source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  35 #include "../librpc/gen_ndr/open_files.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "rpc_server/rpc_ncacn_np.h"
  39 #include "libcli/security/security.h"
  40 #include "libsmb/nmblib.h"
  41 #include "auth.h"
  42 #include "smbprofile.h"
  43 #include "../lib/tsocket/tsocket.h"
  44 #include "lib/tevent_wait.h"
  45 #include "libcli/smb/smb_signing.h"
  46 #include "lib/sys_rw_data.h"
  47
  48 /****************************************************************************
  49  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  50  path or anything including wildcards.
  51  We're assuming here that '/' is not the second byte in any multibyte char
  52  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  53  set.
  54 ****************************************************************************/
  55
  56 /* Custom version for processing POSIX paths. */
  57 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  58
  59 static NTSTATUS check_path_syntax_internal(char *path,
  60                                            bool posix_path,
  61                                            bool *p_last_component_contains_wcard)
  62 {
  63         char *d = path;
  64         const char *s = path;
  65         NTSTATUS ret = NT_STATUS_OK;
  66         bool start_of_name_component = True;
  67         bool stream_started = false;
  68
  69         *p_last_component_contains_wcard = False;
  70
  71         while (*s) {
  72                 if (stream_started) {
  73                         switch (*s) {
  74                         case '/':
  75                         case '\\':
  76                                 return NT_STATUS_OBJECT_NAME_INVALID;
  77                         case ':':
  78                                 if (s[1] == '\0') {
  79                                         return NT_STATUS_OBJECT_NAME_INVALID;
  80                                 }
  81                                 if (strchr_m(&s[1], ':')) {
  82                                         return NT_STATUS_OBJECT_NAME_INVALID;
  83                                 }
  84                                 break;
  85                         }
  86                 }
  87
  88                 if ((*s == ':') && !posix_path && !stream_started) {
  89                         if (*p_last_component_contains_wcard) {
  90                                 return NT_STATUS_OBJECT_NAME_INVALID;
  91                         }
  92                         /* Stream names allow more characters than file names.
  93                            We're overloading posix_path here to allow a wider
  94                            range of characters. If stream_started is true this
  95                            is still a Windows path even if posix_path is true.
  96                            JRA.
  97                         */
  98                         stream_started = true;
  99                         start_of_name_component = false;
 100                         posix_path = true;
 101
 102                         if (s[1] == '\0') {
 103                                 return NT_STATUS_OBJECT_NAME_INVALID;
 104                         }
 105                 }
 106
 107                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 108                         /*
 109                          * Safe to assume is not the second part of a mb char
 110                          * as this is handled below.
 111                          */
 112                         /* Eat multiple '/' or '\\' */
 113                         while (IS_PATH_SEP(*s,posix_path)) {
 114                                 s++;
 115                         }
 116                         if ((d != path) && (*s != '\0')) {
 117                                 /* We only care about non-leading or trailing '/' or '\\' */
 118                                 *d++ = '/';
 119                         }
 120
 121                         start_of_name_component = True;
 122                         /* New component. */
 123                         *p_last_component_contains_wcard = False;
 124                         continue;
 125                 }
 126
 127                 if (start_of_name_component) {
 128                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 129                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 130
 131                                 /*
 132                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 133                                  */
 134
 135                                 /* If  we just added a '/' - delete it */
 136                                 if ((d > path) && (*(d-1) == '/')) {
 137                                         *(d-1) = '\0';
 138                                         d--;
 139                                 }
 140
 141                                 /* Are we at the start ? Can't go back further if so. */
 142                                 if (d <= path) {
 143                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 144                                         break;
 145                                 }
 146                                 /* Go back one level... */
 147                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 148                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 149                                 /* Decrement d first as d points to the *next* char to write into. */
 150                                 for (d--; d > path; d--) {
 151                                         if (*d == '/')
 152                                                 break;
 153                                 }
 154                                 s += 2; /* Else go past the .. */
 155                                 /* We're still at the start of a name component, just the previous one. */
 156                                 continue;
 157
 158                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 159                                 if (posix_path) {
 160                                         /* Eat the '.' */
 161                                         s++;
 162                                         continue;
 163                                 }
 164                         }
 165
 166                 }
 167
 168                 if (!(*s & 0x80)) {
 169                         if (!posix_path) {
 170                                 if (*s <= 0x1f || *s == '|') {
 171                                         return NT_STATUS_OBJECT_NAME_INVALID;
 172                                 }
 173                                 switch (*s) {
 174                                         case '*':
 175                                         case '?':
 176                                         case '<':
 177                                         case '>':
 178                                         case '"':
 179                                                 *p_last_component_contains_wcard = True;
 180                                                 break;
 181                                         default:
 182                                                 break;
 183                                 }
 184                         }
 185                         *d++ = *s++;
 186                 } else {
 187                         size_t siz;
 188                         /* Get the size of the next MB character. */
 189                         next_codepoint(s,&siz);
 190                         switch(siz) {
 191                                 case 5:
 192                                         *d++ = *s++;
 193                                         /*fall through*/
 194                                 case 4:
 195                                         *d++ = *s++;
 196                                         /*fall through*/
 197                                 case 3:
 198                                         *d++ = *s++;
 199                                         /*fall through*/
 200                                 case 2:
 201                                         *d++ = *s++;
 202                                         /*fall through*/
 203                                 case 1:
 204                                         *d++ = *s++;
 205                                         break;
 206                                 default:
 207                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 208                                         *d = '\0';
 209                                         return NT_STATUS_INVALID_PARAMETER;
 210                         }
 211                 }
 212                 start_of_name_component = False;
 213         }
 214
 215         *d = '\0';
 216
 217         return ret;
 218 }
 219
 220 /****************************************************************************
 221  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 222  No wildcards allowed.
 223 ****************************************************************************/
 224
 225 NTSTATUS check_path_syntax(char *path)
 226 {
 227         bool ignore;
 228         return check_path_syntax_internal(path, False, &ignore);
 229 }
 230
 231 /****************************************************************************
 232  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 233  Wildcards allowed - p_contains_wcard returns true if the last component contained
 234  a wildcard.
 235 ****************************************************************************/
 236
 237 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 238 {
 239         return check_path_syntax_internal(path, False, p_contains_wcard);
 240 }
 241
 242 /****************************************************************************
 243  Check the path for a POSIX client.
 244  We're assuming here that '/' is not the second byte in any multibyte char
 245  set (a safe assumption).
 246 ****************************************************************************/
 247
 248 NTSTATUS check_path_syntax_posix(char *path)
 249 {
 250         bool ignore;
 251         return check_path_syntax_internal(path, True, &ignore);
 252 }
 253
 254 /****************************************************************************
 255  Pull a string and check the path allowing a wilcard - provide for error return.
 256 ****************************************************************************/
 257
 258 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 259                         const char *base_ptr,
 260                         uint16_t smb_flags2,
 261                         char **pp_dest,
 262                         const char *src,
 263                         size_t src_len,
 264                         int flags,
 265                         NTSTATUS *err,
 266                         bool *contains_wcard)
 267 {
 268         size_t ret;
 269
 270         *pp_dest = NULL;
 271
 272         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 273                                  src_len, flags);
 274
 275         if (!*pp_dest) {
 276                 *err = NT_STATUS_INVALID_PARAMETER;
 277                 return ret;
 278         }
 279
 280         *contains_wcard = False;
 281
 282         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 283                 /*
 284                  * For a DFS path the function parse_dfs_path()
 285                  * will do the path processing, just make a copy.
 286                  */
 287                 *err = NT_STATUS_OK;
 288                 return ret;
 289         }
 290
 291         if (lp_posix_pathnames()) {
 292                 *err = check_path_syntax_posix(*pp_dest);
 293         } else {
 294                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 295         }
 296
 297         return ret;
 298 }
 299
 300 /****************************************************************************
 301  Pull a string and check the path - provide for error return.
 302 ****************************************************************************/
 303
 304 size_t srvstr_get_path(TALLOC_CTX *ctx,
 305                         const char *base_ptr,
 306                         uint16_t smb_flags2,
 307                         char **pp_dest,
 308                         const char *src,
 309                         size_t src_len,
 310                         int flags,
 311                         NTSTATUS *err)
 312 {
 313         bool ignore;
 314         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 315                                      src_len, flags, err, &ignore);
 316 }
 317
 318 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 319                                  char **pp_dest, const char *src, int flags,
 320                                  NTSTATUS *err, bool *contains_wcard)
 321 {
 322         ssize_t bufrem = smbreq_bufrem(req, src);
 323
 324         if (bufrem < 0) {
 325                 *err = NT_STATUS_INVALID_PARAMETER;
 326                 return 0;
 327         }
 328
 329         return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
 330                                      req->flags2, pp_dest, src, bufrem, flags,
 331                                      err, contains_wcard);
 332 }
 333
 334 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 335                            char **pp_dest, const char *src, int flags,
 336                            NTSTATUS *err)
 337 {
 338         bool ignore;
 339         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 340                                          flags, err, &ignore);
 341 }
 342
 343 /**
 344  * pull a string from the smb_buf part of a packet. In this case the
 345  * string can either be null terminated or it can be terminated by the
 346  * end of the smbbuf area
 347  */
 348 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
 349                               char **dest, const uint8_t *src, int flags)
 350 {
 351         ssize_t bufrem = smbreq_bufrem(req, src);
 352
 353         if (bufrem < 0) {
 354                 return 0;
 355         }
 356
 357         return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
 358                                   bufrem, flags);
 359 }
 360
 361 /****************************************************************************
 362  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 363 ****************************************************************************/
 364
 365 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 366                     files_struct *fsp)
 367 {
 368         if ((fsp == NULL) || (conn == NULL)) {
 369                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 370                 return False;
 371         }
 372         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 373                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 374                 return False;
 375         }
 376         return True;
 377 }
 378
 379 /****************************************************************************
 380  Check if we have a correct fsp pointing to a file.
 381 ****************************************************************************/
 382
 383 bool check_fsp(connection_struct *conn, struct smb_request *req,
 384                files_struct *fsp)
 385 {
 386         if (!check_fsp_open(conn, req, fsp)) {
 387                 return False;
 388         }
 389         if (fsp->is_directory) {
 390                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 391                 return False;
 392         }
 393         if (fsp->fh->fd == -1) {
 394                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 395                 return False;
 396         }
 397         fsp->num_smb_operations++;
 398         return True;
 399 }
 400
 401 /****************************************************************************
 402  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 403  the CHECK_NTQUOTA_HANDLE_OK macro.
 404 ****************************************************************************/
 405
 406 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 407                               files_struct *fsp)
 408 {
 409         if (!check_fsp_open(conn, req, fsp)) {
 410                 return false;
 411         }
 412
 413         if (fsp->is_directory) {
 414                 return false;
 415         }
 416
 417         if (fsp->fake_file_handle == NULL) {
 418                 return false;
 419         }
 420
 421         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 422                 return false;
 423         }
 424
 425         if (fsp->fake_file_handle->private_data == NULL) {
 426                 return false;
 427         }
 428
 429         return true;
 430 }
 431
 432 static bool netbios_session_retarget(struct smbXsrv_connection *xconn,
 433                                      const char *name, int name_type)
 434 {
 435         char *trim_name;
 436         char *trim_name_type;
 437         const char *retarget_parm;
 438         char *retarget;
 439         char *p;
 440         int retarget_type = 0x20;
 441         int retarget_port = NBT_SMB_PORT;
 442         struct sockaddr_storage retarget_addr;
 443         struct sockaddr_in *in_addr;
 444         bool ret = false;
 445         uint8_t outbuf[10];
 446
 447         if (get_socket_port(xconn->transport.sock) != NBT_SMB_PORT) {
 448                 return false;
 449         }
 450
 451         trim_name = talloc_strdup(talloc_tos(), name);
 452         if (trim_name == NULL) {
 453                 goto fail;
 454         }
 455         trim_char(trim_name, ' ', ' ');
 456
 457         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 458                                          name_type);
 459         if (trim_name_type == NULL) {
 460                 goto fail;
 461         }
 462
 463         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 464                                              trim_name_type, NULL);
 465         if (retarget_parm == NULL) {
 466                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 467                                                      trim_name, NULL);
 468         }
 469         if (retarget_parm == NULL) {
 470                 goto fail;
 471         }
 472
 473         retarget = talloc_strdup(trim_name, retarget_parm);
 474         if (retarget == NULL) {
 475                 goto fail;
 476         }
 477
 478         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 479
 480         p = strchr(retarget, ':');
 481         if (p != NULL) {
 482                 *p++ = '\0';
 483                 retarget_port = atoi(p);
 484         }
 485
 486         p = strchr_m(retarget, '#');
 487         if (p != NULL) {
 488                 *p++ = '\0';
 489                 if (sscanf(p, "%x", &retarget_type) != 1) {
 490                         goto fail;
 491                 }
 492         }
 493
 494         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 495         if (!ret) {
 496                 DEBUG(10, ("could not resolve %s\n", retarget));
 497                 goto fail;
 498         }
 499
 500         if (retarget_addr.ss_family != AF_INET) {
 501                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 502                 goto fail;
 503         }
 504
 505         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 506
 507         _smb_setlen(outbuf, 6);
 508         SCVAL(outbuf, 0, 0x84);
 509         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 510         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 511
 512         if (!srv_send_smb(xconn, (char *)outbuf, false, 0, false,
 513                           NULL)) {
 514                 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
 515                                     "failed.");
 516         }
 517
 518         ret = true;
 519  fail:
 520         TALLOC_FREE(trim_name);
 521         return ret;
 522 }
 523
 524 static void reply_called_name_not_present(char *outbuf)
 525 {
 526         smb_setlen(outbuf, 1);
 527         SCVAL(outbuf, 0, 0x83);
 528         SCVAL(outbuf, 4, 0x82);
 529 }
 530
 531 /****************************************************************************
 532  Reply to a (netbios-level) special message.
 533 ****************************************************************************/
 534
 535 void reply_special(struct smbXsrv_connection *xconn, char *inbuf, size_t inbuf_size)
 536 {
 537         struct smbd_server_connection *sconn = xconn->client->sconn;
 538         int msg_type = CVAL(inbuf,0);
 539         int msg_flags = CVAL(inbuf,1);
 540         /*
 541          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 542          * calculation & friends (srv_send_smb uses that) we need the full smb
 543          * header.
