOC_FREE(fsp->lease);
2123                 return NT_STATUS_INSUFFICIENT_RESOURCES;
2124         }
2125
2126         d->modified = true;
2127
2128         return NT_STATUS_OK;
2129 }
2130
2131 static NTSTATUS grant_fsp_lease(struct files_struct *fsp,
2132                                 struct share_mode_lock *lck,
2133                                 const struct smb2_lease *lease,
2134                                 uint32_t granted)
2135 {
2136         const struct GUID *client_guid = fsp_client_guid(fsp);
2137         NTSTATUS status;
2138
2139         status = try_lease_upgrade(fsp, lck, client_guid, lease, granted);
2140
2141         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2142                 status = grant_new_fsp_lease(
2143                         fsp, lck, client_guid, lease, granted);
2144         }
2145
2146         return status;
2147 }
2148
2149 static int map_lease_type_to_oplock(uint32_t lease_type)
2150 {
2151         int result = NO_OPLOCK;
2152
2153         switch (lease_type) {
2154         case SMB2_LEASE_READ|SMB2_LEASE_WRITE|SMB2_LEASE_HANDLE:
2155                 result = BATCH_OPLOCK|EXCLUSIVE_OPLOCK;
2156                 break;
2157         case SMB2_LEASE_READ|SMB2_LEASE_WRITE:
2158                 result = EXCLUSIVE_OPLOCK;
2159                 break;
2160         case SMB2_LEASE_READ|SMB2_LEASE_HANDLE:
2161         case SMB2_LEASE_READ:
2162                 result = LEVEL_II_OPLOCK;
2163                 break;
2164         }
2165
2166         return result;
2167 }
2168
2169 struct delay_for_oplock_state {
2170         struct files_struct *fsp;
2171         const struct smb2_lease *lease;
2172         bool will_overwrite;
2173         uint32_t delay_mask;
2174         bool first_open_attempt;
2175         bool got_handle_lease;
2176         bool got_oplock;
2177         bool have_other_lease;
2178         bool delay;
2179 };
2180
2181 static bool delay_for_oplock_fn(
2182         struct share_mode_entry *e,
2183         bool *modified,
2184         void *private_data)
2185 {
2186         struct delay_for_oplock_state *state = private_data;
2187         struct files_struct *fsp = state->fsp;
2188         const struct smb2_lease *lease = state->lease;
2189         bool e_is_lease = (e->op_type == LEASE_OPLOCK);
2190         uint32_t e_lease_type = get_lease_type(e, fsp->file_id);
2191         uint32_t break_to;
2192         bool lease_is_breaking = false;
2193
2194         if (e_is_lease) {
2195                 NTSTATUS status;
2196
2197                 if (lease != NULL) {
2198                         bool our_lease = is_same_lease(fsp, e, lease);
2199                         if (our_lease) {
2200                                 DBG_DEBUG("Ignoring our own lease\n");
2201                                 return false;
2202                         }
2203                 }
2204
2205                 status = leases_db_get(
2206                         &e->client_guid,
2207                         &e->lease_key,
2208                         &fsp->file_id,
2209                         NULL, /* current_state */
2210                         &lease_is_breaking,
2211                         NULL, /* breaking_to_requested */
2212                         NULL, /* breaking_to_required */
2213                         NULL, /* lease_version */
2214                         NULL); /* epoch */
2215                 SMB_ASSERT(NT_STATUS_IS_OK(status));
2216         }
2217
2218         if (!state->got_handle_lease &&
2219             ((e_lease_type & SMB2_LEASE_HANDLE) != 0) &&
2220             !share_entry_stale_pid(e)) {
2221                 state->got_handle_lease = true;
2222         }
2223
2224         if (!state->got_oplock &&
2225             (e->op_type != LEASE_OPLOCK) &&
2226             !share_entry_stale_pid(e)) {
2227                 state->got_oplock = true;
2228         }
2229
2230         if (!state->have_other_lease &&
2231             !is_same_lease(fsp, e, lease) &&
2232             !share_entry_stale_pid(e)) {
2233                 state->have_other_lease = true;
2234         }
2235
2236         break_to = e_lease_type & ~state->delay_mask;
2237
2238         if (state->will_overwrite) {
2239                 break_to &= ~(SMB2_LEASE_HANDLE|SMB2_LEASE_READ);
2240         }
2241
2242         DBG_DEBUG("e_lease_type %u, will_overwrite: %u\n",
2243                   (unsigned)e_lease_type,
2244                   (unsigned)state->will_overwrite);
2245
2246         if ((e_lease_type & ~break_to) == 0) {
2247                 if (lease_is_breaking) {
2248                         state->delay = true;
2249                 }
2250                 return false;
2251         }
2252
2253         if (share_entry_stale_pid(e)) {
2254                 return false;
2255         }
2256
2257         if (state->will_overwrite) {
2258                 /*
2259                  * If we break anyway break to NONE directly.
2260                  * Otherwise vfs_set_filelen() will trigger the
2261                  * break.
2262                  */
2263                 break_to &= ~(SMB2_LEASE_READ|SMB2_LEASE_WRITE);
2264         }
2265
2266         if (!e_is_lease) {
2267                 /*
2268                  * Oplocks only support breaking to R or NONE.
2269                  */
2270                 break_to &= ~(SMB2_LEASE_HANDLE|SMB2_LEASE_WRITE);
2271         }
2272
2273         DBG_DEBUG("breaking from %d to %d\n",
2274                   (int)e_lease_type,
2275                   (int)break_to);
2276         send_break_message(
2277                 fsp->conn->sconn->msg_ctx, &fsp->file_id, e, break_to);
2278         if (e_lease_type & state->delay_mask) {
2279                 state->delay = true;
2280         }
2281         if (lease_is_breaking && !state->first_open_attempt) {
2282                 state->delay = true;
2283         }
2284
2285         return false;
2286 };
2287
2288 static NTSTATUS delay_for_oplock(files_struct *fsp,
2289                                  int oplock_request,
2290                                  const struct smb2_lease *lease,
2291                                  struct share_mode_lock *lck,
2292                                  bool have_sharing_violation,
2293                                  uint32_t create_disposition,
2294                                  bool first_open_attempt)
2295 {
2296         struct delay_for_oplock_state state = {
2297                 .fsp = fsp,
2298                 .lease = lease,
2299                 .first_open_attempt = first_open_attempt,
2300         };
2301         uint32_t granted;
2302         NTSTATUS status;
2303         bool ok;
2304
2305         if (is_stat_open(fsp->access_mask)) {
2306                 goto grant;
2307         }
2308
2309         state.delay_mask = have_sharing_violation ?
2310                 SMB2_LEASE_HANDLE : SMB2_LEASE_WRITE;
2311
2312         switch (create_disposition) {
2313         case FILE_SUPERSEDE:
2314         case FILE_OVERWRITE:
2315         case FILE_OVERWRITE_IF:
2316                 state.will_overwrite = true;
2317                 break;
2318         default:
2319                 state.will_overwrite = false;
2320                 break;
2321         }
2322
2323         ok = share_mode_forall_entries(lck, delay_for_oplock_fn, &state);
2324         if (!ok) {
2325                 return NT_STATUS_INTERNAL_ERROR;
2326         }
2327
2328         if (state.delay) {
2329                 return NT_STATUS_RETRY;
2330         }
2331
2332 grant:
2333         if (have_sharing_violation) {
2334                 return NT_STATUS_SHARING_VIOLATION;
2335         }
2336
2337         if (oplock_request == LEASE_OPLOCK) {
2338                 if (lease == NULL) {
2339                         /*
2340                          * The SMB2 layer should have checked this
2341                          */
2342                         return NT_STATUS_INTERNAL_ERROR;
2343                 }
2344
2345                 granted = lease->lease_state;
2346
2347                 if (lp_kernel_oplocks(SNUM(fsp->conn))) {
2348                         DEBUG(10, ("No lease granted because kernel oplocks are enabled\n"));
2349                         granted = SMB2_LEASE_NONE;
2350                 }
2351                 if ((granted & (SMB2_LEASE_READ|SMB2_LEASE_WRITE)) == 0) {
2352                         DEBUG(10, ("No read or write lease requested\n"));
2353                         granted = SMB2_LEASE_NONE;
2354                 }
2355                 if (granted == SMB2_LEASE_WRITE) {
2356                         DEBUG(10, ("pure write lease requested\n"));
2357                         granted = SMB2_LEASE_NONE;
2358                 }
2359                 if (granted == (SMB2_LEASE_WRITE|SMB2_LEASE_HANDLE)) {
2360                         DEBUG(10, ("write and handle lease requested\n"));
2361                         granted = SMB2_LEASE_NONE;
2362                 }
2363         } else {
2364                 granted = map_oplock_to_lease_type(
2365                         oplock_request & ~SAMBA_PRIVATE_OPLOCK_MASK);
2366         }
2367
2368         if (lp_locking(fsp->conn->params) && file_has_brlocks(fsp)) {
2369                 DBG_DEBUG("file %s has byte range locks\n",
2370                           fsp_str_dbg(fsp));
2371                 granted &= ~SMB2_LEASE_READ;
2372         }
2373
2374         if (state.have_other_lease) {
2375                 /*
2376                  * Can grant only one writer
2377                  */
2378                 granted &= ~SMB2_LEASE_WRITE;
2379         }
2380
2381         if ((granted & SMB2_LEASE_READ) && !(granted & SMB2_LEASE_WRITE)) {
2382                 bool allow_level2 =
2383                         (global_client_caps & CAP_LEVEL_II_OPLOCKS) &&
2384                         lp_level2_oplocks(SNUM(fsp->conn));
2385
2386                 if (!allow_level2) {
2387                         granted = SMB2_LEASE_NONE;
2388                 }
2389         }
2390
2391         if (oplock_request == LEASE_OPLOCK) {
2392                 if (state.got_oplock) {
2393                         granted &= ~SMB2_LEASE_HANDLE;
2394                 }
2395
2396                 fsp->oplock_type = LEASE_OPLOCK;
2397
2398                 status = grant_fsp_lease(fsp, lck, lease, granted);
2399                 if (!NT_STATUS_IS_OK(status)) {
2400                         return status;
2401
2402                 }
2403
2404                 DBG_DEBUG("lease_state=%d\n", fsp->lease->lease.lease_state);
2405         } else {
2406                 if (state.got_handle_lease) {
2407                         granted = SMB2_LEASE_NONE;
2408                 }
2409
2410                 fsp->oplock_type = map_lease_type_to_oplock(granted);
2411
2412                 status = set_file_oplock(fsp);
2413                 if (!NT_STATUS_IS_OK(status)) {
2414                         /*
2415                          * Could not get the kernel oplock
2416                          */
2417                         fsp->oplock_type = NO_OPLOCK;
2418                 }
2419         }
2420
2421         if (granted & SMB2_LEASE_READ) {
2422                 lck->data->flags |= SHARE_MODE_HAS_READ_LEASE;
2423         }
2424
2425         DBG_DEBUG("oplock type 0x%x on file %s\n",
2426                   fsp->oplock_type, fsp_str_dbg(fsp));
2427
2428         return NT_STATUS_OK;
2429 }
2430
2431 static NTSTATUS handle_share_mode_lease(
2432         files_struct *fsp,
2433         struct share_mode_lock *lck,
2434         uint32_t create_disposition,
2435         uint32_t access_mask,
2436         uint32_t share_access,
2437         int oplock_request,
2438         const struct smb2_lease *lease,
2439         bool first_open_attempt)
2440 {
2441         bool sharing_violation = false;
2442         NTSTATUS status;
2443
2444         status = open_mode_check(
2445                 fsp->conn, lck, access_mask, share_access);
2446         if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
2447                 sharing_violation = true;
2448                 status = NT_STATUS_OK; /* handled later */
2449         }
2450
2451         if (!NT_STATUS_IS_OK(status)) {
2452                 return status;
2453         }
2454
2455         if (oplock_request == INTERNAL_OPEN_ONLY) {
2456                 if (sharing_violation) {
2457                         DBG_DEBUG("Sharing violation for internal open\n");
2458                         return NT_STATUS_SHARING_VIOLATION;
2459                 }
2460
2461                 /*
2462                  * Internal opens never do oplocks or leases. We don't
2463                  * need to go through delay_for_oplock().
2464                  */
2465                 fsp->oplock_type = NO_OPLOCK;
2466
2467                 return NT_STATUS_OK;
2468         }
2469
2470         status = delay_for_oplock(
2471                 fsp,
2472                 oplock_request,
2473                 lease,
2474                 lck,
2475                 sharing_violation,
2476                 create_disposition,
2477                 first_open_attempt);
2478         if (!NT_STATUS_IS_OK(status)) {
2479                 return status;
2480         }
2481
2482         return NT_STATUS_OK;
2483 }
2484
2485 static bool request_timed_out(struct smb_request *req, struct timeval timeout)
2486 {
2487         struct timeval now, end_time;
2488         GetTimeOfDay(&now);
2489         end_time = timeval_sum(&req->request_time, &timeout);
2490         return (timeval_compare(&end_time, &now) < 0);
2491 }
2492
2493 struct defer_open_state {
2494         struct smbXsrv_connection *xconn;
2495         uint64_t mid;
2496 };
2497
2498 static void defer_open_done(struct tevent_req *req);
2499
2500 /**
2501  * Defer an open and watch a locking.tdb record
2502  *
2503  * This defers an open that gets rescheduled once the locking.tdb record watch
2504  * is triggered by a change to the record.
2505  *
2506  * It is used to defer opens that triggered an oplock break and for the SMB1
2507  * sharing violation delay.
2508  **/
2509 static void defer_open(struct share_mode_lock *lck,
2510                        struct timeval timeout,
2511                        struct smb_request *req,
2512                        bool delayed_for_oplocks,
2513                        struct file_id id)
2514 {
2515         struct deferred_open_record *open_rec = NULL;
2516         struct timeval abs_timeout;
2517         struct defer_open_state *watch_state;
2518         struct tevent_req *watch_req;
2519         struct timeval_buf tvbuf1, tvbuf2;
2520         struct file_id_buf fbuf;
2521         bool ok;
2522
2523         abs_timeout = timeval_sum(&req->request_time, &timeout);
2524
2525         DBG_DEBUG("request time [%s] timeout [%s] mid [%" PRIu64 "] "
2526                   "delayed_for_oplocks [%s] file_id [%s]\n",
2527                   timeval_str_buf(&req->request_time, false, true, &tvbuf1),
2528                   timeval_str_buf(&abs_timeout, false, true, &tvbuf2),
2529                   req->mid,
2530                   delayed_for_oplocks ? "yes" : "no",
2531                   file_id_str_buf(id, &fbuf));
2532
2533         open_rec = talloc_zero(NULL, struct deferred_open_record);
2534         if (open_rec == NULL) {
2535                 TALLOC_FREE(lck);
2536                 exit_server("talloc failed");
2537         }
2538
2539         watch_state = talloc(open_rec, struct defer_open_state);
2540         if (watch_state == NULL) {
2541                 exit_server("talloc failed");
2542         }
2543         watch_state->xconn = req->xconn;
2544         watch_state->mid = req->mid;
2545
2546         DBG_DEBUG("defering mid %" PRIu64 "\n", req->mid);
2547
2548         watch_req = dbwrap_watched_watch_send(watch_state,
2549                                               req->sconn->ev_ctx,
2550                                               lck->data->record,
2551                                               (struct server_id){0});
2552         if (watch_req == NULL) {
2553                 exit_server("Could not watch share mode record");
2554         }
2555         tevent_req_set_callback(watch_req, defer_open_done, watch_state);
2556
2557         ok = tevent_req_set_endtime(watch_req, req->sconn->ev_ctx, abs_timeout);
2558         if (!ok) {
2559                 exit_server("tevent_req_set_endtime failed");
2560         }
2561
2562         ok = push_deferred_open_message_smb(req, timeout, id, open_rec);
2563         if (!ok) {
2564                 TALLOC_FREE(lck);
2565                 exit_server("push_deferred_open_message_smb failed");
2566         }
2567 }
2568
2569 static void defer_open_done(struct tevent_req *req)
2570 {
2571         struct defer_open_state *state = tevent_req_callback_data(
2572                 req, struct defer_open_state);
2573         NTSTATUS status;
2574         bool ret;
2575
2576         status = dbwrap_watched_watch_recv(req, NULL, NULL);
2577         TALLOC_FREE(req);
2578         if (!NT_STATUS_IS_OK(status)) {
2579                 DEBUG(5, ("dbwrap_watched_watch_recv returned %s\n",
2580                           nt_errstr(status)));
2581                 /*
2582                  * Even if it failed, retry anyway. TODO: We need a way to
2583                  * tell a re-scheduled open about that error.
2584                  */
2585         }
2586
2587         DEBUG(10, ("scheduling mid %llu\n", (unsigned long long)state->mid));
2588
2589         ret = schedule_deferred_open_message_smb(state->xconn, state->mid);
2590         SMB_ASSERT(ret);
2591         TALLOC_FREE(state);
2592 }
2593
2594 /**
2595  * Actually attempt the kernel oplock polling open.