 544          */
 545         char outbuf[smb_size];
 546
 547         memset(outbuf, '\0', sizeof(outbuf));
 548
 549         smb_setlen(outbuf,0);
 550
 551         switch (msg_type) {
 552         case NBSSrequest: /* session request */
 553         {
 554                 /* inbuf_size is guarenteed to be at least 4. */
 555                 fstring name1,name2;
 556                 int name_type1, name_type2;
 557                 int name_len1, name_len2;
 558
 559                 *name1 = *name2 = 0;
 560
 561                 if (xconn->transport.nbt.got_session) {
 562                         exit_server_cleanly("multiple session request not permitted");
 563                 }
 564
 565                 SCVAL(outbuf,0,NBSSpositive);
 566                 SCVAL(outbuf,3,0);
 567
 568                 /* inbuf_size is guaranteed to be at least 4. */
 569                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 570                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 571                         DEBUG(0,("Invalid name length in session request\n"));
 572                         reply_called_name_not_present(outbuf);
 573                         break;
 574                 }
 575                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 576                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 577                         DEBUG(0,("Invalid name length in session request\n"));
 578                         reply_called_name_not_present(outbuf);
 579                         break;
 580                 }
 581
 582                 name_type1 = name_extract((unsigned char *)inbuf,
 583                                 inbuf_size,(unsigned int)4,name1);
 584                 name_type2 = name_extract((unsigned char *)inbuf,
 585                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 586
 587                 if (name_type1 == -1 || name_type2 == -1) {
 588                         DEBUG(0,("Invalid name type in session request\n"));
 589                         reply_called_name_not_present(outbuf);
 590                         break;
 591                 }
 592
 593                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 594                          name1, name_type1, name2, name_type2));
 595
 596                 if (netbios_session_retarget(xconn, name1, name_type1)) {
 597                         exit_server_cleanly("retargeted client");
 598                 }
 599
 600                 /*
 601                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 602                  * "*SMBSERV" arrggg!!!
 603                  */
 604                 if (strequal(name1, "*SMBSERVER     ")
 605                     || strequal(name1, "*SMBSERV       "))  {
 606                         char *raddr;
 607
 608                         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
 609                                                                  talloc_tos());
 610                         if (raddr == NULL) {
 611                                 exit_server_cleanly("could not allocate raddr");
 612                         }
 613
 614                         fstrcpy(name1, raddr);
 615                 }
 616
 617                 set_local_machine_name(name1, True);
 618                 set_remote_machine_name(name2, True);
 619
 620                 if (is_ipaddress(sconn->remote_hostname)) {
 621                         char *p = discard_const_p(char, sconn->remote_hostname);
 622
 623                         talloc_free(p);
 624
 625                         sconn->remote_hostname = talloc_strdup(sconn,
 626                                                 get_remote_machine_name());
 627                         if (sconn->remote_hostname == NULL) {
 628                                 exit_server_cleanly("could not copy remote name");
 629                         }
 630                         xconn->remote_hostname = sconn->remote_hostname;
 631                 }
 632
 633                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 634                          get_local_machine_name(), get_remote_machine_name(),
 635                          name_type2));
 636
 637                 if (name_type2 == 'R') {
 638                         /* We are being asked for a pathworks session ---
 639                            no thanks! */
 640                         reply_called_name_not_present(outbuf);
 641                         break;
 642                 }
 643
 644                 reload_services(sconn, conn_snum_used, true);
 645                 reopen_logs();
 646
 647                 xconn->transport.nbt.got_session = true;
 648                 break;
 649         }
 650
 651         case 0x89: /* session keepalive request
 652                       (some old clients produce this?) */
 653                 SCVAL(outbuf,0,NBSSkeepalive);
 654                 SCVAL(outbuf,3,0);
 655                 break;
 656
 657         case NBSSpositive: /* positive session response */
 658         case NBSSnegative: /* negative session response */
 659         case NBSSretarget: /* retarget session response */
 660                 DEBUG(0,("Unexpected session response\n"));
 661                 break;
 662
 663         case NBSSkeepalive: /* session keepalive */
 664         default:
 665                 return;
 666         }
 667
 668         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 669                     msg_type, msg_flags));
 670
 671         srv_send_smb(xconn, outbuf, false, 0, false, NULL);
 672
 673         if (CVAL(outbuf, 0) != 0x82) {
 674                 exit_server_cleanly("invalid netbios session");
 675         }
 676         return;
 677 }
 678
 679 /****************************************************************************
 680  Reply to a tcon.
 681  conn POINTER CAN BE NULL HERE !
 682 ****************************************************************************/
 683
 684 void reply_tcon(struct smb_request *req)
 685 {
 686         connection_struct *conn = req->conn;
 687         const char *service;
 688         char *service_buf = NULL;
 689         char *password = NULL;
 690         char *dev = NULL;
 691         int pwlen=0;
 692         NTSTATUS nt_status;
 693         const uint8_t *p;
 694         const char *p2;
 695         TALLOC_CTX *ctx = talloc_tos();
 696         struct smbXsrv_connection *xconn = req->xconn;
 697         NTTIME now = timeval_to_nttime(&req->request_time);
 698
 699         START_PROFILE(SMBtcon);
 700
 701         if (req->buflen < 4) {
 702                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 703                 END_PROFILE(SMBtcon);
 704                 return;
 705         }
 706
 707         p = req->buf + 1;
 708         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 709         p += 1;
 710         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 711         p += pwlen+1;
 712         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 713         p += 1;
 714
 715         if (service_buf == NULL || password == NULL || dev == NULL) {
 716                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 717                 END_PROFILE(SMBtcon);
 718                 return;
 719         }
 720         p2 = strrchr_m(service_buf,'\\');
 721         if (p2) {
 722                 service = p2+1;
 723         } else {
 724                 service = service_buf;
 725         }
 726
 727         conn = make_connection(req, now, service, dev,
 728                                req->vuid,&nt_status);
 729         req->conn = conn;
 730
 731         if (!conn) {
 732                 reply_nterror(req, nt_status);
 733                 END_PROFILE(SMBtcon);
 734                 return;
 735         }
 736
 737         reply_outbuf(req, 2, 0);
 738         SSVAL(req->outbuf,smb_vwv0,xconn->smb1.negprot.max_recv);
 739         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 740         SSVAL(req->outbuf,smb_tid,conn->cnum);
 741
 742         DEBUG(3,("tcon service=%s cnum=%d\n",
 743                  service, conn->cnum));
 744
 745         END_PROFILE(SMBtcon);
 746         return;
 747 }
 748
 749 /****************************************************************************
 750  Reply to a tcon and X.
 751  conn POINTER CAN BE NULL HERE !
 752 ****************************************************************************/
 753
 754 void reply_tcon_and_X(struct smb_request *req)
 755 {
 756         connection_struct *conn = req->conn;
 757         const char *service = NULL;
 758         TALLOC_CTX *ctx = talloc_tos();
 759         /* what the cleint thinks the device is */
 760         char *client_devicetype = NULL;
 761         /* what the server tells the client the share represents */
 762         const char *server_devicetype;
 763         NTSTATUS nt_status;
 764         int passlen;
 765         char *path = NULL;
 766         const uint8_t *p;
 767         const char *q;
 768         uint16_t tcon_flags;
 769         struct smbXsrv_session *session = NULL;
 770         NTTIME now = timeval_to_nttime(&req->request_time);
 771         bool session_key_updated = false;
 772         uint16_t optional_support = 0;
 773         struct smbXsrv_connection *xconn = req->xconn;
 774
 775         START_PROFILE(SMBtconX);
 776
 777         if (req->wct < 4) {
 778                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 779                 END_PROFILE(SMBtconX);
 780                 return;
 781         }
 782
 783         passlen = SVAL(req->vwv+3, 0);
 784         tcon_flags = SVAL(req->vwv+2, 0);
 785
 786         /* we might have to close an old one */
 787         if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
 788                 struct smbXsrv_tcon *tcon;
 789                 NTSTATUS status;
 790
 791                 tcon = conn->tcon;
 792                 req->conn = NULL;
 793                 conn = NULL;
 794
 795                 /*
 796                  * TODO: cancel all outstanding requests on the tcon
 797                  */
 798                 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
 799                 if (!NT_STATUS_IS_OK(status)) {
 800                         DEBUG(0, ("reply_tcon_and_X: "
 801                                   "smbXsrv_tcon_disconnect() failed: %s\n",
 802                                   nt_errstr(status)));
 803                         /*
 804                          * If we hit this case, there is something completely
 805                          * wrong, so we better disconnect the transport connection.
 806                          */
 807                         END_PROFILE(SMBtconX);
 808                         exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
 809                         return;
 810                 }
 811
 812                 TALLOC_FREE(tcon);
 813         }
 814
 815         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 816                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 817                 END_PROFILE(SMBtconX);
 818                 return;
 819         }
 820
 821         if (xconn->smb1.negprot.encrypted_passwords) {
 822                 p = req->buf + passlen;
 823         } else {
 824                 p = req->buf + passlen + 1;
 825         }
 826
 827         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 828
 829         if (path == NULL) {
 830                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 831                 END_PROFILE(SMBtconX);
 832                 return;
 833         }
 834
 835         /*
 836          * the service name can be either: \\server\share
 837          * or share directly like on the DELL PowerVault 705
 838          */
 839         if (*path=='\\') {
 840                 q = strchr_m(path+2,'\\');
 841                 if (!q) {
 842                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 843                         END_PROFILE(SMBtconX);
 844                         return;
 845                 }
 846                 service = q+1;
 847         } else {
 848                 service = path;
 849         }
 850
 851         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 852                                 &client_devicetype, p,
 853                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 854
 855         if (client_devicetype == NULL) {
 856                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 857                 END_PROFILE(SMBtconX);
 858                 return;
 859         }
 860
 861         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 862
 863         nt_status = smb1srv_session_lookup(xconn,
 864                                            req->vuid, now, &session);
 865         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
 866                 reply_force_doserror(req, ERRSRV, ERRbaduid);
 867                 END_PROFILE(SMBtconX);
 868                 return;
 869         }
 870         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 871                 reply_nterror(req, nt_status);
 872                 END_PROFILE(SMBtconX);
 873                 return;
 874         }
 875         if (!NT_STATUS_IS_OK(nt_status)) {
 876                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 877                 END_PROFILE(SMBtconX);
 878                 return;
 879         }
 880
 881         if (session->global->auth_session_info == NULL) {
 882                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 883                 END_PROFILE(SMBtconX);
 884                 return;
 885         }
 886
 887         /*
 888          * If there is no application key defined yet
 889          * we create one.
 890          *
 891          * This means we setup the application key on the
 892          * first tcon that happens via the given session.
 893          *
 894          * Once the application key is defined, it does not
 895          * change any more.
 896          */
 897         if (session->global->application_key.length == 0 &&
 898             session->global->signing_key.length > 0)
 899         {
 900                 struct smbXsrv_session *x = session;
 901                 struct auth_session_info *session_info =
 902                         session->global->auth_session_info;
 903                 uint8_t session_key[16];
 904
 905                 ZERO_STRUCT(session_key);
 906                 memcpy(session_key, x->global->signing_key.data,
 907                        MIN(x->global->signing_key.length, sizeof(session_key)));
 908
 909                 /*
 910                  * The application key is truncated/padded to 16 bytes
 911                  */
 912                 x->global->application_key = data_blob_talloc(x->global,
 913                                                              session_key,
 914                                                              sizeof(session_key));
 915                 ZERO_STRUCT(session_key);
 916                 if (x->global->application_key.data == NULL) {
 917                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 918                         END_PROFILE(SMBtconX);
 919                         return;
 920                 }
 921
 922                 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
 923                         smb_key_derivation(x->global->application_key.data,
 924                                            x->global->application_key.length,
 925                                            x->global->application_key.data);
 926                         optional_support |= SMB_EXTENDED_SIGNATURES;
 927                 }
 928
 929                 /*
 930                  * Place the application key into the session_info
 931                  */
 932                 data_blob_clear_free(&session_info->session_key);
 933                 session_info->session_key = data_blob_dup_talloc(session_info,
 934                                                 x->global->application_key);
 935                 if (session_info->session_key.data == NULL) {
 936                         data_blob_clear_free(&x->global->application_key);
 937                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 938                         END_PROFILE(SMBtconX);
 939                         return;
 940                 }
 941                 session_key_updated = true;
 942         }
 943
 944         conn = make_connection(req, now, service, client_devicetype,
 945                                req->vuid, &nt_status);
 946         req->conn =conn;
 947
 948         if (!conn) {
 949                 if (session_key_updated) {
 950                         struct smbXsrv_session *x = session;
 951                         struct auth_session_info *session_info =
 952                                 session->global->auth_session_info;
 953                         data_blob_clear_free(&x->global->application_key);
 954                         data_blob_clear_free(&session_info->session_key);
 955                 }
 956                 reply_nterror(req, nt_status);
 957                 END_PROFILE(SMBtconX);
 958                 return;
 959         }
 960
 961         if ( IS_IPC(conn) )
 962                 server_devicetype = "IPC";
 963         else if ( IS_PRINT(conn) )
 964                 server_devicetype = "LPT1:";
 965         else
 966                 server_devicetype = "A:";
 967
 968         if (get_Protocol() < PROTOCOL_NT1) {
 969                 reply_outbuf(req, 2, 0);
 970                 if (message_push_string(&req->outbuf, server_devicetype,
 971                                         STR_TERMINATE|STR_ASCII) == -1) {
 972                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 973                         END_PROFILE(SMBtconX);
 974                         return;
 975                 }
 976         } else {
 977                 /* NT sets the fstype of IPC$ to the null string */
 978                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 979
 980                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 981                         /* Return permissions. */
 982                         uint32_t perm1 = 0;
 983                         uint32_t perm2 = 0;
 984
 985                         reply_outbuf(req, 7, 0);
 986
 987                         if (IS_IPC(conn)) {
 988                                 perm1 = FILE_ALL_ACCESS;
 989                                 perm2 = FILE_ALL_ACCESS;
 990                         } else {
 991                                 perm1 = conn->share_access;
 992                         }
 993
 994                         SIVAL(req->outbuf, smb_vwv3, perm1);
 995                         SIVAL(req->outbuf, smb_vwv5, perm2);
 996                 } else {
 997                         reply_outbuf(req, 3, 0);
 998                 }
 999
1000                 if ((message_push_string(&req->outbuf, server_devicetype,
1001                                          STR_TERMINATE|STR_ASCII) == -1)
1002                     || (message_push_string(&req->outbuf, fstype,
1003                                             STR_TERMINATE) == -1)) {
1004                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1005                         END_PROFILE(SMBtconX);
1006                         return;
1007                 }
1008
1009                 /* what does setting this bit do? It is set by NT4 and
1010                    may affect the ability to autorun mounted cdroms */
1011                 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1012                 optional_support |=
1013                         (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1014
1015                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1016                         DEBUG(2,("Serving %s as a Dfs root\n",
1017                                  lp_servicename(ctx, SNUM(conn)) ));
1018                         optional_support |= SMB_SHARE_IN_DFS;
1019                 }
1020
1021                 SSVAL(req->outbuf, smb_vwv2, optional_support);
1022         }
1023
1024         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1025         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
1026
1027         DEBUG(3,("tconX service=%s \n",
1028                  service));
1029
1030         /* set the incoming and outgoing tid to the just created one */
1031         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1032         SSVAL(req->outbuf,smb_tid,conn->cnum);
1033
1034         END_PROFILE(SMBtconX);
1035
1036         req->tid = conn->cnum;
1037 }
1038
1039 /****************************************************************************
1040  Reply to an unknown type.
1041 ****************************************************************************/
1042
1043 void reply_unknown_new(struct smb_request *req, uint8_t type)
1044 {
1045         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1046                   smb_fn_name(type), type, type));
1047         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1048         return;
1049 }
1050
1051 /****************************************************************************
1052  Reply to an ioctl.
1053  conn POINTER CAN BE NULL HERE !
1054 ****************************************************************************/
1055
1056 void reply_ioctl(struct smb_request *req)
1057 {
1058         connection_struct *conn = req->conn;
1059         uint16_t device;
1060         uint16_t function;
1061         uint32_t ioctl_code;
1062         int replysize;
1063         char *p;
1064
1065         START_PROFILE(SMBioctl);
1066
1067         if (req->wct < 3) {
1068                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1069                 END_PROFILE(SMBioctl);
1070                 return;
1071         }
1072
1073         device     = SVAL(req->vwv+1, 0);
1074         function   = SVAL(req->vwv+2, 0);
1075         ioctl_code = (device << 16) + function;
1076
1077         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1078
1079         switch (ioctl_code) {
1080             case IOCTL_QUERY_JOB_INFO:
1081                     replysize = 32;
1082                     break;
1083             default:
1084                     reply_force_doserror(req, ERRSRV, ERRnosupport);
1085                     END_PROFILE(SMBioctl);
1086                     return;
1087         }
1088
1089         reply_outbuf(req, 8, replysize+1);
1090         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1091         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1092         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
1093         p = smb_buf(req->outbuf);
1094         memset(p, '\0', replysize+1); /* valgrind-safe. */
1095         p += 1;          /* Allow for alignment */
1096
1097         switch (ioctl_code) {
1098                 case IOCTL_QUERY_JOB_INFO:
1099                 {
1100                         NTSTATUS status;
1101                         size_t len = 0;
1102                         files_struct *fsp = file_fsp(
1103                                 req, SVAL(req->vwv+0, 0));
1104                         if (!fsp) {
1105                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1106                                 END_PROFILE(SMBioctl);
1107                                 return;
1108                         }
1109                         /* Job number */
1110                         SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1111
1112                         status = srvstr_push((char *)req->outbuf, req->flags2, p+2,
1113                                     lp_netbios_name(), 15,
1114                                     STR_TERMINATE|STR_ASCII, &len);
1115                         if (!NT_STATUS_IS_OK(status)) {
1116                                 reply_nterror(req, status);
1117                                 END_PROFILE(SMBioctl);
1118                                 return;
1119                         }
1120                         if (conn) {
1121                                 status = srvstr_push((char *)req->outbuf, req->flags2,
1122                                             p+18,
1123                                             lp_servicename(talloc_tos(),
1124                                                            SNUM(conn)),
1125                                             13, STR_TERMINATE|STR_ASCII, &len);
1126                                 if (!NT_STATUS_IS_OK(status)) {
1127                                         reply_nterror(req, status);
1128                                         END_PROFILE(SMBioctl);
1129                                         return;
1130                                 }
1131                         } else {
1132                                 memset(p+18, 0, 13);
1133                         }
1134                         break;
1135                 }
1136         }
1137
1138         END_PROFILE(SMBioctl);
1139         return;
1140 }
1141
1142 /****************************************************************************
1143  Strange checkpath NTSTATUS mapping.
1144 ****************************************************************************/
1145
1146 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1147 {
1148         /* Strange DOS error code semantics only for checkpath... */
1149         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1150                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1151                         /* We need to map to ERRbadpath */
1152                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1153                 }
1154         }
1155         return status;
1156 }
1157
1158 /****************************************************************************
1159  Reply to a checkpath.
1160 ****************************************************************************/
1161
1162 void reply_checkpath(struct smb_request *req)
1163 {
1164         connection_struct *conn = req->conn;
1165         struct smb_filename *smb_fname = NULL;
1166         char *name = NULL;
1167         NTSTATUS status;
1168         TALLOC_CTX *ctx = talloc_tos();
1169
1170         START_PROFILE(SMBcheckpath);
1171
1172         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1173                             STR_TERMINATE, &status);
1174
1175         if (!NT_STATUS_IS_OK(status)) {
1176                 status = map_checkpath_error(req->flags2, status);
1177                 reply_nterror(req, status);
1178                 END_PROFILE(SMBcheckpath);
1179                 return;
1180         }
1181
1182         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1183
1184         status = filename_convert(ctx,
1185                                 conn,
1186                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1187                                 name,
1188                                 0,
1189                                 NULL,
1190                                 &smb_fname);
1191
1192         if (!NT_STATUS_IS_OK(status)) {
1193                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1194                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1195                                         ERRSRV, ERRbadpath);
1196                         END_PROFILE(SMBcheckpath);
1197                         return;
1198                 }
1199                 goto path_err;
1200         }
1201
1202         if (!VALID_STAT(smb_fname->st) &&
1203             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1204                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1205                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1206                 status = map_nt_error_from_unix(errno);
1207                 goto path_err;
1208         }
1209
1210         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1211                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1212                                 ERRDOS, ERRbadpath);
1213                 goto out;
1214         }
1215
1216         reply_outbuf(req, 0, 0);
1217
1218  path_err:
1219         /* We special case this - as when a Windows machine
1220                 is parsing a path is steps through the components
1221                 one at a time - if a component fails it expects
1222                 ERRbadpath, not ERRbadfile.
1223         */
1224         status = map_checkpath_error(req->flags2, status);
1225         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1226                 /*
1227                  * Windows returns different error codes if
1228                  * the parent directory is valid but not the
1229                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1230                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1231                  * if the path is invalid.
1232                  */
1233                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1234                                 ERRDOS, ERRbadpath);
1235                 goto out;
1236         }
1237
1238         reply_nterror(req, status);
1239
1240  out:
1241         TALLOC_FREE(smb_fname);
1242         END_PROFILE(SMBcheckpath);
1243         return;
1244 }
1245
1246 /****************************************************************************
1247  Reply to a getatr.
1248 ****************************************************************************/
1249
1250 void reply_getatr(struct smb_request *req)
1251 {
1252         connection_struct *conn = req->conn;
1253         struct smb_filename *smb_fname = NULL;
1254         char *fname = NULL;
1255         int mode=0;
1256         off_t size=0;
1257         time_t mtime=0;
1258         const char *p;
1259         NTSTATUS status;
1260         TALLOC_CTX *ctx = talloc_tos();
1261         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1262
1263         START_PROFILE(SMBgetatr);
1264
1265         p = (const char *)req->buf + 1;
1266         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1267         if (!NT_STATUS_IS_OK(status)) {
1268                 reply_nterror(req, status);
1269                 goto out;
1270         }
1271
1272         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1273                 under WfWg - weird! */
1274         if (*fname == '\0') {
1275                 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1276                 if (!CAN_WRITE(conn)) {
1277                         mode |= FILE_ATTRIBUTE_READONLY;
1278                 }
1279                 size = 0;
1280                 mtime = 0;
1281         } else {
1282                 status = filename_convert(ctx,
1283                                 conn,
1284                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1285                                 fname,
1286                                 0,
1287                                 NULL,
1288                                 &smb_fname);
1289                 if (!NT_STATUS_IS_OK(status)) {
1290                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1291                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1292                                                 ERRSRV, ERRbadpath);
1293                                 goto out;
1294                         }
1295                         reply_nterror(req, status);
1296                         goto out;
1297                 }
1298                 if (!VALID_STAT(smb_fname->st) &&
1299                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1300                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1301                                  smb_fname_str_dbg(smb_fname),
1302                                  strerror(errno)));
1303                         reply_nterror(req,  map_nt_error_from_unix(errno));
1304                         goto out;
1305                 }
1306
1307                 mode = dos_mode(conn, smb_fname);
1308                 size = smb_fname->st.st_ex_size;
1309
1310                 if (ask_sharemode) {
1311                         struct timespec write_time_ts;
1312                         struct file_id fileid;
1313
1314                         ZERO_STRUCT(write_time_ts);
1315                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1316                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1317                         if (!null_timespec(write_time_ts)) {
1318                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1319                         }
1320                 }
1321
1322                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1323                 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1324                         size = 0;
1325                 }
1326         }
1327
1328         reply_outbuf(req, 10, 0);
1329
1330         SSVAL(req->outbuf,smb_vwv0,mode);
1331         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1332                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1333         } else {
1334                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1335         }
1336         SIVAL(req->outbuf,smb_vwv3,(uint32_t)size);
1337
1338         if (get_Protocol() >= PROTOCOL_NT1) {
1339                 SSVAL(req->outbuf, smb_flg2,
1340                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1341         }
1342
1343         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1344                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1345
1346  out:
1347         TALLOC_FREE(smb_fname);
1348         TALLOC_FREE(fname);
1349         END_PROFILE(SMBgetatr);
1350         return;
1351 }
1352
1353 /****************************************************************************