2596  */
2597
2598 static void poll_open_fn(struct tevent_context *ev,
2599                          struct tevent_timer *te,
2600                          struct timeval current_time,
2601                          void *private_data)
2602 {
2603         struct deferred_open_record *open_rec = talloc_get_type_abort(
2604                 private_data, struct deferred_open_record);
2605         bool ok;
2606
2607         TALLOC_FREE(open_rec->watch_req);
2608
2609         ok = schedule_deferred_open_message_smb(
2610                 open_rec->xconn, open_rec->mid);
2611         if (!ok) {
2612                 exit_server("schedule_deferred_open_message_smb failed");
2613         }
2614         DBG_DEBUG("timer fired. Retrying open !\n");
2615 }
2616
2617 static void poll_open_done(struct tevent_req *subreq);
2618
2619 /**
2620  * Reschedule an open for 1 second from now, if not timed out.
2621  **/
2622 static bool setup_poll_open(
2623         struct smb_request *req,
2624         struct share_mode_lock *lck,
2625         struct file_id id,
2626         struct timeval max_timeout,
2627         struct timeval interval)
2628 {
2629         bool ok;
2630         struct deferred_open_record *open_rec = NULL;
2631         struct timeval endtime, next_interval;
2632         struct file_id_buf ftmp;
2633
2634         if (request_timed_out(req, max_timeout)) {
2635                 return false;
2636         }
2637
2638         open_rec = talloc_zero(NULL, struct deferred_open_record);
2639         if (open_rec == NULL) {
2640                 DBG_WARNING("talloc failed\n");
2641                 return false;
2642         }
2643         open_rec->xconn = req->xconn;
2644         open_rec->mid = req->mid;
2645
2646         /*
2647          * Make sure open_rec->te does not come later than the
2648          * request's maximum endtime.
2649          */
2650
2651         endtime = timeval_sum(&req->request_time, &max_timeout);
2652         next_interval = timeval_current_ofs(interval.tv_sec, interval.tv_usec);
2653         next_interval = timeval_min(&endtime, &next_interval);
2654
2655         open_rec->te = tevent_add_timer(
2656                 req->sconn->ev_ctx,
2657                 open_rec,
2658                 next_interval,
2659                 poll_open_fn,
2660                 open_rec);
2661         if (open_rec->te == NULL) {
2662                 DBG_WARNING("tevent_add_timer failed\n");
2663                 TALLOC_FREE(open_rec);
2664                 return false;
2665         }
2666
2667         if (lck != NULL) {
2668                 open_rec->watch_req = dbwrap_watched_watch_send(
2669                         open_rec,
2670                         req->sconn->ev_ctx,
2671                         lck->data->record,
2672                         (struct server_id) {0});
2673                 if (open_rec->watch_req == NULL) {
2674                         DBG_WARNING("dbwrap_watched_watch_send failed\n");
2675                         TALLOC_FREE(open_rec);
2676                         return false;
2677                 }
2678                 tevent_req_set_callback(
2679                         open_rec->watch_req, poll_open_done, open_rec);
2680         }
2681
2682         ok = push_deferred_open_message_smb(req, max_timeout, id, open_rec);
2683         if (!ok) {
2684                 DBG_WARNING("push_deferred_open_message_smb failed\n");
2685                 TALLOC_FREE(open_rec);
2686                 return false;
2687         }
2688
2689         DBG_DEBUG("poll request time [%s] mid [%" PRIu64 "] file_id [%s]\n",
2690                   timeval_string(talloc_tos(), &req->request_time, false),
2691                   req->mid,
2692                   file_id_str_buf(id, &ftmp));
2693
2694         return true;
2695 }
2696
2697 static void poll_open_done(struct tevent_req *subreq)
2698 {
2699         struct deferred_open_record *open_rec = tevent_req_callback_data(
2700                 subreq, struct deferred_open_record);
2701         NTSTATUS status;
2702         bool ok;
2703
2704         status = dbwrap_watched_watch_recv(subreq, NULL, NULL);
2705         TALLOC_FREE(subreq);
2706         DBG_DEBUG("dbwrap_watched_watch_recv returned %s\n",
2707                   nt_errstr(status));
2708
2709         ok = schedule_deferred_open_message_smb(
2710                 open_rec->xconn, open_rec->mid);
2711         if (!ok) {
2712                 exit_server("schedule_deferred_open_message_smb failed");
2713         }
2714 }
2715
2716 bool defer_smb1_sharing_violation(struct smb_request *req)
2717 {
2718         bool ok;
2719         int timeout_usecs;
2720
2721         if (!lp_defer_sharing_violations()) {
2722                 return false;
2723         }
2724
2725         /*
2726          * Try every 200msec up to (by default) one second. To be
2727          * precise, according to behaviour note <247> in [MS-CIFS],
2728          * the server tries 5 times. But up to one second should be
2729          * close enough.
2730          */
2731
2732         timeout_usecs = lp_parm_int(
2733                 SNUM(req->conn),
2734                 "smbd",
2735                 "sharedelay",
2736                 SHARING_VIOLATION_USEC_WAIT);
2737
2738         ok = setup_poll_open(
2739                 req,
2740                 NULL,
2741                 (struct file_id) {0},
2742                 (struct timeval) { .tv_usec = timeout_usecs },
2743                 (struct timeval) { .tv_usec = 200000 });
2744         return ok;
2745 }
2746
2747 /****************************************************************************
2748  On overwrite open ensure that the attributes match.
2749 ****************************************************************************/
2750
2751 static bool open_match_attributes(connection_struct *conn,
2752                                   uint32_t old_dos_attr,
2753                                   uint32_t new_dos_attr,
2754                                   mode_t new_unx_mode,
2755                                   mode_t *returned_unx_mode)
2756 {
2757         uint32_t noarch_old_dos_attr, noarch_new_dos_attr;
2758
2759         noarch_old_dos_attr = (old_dos_attr & ~FILE_ATTRIBUTE_ARCHIVE);
2760         noarch_new_dos_attr = (new_dos_attr & ~FILE_ATTRIBUTE_ARCHIVE);
2761
2762         if((noarch_old_dos_attr == 0 && noarch_new_dos_attr != 0) ||
2763            (noarch_old_dos_attr != 0 && ((noarch_old_dos_attr & noarch_new_dos_attr) == noarch_old_dos_attr))) {
2764                 *returned_unx_mode = new_unx_mode;
2765         } else {
2766                 *returned_unx_mode = (mode_t)0;
2767         }
2768
2769         DEBUG(10,("open_match_attributes: old_dos_attr = 0x%x, "
2770                   "new_dos_attr = 0x%x "
2771                   "returned_unx_mode = 0%o\n",
2772                   (unsigned int)old_dos_attr,
2773                   (unsigned int)new_dos_attr,
2774                   (unsigned int)*returned_unx_mode ));
2775
2776         /* If we're mapping SYSTEM and HIDDEN ensure they match. */
2777         if (lp_map_system(SNUM(conn)) || lp_store_dos_attributes(SNUM(conn))) {
2778                 if ((old_dos_attr & FILE_ATTRIBUTE_SYSTEM) &&
2779                     !(new_dos_attr & FILE_ATTRIBUTE_SYSTEM)) {
2780                         return False;
2781                 }
2782         }
2783         if (lp_map_hidden(SNUM(conn)) || lp_store_dos_attributes(SNUM(conn))) {
2784                 if ((old_dos_attr & FILE_ATTRIBUTE_HIDDEN) &&
2785                     !(new_dos_attr & FILE_ATTRIBUTE_HIDDEN)) {
2786                         return False;
2787                 }
2788         }
2789         return True;
2790 }
2791
2792 static void schedule_defer_open(struct share_mode_lock *lck,
2793                                 struct file_id id,
2794                                 struct smb_request *req)
2795 {
2796         /* This is a relative time, added to the absolute
2797            request_time value to get the absolute timeout time.
2798            Note that if this is the second or greater time we enter
2799            this codepath for this particular request mid then
2800            request_time is left as the absolute time of the *first*
2801            time this request mid was processed. This is what allows
2802            the request to eventually time out. */
2803
2804         struct timeval timeout;
2805
2806         /* Normally the smbd we asked should respond within
2807          * OPLOCK_BREAK_TIMEOUT seconds regardless of whether
2808          * the client did, give twice the timeout as a safety
2809          * measure here in case the other smbd is stuck
2810          * somewhere else. */
2811
2812         timeout = timeval_set(OPLOCK_BREAK_TIMEOUT*2, 0);
2813
2814         if (request_timed_out(req, timeout)) {
2815                 return;
2816         }
2817
2818         defer_open(lck, timeout, req, true, id);
2819 }
2820
2821 /****************************************************************************
2822  Reschedule an open call that went asynchronous.
2823 ****************************************************************************/
2824
2825 static void schedule_async_open_timer(struct tevent_context *ev,
2826                                       struct tevent_timer *te,
2827                                       struct timeval current_time,
2828                                       void *private_data)
2829 {
2830         exit_server("async open timeout");
2831 }
2832
2833 static void schedule_async_open(struct smb_request *req)
2834 {
2835         struct deferred_open_record *open_rec = NULL;
2836         struct timeval timeout = timeval_set(20, 0);
2837         bool ok;
2838
2839         if (request_timed_out(req, timeout)) {
2840                 return;
2841         }
2842
2843         open_rec = talloc_zero(NULL, struct deferred_open_record);
2844         if (open_rec == NULL) {
2845                 exit_server("deferred_open_record_create failed");
2846         }
2847         open_rec->async_open = true;
2848
2849         ok = push_deferred_open_message_smb(
2850                 req, timeout, (struct file_id){0}, open_rec);
2851         if (!ok) {
2852                 exit_server("push_deferred_open_message_smb failed");
2853         }
2854
2855         open_rec->te = tevent_add_timer(req->sconn->ev_ctx,
2856                                         req,
2857                                         timeval_current_ofs(20, 0),
2858                                         schedule_async_open_timer,
2859                                         open_rec);
2860         if (open_rec->te == NULL) {
2861                 exit_server("tevent_add_timer failed");
2862         }
2863 }
2864
2865 /****************************************************************************
2866  Work out what access_mask to use from what the client sent us.
2867 ****************************************************************************/
2868
2869 static NTSTATUS smbd_calculate_maximum_allowed_access(
2870         connection_struct *conn,
2871         const struct smb_filename *smb_fname,
2872         bool use_privs,
2873         uint32_t *p_access_mask)
2874 {
2875         struct security_descriptor *sd;
2876         uint32_t access_granted;
2877         NTSTATUS status;
2878
2879         if (!use_privs && (get_current_uid(conn) == (uid_t)0)) {
2880                 *p_access_mask |= FILE_GENERIC_ALL;
2881                 return NT_STATUS_OK;
2882         }
2883
2884         status = SMB_VFS_GET_NT_ACL(conn, smb_fname,
2885                                     (SECINFO_OWNER |
2886                                      SECINFO_GROUP |
2887                                      SECINFO_DACL),
2888                                     talloc_tos(), &sd);
2889
2890         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
2891                 /*
2892                  * File did not exist
2893                  */
2894                 *p_access_mask = FILE_GENERIC_ALL;
2895                 return NT_STATUS_OK;
2896         }
2897         if (!NT_STATUS_IS_OK(status)) {
2898                 DEBUG(10,("Could not get acl on file %s: %s\n",
2899                           smb_fname_str_dbg(smb_fname),
2900                           nt_errstr(status)));
2901                 return NT_STATUS_ACCESS_DENIED;
2902         }
2903
2904         /*
2905          * If we can access the path to this file, by
2906          * default we have FILE_READ_ATTRIBUTES from the
2907          * containing directory. See the section:
2908          * "Algorithm to Check Access to an Existing File"
2909          * in MS-FSA.pdf.
2910          *
2911          * se_file_access_check()
2912          * also takes care of owner WRITE_DAC and READ_CONTROL.
2913          */
2914         status = se_file_access_check(sd,
2915                                  get_current_nttok(conn),
2916                                  use_privs,
2917                                  (*p_access_mask & ~FILE_READ_ATTRIBUTES),
2918                                  &access_granted);
2919
2920         TALLOC_FREE(sd);
2921
2922         if (!NT_STATUS_IS_OK(status)) {
2923                 DEBUG(10, ("Access denied on file %s: "
2924                            "when calculating maximum access\n",
2925                            smb_fname_str_dbg(smb_fname)));
2926                 return NT_STATUS_ACCESS_DENIED;
2927         }
2928         *p_access_mask = (access_granted | FILE_READ_ATTRIBUTES);
2929
2930         if (!(access_granted & DELETE_ACCESS)) {
2931                 if (can_delete_file_in_directory(conn, smb_fname)) {
2932                         *p_access_mask |= DELETE_ACCESS;
2933                 }
2934         }
2935
2936         return NT_STATUS_OK;
2937 }
2938
2939 NTSTATUS smbd_calculate_access_mask(connection_struct *conn,
2940                                     const struct smb_filename *smb_fname,
2941                                     bool use_privs,
2942                                     uint32_t access_mask,
2943                                     uint32_t *access_mask_out)
2944 {
2945         NTSTATUS status;
2946         uint32_t orig_access_mask = access_mask;
2947         uint32_t rejected_share_access;
2948
2949         if (access_mask & SEC_MASK_INVALID) {
2950                 DBG_DEBUG("access_mask [%8x] contains invalid bits\n",
2951                           access_mask);
2952                 return NT_STATUS_ACCESS_DENIED;
2953         }
2954
2955         /*
2956          * Convert GENERIC bits to specific bits.
2957          */
2958
2959         se_map_generic(&access_mask, &file_generic_mapping);
2960
2961         /* Calculate MAXIMUM_ALLOWED_ACCESS if requested. */
2962         if (access_mask & MAXIMUM_ALLOWED_ACCESS) {
2963
2964                 status = smbd_calculate_maximum_allowed_access(
2965                         conn, smb_fname, use_privs, &access_mask);
2966
2967                 if (!NT_STATUS_IS_OK(status)) {
2968                         return status;
2969                 }
2970
2971                 access_mask &= conn->share_access;
2972         }
2973
2974         rejected_share_access = access_mask & ~(conn->share_access);
2975
2976         if (rejected_share_access) {
2977                 DEBUG(10, ("smbd_calculate_access_mask: Access denied on "
2978                         "file %s: rejected by share access mask[0x%08X] "
2979                         "orig[0x%08X] mapped[0x%08X] reject[0x%08X]\n",
2980                         smb_fname_str_dbg(smb_fname),
2981                         conn->share_access,
2982                         orig_access_mask, access_mask,
2983                         rejected_share_access));
2984                 return NT_STATUS_ACCESS_DENIED;
2985         }
2986
2987         *access_mask_out = access_mask;
2988         return NT_STATUS_OK;
2989 }
2990
2991 /****************************************************************************
2992  Remove the deferred open entry under lock.
2993 ****************************************************************************/
2994
2995 /****************************************************************************
2996  Return true if this is a state pointer to an asynchronous create.
2997 ****************************************************************************/
2998
2999 bool is_deferred_open_async(const struct deferred_open_record *rec)
3000 {
3001         return rec->async_open;
3002 }
3003
3004 static bool clear_ads(uint32_t create_disposition)
3005 {
3006         bool ret = false;
3007
3008         switch (create_disposition) {
3009         case FILE_SUPERSEDE:
3010         case FILE_OVERWRITE_IF:
3011         case FILE_OVERWRITE:
3012                 ret = true;
3013                 break;
3014         default:
3015                 break;
3016         }
3017         return ret;
3018 }
3019
3020 static int disposition_to_open_flags(uint32_t create_disposition)
3021 {
3022         int ret = 0;
3023
3024         /*
3025          * Currently we're using FILE_SUPERSEDE as the same as
3026          * FILE_OVERWRITE_IF but they really are
3027          * different. FILE_SUPERSEDE deletes an existing file
3028          * (requiring delete access) then recreates it.
3029          */
3030
3031         switch (create_disposition) {
3032         case FILE_SUPERSEDE:
3033         case FILE_OVERWRITE_IF:
3034                 /*
3035                  * If file exists replace/overwrite. If file doesn't
3036                  * exist create.
3037                  */
3038                 ret = O_CREAT|O_TRUNC;
3039                 break;
3040
3041         case FILE_OPEN:
3042                 /*
3043                  * If file exists open. If file doesn't exist error.
3044                  */
3045                 ret = 0;
3046                 break;
3047
3048         case FILE_OVERWRITE:
3049                 /*
3050                  * If file exists overwrite. If file doesn't exist
3051                  * error.
3052                  */
3053                 ret = O_TRUNC;
3054                 break;
3055
3056         case FILE_CREATE:
3057                 /*
3058                  * If file exists error. If file doesn't exist create.
3059                  */
3060                 ret = O_CREAT|O_EXCL;
3061                 break;
3062
3063         case FILE_OPEN_IF:
3064                 /*
3065                  * If file exists open. If file doesn't exist create.
3066                  */
3067                 ret = O_CREAT;
3068                 break;
3069         }
3070         return ret;
3071 }
3072
3073 static int calculate_open_access_flags(uint32_t access_mask,
3074                                        uint32_t private_flags)
3075 {
3076         bool need_write, need_read;
3077
3078         /*
3079          * Note that we ignore the append flag as append does not
3080          * mean the same thing under DOS and Unix.
3081          */
3082
3083         need_write = (access_mask & (FILE_WRITE_DATA | FILE_APPEND_DATA));
3084         if (!need_write) {
3085                 return O_RDONLY;
3086         }
3087
3088         /* DENY_DOS opens are always underlying read-write on the
3089            file handle, no matter what the requested access mask
3090            says. */
3091
3092         need_read =
3093                 ((private_flags & NTCREATEX_OPTIONS_PRIVATE_DENY_DOS) ||
3094                  access_mask & (FILE_READ_ATTRIBUTES|FILE_READ_DATA|
3095                                 FILE_READ_EA|FILE_EXECUTE));
3096
3097         if (!need_read) {
3098                 return O_WRONLY;
3099         }
3100         return O_RDWR;
3101 }
3102
3103 /****************************************************************************
3104  Open a file with a share mode. Passed in an already created files_struct *.
3105 ****************************************************************************/
3106
3107 static NTSTATUS open_file_ntcreate(connection_struct *conn,
3108                             struct smb_request *req,
3109                             uint32_t access_mask,               /* access bits (FILE_READ_DATA etc.) */
3110                             uint32_t share_access,      /* share constants (FILE_SHARE_READ etc) */
3111                             uint32_t create_disposition,        /* FILE_OPEN_IF etc. */
3112                             uint32_t create_options,    /* options such as delete on close. */
3113                             uint32_t new_dos_attributes,        /* attributes used for new file. */
3114                             int oplock_request,         /* internal Samba oplock codes. */
3115                             const struct smb2_lease *lease,
3116                                                         /* Information (FILE_EXISTS etc.) */
3117                             uint32_t private_flags,     /* Samba specific flags. */
3118                             int *pinfo,
3119                             files_struct *fsp)
3120 {
3121         struct smb_filename *smb_fname = fsp->fsp_name;
3122         int flags=0;
3123         int flags2=0;
3124         bool file_existed = VALID_STAT(smb_fname->st);
3125         bool def_acl = False;
3126         bool posix_open = False;
3127         bool new_file_created = False;
3128         bool first_open_attempt = true;
3129         NTSTATUS fsp_open = NT_STATUS_ACCESS_DENIED;
3130         mode_t new_unx_mode = (mode_t)0;
3131         mode_t unx_mode = (mode_t)0;
3132         int info;
3133         uint32_t existing_dos_attributes = 0;
3134         struct share_mode_lock *lck = NULL;
3135         uint32_t open_access_mask = access_mask;
3136         NTSTATUS status;
3137         char *parent_dir;
3138         SMB_STRUCT_STAT saved_stat = smb_fname->st;
3139         struct timespec old_write_time;
3140         struct file_id id;
3141         bool ok;
3142
3143         if (conn->printer) {
3144                 /*
3145                  * Printers are handled completely differently.
3146                  * Most of the passed parameters are ignored.
3147                  */
3148
3149                 if (pinfo) {
3150                         *pinfo = FILE_WAS_CREATED;
3151                 }
3152
3153                 DEBUG(10, ("open_file_ntcreate: printer open fname=%s\n",
3154                            smb_fname_str_dbg(smb_fname)));
3155
3156                 if (!req) {
3157                         DEBUG(0,("open_file_ntcreate: printer open without "
3158                                 "an SMB request!\n"));
3159                         return NT_STATUS_INTERNAL_ERROR;
3160                 }
3161
3162                 return print_spool_open(fsp, smb_fname->base_name,
3163                                         req->vuid);
3164         }
3165
3166         if (!parent_dirname(talloc_tos(), smb_fname->base_name, &parent_dir,
3167                             NULL)) {
3168                 return NT_STATUS_NO_MEMORY;
3169         }
3170
3171         if (new_dos_attributes & FILE_FLAG_POSIX_SEMANTICS) {
3172                 posix_open = True;
3173                 unx_mode = (mode_t)(new_dos_attributes & ~FILE_FLAG_POSIX_SEMANTICS);
3174                 new_dos_attributes = 0;
3175         } else {
3176                 /* Windows allows a new file to be created and
3177                    silently removes a FILE_ATTRIBUTE_DIRECTORY
3178                    sent by the client. Do the same. */
3179
3180                 new_dos_attributes &= ~FILE_ATTRIBUTE_DIRECTORY;
3181
3182                 /* We add FILE_ATTRIBUTE_ARCHIVE to this as this mode is only used if the file is
3183                  * created new. */
3184                 unx_mode = unix_mode(conn, new_dos_attributes | FILE_ATTRIBUTE_ARCHIVE,
3185                                      smb_fname, parent_dir);
3186         }
3187
3188         DEBUG(10, ("open_file_ntcreate: fname=%s, dos_attrs=0x%x "
3189                    "access_mask=0x%x share_access=0x%x "
3190                    "create_disposition = 0x%x create_options=0x%x "
3191                    "unix mode=0%o oplock_request=%d private_flags = 0x%x\n",
3192                    smb_fname_str_dbg(smb_fname), new_dos_attributes,
3193                    access_mask, share_access, create_disposition,
3194                    create_options, (unsigned int)unx_mode, oplock_request,
3195                    (unsigned int)private_flags));
3196
3197         if (req == NULL) {
3198                 /* Ensure req == NULL means INTERNAL_OPEN_ONLY */
3199                 SMB_ASSERT(oplock_request == INTERNAL_OPEN_ONLY);
3200         } else {
3201                 /* And req != NULL means no INTERNAL_OPEN_ONLY */
3202                 SMB_ASSERT(((oplock_request & INTERNAL_OPEN_ONLY) == 0));
3203         }
3204
3205         /*
3206          * Only non-internal opens can be deferred at all
3207          */
3208
3209         if (req) {
3210                 struct deferred_open_record *open_rec;
3211                 if (get_deferred_open_message_state(req, NULL, &open_rec)) {
3212
3213                         /* If it was an async create retry, the file
3214                            didn't exist. */
3215
3216                         if (is_deferred_open_async(open_rec)) {
3217                                 SET_STAT_INVALID(smb_fname->st);
3218                                 file_existed = false;
3219                         }
3220
3221                         /* Ensure we don't reprocess this message. */
3222                         remove_deferred_open_message_smb(req->xconn, req->mid);
3223
3224                         first_open_attempt = false;
3225                 }
3226         }
3227
3228         if (!posix_open) {
3229                 new_dos_attributes &= SAMBA_ATTRIBUTES_MASK;
3230                 if (file_existed) {
3231                         /*
3232                          * Only use stored DOS attributes for checks
3233                          * against requested attributes (below via
3234                          * open_match_attributes()), cf bug #11992
3235                          * for details. -slow
3236                          */
3237                         uint32_t attr = 0;
3238
3239                         status = SMB_VFS_GET_DOS_ATTRIBUTES(conn, smb_fname, &attr);
3240                         if (NT_STATUS_IS_OK(status)) {
3241                                 existing_dos_attributes = attr;
3242                         }
3243                 }
3244         }
3245
3246         /* ignore any oplock requests if oplocks are disabled */
3247         if (!lp_oplocks(SNUM(conn)) ||
3248             IS_VETO_OPLOCK_PATH(conn, smb_fname->base_name)) {
3249                 /* Mask off everything except the private Samba bits. */
3250                 oplock_request &= SAMBA_PRIVATE_OPLOCK_MASK;
3251         }
3252
3253         /* this is for OS/2 long file names - say we don't support them */
3254         if (req != NULL && !req->posix_pathnames &&
3255                         strstr(smb_fname->base_name,".+,;=[].")) {
3256                 /* OS/2 Workplace shell fix may be main code stream in a later
3257                  * release. */
3258                 DEBUG(5,("open_file_ntcreate: OS/2 long filenames are not "
3259                          "supported.\n"));
3260                 if (use_nt_status()) {
3261                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3262                 }
3263                 return NT_STATUS_DOS(ERRDOS, ERRcannotopen);
3264         }
3265
3266         switch( create_disposition ) {
3267                 case FILE_OPEN:
3268                         /* If file exists open. If file doesn't exist error. */
3269                         if (!file_existed) {
3270                                 DEBUG(5,("open_file_ntcreate: FILE_OPEN "
3271                                          "requested for file %s and file "
3272                                          "doesn't exist.\n",
3273                                          smb_fname_str_dbg(smb_fname)));
3274                                 errno = ENOENT;
3275                                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3276                         }
3277                         break;
3278
3279                 case FILE_OVERWRITE:
3280                         /* If file exists overwrite. If file doesn't exist
3281                          * error. */
3282                         if (!file_existed) {
3283                                 DEBUG(5,("open_file_ntcreate: FILE_OVERWRITE "
3284                                          "requested for file %s and file "
3285                                          "doesn't exist.\n",
3286                                          smb_fname_str_dbg(smb_fname) ));
3287                                 errno = ENOENT;
3288                                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3289                         }
3290                         break;
3291
3292                 case FILE_CREATE:
3293                         /* If file exists error. If file doesn't exist
3294                          * create. */
3295                         if (file_existed) {
3296                                 DEBUG(5,("open_file_ntcreate: FILE_CREATE "
3297                                          "requested for file %s and file "
3298                                          "already exists.\n",
3299                                          smb_fname_str_dbg(smb_fname)));
3300                                 if (S_ISDIR(smb_fname->st.st_ex_mode)) {
3301                                         errno = EISDIR;
3302                                 } else {
3303                                         errno = EEXIST;
3304                                 }
3305                                 return map_nt_error_from_unix(errno);
3306                         }
3307                         break;
3308
3309                 case FILE_SUPERSEDE:
3310                 case FILE_OVERWRITE_IF:
3311                 case FILE_OPEN_IF:
3312                         break;
3313                 default:
3314                         return NT_STATUS_INVALID_PARAMETER;
3315         }
3316
3317         flags2 = disposition_to_open_flags(create_disposition);
3318
3319         /* We only care about matching attributes on file exists and
3320          * overwrite. */
3321
3322         if (!posix_open && file_existed &&
3323             ((create_disposition == FILE_OVERWRITE) ||
3324              (create_disposition == FILE_OVERWRITE_IF))) {
3325                 if (!open_match_attributes(conn, existing_dos_attributes,
3326                                            new_dos_attributes,
3327                                            unx_mode, &new_unx_mode)) {
3328                         DEBUG(5,("open_file_ntcreate: attributes mismatch "
3329                                  "for file %s (%x %x) (0%o, 0%o)\n",
3330                                  smb_fname_str_dbg(smb_fname),
3331                                  existing_dos_attributes,
3332                                  new_dos_attributes,
3333                                  (unsigned int)smb_fname->st.st_ex_mode,
3334                                  (unsigned int)unx_mode ));
3335                         errno = EACCES;
3336                         return NT_STATUS_ACCESS_DENIED;
3337                 }
3338         }
3339
3340         status = smbd_calculate_access_mask(conn, smb_fname,
3341                                         false,
3342                                         access_mask,
3343                                         &access_mask);
3344         if (!NT_STATUS_IS_OK(status)) {
3345                 DEBUG(10, ("open_file_ntcreate: smbd_calculate_access_mask "
3346                         "on file %s returned %s\n",
3347                         smb_fname_str_dbg(smb_fname), nt_errstr(status)));
3348                 return status;
3349         }
3350
3351         open_access_mask = access_mask;
3352
3353         if (flags2 & O_TRUNC) {
3354                 open_access_mask |= FILE_WRITE_DATA; /* This will cause oplock breaks. */
3355         }
3356
3357         if (file_existed) {
3358                 /*
3359                  * stat opens on existing files don't get oplocks.
3360                  * They can get leases.
3361                  *
3362                  * Note that we check for stat open on the *open_access_mask*,
3363                  * i.e. the access mask we actually used to do the open,
3364                  * not the one the client asked for (which is in
3365                  * fsp->access_mask). This is due to the fact that
3366                  * FILE_OVERWRITE and FILE_OVERWRITE_IF add in O_TRUNC,
3367                  * which adds FILE_WRITE_DATA to open_access_mask.
3368                  */
3369                 if (is_stat_open(open_access_mask) && lease == NULL) {
3370                         oplock_request = NO_OPLOCK;
3371                 }
3372         }
3373
3374         DEBUG(10, ("open_file_ntcreate: fname=%s, after mapping "
3375                    "access_mask=0x%x\n", smb_fname_str_dbg(smb_fname),
3376                     access_mask));
3377
3378         /*
3379          * Note that we ignore the append flag as append does not
3380          * mean the same thing under DOS and Unix.
3381          */
3382
3383         flags = calculate_open_access_flags(access_mask, private_flags);
3384
3385         /*
3386          * Currently we only look at FILE_WRITE_THROUGH for create options.
3387          */
3388
3389 #if defined(O_SYNC)
3390         if ((create_options & FILE_WRITE_THROUGH) && lp_strict_sync(SNUM(conn))) {
3391                 flags2 |= O_SYNC;
3392         }
3393 #endif /* O_SYNC */
3394
3395         if (posix_open && (access_mask & FILE_APPEND_DATA)) {
3396                 flags2 |= O_APPEND;
3397         }
3398
3399         if (!posix_open && !CAN_WRITE(conn)) {
3400                 /*
3401                  * We should really return a permission denied error if either
3402                  * O_CREAT or O_TRUNC are set, but for compatibility with
3403                  * older versions of Samba we just AND them out.
3404                  */
3405                 flags2 &= ~(O_CREAT|O_TRUNC);
3406         }
3407
3408         /*
3409          * With kernel oplocks the open breaking an oplock
3410          * blocks until the oplock holder has given up the
3411          * oplock or closed the file. We prevent this by always
3412          * trying to open the file with O_NONBLOCK (see "man
3413          * fcntl" on Linux).
3414          *
3415          * If a process that doesn't use the smbd open files
3416          * database or communication methods holds a kernel
3417          * oplock we must periodically poll for available open
3418          * using O_NONBLOCK.
3419          */
3420         flags2 |= O_NONBLOCK;
3421
3422         /*
3423          * Ensure we can't write on a read-only share or file.
3424          */
3425
3426         if (flags != O_RDONLY && file_existed &&
3427             (!CAN_WRITE(conn) || IS_DOS_READONLY(existing_dos_attributes))) {
3428                 DEBUG(5,("open_file_ntcreate: write access requested for "
3429                          "file %s on read only %s\n",
3430                          smb_fname_str_dbg(smb_fname),
3431                          !CAN_WRITE(conn) ? "share" : "file" ));
3432                 errno = EACCES;
3433                 return NT_STATUS_ACCESS_DENIED;
3434         }
3435
3436         fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
3437         fsp->fh->private_options = private_flags;
3438         fsp->access_mask = open_access_mask; /* We change this to the
3439                                               * requested access_mask after
3440                                               * the open is done. */
3441         if (posix_open) {
3442                 fsp->posix_flags |= FSP_POSIX_FLAGS_ALL;
3443         }
3444
3445         if ((create_options & FILE_DELETE_ON_CLOSE) &&
3446                         (flags2 & O_CREAT) &&
3447                         !file_existed) {
3448                 /* Delete on close semantics for new files. */
3449                 status = can_set_delete_on_close(fsp,
3450                                                 new_dos_attributes);
3451                 if (!NT_STATUS_IS_OK(status)) {
3452                         fd_close(fsp);
3453                         return status;
3454                 }
3455         }
3456
3457         /*
3458          * Ensure we pay attention to default ACLs on directories if required.
3459          */
3460
3461         if ((flags2 & O_CREAT) && lp_inherit_acls(SNUM(conn)) &&
3462             (def_acl = directory_has_default_acl(conn, parent_dir))) {
3463                 unx_mode = (0777 & lp_create_mask(SNUM(conn)));
3464         }
3465
3466         DEBUG(4,("calling open_file with flags=0x%X flags2=0x%X mode=0%o, "
3467                 "access_mask = 0x%x, open_access_mask = 0x%x\n",
3468                  (unsigned int)flags, (unsigned int)flags2,
3469                  (unsigned int)unx_mode, (unsigned int)access_mask,
3470                  (unsigned int)open_access_mask));
3471
3472         fsp_open = open_file(fsp, conn, req, parent_dir,
3473                              flags|flags2, unx_mode, access_mask,
3474                              open_access_mask, &new_file_created);
3475
3476         if (NT_STATUS_EQUAL(fsp_open, NT_STATUS_NETWORK_BUSY)) {
3477                 /*
3478                  * This handles the kernel oplock case:
3479                  *
3480                  * the file has an active kernel oplock and the open() returned
3481                  * EWOULDBLOCK/EAGAIN which maps to NETWORK_BUSY.
3482                  *
3483                  * "Samba locking.tdb oplocks" are handled below after acquiring
3484                  * the sharemode lock with get_share_mode_lock().