1354  Reply to a setatr.
1355 ****************************************************************************/
1356
1357 void reply_setatr(struct smb_request *req)
1358 {
1359         struct smb_file_time ft;
1360         connection_struct *conn = req->conn;
1361         struct smb_filename *smb_fname = NULL;
1362         char *fname = NULL;
1363         int mode;
1364         time_t mtime;
1365         const char *p;
1366         NTSTATUS status;
1367         TALLOC_CTX *ctx = talloc_tos();
1368
1369         START_PROFILE(SMBsetatr);
1370
1371         ZERO_STRUCT(ft);
1372
1373         if (req->wct < 2) {
1374                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1375                 goto out;
1376         }
1377
1378         p = (const char *)req->buf + 1;
1379         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1380         if (!NT_STATUS_IS_OK(status)) {
1381                 reply_nterror(req, status);
1382                 goto out;
1383         }
1384
1385         status = filename_convert(ctx,
1386                                 conn,
1387                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1388                                 fname,
1389                                 0,
1390                                 NULL,
1391                                 &smb_fname);
1392         if (!NT_STATUS_IS_OK(status)) {
1393                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1394                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1395                                         ERRSRV, ERRbadpath);
1396                         goto out;
1397                 }
1398                 reply_nterror(req, status);
1399                 goto out;
1400         }
1401
1402         if (smb_fname->base_name[0] == '.' &&
1403             smb_fname->base_name[1] == '\0') {
1404                 /*
1405                  * Not sure here is the right place to catch this
1406                  * condition. Might be moved to somewhere else later -- vl
1407                  */
1408                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1409                 goto out;
1410         }
1411
1412         mode = SVAL(req->vwv+0, 0);
1413         mtime = srv_make_unix_date3(req->vwv+1);
1414
1415         if (mode != FILE_ATTRIBUTE_NORMAL) {
1416                 if (VALID_STAT_OF_DIR(smb_fname->st))
1417                         mode |= FILE_ATTRIBUTE_DIRECTORY;
1418                 else
1419                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1420
1421                 status = check_access(conn, NULL, smb_fname,
1422                                         FILE_WRITE_ATTRIBUTES);
1423                 if (!NT_STATUS_IS_OK(status)) {
1424                         reply_nterror(req, status);
1425                         goto out;
1426                 }
1427
1428                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1429                                      false) != 0) {
1430                         reply_nterror(req, map_nt_error_from_unix(errno));
1431                         goto out;
1432                 }
1433         }
1434
1435         ft.mtime = convert_time_t_to_timespec(mtime);
1436         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1437         if (!NT_STATUS_IS_OK(status)) {
1438                 reply_nterror(req, status);
1439                 goto out;
1440         }
1441
1442         reply_outbuf(req, 0, 0);
1443
1444         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1445                  mode));
1446  out:
1447         TALLOC_FREE(smb_fname);
1448         END_PROFILE(SMBsetatr);
1449         return;
1450 }
1451
1452 /****************************************************************************
1453  Reply to a dskattr.
1454 ****************************************************************************/
1455
1456 void reply_dskattr(struct smb_request *req)
1457 {
1458         connection_struct *conn = req->conn;
1459         uint64_t ret;
1460         uint64_t dfree,dsize,bsize;
1461         START_PROFILE(SMBdskattr);
1462
1463         ret = get_dfree_info(conn, ".", &bsize, &dfree, &dsize);
1464         if (ret == (uint64_t)-1) {
1465                 reply_nterror(req, map_nt_error_from_unix(errno));
1466                 END_PROFILE(SMBdskattr);
1467                 return;
1468         }
1469
1470         /*
1471          * Force max to fit in 16 bit fields.
1472          */
1473         while (dfree > WORDMAX || dsize > WORDMAX || bsize < 512) {
1474                 dfree /= 2;
1475                 dsize /= 2;
1476                 bsize *= 2;
1477                 if (bsize > (WORDMAX*512)) {
1478                         bsize = (WORDMAX*512);
1479                         if (dsize > WORDMAX)
1480                                 dsize = WORDMAX;
1481                         if (dfree >  WORDMAX)
1482                                 dfree = WORDMAX;
1483                         break;
1484                 }
1485         }
1486
1487         reply_outbuf(req, 5, 0);
1488
1489         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1490                 double total_space, free_space;
1491                 /* we need to scale this to a number that DOS6 can handle. We
1492                    use floating point so we can handle large drives on systems
1493                    that don't have 64 bit integers
1494
1495                    we end up displaying a maximum of 2G to DOS systems
1496                 */
1497                 total_space = dsize * (double)bsize;
1498                 free_space = dfree * (double)bsize;
1499
1500                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1501                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1502
1503                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1504                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1505
1506                 SSVAL(req->outbuf,smb_vwv0,dsize);
1507                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1508                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1509                 SSVAL(req->outbuf,smb_vwv3,dfree);
1510         } else {
1511                 SSVAL(req->outbuf,smb_vwv0,dsize);
1512                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1513                 SSVAL(req->outbuf,smb_vwv2,512);
1514                 SSVAL(req->outbuf,smb_vwv3,dfree);
1515         }
1516
1517         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1518
1519         END_PROFILE(SMBdskattr);
1520         return;
1521 }
1522
1523 /*
1524  * Utility function to split the filename from the directory.
1525  */
1526 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1527                                      char **fname_dir_out,
1528                                      char **fname_mask_out)
1529 {
1530         const char *p = NULL;
1531         char *fname_dir = NULL;
1532         char *fname_mask = NULL;
1533
1534         p = strrchr_m(fname_in, '/');
1535         if (!p) {
1536                 fname_dir = talloc_strdup(ctx, ".");
1537                 fname_mask = talloc_strdup(ctx, fname_in);
1538         } else {
1539                 fname_dir = talloc_strndup(ctx, fname_in,
1540                     PTR_DIFF(p, fname_in));
1541                 fname_mask = talloc_strdup(ctx, p+1);
1542         }
1543
1544         if (!fname_dir || !fname_mask) {
1545                 TALLOC_FREE(fname_dir);
1546                 TALLOC_FREE(fname_mask);
1547                 return NT_STATUS_NO_MEMORY;
1548         }
1549
1550         *fname_dir_out = fname_dir;
1551         *fname_mask_out = fname_mask;
1552         return NT_STATUS_OK;
1553 }
1554
1555 /****************************************************************************
1556  Make a dir struct.
1557 ****************************************************************************/
1558
1559 static bool make_dir_struct(TALLOC_CTX *ctx,
1560                             char *buf,
1561                             const char *mask,
1562                             const char *fname,
1563                             off_t size,
1564                             uint32_t mode,
1565                             time_t date,
1566                             bool uc)
1567 {
1568         char *p;
1569         char *mask2 = talloc_strdup(ctx, mask);
1570
1571         if (!mask2) {
1572                 return False;
1573         }
1574
1575         if ((mode & FILE_ATTRIBUTE_DIRECTORY) != 0) {
1576                 size = 0;
1577         }
1578
1579         memset(buf+1,' ',11);
1580         if ((p = strchr_m(mask2,'.')) != NULL) {
1581                 *p = 0;
1582                 push_ascii(buf+1,mask2,8, 0);
1583                 push_ascii(buf+9,p+1,3, 0);
1584                 *p = '.';
1585         } else {
1586                 push_ascii(buf+1,mask2,11, 0);
1587         }
1588
1589         memset(buf+21,'\0',DIR_STRUCT_SIZE-21);
1590         SCVAL(buf,21,mode);
1591         srv_put_dos_date(buf,22,date);
1592         SSVAL(buf,26,size & 0xFFFF);
1593         SSVAL(buf,28,(size >> 16)&0xFFFF);
1594         /* We only uppercase if FLAGS2_LONG_PATH_COMPONENTS is zero in the input buf.
1595            Strange, but verified on W2K3. Needed for OS/2. JRA. */
1596         push_ascii(buf+30,fname,12, uc ? STR_UPPER : 0);
1597         DEBUG(8,("put name [%s] from [%s] into dir struct\n",buf+30, fname));
1598         return True;
1599 }
1600
1601 /****************************************************************************
1602  Reply to a search.
1603  Can be called from SMBsearch, SMBffirst or SMBfunique.
1604 ****************************************************************************/
1605
1606 void reply_search(struct smb_request *req)
1607 {
1608         connection_struct *conn = req->conn;
1609         char *path = NULL;
1610         const char *mask = NULL;
1611         char *directory = NULL;
1612         struct smb_filename *smb_fname = NULL;
1613         char *fname = NULL;
1614         off_t size;
1615         uint32_t mode;
1616         struct timespec date;
1617         uint32_t dirtype;
1618         unsigned int numentries = 0;
1619         unsigned int maxentries = 0;
1620         bool finished = False;
1621         const char *p;
1622         int status_len;
1623         char status[21];
1624         int dptr_num= -1;
1625         bool check_descend = False;
1626         bool expect_close = False;
1627         NTSTATUS nt_status;
1628         bool mask_contains_wcard = False;
1629         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1630         TALLOC_CTX *ctx = talloc_tos();
1631         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1632         struct dptr_struct *dirptr = NULL;
1633         struct smbXsrv_connection *xconn = req->xconn;
1634         struct smbd_server_connection *sconn = req->sconn;
1635
1636         START_PROFILE(SMBsearch);
1637
1638         if (req->wct < 2) {
1639                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1640                 goto out;
1641         }
1642
1643         if (lp_posix_pathnames()) {
1644                 reply_unknown_new(req, req->cmd);
1645                 goto out;
1646         }
1647
1648         /* If we were called as SMBffirst then we must expect close. */
1649         if(req->cmd == SMBffirst) {
1650                 expect_close = True;
1651         }
1652
1653         reply_outbuf(req, 1, 3);
1654         maxentries = SVAL(req->vwv+0, 0);
1655         dirtype = SVAL(req->vwv+1, 0);
1656         p = (const char *)req->buf + 1;
1657         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1658                                        &nt_status, &mask_contains_wcard);
1659         if (!NT_STATUS_IS_OK(nt_status)) {
1660                 reply_nterror(req, nt_status);
1661                 goto out;
1662         }
1663
1664         p++;
1665         status_len = SVAL(p, 0);
1666         p += 2;
1667
1668         /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1669
1670         if (status_len == 0) {
1671                 nt_status = filename_convert(ctx, conn,
1672                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1673                                              path,
1674                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1675                                              &mask_contains_wcard,
1676                                              &smb_fname);
1677                 if (!NT_STATUS_IS_OK(nt_status)) {
1678                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1679                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1680                                                 ERRSRV, ERRbadpath);
1681                                 goto out;
1682                         }
1683                         reply_nterror(req, nt_status);
1684                         goto out;
1685                 }
1686
1687                 directory = smb_fname->base_name;
1688
1689                 p = strrchr_m(directory,'/');
1690                 if ((p != NULL) && (*directory != '/')) {
1691                         mask = p + 1;
1692                         directory = talloc_strndup(ctx, directory,
1693                                                    PTR_DIFF(p, directory));
1694                 } else {
1695                         mask = directory;
1696                         directory = talloc_strdup(ctx,".");
1697                 }
1698
1699                 if (!directory) {
1700                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1701                         goto out;
1702                 }
1703
1704                 memset((char *)status,'\0',21);
1705                 SCVAL(status,0,(dirtype & 0x1F));
1706
1707                 nt_status = dptr_create(conn,
1708                                         NULL, /* req */
1709                                         NULL, /* fsp */
1710                                         directory,
1711                                         True,
1712                                         expect_close,
1713                                         req->smbpid,
1714                                         mask,
1715                                         mask_contains_wcard,
1716                                         dirtype,
1717                                         &dirptr);
1718                 if (!NT_STATUS_IS_OK(nt_status)) {
1719                         reply_nterror(req, nt_status);
1720                         goto out;
1721                 }
1722                 dptr_num = dptr_dnum(dirptr);
1723         } else {
1724                 int status_dirtype;
1725                 const char *dirpath;
1726
1727                 memcpy(status,p,21);
1728                 status_dirtype = CVAL(status,0) & 0x1F;
1729                 if (status_dirtype != (dirtype & 0x1F)) {
1730                         dirtype = status_dirtype;
1731                 }
1732
1733                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1734                 if (!dirptr) {
1735                         goto SearchEmpty;
1736                 }
1737                 dirpath = dptr_path(sconn, dptr_num);
1738                 directory = talloc_strdup(ctx, dirpath);
1739                 if (!directory) {
1740                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1741                         goto out;
1742                 }
1743
1744                 mask = dptr_wcard(sconn, dptr_num);
1745                 if (!mask) {
1746                         goto SearchEmpty;
1747                 }
1748                 /*
1749                  * For a 'continue' search we have no string. So
1750                  * check from the initial saved string.