3485                  */
3486                 if (file_existed && S_ISFIFO(fsp->fsp_name->st.st_ex_mode)) {
3487                         DEBUG(10, ("FIFO busy\n"));
3488                         return NT_STATUS_NETWORK_BUSY;
3489                 }
3490                 if (req == NULL) {
3491                         DEBUG(10, ("Internal open busy\n"));
3492                         return NT_STATUS_NETWORK_BUSY;
3493                 }
3494
3495                 /*
3496                  * From here on we assume this is an oplock break triggered
3497                  */
3498
3499                 lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
3500
3501                 if ((lck != NULL) && !validate_oplock_types(lck)) {
3502                         smb_panic("validate_oplock_types failed");
3503                 }
3504
3505                 /*
3506                  * Retry once a second. If there's a share_mode_lock
3507                  * around, also wait for it in case it was smbd
3508                  * holding that kernel oplock that can quickly tell us
3509                  * the oplock got removed.
3510                  */
3511
3512                 setup_poll_open(
3513                         req,
3514                         lck,
3515                         fsp->file_id,
3516                         timeval_set(OPLOCK_BREAK_TIMEOUT*2, 0),
3517                         timeval_set(1, 0));
3518
3519                 TALLOC_FREE(lck);
3520
3521                 return NT_STATUS_SHARING_VIOLATION;
3522         }
3523
3524         if (!NT_STATUS_IS_OK(fsp_open)) {
3525                 if (NT_STATUS_EQUAL(fsp_open, NT_STATUS_RETRY)) {
3526                         schedule_async_open(req);
3527                 }
3528                 return fsp_open;
3529         }
3530
3531         if (new_file_created) {
3532                 /*
3533                  * As we atomically create using O_CREAT|O_EXCL,
3534                  * then if new_file_created is true, then
3535                  * file_existed *MUST* have been false (even
3536                  * if the file was previously detected as being
3537                  * there).
3538                  */
3539                 file_existed = false;
3540         }
3541
3542         if (file_existed && !check_same_dev_ino(&saved_stat, &smb_fname->st)) {
3543                 /*
3544                  * The file did exist, but some other (local or NFS)
3545                  * process either renamed/unlinked and re-created the
3546                  * file with different dev/ino after we walked the path,
3547                  * but before we did the open. We could retry the
3548                  * open but it's a rare enough case it's easier to
3549                  * just fail the open to prevent creating any problems
3550                  * in the open file db having the wrong dev/ino key.
3551                  */
3552                 fd_close(fsp);
3553                 DBG_WARNING("file %s - dev/ino mismatch. "
3554                             "Old (dev=%ju, ino=%ju). "
3555                             "New (dev=%ju, ino=%ju). Failing open "
3556                             "with NT_STATUS_ACCESS_DENIED.\n",
3557                             smb_fname_str_dbg(smb_fname),
3558                             (uintmax_t)saved_stat.st_ex_dev,
3559                             (uintmax_t)saved_stat.st_ex_ino,
3560                             (uintmax_t)smb_fname->st.st_ex_dev,
3561                             (uintmax_t)smb_fname->st.st_ex_ino);
3562                 return NT_STATUS_ACCESS_DENIED;
3563         }
3564
3565         old_write_time = smb_fname->st.st_ex_mtime;
3566
3567         /*
3568          * Deal with the race condition where two smbd's detect the
3569          * file doesn't exist and do the create at the same time. One
3570          * of them will win and set a share mode, the other (ie. this
3571          * one) should check if the requested share mode for this
3572          * create is allowed.
3573          */
3574
3575         /*
3576          * Now the file exists and fsp is successfully opened,
3577          * fsp->dev and fsp->inode are valid and should replace the
3578          * dev=0,inode=0 from a non existent file. Spotted by
3579          * Nadav Danieli <nadavd@exanet.com>. JRA.
3580          */
3581
3582         id = fsp->file_id;
3583
3584         lck = get_share_mode_lock(talloc_tos(), id,
3585                                   conn->connectpath,
3586                                   smb_fname, &old_write_time);
3587
3588         if (lck == NULL) {
3589                 DEBUG(0, ("open_file_ntcreate: Could not get share "
3590                           "mode lock for %s\n",
3591                           smb_fname_str_dbg(smb_fname)));
3592                 fd_close(fsp);
3593                 return NT_STATUS_SHARING_VIOLATION;
3594         }
3595
3596         /* Get the types we need to examine. */
3597         if (!validate_oplock_types(lck)) {
3598                 smb_panic("validate_oplock_types failed");
3599         }
3600
3601         if (has_delete_on_close(lck, fsp->name_hash)) {
3602                 TALLOC_FREE(lck);
3603                 fd_close(fsp);
3604                 return NT_STATUS_DELETE_PENDING;
3605         }
3606
3607         status = handle_share_mode_lease(
3608                 fsp,
3609                 lck,
3610                 create_disposition,
3611                 access_mask,
3612                 share_access,
3613                 oplock_request,
3614                 lease,
3615                 first_open_attempt);
3616
3617         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3618                 schedule_defer_open(lck, fsp->file_id, req);
3619                 TALLOC_FREE(lck);
3620                 fd_close(fsp);
3621                 return NT_STATUS_SHARING_VIOLATION;
3622         }
3623
3624         if (!NT_STATUS_IS_OK(status)) {
3625                 TALLOC_FREE(lck);
3626                 fd_close(fsp);
3627                 return status;
3628         }
3629
3630         ok = set_share_mode(
3631                 lck,
3632                 fsp,
3633                 get_current_uid(fsp->conn),
3634                 req ? req->mid : 0,
3635                 fsp->oplock_type,
3636                 share_access,
3637                 access_mask);
3638         if (!ok) {
3639                 if (fsp->oplock_type == LEASE_OPLOCK) {
3640                         status = remove_lease_if_stale(
3641                                 lck->data,
3642                                 fsp_client_guid(fsp),
3643                                 &fsp->lease->lease.lease_key);
3644                         if (!NT_STATUS_IS_OK(status)) {
3645                                 DBG_WARNING("remove_lease_if_stale "
3646                                             "failed: %s\n",
3647                                             nt_errstr(status));
3648                         }
3649                 }
3650                 return NT_STATUS_NO_MEMORY;
3651         }
3652
3653         /* Should we atomically (to the client at least) truncate ? */
3654         if ((!new_file_created) &&
3655             (flags2 & O_TRUNC) &&
3656             (S_ISREG(fsp->fsp_name->st.st_ex_mode))) {
3657                 int ret;
3658
3659                 ret = SMB_VFS_FTRUNCATE(fsp, 0);
3660                 if (ret != 0) {
3661                         status = map_nt_error_from_unix(errno);
3662                         del_share_mode(lck, fsp);
3663                         TALLOC_FREE(lck);
3664                         fd_close(fsp);
3665                         return status;
3666                 }
3667                 notify_fname(fsp->conn, NOTIFY_ACTION_MODIFIED,
3668                              FILE_NOTIFY_CHANGE_SIZE
3669                              | FILE_NOTIFY_CHANGE_ATTRIBUTES,
3670                              fsp->fsp_name->base_name);
3671         }
3672
3673         /*
3674          * We have the share entry *locked*.....
3675          */
3676
3677         /* Delete streams if create_disposition requires it */
3678         if (!new_file_created && clear_ads(create_disposition) &&
3679             !is_ntfs_stream_smb_fname(smb_fname)) {
3680                 status = delete_all_streams(conn, smb_fname);
3681                 if (!NT_STATUS_IS_OK(status)) {
3682                         del_share_mode(lck, fsp);
3683                         TALLOC_FREE(lck);
3684                         fd_close(fsp);
3685                         return status;
3686                 }
3687         }
3688
3689         if (fsp->fh->fd != -1 && lp_kernel_share_modes(SNUM(conn))) {
3690                 int ret_flock;
3691                 /*
3692                  * Beware: streams implementing VFS modules may
3693                  * implement streams in a way that fsp will have the
3694                  * basefile open in the fsp fd, so lacking a distinct
3695                  * fd for the stream kernel_flock will apply on the
3696                  * basefile which is wrong. The actual check is
3697                  * deferred to the VFS module implementing the
3698                  * kernel_flock call.
3699                  */
3700                 ret_flock = SMB_VFS_KERNEL_FLOCK(fsp, share_access, access_mask);
3701                 if(ret_flock == -1 ){
3702
3703                         del_share_mode(lck, fsp);
3704                         TALLOC_FREE(lck);
3705                         fd_close(fsp);
3706
3707                         return NT_STATUS_SHARING_VIOLATION;
3708                 }
3709
3710                 fsp->kernel_share_modes_taken = true;
3711         }
3712
3713         /*
3714          * At this point onwards, we can guarantee that the share entry
3715          * is locked, whether we created the file or not, and that the
3716          * deny mode is compatible with all current opens.
3717          */
3718
3719         /*
3720          * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
3721          * but we don't have to store this - just ignore it on access check.
3722          */
3723         if (conn->sconn->using_smb2) {
3724                 /*
3725                  * SMB2 doesn't return it (according to Microsoft tests).
3726                  * Test Case: TestSuite_ScenarioNo009GrantedAccessTestS0
3727                  * File created with access = 0x7 (Read, Write, Delete)
3728                  * Query Info on file returns 0x87 (Read, Write, Delete, Read Attributes)
3729                  */
3730                 fsp->access_mask = access_mask;
3731         } else {
3732                 /* But SMB1 does. */
3733                 fsp->access_mask = access_mask | FILE_READ_ATTRIBUTES;
3734         }
3735
3736         if (new_file_created) {
3737                 info = FILE_WAS_CREATED;
3738         } else {
3739                 if (flags2 & O_TRUNC) {
3740                         info = FILE_WAS_OVERWRITTEN;
3741                 } else {
3742                         info = FILE_WAS_OPENED;
3743                 }
3744         }
3745
3746         if (pinfo) {
3747                 *pinfo = info;
3748         }
3749
3750         /* Handle strange delete on close create semantics. */
3751         if (create_options & FILE_DELETE_ON_CLOSE) {
3752                 if (!new_file_created) {
3753                         status = can_set_delete_on_close(fsp,
3754                                          existing_dos_attributes);
3755
3756                         if (!NT_STATUS_IS_OK(status)) {
3757                                 /* Remember to delete the mode we just added. */
3758                                 del_share_mode(lck, fsp);
3759                                 TALLOC_FREE(lck);
3760                                 fd_close(fsp);
3761                                 return status;
3762                         }
3763                 }
3764                 /* Note that here we set the *initial* delete on close flag,
3765                    not the regular one. The magic gets handled in close. */
3766                 fsp->initial_delete_on_close = True;
3767         }
3768
3769         if (info == FILE_WAS_CREATED) {
3770                 smb_fname->st.st_ex_iflags &= ~ST_EX_IFLAG_CALCULATED_ITIME;
3771
3772                 if (lp_store_dos_attributes(SNUM(conn)) &&
3773                     smb_fname->st.st_ex_iflags & ST_EX_IFLAG_CALCULATED_FILE_ID)
3774                 {
3775                         uint64_t file_id;
3776
3777                         file_id = make_file_id_from_itime(&smb_fname->st);
3778                         update_stat_ex_file_id(&smb_fname->st, file_id);
3779                 }
3780         }
3781
3782         if (info != FILE_WAS_OPENED) {
3783                 /* Overwritten files should be initially set as archive */
3784                 if ((info == FILE_WAS_OVERWRITTEN && lp_map_archive(SNUM(conn))) ||
3785                     lp_store_dos_attributes(SNUM(conn))) {
3786                         if (!posix_open) {
3787                                 if (file_set_dosmode(conn, smb_fname,
3788                                             new_dos_attributes | FILE_ATTRIBUTE_ARCHIVE,
3789                                             parent_dir, true) == 0) {
3790                                         unx_mode = smb_fname->st.st_ex_mode;
3791                                 }
3792                         }
3793                 }
3794         }
3795
3796         /* Determine sparse flag. */
3797         if (posix_open) {
3798                 /* POSIX opens are sparse by default. */
3799                 fsp->is_sparse = true;
3800         } else {
3801                 fsp->is_sparse =
3802                         (existing_dos_attributes & FILE_ATTRIBUTE_SPARSE);
3803         }
3804
3805         /*
3806          * Take care of inherited ACLs on created files - if default ACL not
3807          * selected.
3808          */
3809
3810         if (!posix_open && new_file_created && !def_acl) {
3811                 if (unx_mode != smb_fname->st.st_ex_mode) {
3812                         int ret = SMB_VFS_FCHMOD(fsp, unx_mode);
3813                         if (ret == -1) {
3814                                 DBG_INFO("failed to reset "
3815                                   "attributes of file %s to 0%o\n",
3816                                   smb_fname_str_dbg(smb_fname),
3817                                   (unsigned int)unx_mode);
3818                         }
3819                 }
3820
3821         } else if (new_unx_mode) {
3822                 /*
3823                  * We only get here in the case of:
3824                  *
3825                  * a). Not a POSIX open.
3826                  * b). File already existed.
3827                  * c). File was overwritten.
3828                  * d). Requested DOS attributes didn't match
3829                  *     the DOS attributes on the existing file.
3830                  *
3831                  * In that case new_unx_mode has been set
3832                  * equal to the calculated mode (including
3833                  * possible inheritance of the mode from the
3834                  * containing directory).
3835                  *
3836                  * Note this mode was calculated with the
3837                  * DOS attribute FILE_ATTRIBUTE_ARCHIVE added,
3838                  * so the mode change here is suitable for
3839                  * an overwritten file.
3840                  */
3841
3842                 if (new_unx_mode != smb_fname->st.st_ex_mode) {
3843                         int ret = SMB_VFS_FCHMOD(fsp, new_unx_mode);
3844                         if (ret == -1) {
3845                                 DBG_INFO("failed to reset "
3846                                   "attributes of file %s to 0%o\n",
3847                                   smb_fname_str_dbg(smb_fname),
3848                                   (unsigned int)new_unx_mode);
3849                         }
3850                 }
3851         }
3852
3853         {
3854                 /*
3855                  * Deal with other opens having a modified write time.
3856                  */
3857                 struct timespec write_time = get_share_mode_write_time(lck);
3858
3859                 if (!null_timespec(write_time)) {
3860                         update_stat_ex_mtime(&fsp->fsp_name->st, write_time);
3861                 }
3862         }
3863
3864         TALLOC_FREE(lck);
3865
3866         return NT_STATUS_OK;
3867 }
3868
3869 static NTSTATUS mkdir_internal(connection_struct *conn,
3870                                struct smb_filename *smb_dname,
3871                                uint32_t file_attributes)
3872 {
3873         mode_t mode;
3874         char *parent_dir = NULL;
3875         NTSTATUS status;
3876         bool posix_open = false;
3877         bool need_re_stat = false;
3878         uint32_t access_mask = SEC_DIR_ADD_SUBDIR;
3879         int ret;
3880
3881         if (!CAN_WRITE(conn) || (access_mask & ~(conn->share_access))) {
3882                 DEBUG(5,("mkdir_internal: failing share access "
3883                          "%s\n", lp_servicename(talloc_tos(), SNUM(conn))));
3884                 return NT_STATUS_ACCESS_DENIED;
3885         }
3886
3887         if (!parent_dirname(talloc_tos(), smb_dname->base_name, &parent_dir,
3888                             NULL)) {
3889                 return NT_STATUS_NO_MEMORY;
3890         }
3891
3892         if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
3893                 posix_open = true;
3894                 mode = (mode_t)(file_attributes & ~FILE_FLAG_POSIX_SEMANTICS);
3895         } else {
3896                 mode = unix_mode(conn, FILE_ATTRIBUTE_DIRECTORY, smb_dname, parent_dir);
3897         }
3898
3899         status = check_parent_access(conn,
3900                                         smb_dname,
3901                                         access_mask);
3902         if(!NT_STATUS_IS_OK(status)) {
3903                 DEBUG(5,("mkdir_internal: check_parent_access "
3904                         "on directory %s for path %s returned %s\n",
3905                         parent_dir,
3906                         smb_dname->base_name,
3907                         nt_errstr(status) ));
3908                 return status;
3909         }
3910
3911         ret = SMB_VFS_MKDIRAT(conn,
3912                         conn->cwd_fsp,
3913                         smb_dname,
3914                         mode);
3915         if (ret != 0) {
3916                 return map_nt_error_from_unix(errno);
3917         }
3918
3919         /* Ensure we're checking for a symlink here.... */
3920         /* We don't want to get caught by a symlink racer. */
3921
3922         if (SMB_VFS_LSTAT(conn, smb_dname) == -1) {
3923                 DEBUG(2, ("Could not stat directory '%s' just created: %s\n",
3924                           smb_fname_str_dbg(smb_dname), strerror(errno)));
3925                 return map_nt_error_from_unix(errno);
3926         }
3927
3928         if (!S_ISDIR(smb_dname->st.st_ex_mode)) {
3929                 DEBUG(0, ("Directory '%s' just created is not a directory !\n",
3930                           smb_fname_str_dbg(smb_dname)));
3931                 return NT_STATUS_NOT_A_DIRECTORY;
3932         }
3933
3934         smb_dname->st.st_ex_iflags &= ~ST_EX_IFLAG_CALCULATED_ITIME;
3935
3936         if (lp_store_dos_attributes(SNUM(conn))) {
3937                 if (smb_dname->st.st_ex_iflags & ST_EX_IFLAG_CALCULATED_FILE_ID)
3938                 {
3939                         uint64_t file_id;
3940
3941                         file_id = make_file_id_from_itime(&smb_dname->st);
3942                         update_stat_ex_file_id(&smb_dname->st, file_id);
3943                 }
3944
3945                 if (!posix_open) {
3946                         file_set_dosmode(conn, smb_dname,
3947                                          file_attributes | FILE_ATTRIBUTE_DIRECTORY,
3948                                          parent_dir, true);
3949                 }
3950         }
3951
3952         if (lp_inherit_permissions(SNUM(conn))) {
3953                 inherit_access_posix_acl(conn, parent_dir,
3954                                          smb_dname, mode);
3955                 need_re_stat = true;
3956         }
3957
3958         if (!posix_open) {
3959                 /*
3960                  * Check if high bits should have been set,
3961                  * then (if bits are missing): add them.
3962                  * Consider bits automagically set by UNIX, i.e. SGID bit from parent
3963                  * dir.
3964                  */
3965                 if ((mode & ~(S_IRWXU|S_IRWXG|S_IRWXO)) &&
3966                     (mode & ~smb_dname->st.st_ex_mode)) {
3967                         SMB_VFS_CHMOD(conn, smb_dname,
3968                                       (smb_dname->st.st_ex_mode |
3969                                           (mode & ~smb_dname->st.st_ex_mode)));
3970                         need_re_stat = true;
3971                 }
3972         }
3973
3974         /* Change the owner if required. */
3975         if (lp_inherit_owner(SNUM(conn)) != INHERIT_OWNER_NO) {
3976                 change_dir_owner_to_parent(conn, parent_dir,
3977                                            smb_dname,
3978                                            &smb_dname->st);
3979                 need_re_stat = true;
3980         }
3981
3982         if (need_re_stat) {
3983                 if (SMB_VFS_LSTAT(conn, smb_dname) == -1) {
3984                         DEBUG(2, ("Could not stat directory '%s' just created: %s\n",
3985                           smb_fname_str_dbg(smb_dname), strerror(errno)));
3986                         return map_nt_error_from_unix(errno);
3987                 }
3988         }
3989
3990         notify_fname(conn, NOTIFY_ACTION_ADDED, FILE_NOTIFY_CHANGE_DIR_NAME,
3991                      smb_dname->base_name);
3992
3993         return NT_STATUS_OK;
3994 }
3995
3996 /****************************************************************************
3997  Open a directory from an NT SMB call.
3998 ****************************************************************************/
3999
4000 static NTSTATUS open_directory(connection_struct *conn,
4001                                struct smb_request *req,
4002                                struct smb_filename *smb_dname,
4003                                uint32_t access_mask,
4004                                uint32_t share_access,
4005                                uint32_t create_disposition,
4006                                uint32_t create_options,
4007                                uint32_t file_attributes,
4008                                int *pinfo,
4009                                files_struct **result)
4010 {
4011         files_struct *fsp = NULL;
4012         bool dir_existed = VALID_STAT(smb_dname->st) ? True : False;
4013         struct share_mode_lock *lck = NULL;
4014         NTSTATUS status;
4015         struct timespec mtimespec;
4016         int info = 0;
4017         bool ok;
4018
4019         if (is_ntfs_stream_smb_fname(smb_dname)) {
4020                 DEBUG(2, ("open_directory: %s is a stream name!\n",
4021                           smb_fname_str_dbg(smb_dname)));
4022                 return NT_STATUS_NOT_A_DIRECTORY;
4023         }
4024
4025         if (!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
4026                 /* Ensure we have a directory attribute. */
4027                 file_attributes |= FILE_ATTRIBUTE_DIRECTORY;
4028         }
4029
4030         DEBUG(5,("open_directory: opening directory %s, access_mask = 0x%x, "
4031                  "share_access = 0x%x create_options = 0x%x, "
4032                  "create_disposition = 0x%x, file_attributes = 0x%x\n",
4033                  smb_fname_str_dbg(smb_dname),
4034                  (unsigned int)access_mask,
4035                  (unsigned int)share_access,
4036                  (unsigned int)create_options,
4037                  (unsigned int)create_disposition,
4038                  (unsigned int)file_attributes));
4039
4040         status = smbd_calculate_access_mask(conn, smb_dname, false,
4041                                             access_mask, &access_mask);
4042         if (!NT_STATUS_IS_OK(status)) {
4043                 DEBUG(10, ("open_directory: smbd_calculate_access_mask "
4044                         "on file %s returned %s\n",
4045                         smb_fname_str_dbg(smb_dname),
4046                         nt_errstr(status)));
4047                 return status;
4048         }
4049
4050         if ((access_mask & SEC_FLAG_SYSTEM_SECURITY) &&
4051                         !security_token_has_privilege(get_current_nttok(conn),
4052                                         SEC_PRIV_SECURITY)) {
4053                 DEBUG(10, ("open_directory: open on %s "
4054                         "failed - SEC_FLAG_SYSTEM_SECURITY denied.\n",
4055                         smb_fname_str_dbg(smb_dname)));
4056                 return NT_STATUS_PRIVILEGE_NOT_HELD;
4057         }
4058
4059         switch( create_disposition ) {
4060                 case FILE_OPEN:
4061
4062                         if (!dir_existed) {
4063                                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4064                         }
4065
4066                         info = FILE_WAS_OPENED;
4067                         break;
4068
4069                 case FILE_CREATE:
4070
4071                         /* If directory exists error. If directory doesn't
4072                          * exist create. */
4073
4074                         if (dir_existed) {
4075                                 status = NT_STATUS_OBJECT_NAME_COLLISION;
4076                                 DEBUG(2, ("open_directory: unable to create "
4077                                           "%s. Error was %s\n",
4078                                           smb_fname_str_dbg(smb_dname),
4079                                           nt_errstr(status)));
4080                                 return status;
4081                         }
4082
4083                         status = mkdir_internal(conn, smb_dname,
4084                                                 file_attributes);
4085
4086                         if (!NT_STATUS_IS_OK(status)) {
4087                                 DEBUG(2, ("open_directory: unable to create "
4088                                           "%s. Error was %s\n",
4089                                           smb_fname_str_dbg(smb_dname),
4090                                           nt_errstr(status)));
4091                                 return status;
4092                         }
4093
4094                         info = FILE_WAS_CREATED;
4095                         break;
4096
4097                 case FILE_OPEN_IF:
4098                         /*
4099                          * If directory exists open. If directory doesn't
4100                          * exist create.
4101                          */
4102
4103                         if (dir_existed) {
4104                                 status = NT_STATUS_OK;
4105                                 info = FILE_WAS_OPENED;
4106                         } else {
4107                                 status = mkdir_internal(conn, smb_dname,
4108                                                 file_attributes);
4109
4110                                 if (NT_STATUS_IS_OK(status)) {
4111                                         info = FILE_WAS_CREATED;
4112                                 } else {
4113                                         /* Cope with create race. */
4114                                         if (!NT_STATUS_EQUAL(status,
4115                                                         NT_STATUS_OBJECT_NAME_COLLISION)) {
4116                                                 DEBUG(2, ("open_directory: unable to create "
4117                                                         "%s. Error was %s\n",
4118                                                         smb_fname_str_dbg(smb_dname),
4119                                                         nt_errstr(status)));
4120                                                 return status;
4121                                         }
4122
4123                                         /*
4124                                          * If mkdir_internal() returned
4125                                          * NT_STATUS_OBJECT_NAME_COLLISION
4126                                          * we still must lstat the path.
4127                                          */
4128
4129                                         if (SMB_VFS_LSTAT(conn, smb_dname)
4130                                                         == -1) {
4131                                                 DEBUG(2, ("Could not stat "
4132                                                         "directory '%s' just "
4133                                                         "opened: %s\n",
4134                                                         smb_fname_str_dbg(
4135                                                                 smb_dname),
4136                                                         strerror(errno)));
4137                                                 return map_nt_error_from_unix(
4138                                                                 errno);
4139                                         }
4140
4141                                         info = FILE_WAS_OPENED;
4142                                 }
4143                         }
4144
4145                         break;
4146
4147                 case FILE_SUPERSEDE:
4148                 case FILE_OVERWRITE:
4149                 case FILE_OVERWRITE_IF:
4150                 default:
4151                         DEBUG(5,("open_directory: invalid create_disposition "
4152                                  "0x%x for directory %s\n",
4153                                  (unsigned int)create_disposition,
4154                                  smb_fname_str_dbg(smb_dname)));
4155                         return NT_STATUS_INVALID_PARAMETER;
4156         }
4157
4158         if(!S_ISDIR(smb_dname->st.st_ex_mode)) {
4159                 DEBUG(5,("open_directory: %s is not a directory !\n",
4160                          smb_fname_str_dbg(smb_dname)));
4161                 return NT_STATUS_NOT_A_DIRECTORY;
4162         }
4163
4164         if (info == FILE_WAS_OPENED) {
4165                 status = smbd_check_access_rights(conn,
4166                                                 smb_dname,
4167                                                 false,
4168                                                 access_mask);
4169                 if (!NT_STATUS_IS_OK(status)) {
4170                         DEBUG(10, ("open_directory: smbd_check_access_rights on "
4171                                 "file %s failed with %s\n",
4172                                 smb_fname_str_dbg(smb_dname),
4173                                 nt_errstr(status)));
4174                         return status;
4175                 }
4176         }
4177
4178         status = file_new(req, conn, &fsp);
4179         if(!NT_STATUS_IS_OK(status)) {
4180                 return status;
4181         }
4182
4183         /*
4184          * Setup the files_struct for it.
4185          */
4186
4187         fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_dname->st);
4188         fsp->vuid = req ? req->vuid : UID_FIELD_INVALID;
4189         fsp->file_pid = req ? req->smbpid : 0;
4190         fsp->can_lock = False;
4191         fsp->can_read = False;
4192         fsp->can_write = False;
4193
4194         fsp->fh->private_options = 0;
4195         /*
4196          * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
4197          */
4198         fsp->access_mask = access_mask | FILE_READ_ATTRIBUTES;
4199         fsp->print_file = NULL;
4200         fsp->modified = False;
4201         fsp->oplock_type = NO_OPLOCK;
4202         fsp->sent_oplock_break = NO_BREAK_SENT;
4203         fsp->is_directory = True;
4204         if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
4205                 fsp->posix_flags |= FSP_POSIX_FLAGS_ALL;
4206         }
4207         status = fsp_set_smb_fname(fsp, smb_dname);
4208         if (!NT_STATUS_IS_OK(status)) {
4209                 file_free(req, fsp);
4210                 return status;
4211         }
4212
4213         /* Don't store old timestamps for directory
4214            handles in the internal database. We don't
4215            update them in there if new objects
4216            are creaded in the directory. Currently
4217            we only update timestamps on file writes.
4218            See bug #9870.
4219         */
4220         ZERO_STRUCT(mtimespec);
4221
4222 #ifdef O_DIRECTORY
4223         status = fd_open(conn, fsp, O_RDONLY|O_DIRECTORY, 0);
4224 #else
4225         /* POSIX allows us to open a directory with O_RDONLY. */
4226         status = fd_open(conn, fsp, O_RDONLY, 0);
4227 #endif
4228         if (!NT_STATUS_IS_OK(status)) {
4229                 DBG_INFO("Could not open fd for "
4230                         "%s (%s)\n",
4231                         smb_fname_str_dbg(smb_dname),
4232                         nt_errstr(status));
4233                 file_free(req, fsp);
4234                 return status;
4235         }
4236
4237         status = vfs_stat_fsp(fsp);
4238         if (!NT_STATUS_IS_OK(status)) {
4239                 fd_close(fsp);
4240                 file_free(req, fsp);
4241                 return status;
4242         }
4243
4244         if(!S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
4245                 DEBUG(5,("open_directory: %s is not a directory !\n",
4246                          smb_fname_str_dbg(smb_dname)));
4247                 fd_close(fsp);
4248                 file_free(req, fsp);
4249                 return NT_STATUS_NOT_A_DIRECTORY;
4250         }
4251
4252         /* Ensure there was no race condition.  We need to check
4253          * dev/inode but not permissions, as these can change
4254          * legitimately */
4255         if (!check_same_dev_ino(&smb_dname->st, &fsp->fsp_name->st)) {
4256                 DEBUG(5,("open_directory: stat struct differs for "
4257                         "directory %s.\n",
4258                         smb_fname_str_dbg(smb_dname)));
4259                 fd_close(fsp);
4260                 file_free(req, fsp);
4261                 return NT_STATUS_ACCESS_DENIED;
4262         }
4263
4264         lck = get_share_mode_lock(talloc_tos(), fsp->file_id,
4265                                   conn->connectpath, smb_dname,
4266                                   &mtimespec);
4267
4268         if (lck == NULL) {
4269                 DEBUG(0, ("open_directory: Could not get share mode lock for "
4270                           "%s\n", smb_fname_str_dbg(smb_dname)));
4271                 fd_close(fsp);
4272                 file_free(req, fsp);
4273                 return NT_STATUS_SHARING_VIOLATION;
4274         }
4275
4276         if (has_delete_on_close(lck, fsp->name_hash)) {
4277                 TALLOC_FREE(lck);
4278                 fd_close(fsp);
4279                 file_free(req, fsp);
4280                 return NT_STATUS_DELETE_PENDING;
4281         }
4282
4283         status = open_mode_check(conn, lck,
4284                                  access_mask, share_access);
4285
4286         if (!NT_STATUS_IS_OK(status)) {
4287                 TALLOC_FREE(lck);
4288                 fd_close(fsp);
4289                 file_free(req, fsp);
4290                 return status;
4291         }
4292
4293         ok = set_share_mode(
4294                 lck,
4295                 fsp,
4296                 get_current_uid(conn),
4297                 req ? req->mid : 0,
4298                 NO_OPLOCK,
4299                 share_access,
4300                 fsp->access_mask);
4301         if (!ok) {
4302                 TALLOC_FREE(lck);
4303                 fd_close(fsp);
4304                 file_free(req, fsp);
4305                 return NT_STATUS_NO_MEMORY;
4306         }
4307
4308         /* For directories the delete on close bit at open time seems
4309            always to be honored on close... See test 19 in Samba4 BASE-DELETE. */
4310         if (create_options & FILE_DELETE_ON_CLOSE) {
4311                 status = can_set_delete_on_close(fsp, 0);
4312                 if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, NT_STATUS_DIRECTORY_NOT_EMPTY)) {
4313                         del_share_mode(lck, fsp);
4314                         TALLOC_FREE(lck);
4315                         fd_close(fsp);
4316                         file_free(req, fsp);
4317                         return status;
4318                 }
4319
4320                 if (NT_STATUS_IS_OK(status)) {
4321                         /* Note that here we set the *initial* delete on close flag,
4322                            not the regular one. The magic gets handled in close. */
4323                         fsp->initial_delete_on_close = True;
4324                 }
4325         }
4326
4327         {
4328                 /*
4329                  * Deal with other opens having a modified write time. Is this
4330                  * possible for directories?
4331                  */
4332                 struct timespec write_time = get_share_mode_write_time(lck);
4333
4334                 if (!null_timespec(write_time)) {
4335                         update_stat_ex_mtime(&fsp->fsp_name->st, write_time);
4336                 }
4337         }
4338
4339         TALLOC_FREE(lck);
4340
4341         if (pinfo) {
4342                 *pinfo = info;
4343         }
4344
4345         *result = fsp;
4346         return NT_STATUS_OK;
4347 }
4348
4349 NTSTATUS create_directory(connection_struct *conn, struct smb_request *req,
4350                           struct smb_filename *smb_dname)
4351 {
4352         NTSTATUS status;
4353         files_struct *fsp;
4354
4355         status = SMB_VFS_CREATE_FILE(
4356                 conn,                                   /* conn */
4357                 req,                                    /* req */
4358                 0,                                      /* root_dir_fid */
4359                 smb_dname,                              /* fname */
4360                 FILE_READ_ATTRIBUTES,                   /* access_mask */
4361                 FILE_SHARE_NONE,                        /* share_access */
4362                 FILE_CREATE,                            /* create_disposition*/
4363                 FILE_DIRECTORY_FILE,                    /* create_options */
4364                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
4365                 0,                                      /* oplock_request */
4366                 NULL,                                   /* lease */
4367                 0,                                      /* allocation_size */
4368                 0,                                      /* private_flags */
4369                 NULL,                                   /* sd */
4370                 NULL,                                   /* ea_list */
4371                 &fsp,                                   /* result */
4372                 NULL,                                   /* pinfo */
4373                 NULL, NULL);                            /* create context */
4374
4375         if (NT_STATUS_IS_OK(status)) {
4376                 close_file(req, fsp, NORMAL_CLOSE);
4377         }
4378
4379         return status;
4380 }
4381
4382 /****************************************************************************
4383  Receive notification that one of our open files has been renamed by another
4384  smbd process.