1751                  */
1752                 mask_contains_wcard = ms_has_wild(mask);
1753                 dirtype = dptr_attr(sconn, dptr_num);
1754         }
1755
1756         DEBUG(4,("dptr_num is %d\n",dptr_num));
1757
1758         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1759         dptr_init_search_op(dirptr);
1760
1761         if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1762                 char buf[DIR_STRUCT_SIZE];
1763                 memcpy(buf,status,21);
1764                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1765                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1766                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1767                         goto out;
1768                 }
1769                 dptr_fill(sconn, buf+12,dptr_num);
1770                 if (dptr_zero(buf+12) && (status_len==0)) {
1771                         numentries = 1;
1772                 } else {
1773                         numentries = 0;
1774                 }
1775                 if (message_push_blob(&req->outbuf,
1776                                       data_blob_const(buf, sizeof(buf)))
1777                     == -1) {
1778                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1779                         goto out;
1780                 }
1781         } else {
1782                 unsigned int i;
1783                 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1784                 size_t available_space = xconn->smb1.sessions.max_send - hdr_size;
1785
1786                 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1787
1788                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1789                          directory,lp_dont_descend(ctx, SNUM(conn))));
1790                 if (in_list(directory, lp_dont_descend(ctx, SNUM(conn)),True)) {
1791                         check_descend = True;
1792                 }
1793
1794                 for (i=numentries;(i<maxentries) && !finished;i++) {
1795                         finished = !get_dir_entry(ctx,
1796                                                   dirptr,
1797                                                   mask,
1798                                                   dirtype,
1799                                                   &fname,
1800                                                   &size,
1801                                                   &mode,
1802                                                   &date,
1803                                                   check_descend,
1804                                                   ask_sharemode);
1805                         if (!finished) {
1806                                 char buf[DIR_STRUCT_SIZE];
1807                                 memcpy(buf,status,21);
1808                                 if (!make_dir_struct(ctx,
1809                                                 buf,
1810                                                 mask,
1811                                                 fname,
1812                                                 size,
1813                                                 mode,
1814                                                 convert_timespec_to_time_t(date),
1815                                                 !allow_long_path_components)) {
1816                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1817                                         goto out;
1818                                 }
1819                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1820                                         break;
1821                                 }
1822                                 if (message_push_blob(&req->outbuf,
1823                                                       data_blob_const(buf, sizeof(buf)))
1824                                     == -1) {
1825                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1826                                         goto out;
1827                                 }
1828                                 numentries++;
1829                         }
1830                 }
1831         }
1832
1833   SearchEmpty:
1834
1835         /* If we were called as SMBffirst with smb_search_id == NULL
1836                 and no entries were found then return error and close dirptr
1837                 (X/Open spec) */
1838
1839         if (numentries == 0) {
1840                 dptr_close(sconn, &dptr_num);
1841         } else if(expect_close && status_len == 0) {
1842                 /* Close the dptr - we know it's gone */
1843                 dptr_close(sconn, &dptr_num);
1844         }
1845
1846         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1847         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1848                 dptr_close(sconn, &dptr_num);
1849         }
1850
1851         if ((numentries == 0) && !mask_contains_wcard) {
1852                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1853                 goto out;
1854         }
1855
1856         SSVAL(req->outbuf,smb_vwv0,numentries);
1857         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1858         SCVAL(smb_buf(req->outbuf),0,5);
1859         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1860
1861         /* The replies here are never long name. */
1862         SSVAL(req->outbuf, smb_flg2,
1863               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1864         if (!allow_long_path_components) {
1865                 SSVAL(req->outbuf, smb_flg2,
1866                       SVAL(req->outbuf, smb_flg2)
1867                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1868         }
1869
1870         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1871         SSVAL(req->outbuf, smb_flg2,
1872               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1873
1874         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1875                 smb_fn_name(req->cmd),
1876                 mask,
1877                 directory,
1878                 dirtype,
1879                 numentries,
1880                 maxentries ));
1881  out:
1882         TALLOC_FREE(directory);
1883         TALLOC_FREE(smb_fname);
1884         END_PROFILE(SMBsearch);
1885         return;
1886 }
1887
1888 /****************************************************************************
1889  Reply to a fclose (stop directory search).
1890 ****************************************************************************/
1891
1892 void reply_fclose(struct smb_request *req)
1893 {
1894         int status_len;
1895         char status[21];
1896         int dptr_num= -2;
1897         const char *p;
1898         char *path = NULL;
1899         NTSTATUS err;
1900         bool path_contains_wcard = False;
1901         TALLOC_CTX *ctx = talloc_tos();
1902         struct smbd_server_connection *sconn = req->sconn;
1903
1904         START_PROFILE(SMBfclose);
1905
1906         if (lp_posix_pathnames()) {
1907                 reply_unknown_new(req, req->cmd);
1908                 END_PROFILE(SMBfclose);
1909                 return;
1910         }
1911
1912         p = (const char *)req->buf + 1;
1913         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1914                                        &err, &path_contains_wcard);
1915         if (!NT_STATUS_IS_OK(err)) {
1916                 reply_nterror(req, err);
1917                 END_PROFILE(SMBfclose);
1918                 return;
1919         }
1920         p++;
1921         status_len = SVAL(p,0);
1922         p += 2;
1923
1924         if (status_len == 0) {
1925                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1926                 END_PROFILE(SMBfclose);
1927                 return;
1928         }
1929
1930         memcpy(status,p,21);
1931
1932         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1933                 /*  Close the dptr - we know it's gone */
1934                 dptr_close(sconn, &dptr_num);
1935         }
1936
1937         reply_outbuf(req, 1, 0);
1938         SSVAL(req->outbuf,smb_vwv0,0);
1939
1940         DEBUG(3,("search close\n"));
1941
1942         END_PROFILE(SMBfclose);
1943         return;
1944 }
1945
1946 /****************************************************************************
1947  Reply to an open.
1948 ****************************************************************************/
1949
1950 void reply_open(struct smb_request *req)
1951 {
1952         connection_struct *conn = req->conn;
1953         struct smb_filename *smb_fname = NULL;
1954         char *fname = NULL;
1955         uint32_t fattr=0;
1956         off_t size = 0;
1957         time_t mtime=0;
1958         int info;
1959         files_struct *fsp;
1960         int oplock_request;
1961         int deny_mode;
1962         uint32_t dos_attr;
1963         uint32_t access_mask;
1964         uint32_t share_mode;
1965         uint32_t create_disposition;
1966         uint32_t create_options = 0;
1967         uint32_t private_flags = 0;
1968         NTSTATUS status;
1969         TALLOC_CTX *ctx = talloc_tos();
1970
1971         START_PROFILE(SMBopen);
1972
1973         if (req->wct < 2) {
1974                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1975                 goto out;
1976         }
1977
1978         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1979         deny_mode = SVAL(req->vwv+0, 0);
1980         dos_attr = SVAL(req->vwv+1, 0);
1981
1982         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1983                             STR_TERMINATE, &status);
1984         if (!NT_STATUS_IS_OK(status)) {
1985                 reply_nterror(req, status);
1986                 goto out;
1987         }
1988
1989         if (!map_open_params_to_ntcreate(fname, deny_mode,
1990                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1991                                          &share_mode, &create_disposition,
1992                                          &create_options, &private_flags)) {
1993                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1994                 goto out;
1995         }
1996
1997         status = filename_convert(ctx,
1998                                 conn,
1999                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2000                                 fname,
2001                                 UCF_PREP_CREATEFILE,
2002                                 NULL,
2003                                 &smb_fname);
2004         if (!NT_STATUS_IS_OK(status)) {
2005                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2006                         reply_botherror(req,
2007                                         NT_STATUS_PATH_NOT_COVERED,
2008                                         ERRSRV, ERRbadpath);
2009                         goto out;
2010                 }
2011                 reply_nterror(req, status);
2012                 goto out;
2013         }
2014
2015         status = SMB_VFS_CREATE_FILE(
2016                 conn,                                   /* conn */
2017                 req,                                    /* req */
2018                 0,                                      /* root_dir_fid */
2019                 smb_fname,                              /* fname */
2020                 access_mask,                            /* access_mask */
2021                 share_mode,                             /* share_access */
2022                 create_disposition,                     /* create_disposition*/
2023                 create_options,                         /* create_options */
2024                 dos_attr,                               /* file_attributes */
2025                 oplock_request,                         /* oplock_request */
2026                 NULL,                                   /* lease */
2027                 0,                                      /* allocation_size */
2028                 private_flags,
2029                 NULL,                                   /* sd */
2030                 NULL,                                   /* ea_list */
2031                 &fsp,                                   /* result */
2032                 &info,                                  /* pinfo */
2033                 NULL, NULL);                            /* create context */
2034
2035         if (!NT_STATUS_IS_OK(status)) {
2036                 if (open_was_deferred(req->xconn, req->mid)) {
2037                         /* We have re-scheduled this call. */
2038                         goto out;
2039                 }
2040                 reply_openerror(req, status);
2041                 goto out;
2042         }
2043
2044         /* Ensure we're pointing at the correct stat struct. */
2045         TALLOC_FREE(smb_fname);
2046         smb_fname = fsp->fsp_name;
2047
2048         size = smb_fname->st.st_ex_size;
2049         fattr = dos_mode(conn, smb_fname);
2050
2051         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
2052
2053         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2054                 DEBUG(3,("attempt to open a directory %s\n",
2055                          fsp_str_dbg(fsp)));
2056                 close_file(req, fsp, ERROR_CLOSE);
2057                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
2058                         ERRDOS, ERRnoaccess);
2059                 goto out;
2060         }
2061
2062         reply_outbuf(req, 7, 0);
2063         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2064         SSVAL(req->outbuf,smb_vwv1,fattr);
2065         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2066                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
2067         } else {
2068                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
2069         }
2070         SIVAL(req->outbuf,smb_vwv4,(uint32_t)size);
2071         SSVAL(req->outbuf,smb_vwv6,deny_mode);
2072
2073         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2074                 SCVAL(req->outbuf,smb_flg,
2075                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2076         }
2077
2078         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2079                 SCVAL(req->outbuf,smb_flg,
2080                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2081         }
2082  out:
2083         END_PROFILE(SMBopen);
2084         return;
2085 }
2086
2087 /****************************************************************************