4385 ****************************************************************************/
4386
4387 void msg_file_was_renamed(struct messaging_context *msg_ctx,
4388                           void *private_data,
4389                           uint32_t msg_type,
4390                           struct server_id src,
4391                           DATA_BLOB *data)
4392 {
4393         struct file_rename_message *msg = NULL;
4394         enum ndr_err_code ndr_err;
4395         files_struct *fsp;
4396         struct smb_filename *smb_fname = NULL;
4397         struct smbd_server_connection *sconn =
4398                 talloc_get_type_abort(private_data,
4399                 struct smbd_server_connection);
4400
4401         msg = talloc(talloc_tos(), struct file_rename_message);
4402         if (msg == NULL) {
4403                 DBG_WARNING("talloc failed\n");
4404                 return;
4405         }
4406
4407         ndr_err = ndr_pull_struct_blob_all(
4408                 data,
4409                 msg,
4410                 msg,
4411                 (ndr_pull_flags_fn_t)ndr_pull_file_rename_message);
4412         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4413                 DBG_DEBUG("ndr_pull_oplock_break_message failed: %s\n",
4414                           ndr_errstr(ndr_err));
4415                 goto out;
4416         }
4417         if (DEBUGLEVEL >= 10) {
4418                 struct server_id_buf buf;
4419                 DBG_DEBUG("Got rename message from %s\n",
4420                           server_id_str_buf(src, &buf));
4421                 NDR_PRINT_DEBUG(file_rename_message, msg);
4422         }
4423
4424         /* stream_name must always be NULL if there is no stream. */
4425         if ((msg->stream_name != NULL) && (msg->stream_name[0] == '\0')) {
4426                 msg->stream_name = NULL;
4427         }
4428
4429         smb_fname = synthetic_smb_fname(
4430                 msg, msg->base_name, msg->stream_name, NULL, 0);
4431         if (smb_fname == NULL) {
4432                 DBG_DEBUG("synthetic_smb_fname failed\n");
4433                 goto out;
4434         }
4435
4436         fsp = file_find_dif(sconn, msg->id, msg->share_file_id);
4437         if (fsp == NULL) {
4438                 DBG_DEBUG("fsp not found\n");
4439                 goto out;
4440         }
4441
4442         if (strcmp(fsp->conn->connectpath, msg->servicepath) == 0) {
4443                 NTSTATUS status;
4444                 DBG_DEBUG("renaming file %s from %s -> %s\n",
4445                           fsp_fnum_dbg(fsp),
4446                           fsp_str_dbg(fsp),
4447                           smb_fname_str_dbg(smb_fname));
4448                 status = fsp_set_smb_fname(fsp, smb_fname);
4449                 if (!NT_STATUS_IS_OK(status)) {
4450                         DBG_DEBUG("fsp_set_smb_fname failed: %s\n",
4451                                   nt_errstr(status));
4452                 }
4453         } else {
4454                 /* TODO. JRA. */
4455                 /*
4456                  * Now we have the complete path we can work out if
4457                  * this is actually within this share and adjust
4458                  * newname accordingly.
4459                  */
4460                 DBG_DEBUG("share mismatch (sharepath %s not sharepath %s) "
4461                           "%s from %s -> %s\n",
4462                           fsp->conn->connectpath,
4463                           msg->servicepath,
4464                           fsp_fnum_dbg(fsp),
4465                           fsp_str_dbg(fsp),
4466                           smb_fname_str_dbg(smb_fname));
4467         }
4468  out:
4469         TALLOC_FREE(msg);
4470 }
4471
4472 /*
4473  * If a main file is opened for delete, all streams need to be checked for
4474  * !FILE_SHARE_DELETE. Do this by opening with DELETE_ACCESS.
4475  * If that works, delete them all by setting the delete on close and close.
4476  */
4477
4478 static NTSTATUS open_streams_for_delete(connection_struct *conn,
4479                                         const struct smb_filename *smb_fname)
4480 {
4481         struct stream_struct *stream_info = NULL;
4482         files_struct **streams = NULL;
4483         int j;
4484         unsigned int i, num_streams = 0;
4485         TALLOC_CTX *frame = talloc_stackframe();
4486         NTSTATUS status;
4487
4488         status = vfs_streaminfo(conn, NULL, smb_fname, talloc_tos(),
4489                                 &num_streams, &stream_info);
4490
4491         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)
4492             || NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
4493                 DEBUG(10, ("no streams around\n"));
4494                 TALLOC_FREE(frame);
4495                 return NT_STATUS_OK;
4496         }
4497
4498         if (!NT_STATUS_IS_OK(status)) {
4499                 DEBUG(10, ("vfs_streaminfo failed: %s\n",
4500                            nt_errstr(status)));
4501                 goto fail;
4502         }
4503
4504         DEBUG(10, ("open_streams_for_delete found %d streams\n",
4505                    num_streams));
4506
4507         if (num_streams == 0) {
4508                 TALLOC_FREE(frame);
4509                 return NT_STATUS_OK;
4510         }
4511
4512         streams = talloc_array(talloc_tos(), files_struct *, num_streams);
4513         if (streams == NULL) {
4514                 DEBUG(0, ("talloc failed\n"));
4515                 status = NT_STATUS_NO_MEMORY;
4516                 goto fail;
4517         }
4518
4519         for (i=0; i<num_streams; i++) {
4520                 struct smb_filename *smb_fname_cp;
4521
4522                 if (strequal(stream_info[i].name, "::$DATA")) {
4523                         streams[i] = NULL;
4524                         continue;
4525                 }
4526
4527                 smb_fname_cp = synthetic_smb_fname(talloc_tos(),
4528                                         smb_fname->base_name,
4529                                         stream_info[i].name,
4530                                         NULL,
4531                                         (smb_fname->flags &
4532                                                 ~SMB_FILENAME_POSIX_PATH));
4533                 if (smb_fname_cp == NULL) {
4534                         status = NT_STATUS_NO_MEMORY;
4535                         goto fail;
4536                 }
4537
4538                 if (SMB_VFS_STAT(conn, smb_fname_cp) == -1) {
4539                         DEBUG(10, ("Unable to stat stream: %s\n",
4540                                    smb_fname_str_dbg(smb_fname_cp)));
4541                 }
4542
4543                 status = SMB_VFS_CREATE_FILE(
4544                          conn,                  /* conn */
4545                          NULL,                  /* req */
4546                          0,                     /* root_dir_fid */
4547                          smb_fname_cp,          /* fname */
4548                          DELETE_ACCESS,         /* access_mask */
4549                          (FILE_SHARE_READ |     /* share_access */
4550                              FILE_SHARE_WRITE | FILE_SHARE_DELETE),
4551                          FILE_OPEN,             /* create_disposition*/
4552                          0,                     /* create_options */
4553                          FILE_ATTRIBUTE_NORMAL, /* file_attributes */
4554                          0,                     /* oplock_request */
4555                          NULL,                  /* lease */
4556                          0,                     /* allocation_size */
4557                          NTCREATEX_OPTIONS_PRIVATE_STREAM_DELETE, /* private_flags */
4558                          NULL,                  /* sd */
4559                          NULL,                  /* ea_list */
4560                          &streams[i],           /* result */
4561                          NULL,                  /* pinfo */
4562                          NULL, NULL);           /* create context */
4563
4564                 if (!NT_STATUS_IS_OK(status)) {
4565                         DEBUG(10, ("Could not open stream %s: %s\n",
4566                                    smb_fname_str_dbg(smb_fname_cp),
4567                                    nt_errstr(status)));
4568
4569                         TALLOC_FREE(smb_fname_cp);
4570                         break;
4571                 }
4572                 TALLOC_FREE(smb_fname_cp);
4573         }
4574
4575         /*
4576          * don't touch the variable "status" beyond this point :-)
4577          */
4578
4579         for (j = i-1 ; j >= 0; j--) {
4580                 if (streams[j] == NULL) {
4581                         continue;
4582                 }
4583
4584                 DEBUG(10, ("Closing stream # %d, %s\n", j,
4585                            fsp_str_dbg(streams[j])));
4586                 close_file(NULL, streams[j], NORMAL_CLOSE);
4587         }
4588
4589  fail:
4590         TALLOC_FREE(frame);
4591         return status;
4592 }
4593
4594 /*********************************************************************
4595  Create a default ACL by inheriting from the parent. If no inheritance
4596  from the parent available, don't set anything. This will leave the actual
4597  permissions the new file or directory already got from the filesystem
4598  as the NT ACL when read.
4599 *********************************************************************/
4600
4601 static NTSTATUS inherit_new_acl(files_struct *fsp)
4602 {
4603         TALLOC_CTX *frame = talloc_stackframe();
4604         char *parent_name = NULL;
4605         struct security_descriptor *parent_desc = NULL;
4606         NTSTATUS status = NT_STATUS_OK;
4607         struct security_descriptor *psd = NULL;
4608         const struct dom_sid *owner_sid = NULL;
4609         const struct dom_sid *group_sid = NULL;
4610         uint32_t security_info_sent = (SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL);
4611         struct security_token *token = fsp->conn->session_info->security_token;
4612         bool inherit_owner =
4613             (lp_inherit_owner(SNUM(fsp->conn)) == INHERIT_OWNER_WINDOWS_AND_UNIX);
4614         bool inheritable_components = false;
4615         bool try_builtin_administrators = false;
4616         const struct dom_sid *BA_U_sid = NULL;
4617         const struct dom_sid *BA_G_sid = NULL;
4618         bool try_system = false;
4619         const struct dom_sid *SY_U_sid = NULL;
4620         const struct dom_sid *SY_G_sid = NULL;
4621         size_t size = 0;
4622         struct smb_filename *parent_smb_fname = NULL;
4623
4624         if (!parent_dirname(frame, fsp->fsp_name->base_name, &parent_name, NULL)) {
4625                 TALLOC_FREE(frame);
4626                 return NT_STATUS_NO_MEMORY;
4627         }
4628         parent_smb_fname = synthetic_smb_fname(talloc_tos(),
4629                                                 parent_name,
4630                                                 NULL,
4631                                                 NULL,
4632                                                 fsp->fsp_name->flags);
4633
4634         if (parent_smb_fname == NULL) {
4635                 TALLOC_FREE(frame);
4636                 return NT_STATUS_NO_MEMORY;
4637         }
4638
4639         status = SMB_VFS_GET_NT_ACL(fsp->conn,
4640                                     parent_smb_fname,
4641                                     (SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL),
4642                                     frame,
4643                                     &parent_desc);
4644         if (!NT_STATUS_IS_OK(status)) {
4645                 TALLOC_FREE(frame);
4646                 return status;
4647         }
4648
4649         inheritable_components = sd_has_inheritable_components(parent_desc,
4650                                         fsp->is_directory);
4651
4652         if (!inheritable_components && !inherit_owner) {
4653                 TALLOC_FREE(frame);
4654                 /* Nothing to inherit and not setting owner. */
4655                 return NT_STATUS_OK;
4656         }
4657
4658         /* Create an inherited descriptor from the parent. */
4659
4660         if (DEBUGLEVEL >= 10) {
4661                 DEBUG(10,("inherit_new_acl: parent acl for %s is:\n",
4662                         fsp_str_dbg(fsp) ));
4663                 NDR_PRINT_DEBUG(security_descriptor, parent_desc);
4664         }
4665
4666         /* Inherit from parent descriptor if "inherit owner" set. */
4667         if (inherit_owner) {
4668                 owner_sid = parent_desc->owner_sid;
4669                 group_sid = parent_desc->group_sid;
4670         }
4671
4672         if (owner_sid == NULL) {
4673                 if (security_token_has_builtin_administrators(token)) {
4674                         try_builtin_administrators = true;
4675                 } else if (security_token_is_system(token)) {
4676                         try_builtin_administrators = true;
4677                         try_system = true;
4678                 }
4679         }
4680
4681         if (group_sid == NULL &&
4682             token->num_sids == PRIMARY_GROUP_SID_INDEX)
4683         {
4684                 if (security_token_is_system(token)) {
4685                         try_builtin_administrators = true;
4686                         try_system = true;
4687                 }
4688         }
4689
4690         if (try_builtin_administrators) {
4691                 struct unixid ids;
4692                 bool ok;
4693
4694                 ZERO_STRUCT(ids);
4695                 ok = sids_to_unixids(&global_sid_Builtin_Administrators, 1, &ids);
4696                 if (ok) {
4697                         switch (ids.type) {
4698                         case ID_TYPE_BOTH:
4699                                 BA_U_sid = &global_sid_Builtin_Administrators;
4700                                 BA_G_sid = &global_sid_Builtin_Administrators;
4701                                 break;
4702                         case ID_TYPE_UID:
4703                                 BA_U_sid = &global_sid_Builtin_Administrators;
4704                                 break;
4705                         case ID_TYPE_GID:
4706                                 BA_G_sid = &global_sid_Builtin_Administrators;
4707                                 break;
4708                         default:
4709                                 break;
4710                         }
4711                 }
4712         }
4713
4714         if (try_system) {
4715                 struct unixid ids;
4716                 bool ok;
4717
4718                 ZERO_STRUCT(ids);
4719                 ok = sids_to_unixids(&global_sid_System, 1, &ids);
4720                 if (ok) {
4721                         switch (ids.type) {
4722                         case ID_TYPE_BOTH:
4723                                 SY_U_sid = &global_sid_System;
4724                                 SY_G_sid = &global_sid_System;
4725                                 break;
4726                         case ID_TYPE_UID:
4727                                 SY_U_sid = &global_sid_System;
4728                                 break;
4729                         case ID_TYPE_GID:
4730                                 SY_G_sid = &global_sid_System;
4731                                 break;
4732                         default:
4733                                 break;
4734                         }
4735                 }
4736         }
4737
4738         if (owner_sid == NULL) {
4739                 owner_sid = BA_U_sid;
4740         }
4741
4742         if (owner_sid == NULL) {
4743                 owner_sid = SY_U_sid;
4744         }
4745
4746         if (group_sid == NULL) {
4747                 group_sid = SY_G_sid;
4748         }
4749
4750         if (try_system && group_sid == NULL) {
4751                 group_sid = BA_G_sid;
4752         }
4753
4754         if (owner_sid == NULL) {
4755                 owner_sid = &token->sids[PRIMARY_USER_SID_INDEX];
4756         }
4757         if (group_sid == NULL) {
4758                 if (token->num_sids == PRIMARY_GROUP_SID_INDEX) {
4759                         group_sid = &token->sids[PRIMARY_USER_SID_INDEX];
4760                 } else {
4761                         group_sid = &token->sids[PRIMARY_GROUP_SID_INDEX];
4762                 }
4763         }
4764
4765         status = se_create_child_secdesc(frame,
4766                         &psd,
4767                         &size,
4768                         parent_desc,
4769                         owner_sid,
4770                         group_sid,
4771                         fsp->is_directory);
4772         if (!NT_STATUS_IS_OK(status)) {
4773                 TALLOC_FREE(frame);
4774                 return status;
4775         }
4776
4777         /* If inheritable_components == false,
4778            se_create_child_secdesc()
4779            creates a security descriptor with a NULL dacl
4780            entry, but with SEC_DESC_DACL_PRESENT. We need
4781            to remove that flag. */
4782
4783         if (!inheritable_components) {
4784                 security_info_sent &= ~SECINFO_DACL;
4785                 psd->type &= ~SEC_DESC_DACL_PRESENT;
4786         }
4787
4788         if (DEBUGLEVEL >= 10) {
4789                 DEBUG(10,("inherit_new_acl: child acl for %s is:\n",
4790                         fsp_str_dbg(fsp) ));
4791                 NDR_PRINT_DEBUG(security_descriptor, psd);
4792         }
4793
4794         if (inherit_owner) {
4795                 /* We need to be root to force this. */
4796                 become_root();
4797         }
4798         status = SMB_VFS_FSET_NT_ACL(fsp,
4799                         security_info_sent,
4800                         psd);
4801         if (inherit_owner) {
4802                 unbecome_root();
4803         }
4804         TALLOC_FREE(frame);
4805         return status;
4806 }
4807
4808 /*
4809  * If we already have a lease, it must match the new file id. [MS-SMB2]
4810  * 3.3.5.9.8 speaks about INVALID_PARAMETER if an already used lease key is
4811  * used for a different file name.
4812  */
4813
4814 struct lease_match_state {
4815         /* Input parameters. */
4816         TALLOC_CTX *mem_ctx;
4817         const char *servicepath;
4818         const struct smb_filename *fname;
4819         bool file_existed;
4820         struct file_id id;
4821         /* Return parameters. */
4822         uint32_t num_file_ids;
4823         struct file_id *ids;
4824         NTSTATUS match_status;
4825 };
4826
4827 /*************************************************************
4828  File doesn't exist but this lease key+guid is already in use.
4829
4830  This is only allowable in the dynamic share case where the
4831  service path must be different.
4832
4833  There is a small race condition here in the multi-connection
4834  case where a client sends two create calls on different connections,
4835  where the file doesn't exist and one smbd creates the leases_db
4836  entry first, but this will get fixed by the multichannel cleanup
4837  when all identical client_guids get handled by a single smbd.
4838 **************************************************************/
4839
4840 static void lease_match_parser_new_file(
4841         uint32_t num_files,
4842         const struct leases_db_file *files,
4843         struct lease_match_state *state)
4844 {
4845         uint32_t i;
4846
4847         for (i = 0; i < num_files; i++) {
4848                 const struct leases_db_file *f = &files[i];
4849                 if (strequal(state->servicepath, f->servicepath)) {
4850                         state->match_status = NT_STATUS_INVALID_PARAMETER;
4851                         return;
4852                 }
4853         }
4854
4855         /* Dynamic share case. Break leases on all other files. */
4856         state->match_status = leases_db_copy_file_ids(state->mem_ctx,
4857                                         num_files,
4858                                         files,
4859                                         &state->ids);
4860         if (!NT_STATUS_IS_OK(state->match_status)) {
4861                 return;
4862         }
4863
4864         state->num_file_ids = num_files;
4865         state->match_status = NT_STATUS_OPLOCK_NOT_GRANTED;
4866         return;
4867 }
4868
4869 static void lease_match_parser(
4870         uint32_t num_files,
4871         const struct leases_db_file *files,
4872         void *private_data)
4873 {
4874         struct lease_match_state *state =
4875                 (struct lease_match_state *)private_data;
4876         uint32_t i;
4877
4878         if (!state->file_existed) {
4879                 /*
4880                  * Deal with name mismatch or
4881                  * possible dynamic share case separately
4882                  * to make code clearer.
4883                  */
4884                 lease_match_parser_new_file(num_files,
4885                                                 files,
4886                                                 state);
4887                 return;
4888         }
4889
4890         /* File existed. */
4891         state->match_status = NT_STATUS_OK;
4892
4893         for (i = 0; i < num_files; i++) {
4894                 const struct leases_db_file *f = &files[i];
4895
4896                 /* Everything should be the same. */
4897                 if (!file_id_equal(&state->id, &f->id)) {
4898                         /* This should catch all dynamic share cases. */
4899                         state->match_status = NT_STATUS_OPLOCK_NOT_GRANTED;
4900                         break;
4901                 }
4902                 if (!strequal(f->servicepath, state->servicepath)) {
4903                         state->match_status = NT_STATUS_INVALID_PARAMETER;
4904                         break;
4905                 }
4906                 if (!strequal(f->base_name, state->fname->base_name)) {
4907                         state->match_status = NT_STATUS_INVALID_PARAMETER;
4908                         break;
4909                 }
4910                 if (!strequal(f->stream_name, state->fname->stream_name)) {
4911                         state->match_status = NT_STATUS_INVALID_PARAMETER;
4912                         break;
4913                 }
4914         }
4915
4916         if (NT_STATUS_IS_OK(state->match_status)) {
4917                 /*
4918                  * Common case - just opening another handle on a
4919                  * file on a non-dynamic share.
4920                  */
4921                 return;
4922         }
4923
4924         if (NT_STATUS_EQUAL(state->match_status, NT_STATUS_INVALID_PARAMETER)) {
4925                 /* Mismatched path. Error back to client. */
4926                 return;
4927         }
4928
4929         /*
4930          * File id mismatch. Dynamic share case NT_STATUS_OPLOCK_NOT_GRANTED.
4931          * Don't allow leases.
4932          */
4933
4934         state->match_status = leases_db_copy_file_ids(state->mem_ctx,
4935                                         num_files,
4936                                         files,
4937                                         &state->ids);
4938         if (!NT_STATUS_IS_OK(state->match_status)) {
4939                 return;
4940         }
4941
4942         state->num_file_ids = num_files;
4943         state->match_status = NT_STATUS_OPLOCK_NOT_GRANTED;
4944         return;
4945 }
4946
4947 static NTSTATUS lease_match(connection_struct *conn,
4948                             struct smb_request *req,
4949                             const struct smb2_lease_key *lease_key,
4950                             const char *servicepath,
4951                             const struct smb_filename *fname,
4952                             uint16_t *p_version,
4953                             uint16_t *p_epoch)
4954 {
4955         struct smbd_server_connection *sconn = req->sconn;
4956         TALLOC_CTX *tos = talloc_tos();
4957         struct lease_match_state state = {
4958                 .mem_ctx = tos,
4959                 .servicepath = servicepath,
4960                 .fname = fname,
4961                 .match_status = NT_STATUS_OK
4962         };
4963         uint32_t i;
4964         NTSTATUS status;
4965
4966         state.file_existed = VALID_STAT(fname->st);
4967         if (state.file_existed) {
4968                 state.id = vfs_file_id_from_sbuf(conn, &fname->st);
4969         }
4970
4971         status = leases_db_parse(&sconn->client->connections->smb2.client.guid,
4972                                  lease_key, lease_match_parser, &state);
4973         if (!NT_STATUS_IS_OK(status)) {
4974                 /*
4975                  * Not found or error means okay: We can make the lease pass
4976                  */
4977                 return NT_STATUS_OK;
4978         }
4979         if (!NT_STATUS_EQUAL(state.match_status, NT_STATUS_OPLOCK_NOT_GRANTED)) {
4980                 /*
4981                  * Anything but NT_STATUS_OPLOCK_NOT_GRANTED, let the caller
4982                  * deal with it.
4983                  */
4984                 return state.match_status;
4985         }
4986
4987         /* We have to break all existing leases. */
4988         for (i = 0; i < state.num_file_ids; i++) {
4989                 struct share_mode_lock *lck;
4990                 struct share_mode_data *d;
4991                 struct share_mode_entry *lease_entry = NULL;
4992                 uint32_t j;
4993
4994                 if (file_id_equal(&state.ids[i], &state.id)) {
4995                         /* Don't need to break our own file. */
4996                         continue;
4997                 }
4998
4999                 lck = get_existing_share_mode_lock(talloc_tos(), state.ids[i]);
5000                 if (lck == NULL) {
5001                         /* Race condition - file already closed. */
5002                         continue;
5003                 }
5004                 d = lck->data;
5005                 for (j=0; j<d->num_share_modes; j++) {
5006                         struct share_mode_entry *e = &d->share_modes[j];
5007                         uint32_t e_lease_type = get_lease_type(e, d->id);
5008
5009                         if (share_mode_stale_pid(d, j)) {
5010                                 continue;
5011                         }
5012
5013                         if (e->op_type == LEASE_OPLOCK) {
5014                                 if (!smb2_lease_key_equal(&e->lease_key,
5015                                                           lease_key)) {
5016                                         continue;
5017                                 }
5018                                 lease_entry = e;
5019                         }
5020
5021                         if (e_lease_type == SMB2_LEASE_NONE) {
5022                                 continue;
5023                         }
5024
5025                         send_break_message(conn->sconn->msg_ctx, &d->id, e,
5026                                            SMB2_LEASE_NONE);
5027
5028                         /*
5029                          * Windows 7 and 8 lease clients
5030                          * are broken in that they will not
5031                          * respond to lease break requests
5032                          * whilst waiting for an outstanding
5033                          * open request on that lease handle
5034                          * on the same TCP connection, due
5035                          * to holding an internal inode lock.
5036                          *
5037                          * This means we can't reschedule
5038                          * ourselves here, but must return
5039                          * from the create.
5040                          *
5041                          * Work around:
5042                          *
5043                          * Send the breaks and then return
5044                          * SMB2_LEASE_NONE in the lease handle
5045                          * to cause them to acknowledge the
5046                          * lease break. Consultation with
5047                          * Microsoft engineering confirmed
5048                          * this approach is safe.
5049                          */
5050
5051                 }
5052
5053                 if (lease_entry != NULL) {
5054                         status = leases_db_get(
5055                                 &lease_entry->client_guid,
5056                                 &lease_entry->lease_key,
5057                                 &d->id,
5058                                 NULL, /* current_state */
5059                                 NULL, /* breaking */
5060                                 NULL, /* breaking_to_requested */
5061                                 NULL, /* breaking_to_required */
5062                                 p_version, /* lease_version */
5063                                 p_epoch); /* epoch */
5064                         if (!NT_STATUS_IS_OK(status)) {
5065                                 DBG_WARNING("Could not find version/epoch: "
5066                                             "%s\n",
5067                                             nt_errstr(status));
5068                         }
5069                 }
5070
5071                 TALLOC_FREE(lck);
5072         }
5073         /*
5074          * Ensure we don't grant anything more so we
5075          * never upgrade.
5076          */
5077         return NT_STATUS_OPLOCK_NOT_GRANTED;
5078 }
5079
5080 /*
5081  * Wrapper around open_file_ntcreate and open_directory
5082  */
5083
5084 static NTSTATUS create_file_unixpath(connection_struct *conn,
5085                                      struct smb_request *req,
5086                                      struct smb_filename *smb_fname,
5087                                      uint32_t access_mask,
5088                                      uint32_t share_access,
5089                                      uint32_t create_disposition,
5090                                      uint32_t create_options,
5091                                      uint32_t file_attributes,
5092                                      uint32_t oplock_request,
5093                                      const struct smb2_lease *lease,
5094                                      uint64_t allocation_size,
5095                                      uint32_t private_flags,
5096                                      struct security_descriptor *sd,
5097                                      struct ea_list *ea_list,
5098
5099                                      files_struct **result,
5100                                      int *pinfo)
5101 {
5102         struct smb2_lease none_lease;
5103         int info = FILE_WAS_OPENED;
5104         files_struct *base_fsp = NULL;
5105         files_struct *fsp = NULL;
5106         NTSTATUS status;
5107
5108         DBG_DEBUG("create_file_unixpath: access_mask = 0x%x "
5109                   "file_attributes = 0x%x, share_access = 0x%x, "
5110                   "create_disposition = 0x%x create_options = 0x%x "
5111                   "oplock_request = 0x%x private_flags = 0x%x "
5112                   "ea_list = %p, sd = %p, "
5113                   "fname = %s\n",
5114                   (unsigned int)access_mask,
5115                   (unsigned int)file_attributes,
5116                   (unsigned int)share_access,
5117                   (unsigned int)create_disposition,
5118                   (unsigned int)create_options,
5119                   (unsigned int)oplock_request,
5120                   (unsigned int)private_flags,
5121                   ea_list, sd, smb_fname_str_dbg(smb_fname));
5122
5123         if (create_options & FILE_OPEN_BY_FILE_ID) {
5124                 status = NT_STATUS_NOT_SUPPORTED;
5125                 goto fail;
5126         }
5127
5128         if (create_options & NTCREATEX_OPTIONS_INVALID_PARAM_MASK) {
5129                 status = NT_STATUS_INVALID_PARAMETER;
5130                 goto fail;
5131         }
5132
5133         if (req == NULL) {
5134                 oplock_request |= INTERNAL_OPEN_ONLY;
5135         }
5136
5137         if (lease != NULL) {
5138                 uint16_t epoch = lease->lease_epoch;
5139                 uint16_t version = lease->lease_version;
5140
5141                 if (req == NULL) {
5142                         DBG_WARNING("Got lease on internal open\n");
5143                         status = NT_STATUS_INTERNAL_ERROR;
5144                         goto fail;
5145                 }
5146
5147                 status = lease_match(conn,
5148                                 req,
5149                                 &lease->lease_key,
5150                                 conn->connectpath,
5151                                 smb_fname,
5152                                 &version,
5153                                 &epoch);
5154                 if (NT_STATUS_EQUAL(status, NT_STATUS_OPLOCK_NOT_GRANTED)) {
5155                         /* Dynamic share file. No leases and update epoch... */
5156                         none_lease = *lease;
5157                         none_lease.lease_state = SMB2_LEASE_NONE;
5158                         none_lease.lease_epoch = epoch;
5159                         none_lease.lease_version = version;
5160                         lease = &none_lease;
5161                 } else if (!NT_STATUS_IS_OK(status)) {
5162                         goto fail;
5163                 }
5164         }
5165
5166         if ((conn->fs_capabilities & FILE_NAMED_STREAMS)
5167             && (access_mask & DELETE_ACCESS)
5168             && !is_ntfs_stream_smb_fname(smb_fname)) {
5169                 /*
5170                  * We can't open a file with DELETE access if any of the
5171                  * streams is open without FILE_SHARE_DELETE
5172                  */
5173                 status = open_streams_for_delete(conn, smb_fname);
5174
5175                 if (!NT_STATUS_IS_OK(status)) {
5176                         goto fail;
5177                 }
5178         }
5179
5180         if ((access_mask & SEC_FLAG_SYSTEM_SECURITY) &&
5181                         !security_token_has_privilege(get_current_nttok(conn),
5182                                         SEC_PRIV_SECURITY)) {
5183                 DEBUG(10, ("create_file_unixpath: open on %s "
5184                         "failed - SEC_FLAG_SYSTEM_SECURITY denied.\n",
5185                         smb_fname_str_dbg(smb_fname)));
5186                 status = NT_STATUS_PRIVILEGE_NOT_HELD;
5187                 goto fail;
5188         }
5189
5190         /*
5191          * Files or directories can't be opened DELETE_ON_CLOSE without
5192          * delete access.
5193          * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13358
5194          */
5195         if (create_options & FILE_DELETE_ON_CLOSE) {
5196                 if ((access_mask & DELETE_ACCESS) == 0) {
5197                         status = NT_STATUS_INVALID_PARAMETER;
5198                         goto fail;
5199                 }
5200         }
5201
5202         if ((conn->fs_capabilities & FILE_NAMED_STREAMS)
5203             && is_ntfs_stream_smb_fname(smb_fname)
5204             && (!(private_flags & NTCREATEX_OPTIONS_PRIVATE_STREAM_DELETE))) {
5205                 uint32_t base_create_disposition;
5206                 struct smb_filename *smb_fname_base = NULL;
5207                 uint32_t base_privflags;
5208
5209                 if (create_options & FILE_DIRECTORY_FILE) {
5210                         status = NT_STATUS_NOT_A_DIRECTORY;
5211                         goto fail;
5212                 }
5213
5214                 switch (create_disposition) {
5215                 case FILE_OPEN:
5216                         base_create_disposition = FILE_OPEN;
5217                         break;
5218                 default:
5219                         base_create_disposition = FILE_OPEN_IF;
5220                         break;
5221                 }
5222
5223                 /* Create an smb_filename with stream_name == NULL. */
5224                 smb_fname_base = synthetic_smb_fname(talloc_tos(),
5225                                                 smb_fname->base_name,
5226                                                 NULL,
5227                                                 NULL,
5228                                                 smb_fname->flags);
5229                 if (smb_fname_base == NULL) {
5230                         status = NT_STATUS_NO_MEMORY;
5231                         goto fail;
5232                 }
5233
5234                 if (SMB_VFS_STAT(conn, smb_fname_base) == -1) {
5235                         DEBUG(10, ("Unable to stat stream: %s\n",
5236                                    smb_fname_str_dbg(smb_fname_base)));
5237                 } else {
5238                         /*
5239                          * https://bugzilla.samba.org/show_bug.cgi?id=10229
5240                          * We need to check if the requested access mask
5241                          * could be used to open the underlying file (if
5242                          * it existed), as we're passing in zero for the
5243                          * access mask to the base filename.
5244                          */
5245                         status = check_base_file_access(conn,
5246                                                         smb_fname_base,
5247                                                         access_mask);
5248
5249                         if (!NT_STATUS_IS_OK(status)) {
5250                                 DEBUG(10, ("Permission check "
5251                                         "for base %s failed: "
5252                                         "%s\n", smb_fname->base_name,
5253                                         nt_errstr(status)));
5254                                 goto fail;
5255                         }
5256                 }
5257
5258                 base_privflags = NTCREATEX_OPTIONS_PRIVATE_STREAM_BASEOPEN;
5259
5260                 /* Open the base file. */
5261                 status = create_file_unixpath(conn, NULL, smb_fname_base, 0,
5262                                               FILE_SHARE_READ
5263                                               | FILE_SHARE_WRITE
5264                                               | FILE_SHARE_DELETE,
5265                                               base_create_disposition,
5266                                               0, 0, 0, NULL, 0,
5267                                               base_privflags,
5268                                               NULL, NULL,
5269                                               &base_fsp, NULL);
5270                 TALLOC_FREE(smb_fname_base);
5271
5272                 if (!NT_STATUS_IS_OK(status)) {
5273                         DEBUG(10, ("create_file_unixpath for base %s failed: "
5274                                    "%s\n", smb_fname->base_name,
5275                                    nt_errstr(status)));
5276                         goto fail;
5277                 }
5278                 /* we don't need the low level fd */
5279                 fd_close(base_fsp);
5280         }
5281
5282         /*
5283          * If it's a request for a directory open, deal with it separately.
5284          */
5285
5286         if (create_options & FILE_DIRECTORY_FILE) {
5287
5288                 if (create_options & FILE_NON_DIRECTORY_FILE) {
5289                         status = NT_STATUS_INVALID_PARAMETER;
5290                         goto fail;
5291                 }
5292
5293                 /* Can't open a temp directory. IFS kit test. */
5294                 if (!(file_attributes & FILE_FLAG_POSIX_SEMANTICS) &&
5295                      (file_attributes & FILE_ATTRIBUTE_TEMPORARY)) {
5296                         status = NT_STATUS_INVALID_PARAMETER;
5297                         goto fail;
5298                 }
5299
5300                 /*
5301                  * We will get a create directory here if the Win32
5302                  * app specified a security descriptor in the
5303                  * CreateDirectory() call.