2088  Reply to an open and X.
2089 ****************************************************************************/
2090
2091 void reply_open_and_X(struct smb_request *req)
2092 {
2093         connection_struct *conn = req->conn;
2094         struct smb_filename *smb_fname = NULL;
2095         char *fname = NULL;
2096         uint16_t open_flags;
2097         int deny_mode;
2098         uint32_t smb_attr;
2099         /* Breakout the oplock request bits so we can set the
2100                 reply bits separately. */
2101         int ex_oplock_request;
2102         int core_oplock_request;
2103         int oplock_request;
2104 #if 0
2105         int smb_sattr = SVAL(req->vwv+4, 0);
2106         uint32_t smb_time = make_unix_date3(req->vwv+6);
2107 #endif
2108         int smb_ofun;
2109         uint32_t fattr=0;
2110         int mtime=0;
2111         int smb_action = 0;
2112         files_struct *fsp;
2113         NTSTATUS status;
2114         uint64_t allocation_size;
2115         ssize_t retval = -1;
2116         uint32_t access_mask;
2117         uint32_t share_mode;
2118         uint32_t create_disposition;
2119         uint32_t create_options = 0;
2120         uint32_t private_flags = 0;
2121         TALLOC_CTX *ctx = talloc_tos();
2122
2123         START_PROFILE(SMBopenX);
2124
2125         if (req->wct < 15) {
2126                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2127                 goto out;
2128         }
2129
2130         open_flags = SVAL(req->vwv+2, 0);
2131         deny_mode = SVAL(req->vwv+3, 0);
2132         smb_attr = SVAL(req->vwv+5, 0);
2133         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2134         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2135         oplock_request = ex_oplock_request | core_oplock_request;
2136         smb_ofun = SVAL(req->vwv+8, 0);
2137         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2138
2139         /* If it's an IPC, pass off the pipe handler. */
2140         if (IS_IPC(conn)) {
2141                 if (lp_nt_pipe_support()) {
2142                         reply_open_pipe_and_X(conn, req);
2143                 } else {
2144                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2145                 }
2146                 goto out;
2147         }
2148
2149         /* XXXX we need to handle passed times, sattr and flags */
2150         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2151                         STR_TERMINATE, &status);
2152         if (!NT_STATUS_IS_OK(status)) {
2153                 reply_nterror(req, status);
2154                 goto out;
2155         }
2156
2157         if (!map_open_params_to_ntcreate(fname, deny_mode,
2158                                          smb_ofun,
2159                                          &access_mask, &share_mode,
2160                                          &create_disposition,
2161                                          &create_options,
2162                                          &private_flags)) {
2163                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2164                 goto out;
2165         }
2166
2167         status = filename_convert(ctx,
2168                                 conn,
2169                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2170                                 fname,
2171                                 UCF_PREP_CREATEFILE,
2172                                 NULL,
2173                                 &smb_fname);
2174         if (!NT_STATUS_IS_OK(status)) {
2175                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2176                         reply_botherror(req,
2177                                         NT_STATUS_PATH_NOT_COVERED,
2178                                         ERRSRV, ERRbadpath);
2179                         goto out;
2180                 }
2181                 reply_nterror(req, status);
2182                 goto out;
2183         }
2184
2185         status = SMB_VFS_CREATE_FILE(
2186                 conn,                                   /* conn */
2187                 req,                                    /* req */
2188                 0,                                      /* root_dir_fid */
2189                 smb_fname,                              /* fname */
2190                 access_mask,                            /* access_mask */
2191                 share_mode,                             /* share_access */
2192                 create_disposition,                     /* create_disposition*/
2193                 create_options,                         /* create_options */
2194                 smb_attr,                               /* file_attributes */
2195                 oplock_request,                         /* oplock_request */
2196                 NULL,                                   /* lease */
2197                 0,                                      /* allocation_size */
2198                 private_flags,
2199                 NULL,                                   /* sd */
2200                 NULL,                                   /* ea_list */
2201                 &fsp,                                   /* result */
2202                 &smb_action,                            /* pinfo */
2203                 NULL, NULL);                            /* create context */
2204
2205         if (!NT_STATUS_IS_OK(status)) {
2206                 if (open_was_deferred(req->xconn, req->mid)) {
2207                         /* We have re-scheduled this call. */
2208                         goto out;
2209                 }
2210                 reply_openerror(req, status);
2211                 goto out;
2212         }
2213
2214         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2215            if the file is truncated or created. */
2216         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2217                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2218                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2219                         close_file(req, fsp, ERROR_CLOSE);
2220                         reply_nterror(req, NT_STATUS_DISK_FULL);
2221                         goto out;
2222                 }
2223                 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2224                 if (retval < 0) {
2225                         close_file(req, fsp, ERROR_CLOSE);
2226                         reply_nterror(req, NT_STATUS_DISK_FULL);
2227                         goto out;
2228                 }
2229                 status = vfs_stat_fsp(fsp);
2230                 if (!NT_STATUS_IS_OK(status)) {
2231                         close_file(req, fsp, ERROR_CLOSE);
2232                         reply_nterror(req, status);
2233                         goto out;
2234                 }
2235         }
2236
2237         fattr = dos_mode(conn, fsp->fsp_name);
2238         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2239         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2240                 close_file(req, fsp, ERROR_CLOSE);
2241                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2242                 goto out;
2243         }
2244
2245         /* If the caller set the extended oplock request bit
2246                 and we granted one (by whatever means) - set the
2247                 correct bit for extended oplock reply.
2248         */
2249
2250         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2251                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2252         }
2253
2254         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2255                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2256         }
2257
2258         /* If the caller set the core oplock request bit
2259                 and we granted one (by whatever means) - set the
2260                 correct bit for core oplock reply.
2261         */
2262
2263         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2264                 reply_outbuf(req, 19, 0);
2265         } else {
2266                 reply_outbuf(req, 15, 0);
2267         }
2268
2269         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2270         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2271
2272         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2273                 SCVAL(req->outbuf, smb_flg,
2274                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2275         }
2276
2277         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2278                 SCVAL(req->outbuf, smb_flg,
2279                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2280         }
2281
2282         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2283         SSVAL(req->outbuf,smb_vwv3,fattr);
2284         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2285                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2286         } else {
2287                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2288         }
2289         SIVAL(req->outbuf,smb_vwv6,(uint32_t)fsp->fsp_name->st.st_ex_size);
2290         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2291         SSVAL(req->outbuf,smb_vwv11,smb_action);
2292
2293         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2294                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2295         }
2296
2297  out:
2298         TALLOC_FREE(smb_fname);
2299         END_PROFILE(SMBopenX);
2300         return;
2301 }
2302
2303 /****************************************************************************
2304  Reply to a SMBulogoffX.
2305 ****************************************************************************/
2306
2307 void reply_ulogoffX(struct smb_request *req)
2308 {
2309         struct smbd_server_connection *sconn = req->sconn;
2310         struct user_struct *vuser;
2311         struct smbXsrv_session *session = NULL;
2312         NTSTATUS status;
2313
2314         START_PROFILE(SMBulogoffX);
2315
2316         vuser = get_valid_user_struct(sconn, req->vuid);
2317
2318         if(vuser == NULL) {
2319                 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2320                          (unsigned long long)req->vuid));
2321
2322                 req->vuid = UID_FIELD_INVALID;
2323                 reply_force_doserror(req, ERRSRV, ERRbaduid);
2324                 END_PROFILE(SMBulogoffX);
2325                 return;
2326         }
2327
2328         session = vuser->session;
2329         vuser = NULL;
2330
2331         /*
2332          * TODO: cancel all outstanding requests on the session
2333          */
2334         status = smbXsrv_session_logoff(session);
2335         if (!NT_STATUS_IS_OK(status)) {
2336                 DEBUG(0, ("reply_ulogoff: "
2337                           "smbXsrv_session_logoff() failed: %s\n",
2338                           nt_errstr(status)));
2339                 /*
2340                  * If we hit this case, there is something completely
2341                  * wrong, so we better disconnect the transport connection.
2342                  */
2343                 END_PROFILE(SMBulogoffX);
2344                 exit_server(__location__ ": smbXsrv_session_logoff failed");
2345                 return;
2346         }
2347
2348         TALLOC_FREE(session);
2349
2350         reply_outbuf(req, 2, 0);
2351         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2352         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2353
2354         DEBUG(3, ("ulogoffX vuid=%llu\n",
2355                   (unsigned long long)req->vuid));
2356
2357         END_PROFILE(SMBulogoffX);
2358         req->vuid = UID_FIELD_INVALID;
2359 }
2360
2361 /****************************************************************************
2362  Reply to a mknew or a create.
2363 ****************************************************************************/
2364
2365 void reply_mknew(struct smb_request *req)
2366 {
2367         connection_struct *conn = req->conn;
2368         struct smb_filename *smb_fname = NULL;
2369         char *fname = NULL;
2370         uint32_t fattr = 0;
2371         struct smb_file_time ft;
2372         files_struct *fsp;
2373         int oplock_request = 0;
2374         NTSTATUS status;
2375         uint32_t access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2376         uint32_t share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2377         uint32_t create_disposition;
2378         uint32_t create_options = 0;
2379         TALLOC_CTX *ctx = talloc_tos();
2380
2381         START_PROFILE(SMBcreate);
2382         ZERO_STRUCT(ft);
2383
2384         if (req->wct < 3) {
2385                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2386                 goto out;
2387         }
2388
2389         fattr = SVAL(req->vwv+0, 0);
2390         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2391
2392         /* mtime. */
2393         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2394
2395         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2396                             STR_TERMINATE, &status);
2397         if (!NT_STATUS_IS_OK(status)) {
2398                 reply_nterror(req, status);
2399                 goto out;
2400         }
2401
2402         status = filename_convert(ctx,
2403                                 conn,
2404                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2405                                 fname,
2406                                 UCF_PREP_CREATEFILE,
2407                                 NULL,
2408                                 &smb_fname);
2409         if (!NT_STATUS_IS_OK(status)) {
2410                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2411                         reply_botherror(req,
2412                                         NT_STATUS_PATH_NOT_COVERED,
2413                                         ERRSRV, ERRbadpath);
2414                         goto out;
2415                 }
2416                 reply_nterror(req, status);
2417                 goto out;
2418         }
2419
2420         if (fattr & FILE_ATTRIBUTE_VOLUME) {
2421                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2422                          "please report this\n",
2423                          smb_fname_str_dbg(smb_fname)));
2424         }
2425
2426         if(req->cmd == SMBmknew) {
2427                 /* We should fail if file exists. */
2428                 create_disposition = FILE_CREATE;
2429         } else {
2430                 /* Create if file doesn't exist, truncate if it does. */
2431                 create_disposition = FILE_OVERWRITE_IF;
2432         }
2433
2434         status = SMB_VFS_CREATE_FILE(
2435                 conn,                                   /* conn */
2436                 req,                                    /* req */
2437                 0,                                      /* root_dir_fid */
2438                 smb_fname,                              /* fname */
2439                 access_mask,                            /* access_mask */
2440                 share_mode,                             /* share_access */
2441                 create_disposition,                     /* create_disposition*/
2442                 create_options,                         /* create_options */
2443                 fattr,                                  /* file_attributes */
2444                 oplock_request,                         /* oplock_request */
2445                 NULL,                                   /* lease */
2446                 0,                                      /* allocation_size */
2447                 0,                                      /* private_flags */
2448                 NULL,                                   /* sd */
2449                 NULL,                                   /* ea_list */
2450                 &fsp,                                   /* result */
2451                 NULL,                                   /* pinfo */
2452                 NULL, NULL);                            /* create context */
2453
2454         if (!NT_STATUS_IS_OK(status)) {
2455                 if (open_was_deferred(req->xconn, req->mid)) {
2456                         /* We have re-scheduled this call. */
2457                         goto out;
2458                 }
2459                 reply_openerror(req, status);
2460                 goto out;
2461         }
2462
2463         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2464         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2465         if (!NT_STATUS_IS_OK(status)) {
2466                 END_PROFILE(SMBcreate);
2467                 goto out;
2468         }
2469
2470         reply_outbuf(req, 1, 0);
2471         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2472
2473         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2474                 SCVAL(req->outbuf,smb_flg,
2475                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2476         }
2477
2478         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2479                 SCVAL(req->outbuf,smb_flg,
2480                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2481         }
2482
2483         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2484         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2485                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2486                   (unsigned int)fattr));
2487
2488  out:
2489         TALLOC_FREE(smb_fname);
2490         END_PROFILE(SMBcreate);
2491         return;
2492 }
2493
2494 /****************************************************************************
2495  Reply to a create temporary file.
2496 ****************************************************************************/
2497
2498 void reply_ctemp(struct smb_request *req)
2499 {
2500         connection_struct *conn = req->conn;
2501         struct smb_filename *smb_fname = NULL;
2502         char *wire_name = NULL;
2503         char *fname = NULL;
2504         uint32_t fattr;
2505         files_struct *fsp;
2506         int oplock_request;
2507         char *s;
2508         NTSTATUS status;
2509         int i;
2510         TALLOC_CTX *ctx = talloc_tos();
2511
2512         START_PROFILE(SMBctemp);
2513
2514         if (req->wct < 3) {
2515                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2516                 goto out;
2517         }
2518
2519         fattr = SVAL(req->vwv+0, 0);
2520         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2521
2522         srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2523                             STR_TERMINATE, &status);
2524         if (!NT_STATUS_IS_OK(status)) {
2525                 reply_nterror(req, status);
2526                 goto out;
2527         }
2528
2529         for (i = 0; i < 10; i++) {
2530                 if (*wire_name) {
2531                         fname = talloc_asprintf(ctx,
2532                                         "%s/TMP%s",
2533                                         wire_name,
2534                                         generate_random_str_list(ctx, 5, "0123456789"));
2535                 } else {
2536                         fname = talloc_asprintf(ctx,
2537                                         "TMP%s",
2538                                         generate_random_str_list(ctx, 5, "0123456789"));
2539                 }
2540
2541                 if (!fname) {
2542                         reply_nterror(req, NT_STATUS_NO_MEMORY);
2543                         goto out;
2544                 }
2545
2546                 status = filename_convert(ctx, conn,
2547                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2548                                 fname,
2549                                 UCF_PREP_CREATEFILE,
2550                                 NULL,
2551                                 &smb_fname);
2552                 if (!NT_STATUS_IS_OK(status)) {
2553                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2554                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2555                                         ERRSRV, ERRbadpath);
2556                                 goto out;
2557                         }
2558                         reply_nterror(req, status);
2559                         goto out;
2560                 }
2561
2562                 /* Create the file. */
2563                 status = SMB_VFS_CREATE_FILE(
2564                         conn,                                   /* conn */
2565                         req,                                    /* req */
2566                         0,                                      /* root_dir_fid */
2567                         smb_fname,                              /* fname */
2568                         FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2569                         FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2570                         FILE_CREATE,                            /* create_disposition*/
2571                         0,                                      /* create_options */
2572                         fattr,                                  /* file_attributes */
2573                         oplock_request,                         /* oplock_request */
2574                         NULL,                                   /* lease */
2575                         0,                                      /* allocation_size */
2576                         0,                                      /* private_flags */
2577                         NULL,                                   /* sd */
2578                         NULL,                                   /* ea_list */
2579                         &fsp,                                   /* result */
2580                         NULL,                                   /* pinfo */
2581                         NULL, NULL);                            /* create context */
2582
2583                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2584                         TALLOC_FREE(fname);
2585                         TALLOC_FREE(smb_fname);
2586                         continue;
2587                 }
2588
2589                 if (!NT_STATUS_IS_OK(status)) {
2590                         if (open_was_deferred(req->xconn, req->mid)) {
2591                                 /* We have re-scheduled this call. */
2592                                 goto out;
2593                         }
2594                         reply_openerror(req, status);
2595                         goto out;
2596                 }
2597
2598                 break;
2599         }
2600
2601         if (i == 10) {
2602                 /* Collision after 10 times... */
2603                 reply_nterror(req, status);
2604                 goto out;
2605         }
2606
2607         reply_outbuf(req, 1, 0);
2608         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2609
2610         /* the returned filename is relative to the directory */
2611         s = strrchr_m(fsp->fsp_name->base_name, '/');
2612         if (!s) {
2613                 s = fsp->fsp_name->base_name;
2614         } else {
2615                 s++;
2616         }
2617
2618 #if 0
2619         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2620            thing in the byte section. JRA */
2621         SSVALS(p, 0, -1); /* what is this? not in spec */
2622 #endif
2623         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2624             == -1) {
2625                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2626                 goto out;
2627         }
2628
2629         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2630                 SCVAL(req->outbuf, smb_flg,
2631                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2632         }
2633
2634         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2635                 SCVAL(req->outbuf, smb_flg,
2636                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2637         }
2638
2639         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2640         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2641                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2642  out:
2643         TALLOC_FREE(smb_fname);
2644         TALLOC_FREE(wire_name);
2645         END_PROFILE(SMBctemp);
2646         return;