5304                  */
5305
5306                 oplock_request = 0;
5307                 status = open_directory(
5308                         conn, req, smb_fname, access_mask, share_access,
5309                         create_disposition, create_options, file_attributes,
5310                         &info, &fsp);
5311         } else {
5312
5313                 /*
5314                  * Ordinary file case.
5315                  */
5316
5317                 status = file_new(req, conn, &fsp);
5318                 if(!NT_STATUS_IS_OK(status)) {
5319                         goto fail;
5320                 }
5321
5322                 status = fsp_set_smb_fname(fsp, smb_fname);
5323                 if (!NT_STATUS_IS_OK(status)) {
5324                         goto fail;
5325                 }
5326
5327                 if (base_fsp) {
5328                         /*
5329                          * We're opening the stream element of a
5330                          * base_fsp we already opened. Set up the
5331                          * base_fsp pointer.
5332                          */
5333                         fsp->base_fsp = base_fsp;
5334                 }
5335
5336                 if (allocation_size) {
5337                         fsp->initial_allocation_size = smb_roundup(fsp->conn,
5338                                                         allocation_size);
5339                 }
5340
5341                 status = open_file_ntcreate(conn,
5342                                             req,
5343                                             access_mask,
5344                                             share_access,
5345                                             create_disposition,
5346                                             create_options,
5347                                             file_attributes,
5348                                             oplock_request,
5349                                             lease,
5350                                             private_flags,
5351                                             &info,
5352                                             fsp);
5353
5354                 if(!NT_STATUS_IS_OK(status)) {
5355                         file_free(req, fsp);
5356                         fsp = NULL;
5357                 }
5358
5359                 if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_IS_A_DIRECTORY)) {
5360
5361                         /* A stream open never opens a directory */
5362
5363                         if (base_fsp) {
5364                                 status = NT_STATUS_FILE_IS_A_DIRECTORY;
5365                                 goto fail;
5366                         }
5367
5368                         /*
5369                          * Fail the open if it was explicitly a non-directory
5370                          * file.
5371                          */
5372
5373                         if (create_options & FILE_NON_DIRECTORY_FILE) {
5374                                 status = NT_STATUS_FILE_IS_A_DIRECTORY;
5375                                 goto fail;
5376                         }
5377
5378                         oplock_request = 0;
5379                         status = open_directory(
5380                                 conn, req, smb_fname, access_mask,
5381                                 share_access, create_disposition,
5382                                 create_options, file_attributes,
5383                                 &info, &fsp);
5384                 }
5385         }
5386
5387         if (!NT_STATUS_IS_OK(status)) {
5388                 goto fail;
5389         }
5390
5391         fsp->base_fsp = base_fsp;
5392
5393         if ((ea_list != NULL) &&
5394             ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN))) {
5395                 status = set_ea(conn, fsp, fsp->fsp_name, ea_list);
5396                 if (!NT_STATUS_IS_OK(status)) {
5397                         goto fail;
5398                 }
5399         }
5400
5401         if (!fsp->is_directory && S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
5402                 status = NT_STATUS_ACCESS_DENIED;
5403                 goto fail;
5404         }
5405
5406         /* Save the requested allocation size. */
5407         if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
5408                 if ((allocation_size > (uint64_t)fsp->fsp_name->st.st_ex_size)
5409                     && !(fsp->is_directory))
5410                 {
5411                         fsp->initial_allocation_size = smb_roundup(
5412                                 fsp->conn, allocation_size);
5413                         if (vfs_allocate_file_space(
5414                                     fsp, fsp->initial_allocation_size) == -1) {
5415                                 status = NT_STATUS_DISK_FULL;
5416                                 goto fail;
5417                         }
5418                 } else {
5419                         fsp->initial_allocation_size = smb_roundup(
5420                                 fsp->conn, (uint64_t)fsp->fsp_name->st.st_ex_size);
5421                 }
5422         } else {
5423                 fsp->initial_allocation_size = 0;
5424         }
5425
5426         if ((info == FILE_WAS_CREATED) && lp_nt_acl_support(SNUM(conn)) &&
5427                                 fsp->base_fsp == NULL) {
5428                 if (sd != NULL) {
5429                         /*
5430                          * According to the MS documentation, the only time the security
5431                          * descriptor is applied to the opened file is iff we *created* the
5432                          * file; an existing file stays the same.
5433                          *
5434                          * Also, it seems (from observation) that you can open the file with
5435                          * any access mask but you can still write the sd. We need to override
5436                          * the granted access before we call set_sd
5437                          * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
5438                          */
5439
5440                         uint32_t sec_info_sent;
5441                         uint32_t saved_access_mask = fsp->access_mask;
5442
5443                         sec_info_sent = get_sec_info(sd);
5444
5445                         fsp->access_mask = FILE_GENERIC_ALL;
5446
5447                         if (sec_info_sent & (SECINFO_OWNER|
5448                                                 SECINFO_GROUP|
5449                                                 SECINFO_DACL|
5450                                                 SECINFO_SACL)) {
5451                                 status = set_sd(fsp, sd, sec_info_sent);
5452                         }
5453
5454                         fsp->access_mask = saved_access_mask;
5455
5456                         if (!NT_STATUS_IS_OK(status)) {
5457                                 goto fail;
5458                         }
5459                 } else if (lp_inherit_acls(SNUM(conn))) {
5460                         /* Inherit from parent. Errors here are not fatal. */
5461                         status = inherit_new_acl(fsp);
5462                         if (!NT_STATUS_IS_OK(status)) {
5463                                 DEBUG(10,("inherit_new_acl: failed for %s with %s\n",
5464                                         fsp_str_dbg(fsp),
5465                                         nt_errstr(status) ));
5466                         }
5467                 }
5468         }
5469
5470         if ((conn->fs_capabilities & FILE_FILE_COMPRESSION)
5471          && (create_options & FILE_NO_COMPRESSION)
5472          && (info == FILE_WAS_CREATED)) {
5473                 status = SMB_VFS_SET_COMPRESSION(conn, fsp, fsp,
5474                                                  COMPRESSION_FORMAT_NONE);
5475                 if (!NT_STATUS_IS_OK(status)) {
5476                         DEBUG(1, ("failed to disable compression: %s\n",
5477                                   nt_errstr(status)));
5478                 }
5479         }
5480
5481         DEBUG(10, ("create_file_unixpath: info=%d\n", info));
5482
5483         *result = fsp;
5484         if (pinfo != NULL) {
5485                 *pinfo = info;
5486         }
5487
5488         smb_fname->st = fsp->fsp_name->st;
5489
5490         return NT_STATUS_OK;
5491
5492  fail:
5493         DEBUG(10, ("create_file_unixpath: %s\n", nt_errstr(status)));
5494
5495         if (fsp != NULL) {
5496                 if (base_fsp && fsp->base_fsp == base_fsp) {
5497                         /*
5498                          * The close_file below will close
5499                          * fsp->base_fsp.
5500                          */
5501                         base_fsp = NULL;
5502                 }
5503                 close_file(req, fsp, ERROR_CLOSE);
5504                 fsp = NULL;
5505         }
5506         if (base_fsp != NULL) {
5507                 close_file(req, base_fsp, ERROR_CLOSE);
5508                 base_fsp = NULL;
5509         }
5510         return status;
5511 }
5512
5513 /*
5514  * Calculate the full path name given a relative fid.
5515  */
5516 static NTSTATUS get_relative_fid_filename(
5517         connection_struct *conn,
5518         struct smb_request *req,
5519         uint16_t root_dir_fid,
5520         const struct smb_filename *smb_fname,
5521         struct smb_filename **smb_fname_out)
5522 {
5523         files_struct *dir_fsp;
5524         char *parent_fname = NULL;
5525         char *new_base_name = NULL;
5526         uint32_t ucf_flags = ucf_flags_from_smb_request(req);
5527         NTSTATUS status;
5528
5529         if (root_dir_fid == 0 || !smb_fname) {
5530                 status = NT_STATUS_INTERNAL_ERROR;
5531                 goto out;
5532         }
5533
5534         dir_fsp = file_fsp(req, root_dir_fid);
5535
5536         if (dir_fsp == NULL) {
5537                 status = NT_STATUS_INVALID_HANDLE;
5538                 goto out;
5539         }
5540
5541         if (is_ntfs_stream_smb_fname(dir_fsp->fsp_name)) {
5542                 status = NT_STATUS_INVALID_HANDLE;
5543                 goto out;
5544         }
5545
5546         if (!dir_fsp->is_directory) {
5547
5548                 /*
5549                  * Check to see if this is a mac fork of some kind.
5550                  */
5551
5552                 if ((conn->fs_capabilities & FILE_NAMED_STREAMS) &&
5553                     is_ntfs_stream_smb_fname(smb_fname)) {
5554                         status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
5555                         goto out;
5556                 }
5557
5558                 /*
5559                   we need to handle the case when we get a
5560                   relative open relative to a file and the
5561                   pathname is blank - this is a reopen!
5562                   (hint from demyn plantenberg)
5563                 */
5564
5565                 status = NT_STATUS_INVALID_HANDLE;
5566                 goto out;
5567         }
5568
5569         if (ISDOT(dir_fsp->fsp_name->base_name)) {
5570                 /*
5571                  * We're at the toplevel dir, the final file name
5572                  * must not contain ./, as this is filtered out
5573                  * normally by srvstr_get_path and unix_convert
5574                  * explicitly rejects paths containing ./.
5575                  */
5576                 parent_fname = talloc_strdup(talloc_tos(), "");
5577                 if (parent_fname == NULL) {
5578                         status = NT_STATUS_NO_MEMORY;
5579                         goto out;
5580                 }
5581         } else {
5582                 size_t dir_name_len = strlen(dir_fsp->fsp_name->base_name);
5583
5584                 /*
5585                  * Copy in the base directory name.
5586                  */
5587
5588                 parent_fname = talloc_array(talloc_tos(), char,
5589                     dir_name_len+2);
5590                 if (parent_fname == NULL) {
5591                         status = NT_STATUS_NO_MEMORY;
5592                         goto out;
5593                 }
5594                 memcpy(parent_fname, dir_fsp->fsp_name->base_name,
5595                     dir_name_len+1);
5596
5597                 /*
5598                  * Ensure it ends in a '/'.
5599                  * We used TALLOC_SIZE +2 to add space for the '/'.
5600                  */
5601
5602                 if(dir_name_len
5603                     && (parent_fname[dir_name_len-1] != '\\')
5604                     && (parent_fname[dir_name_len-1] != '/')) {
5605                         parent_fname[dir_name_len] = '/';
5606                         parent_fname[dir_name_len+1] = '\0';
5607                 }
5608         }
5609
5610         new_base_name = talloc_asprintf(talloc_tos(), "%s%s", parent_fname,
5611                                         smb_fname->base_name);
5612         if (new_base_name == NULL) {
5613                 status = NT_STATUS_NO_MEMORY;
5614                 goto out;
5615         }
5616
5617         status = filename_convert(req,
5618                                 conn,
5619                                 new_base_name,
5620                                 ucf_flags,
5621                                 NULL,
5622                                 NULL,
5623                                 smb_fname_out);
5624         if (!NT_STATUS_IS_OK(status)) {
5625                 goto out;
5626         }
5627
5628  out:
5629         TALLOC_FREE(parent_fname);
5630         TALLOC_FREE(new_base_name);
5631         return status;
5632 }
5633
5634 NTSTATUS create_file_default(connection_struct *conn,
5635                              struct smb_request *req,
5636                              uint16_t root_dir_fid,
5637                              struct smb_filename *smb_fname,
5638                              uint32_t access_mask,
5639                              uint32_t share_access,
5640                              uint32_t create_disposition,
5641                              uint32_t create_options,
5642                              uint32_t file_attributes,
5643                              uint32_t oplock_request,
5644                              const struct smb2_lease *lease,
5645                              uint64_t allocation_size,
5646                              uint32_t private_flags,
5647                              struct security_descriptor *sd,
5648                              struct ea_list *ea_list,
5649                              files_struct **result,
5650                              int *pinfo,
5651                              const struct smb2_create_blobs *in_context_blobs,
5652                              struct smb2_create_blobs *out_context_blobs)
5653 {
5654         int info = FILE_WAS_OPENED;
5655         files_struct *fsp = NULL;
5656         NTSTATUS status;
5657         bool stream_name = false;
5658
5659         DBG_DEBUG("create_file: access_mask = 0x%x "
5660                   "file_attributes = 0x%x, share_access = 0x%x, "
5661                   "create_disposition = 0x%x create_options = 0x%x "
5662                   "oplock_request = 0x%x "
5663                   "private_flags = 0x%x "
5664                   "root_dir_fid = 0x%x, ea_list = %p, sd = %p, "
5665                   "fname = %s\n",
5666                   (unsigned int)access_mask,
5667                   (unsigned int)file_attributes,
5668                   (unsigned int)share_access,
5669                   (unsigned int)create_disposition,
5670                   (unsigned int)create_options,
5671                   (unsigned int)oplock_request,
5672                   (unsigned int)private_flags,
5673                   (unsigned int)root_dir_fid,
5674                   ea_list, sd, smb_fname_str_dbg(smb_fname));
5675
5676         if (req != NULL) {
5677                 /*
5678                  * Remember the absolute time of the original request
5679                  * with this mid. We'll use it later to see if this
5680                  * has timed out.
5681                  */
5682                 get_deferred_open_message_state(req, &req->request_time, NULL);
5683         }
5684
5685         /*
5686          * Calculate the filename from the root_dir_if if necessary.
5687          */
5688
5689         if (root_dir_fid != 0) {
5690                 struct smb_filename *smb_fname_out = NULL;
5691                 status = get_relative_fid_filename(conn, req, root_dir_fid,
5692                                                    smb_fname, &smb_fname_out);
5693                 if (!NT_STATUS_IS_OK(status)) {
5694                         goto fail;
5695                 }
5696                 smb_fname = smb_fname_out;
5697         }
5698
5699         /*
5700          * Check to see if this is a mac fork of some kind.
5701          */
5702
5703         stream_name = is_ntfs_stream_smb_fname(smb_fname);
5704         if (stream_name) {
5705                 enum FAKE_FILE_TYPE fake_file_type;
5706
5707                 fake_file_type = is_fake_file(smb_fname);
5708
5709                 if (fake_file_type != FAKE_FILE_TYPE_NONE) {
5710
5711                         /*
5712                          * Here we go! support for changing the disk quotas
5713                          * --metze
5714                          *
5715                          * We need to fake up to open this MAGIC QUOTA file
5716                          * and return a valid FID.
5717                          *
5718                          * w2k close this file directly after openening xp
5719                          * also tries a QUERY_FILE_INFO on the file and then
5720                          * close it
5721                          */
5722                         status = open_fake_file(req, conn, req->vuid,
5723                                                 fake_file_type, smb_fname,
5724                                                 access_mask, &fsp);
5725                         if (!NT_STATUS_IS_OK(status)) {
5726                                 goto fail;
5727                         }
5728
5729                         ZERO_STRUCT(smb_fname->st);
5730                         goto done;
5731                 }
5732
5733                 if (!(conn->fs_capabilities & FILE_NAMED_STREAMS)) {
5734                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
5735                         goto fail;
5736                 }
5737         }
5738
5739         if (is_ntfs_default_stream_smb_fname(smb_fname)) {
5740                 int ret;
5741                 smb_fname->stream_name = NULL;
5742                 /* We have to handle this error here. */
5743                 if (create_options & FILE_DIRECTORY_FILE) {
5744                         status = NT_STATUS_NOT_A_DIRECTORY;
5745                         goto fail;
5746                 }
5747                 if (req != NULL && req->posix_pathnames) {
5748                         ret = SMB_VFS_LSTAT(conn, smb_fname);
5749                 } else {
5750                         ret = SMB_VFS_STAT(conn, smb_fname);
5751                 }
5752
5753                 if (ret == 0 && VALID_STAT_OF_DIR(smb_fname->st)) {
5754                         status = NT_STATUS_FILE_IS_A_DIRECTORY;
5755                         goto fail;
5756                 }
5757         }
5758
5759         status = create_file_unixpath(
5760                 conn, req, smb_fname, access_mask, share_access,
5761                 create_disposition, create_options, file_attributes,
5762                 oplock_request, lease, allocation_size, private_flags,
5763                 sd, ea_list,
5764                 &fsp, &info);
5765
5766         if (!NT_STATUS_IS_OK(status)) {
5767                 goto fail;
5768         }
5769
5770  done:
5771         DEBUG(10, ("create_file: info=%d\n", info));
5772
5773         *result = fsp;
5774         if (pinfo != NULL) {
5775                 *pinfo = info;
5776         }
5777         return NT_STATUS_OK;
5778
5779  fail:
5780         DEBUG(10, ("create_file: %s\n", nt_errstr(status)));
5781
5782         if (fsp != NULL) {
5783                 close_file(req, fsp, ERROR_CLOSE);
5784                 fsp = NULL;
5785         }
5786         return status;
5787 }