2647 }
2648
2649 /*******************************************************************
2650  Check if a user is allowed to rename a file.
2651 ********************************************************************/
2652
2653 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2654                         uint16_t dirtype)
2655 {
2656         if (!CAN_WRITE(conn)) {
2657                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2658         }
2659
2660         if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2661                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2662                 /* Only bother to read the DOS attribute if we might deny the
2663                    rename on the grounds of attribute missmatch. */
2664                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2665                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2666                         return NT_STATUS_NO_SUCH_FILE;
2667                 }
2668         }
2669
2670         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2671                 if (fsp->posix_open) {
2672                         return NT_STATUS_OK;
2673                 }
2674
2675                 /* If no pathnames are open below this
2676                    directory, allow the rename. */
2677
2678                 if (file_find_subpath(fsp)) {
2679                         return NT_STATUS_ACCESS_DENIED;
2680                 }
2681                 return NT_STATUS_OK;
2682         }
2683
2684         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2685                 return NT_STATUS_OK;
2686         }
2687
2688         return NT_STATUS_ACCESS_DENIED;
2689 }
2690
2691 /*******************************************************************
2692  * unlink a file with all relevant access checks
2693  *******************************************************************/
2694
2695 static NTSTATUS do_unlink(connection_struct *conn,
2696                         struct smb_request *req,
2697                         struct smb_filename *smb_fname,
2698                         uint32_t dirtype)
2699 {
2700         uint32_t fattr;
2701         files_struct *fsp;
2702         uint32_t dirtype_orig = dirtype;
2703         NTSTATUS status;
2704         int ret;
2705         bool posix_paths = lp_posix_pathnames();
2706
2707         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2708                   smb_fname_str_dbg(smb_fname),
2709                   dirtype));
2710
2711         if (!CAN_WRITE(conn)) {
2712                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2713         }
2714
2715         if (posix_paths) {
2716                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2717         } else {
2718                 ret = SMB_VFS_STAT(conn, smb_fname);
2719         }
2720         if (ret != 0) {
2721                 return map_nt_error_from_unix(errno);
2722         }
2723
2724         fattr = dos_mode(conn, smb_fname);
2725
2726         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2727                 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2728         }
2729
2730         dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2731         if (!dirtype) {
2732                 return NT_STATUS_NO_SUCH_FILE;
2733         }
2734
2735         if (!dir_check_ftype(fattr, dirtype)) {
2736                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2737                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2738                 }
2739                 return NT_STATUS_NO_SUCH_FILE;
2740         }
2741
2742         if (dirtype_orig & 0x8000) {
2743                 /* These will never be set for POSIX. */
2744                 return NT_STATUS_NO_SUCH_FILE;
2745         }
2746
2747 #if 0
2748         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2749                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2750         }
2751
2752         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2753                 return NT_STATUS_NO_SUCH_FILE;
2754         }
2755
2756         if (dirtype & 0xFF00) {
2757                 /* These will never be set for POSIX. */
2758                 return NT_STATUS_NO_SUCH_FILE;
2759         }
2760
2761         dirtype &= 0xFF;
2762         if (!dirtype) {
2763                 return NT_STATUS_NO_SUCH_FILE;
2764         }
2765
2766         /* Can't delete a directory. */
2767         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2768                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2769         }
2770 #endif
2771
2772 #if 0 /* JRATEST */
2773         else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2774                 return NT_STATUS_OBJECT_NAME_INVALID;
2775 #endif /* JRATEST */
2776
2777         /* On open checks the open itself will check the share mode, so
2778            don't do it here as we'll get it wrong. */
2779
2780         status = SMB_VFS_CREATE_FILE
2781                 (conn,                  /* conn */
2782                  req,                   /* req */
2783                  0,                     /* root_dir_fid */
2784                  smb_fname,             /* fname */
2785                  DELETE_ACCESS,         /* access_mask */
2786                  FILE_SHARE_NONE,       /* share_access */
2787                  FILE_OPEN,             /* create_disposition*/
2788                  FILE_NON_DIRECTORY_FILE, /* create_options */
2789                                         /* file_attributes */
2790                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2791                                 FILE_ATTRIBUTE_NORMAL,
2792                  0,                     /* oplock_request */
2793                  NULL,                  /* lease */
2794                  0,                     /* allocation_size */
2795                  0,                     /* private_flags */
2796                  NULL,                  /* sd */
2797                  NULL,                  /* ea_list */
2798                  &fsp,                  /* result */
2799                  NULL,                  /* pinfo */
2800                  NULL, NULL);           /* create context */
2801
2802         if (!NT_STATUS_IS_OK(status)) {
2803                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2804                            nt_errstr(status)));
2805                 return status;
2806         }
2807
2808         status = can_set_delete_on_close(fsp, fattr);
2809         if (!NT_STATUS_IS_OK(status)) {
2810                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2811                         "(%s)\n",
2812                         smb_fname_str_dbg(smb_fname),
2813                         nt_errstr(status)));
2814                 close_file(req, fsp, NORMAL_CLOSE);
2815                 return status;
2816         }
2817
2818         /* The set is across all open files on this dev/inode pair. */
2819         if (!set_delete_on_close(fsp, True,
2820                                 conn->session_info->security_token,
2821                                 conn->session_info->unix_token)) {
2822                 close_file(req, fsp, NORMAL_CLOSE);
2823                 return NT_STATUS_ACCESS_DENIED;
2824         }
2825
2826         return close_file(req, fsp, NORMAL_CLOSE);
2827 }
2828
2829 /****************************************************************************
2830  The guts of the unlink command, split out so it may be called by the NT SMB
2831  code.
2832 ****************************************************************************/
2833
2834 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2835                           uint32_t dirtype, struct smb_filename *smb_fname,
2836                           bool has_wild)
2837 {
2838         char *fname_dir = NULL;
2839         char *fname_mask = NULL;
2840         int count=0;
2841         NTSTATUS status = NT_STATUS_OK;
2842         TALLOC_CTX *ctx = talloc_tos();
2843
2844         /* Split up the directory from the filename/mask. */
2845         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2846                                       &fname_dir, &fname_mask);
2847         if (!NT_STATUS_IS_OK(status)) {
2848                 goto out;
2849         }
2850
2851         /*
2852          * We should only check the mangled cache
2853          * here if unix_convert failed. This means
2854          * that the path in 'mask' doesn't exist
2855          * on the file system and so we need to look
2856          * for a possible mangle. This patch from
2857          * Tine Smukavec <valentin.smukavec@hermes.si>.
2858          */
2859
2860         if (!VALID_STAT(smb_fname->st) &&
2861             mangle_is_mangled(fname_mask, conn->params)) {
2862                 char *new_mask = NULL;
2863                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2864                                             &new_mask, conn->params);
2865                 if (new_mask) {
2866                         TALLOC_FREE(fname_mask);
2867                         fname_mask = new_mask;
2868                 }
2869         }
2870
2871         if (!has_wild) {
2872
2873                 /*
2874                  * Only one file needs to be unlinked. Append the mask back
2875                  * onto the directory.
2876                  */
2877                 TALLOC_FREE(smb_fname->base_name);
2878                 if (ISDOT(fname_dir)) {
2879                         /* Ensure we use canonical names on open. */
2880                         smb_fname->base_name = talloc_asprintf(smb_fname,
2881                                                         "%s",
2882                                                         fname_mask);
2883                 } else {
2884                         smb_fname->base_name = talloc_asprintf(smb_fname,
2885                                                         "%s/%s",
2886                                                         fname_dir,
2887                                                         fname_mask);
2888                 }
2889                 if (!smb_fname->base_name) {
2890                         status = NT_STATUS_NO_MEMORY;
2891                         goto out;
2892                 }
2893                 if (dirtype == 0) {
2894                         dirtype = FILE_ATTRIBUTE_NORMAL;
2895                 }
2896
2897                 status = check_name(conn, smb_fname->base_name);
2898                 if (!NT_STATUS_IS_OK(status)) {
2899                         goto out;
2900                 }
2901
2902                 status = do_unlink(conn, req, smb_fname, dirtype);
2903                 if (!NT_STATUS_IS_OK(status)) {
2904                         goto out;
2905                 }
2906
2907                 count++;
2908         } else {
2909                 struct smb_Dir *dir_hnd = NULL;
2910                 long offset = 0;
2911                 const char *dname = NULL;
2912                 char *talloced = NULL;
2913
2914                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2915                         status = NT_STATUS_OBJECT_NAME_INVALID;
2916                         goto out;
2917                 }
2918
2919                 if (strequal(fname_mask,"????????.???")) {
2920                         TALLOC_FREE(fname_mask);
2921                         fname_mask = talloc_strdup(ctx, "*");
2922                         if (!fname_mask) {
2923                                 status = NT_STATUS_NO_MEMORY;
2924                                 goto out;
2925                         }
2926                 }
2927
2928                 status = check_name(conn, fname_dir);
2929                 if (!NT_STATUS_IS_OK(status)) {
2930                         goto out;
2931                 }
2932
2933                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2934                                   dirtype);
2935                 if (dir_hnd == NULL) {
2936                         status = map_nt_error_from_unix(errno);
2937                         goto out;
2938                 }
2939
2940                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2941                    the pattern matches against the long name, otherwise the short name
2942                    We don't implement this yet XXXX
2943                 */
2944
2945                 status = NT_STATUS_NO_SUCH_FILE;
2946
2947                 while ((dname = ReadDirName(dir_hnd, &offset,
2948                                             &smb_fname->st, &talloced))) {
2949                         TALLOC_CTX *frame = talloc_stackframe();
2950
2951                         if (!is_visible_file(conn, fname_dir, dname,
2952                                              &smb_fname->st, true)) {
2953                                 TALLOC_FREE(frame);
2954                                 TALLOC_FREE(talloced);
2955                                 continue;
2956                         }
2957
2958                         /* Quick check for "." and ".." */
2959                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2960                                 TALLOC_FREE(frame);
2961                                 TALLOC_FREE(talloced);
2962                                 continue;
2963                         }
2964
2965                         if(!mask_match(dname, fname_mask,
2966                                        conn->case_sensitive)) {
2967                                 TALLOC_FREE(frame);
2968                                 TALLOC_FREE(talloced);
2969                                 continue;
2970                         }
2971
2972                         TALLOC_FREE(smb_fname->base_name);
2973                         if (ISDOT(fname_dir)) {
2974                                 /* Ensure we use canonical names on open. */
2975                                 smb_fname->base_name =
2976                                         talloc_asprintf(smb_fname, "%s",
2977                                                 dname);
2978                         } else {
2979                                 smb_fname->base_name =
2980                                         talloc_asprintf(smb_fname, "%s/%s",
2981                                                 fname_dir, dname);
2982                         }
2983
2984                         if (!smb_fname->base_name) {
2985                                 TALLOC_FREE(dir_hnd);
2986                                 status = NT_STATUS_NO_MEMORY;
2987                                 TALLOC_FREE(frame);
2988                                 TALLOC_FREE(talloced);
2989                                 goto out;
2990                         }
2991
2992                         status = check_name(conn, smb_fname->base_name);
2993                         if (!NT_STATUS_IS_OK(status)) {
2994                                 TALLOC_FREE(dir_hnd);
2995                                 TALLOC_FREE(frame);
2996                                 TALLOC_FREE(talloced);
2997                                 goto out;
2998                         }
2999
3000                         status = do_unlink(conn, req, smb_fname, dirtype);
3001                         if (!NT_STATUS_IS_OK(status)) {
3002                                 TALLOC_FREE(dir_hnd);
3003                                 TALLOC_FREE(frame);
3004                                 TALLOC_FREE(talloced);
3005                                 goto out;
3006                         }
3007
3008                         count++;
3009                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
3010                                  smb_fname->base_name));
3011
3012                         TALLOC_FREE(frame);
3013                         TALLOC_FREE(talloced);
3014                 }
3015                 TALLOC_FREE(dir_hnd);
3016         }
3017
3018         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
3019                 status = map_nt_error_from_unix(errno);
3020         }
3021
3022  out:
3023         TALLOC_FREE(fname_dir);
3024         TALLOC_FREE(fname_mask);
3025         return status;
3026 }
3027
3028 /****************************************************************************
3029  Reply to a unlink
3030 ****************************************************************************/
3031
3032 void reply_unlink(struct smb_request *req)
3033 {
3034         connection_struct *conn = req->conn;
3035         char *name = NULL;
3036         struct smb_filename *smb_fname = NULL;
3037         uint32_t dirtype;
3038         NTSTATUS status;
3039         bool path_contains_wcard = False;
3040         TALLOC_CTX *ctx = talloc_tos();
3041
3042         START_PROFILE(SMBunlink);
3043
3044         if (req->wct < 1) {
3045                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3046                 goto out;
3047         }
3048
3049         dirtype = SVAL(req->vwv+0, 0);
3050
3051         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
3052                                   STR_TERMINATE, &status,
3053                                   &path_contains_wcard);
3054         if (!NT_STATUS_IS_OK(status)) {
3055                 reply_nterror(req, status);
3056                 goto out;
3057         }
3058
3059         status = filename_convert(ctx, conn,
3060                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
3061                                   name,
3062                                   UCF_COND_ALLOW_WCARD_LCOMP,
3063                                   &path_contains_wcard,
3064                                   &smb_fname);
3065         if (!NT_STATUS_IS_OK(status)) {
3066                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
3067                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
3068                                         ERRSRV, ERRbadpath);
3069                         goto out;
3070                 }
3071                 reply_nterror(req, status);
3072                 goto out;
3073         }
3074
3075         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
3076
3077         status = unlink_internals(conn, req, dirtype, smb_fname,
3078                                   path_contains_wcard);
3079         if (!NT_STATUS_IS_OK(status)) {
3080                 if (open_was_deferred(req->xconn, req->mid)) {
3081                         /* We have re-scheduled this call. */
3082                         goto out;
3083                 }
3084                 reply_nterror(req, status);
3085                 goto out;
3086         }
3087
3088         reply_outbuf(req, 0, 0);
3089  out:
3090         TALLOC_FREE(smb_fname);
3091         END_PROFILE(SMBunlink);
3092         return;
3093 }
3094
3095 /****************************************************************************
3096  Fail for readbraw.
3097 ****************************************************************************/
3098
3099 static void fail_readraw(void)
3100 {
3101         const char *errstr = talloc_asprintf(talloc_tos(),
3102                         "FAIL ! reply_readbraw: socket write fail (%s)",
3103                         strerror(errno));
3104         if (!errstr) {
3105                 errstr = "";
3106         }
3107         exit_server_cleanly(errstr);
3108 }
3109
3110 /****************************************************************************
3111  Fake (read/write) sendfile. Returns -1 on read or write fail.
3112 ****************************************************************************/
3113
3114 ssize_t fake_sendfile(struct smbXsrv_connection *xconn, files_struct *fsp,
3115                       off_t startpos, size_t nread)
3116 {
3117         size_t bufsize;
3118         size_t tosend = nread;
3119         char *buf;
3120
3121         if (nread == 0) {
3122                 return 0;
3123         }
3124
3125         bufsize = MIN(nread, 65536);
3126
3127         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3128                 return -1;
3129         }
3130
3131         while (tosend > 0) {
3132                 ssize_t ret;
3133                 size_t cur_read;
3134
3135                 cur_read = MIN(tosend, bufsize);
3136                 ret = read_file(fsp,buf,startpos,cur_read);
3137                 if (ret == -1) {
3138                         SAFE_FREE(buf);
3139                         return -1;
3140                 }
3141
3142                 /* If we had a short read, fill with zeros. */
3143                 if (ret < cur_read) {
3144                         memset(buf + ret, '\0', cur_read - ret);
3145                 }
3146
3147                 ret = write_data(xconn->transport.sock, buf, cur_read);
3148                 if (ret != cur_read) {
3149                         int saved_errno = errno;
3150                         /*
3151                          * Try and give an error message saying what
3152                          * client failed.
3153                          */
3154                         DEBUG(0, ("write_data failed for client %s. "
3155                                   "Error %s\n",
3156                                   smbXsrv_connection_dbg(xconn),
3157                                   strerror(saved_errno)));
3158                         SAFE_FREE(buf);
3159                         errno = saved_errno;
3160                         return -1;
3161                 }
3162                 tosend -= cur_read;
3163                 startpos += cur_read;
3164         }
3165
3166         SAFE_FREE(buf);
3167         return (ssize_t)nread;
3168 }
3169
3170 /****************************************************************************
3171  Deal with the case of sendfile reading less bytes from the file than
3172  requested. Fill with zeros (all we can do). Returns 0 on success
3173 ****************************************************************************/
3174
3175 ssize_t sendfile_short_send(struct smbXsrv_connection *xconn,
3176                             files_struct *fsp,
3177                             ssize_t nread,
3178                             size_t headersize,
3179                             size_t smb_maxcnt)
3180 {
3181 #define SHORT_SEND_BUFSIZE 1024
3182         if (nread < headersize) {
3183                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3184                         "header for file %s (%s). Terminating\n",
3185                         fsp_str_dbg(fsp), strerror(errno)));
3186                 return -1;
3187         }
3188
3189         nread -= headersize;
3190
3191         if (nread < smb_maxcnt) {
3192                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3193                 if (!buf) {
3194                         DEBUG(0,("sendfile_short_send: malloc failed "
3195                                 "for file %s (%s). Terminating\n",
3196                                 fsp_str_dbg(fsp), strerror(errno)));
3197                         return -1;
3198                 }
3199
3200                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3201                         "with zeros !\n", fsp_str_dbg(fsp)));
3202
3203                 while (nread < smb_maxcnt) {
3204                         /*
3205                          * We asked for the real file size and told sendfile
3206                          * to not go beyond the end of the file. But it can
3207                          * happen that in between our fstat call and the
3208                          * sendfile call the file was truncated. This is very
3209                          * bad because we have already announced the larger
3210                          * number of bytes to the client.
3211                          *
3212                          * The best we can do now is to send 0-bytes, just as
3213                          * a read from a hole in a sparse file would do.
3214                          *
3215                          * This should happen rarely enough that I don't care
3216                          * about efficiency here :-)
3217                          */
3218                         size_t to_write;
3219                         ssize_t ret;
3220
3221                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3222                         ret = write_data(xconn->transport.sock, buf, to_write);
3223                         if (ret != to_write) {
3224                                 int saved_errno = errno;
3225                                 /*
3226                                  * Try and give an error message saying what
3227                                  * client failed.
3228                                  */
3229                                 DEBUG(0, ("write_data failed for client %s. "
3230                                           "Error %s\n",
3231                                           smbXsrv_connection_dbg(xconn),
3232                                           strerror(saved_errno)));
3233                                 errno = saved_errno;
3234                                 return -1;
3235                         }
3236                         nread += to_write;
3237                 }
3238                 SAFE_FREE(buf);
3239         }
3240
3241         return 0;
3242 }
3243
3244 /****************************************************************************
3245  Return a readbraw error (4 bytes of zero).
3246 ****************************************************************************/
3247
3248 static void reply_readbraw_error(struct smbXsrv_connection *xconn)
3249 {
3250         char header[4];
3251
3252         SIVAL(header,0,0);
3253
3254         smbd_lock_socket(xconn);
3255         if (write_data(xconn->transport.sock,header,4) != 4) {
3256                 int saved_errno = errno;
3257                 /*
3258                  * Try and give an error message saying what
3259                  * client failed.
3260                  */
3261                 DEBUG(0, ("write_data failed for client %s. "
3262                           "Error %s\n",
3263                           smbXsrv_connection_dbg(xconn),
3264                           strerror(saved_errno)));
3265                 errno = saved_errno;
3266
3267                 fail_readraw();
3268         }
3269         smbd_unlock_socket(xconn);
3270 }
3271
3272 /****************************************************************************
3273  Use sendfile in readbraw.
3274 ****************************************************************************/
3275
3276 static void send_file_readbraw(connection_struct *conn,
3277                                struct smb_request *req,
3278                                files_struct *fsp,
3279                                off_t startpos,
3280                                size_t nread,
3281                                ssize_t mincount)
3282 {
3283         struct smbXsrv_connection *xconn = req->xconn;
3284         char *outbuf = NULL;
3285         ssize_t ret=0;
3286
3287         /*
3288          * We can only use sendfile on a non-chained packet
3289          * but we can use on a non-oplocked file. tridge proved this
3290          * on a train in Germany :-). JRA.
3291          * reply_readbraw has already checked the length.
3292          */
3293
3294         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3295             (fsp->wcp == NULL) &&
3296             lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3297                 ssize_t sendfile_read = -1;
3298                 char header[4];
3299                 DATA_BLOB header_blob;
3300
3301                 _smb_setlen(header,nread);
3302                 header_blob = data_blob_const(header, 4);
3303
3304                 sendfile_read = SMB_VFS_SENDFILE(xconn->transport.sock, fsp,
3305                                                  &header_blob, startpos,
3306                                                  nread);
3307                 if (sendfile_read == -1) {
3308                         /* Returning ENOSYS means no data at all was sent.
3309                          * Do this as a normal read. */
3310                         if (errno == ENOSYS) {
3311                                 goto normal_readbraw;
3312                         }
3313
3314                         /*
3315                          * Special hack for broken Linux with no working sendfile. If we
3316                          * return EINTR we sent the header but not the rest of the data.
3317                          * Fake this up by doing read/write calls.
3318                          */
3319                         if (errno == EINTR) {
3320                                 /* Ensure we don't do this again. */
3321                                 set_use_sendfile(SNUM(conn), False);
3322                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3323
3324                                 if (fake_sendfile(xconn, fsp, startpos, nread) == -1) {
3325                                         DEBUG(0,("send_file_readbraw: "
3326                                                  "fake_sendfile failed for "
3327                                                  "file %s (%s).\n",
3328                                                  fsp_str_dbg(fsp),
3329                                                  strerror(errno)));
3330                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3331                                 }
3332                                 return;
3333                         }
3334
3335                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3336                                  "file %s (%s). Terminating\n",
3337                                  fsp_str_dbg(fsp), strerror(errno)));
3338                         exit_server_cleanly("send_file_readbraw sendfile failed");
3339                 } else if (sendfile_read == 0) {
3340                         /*
3341                          * Some sendfile implementations return 0 to indicate
3342                          * that there was a short read, but nothing was
3343                          * actually written to the socket.  In this case,
3344                          * fallback to the normal read path so the header gets
3345                          * the correct byte count.
3346                          */
3347                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3348                                   "bytes falling back to the normal read: "
3349                                   "%s\n", fsp_str_dbg(fsp)));
3350                         goto normal_readbraw;
3351                 }
3352
3353                 /* Deal with possible short send. */
3354                 if (sendfile_read != 4+nread) {
3355                         ret = sendfile_short_send(xconn, fsp,
3356                                                   sendfile_read, 4, nread);
3357                         if (ret == -1) {
3358                                 fail_readraw();
3359                         }
3360                 }
3361                 return;
3362         }
3363
3364 normal_readbraw:
3365
3366         outbuf = talloc_array(NULL, char, nread+4);
3367         if (!outbuf) {
3368                 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3369                         (unsigned)(nread+4)));
3370                 reply_readbraw_error(xconn);
3371                 return;
3372         }
3373
3374         if (nread > 0) {
3375                 ret = read_file(fsp,outbuf+4,startpos,nread);
3376 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3377                 if (ret < mincount)
3378                         ret = 0;
3379 #else
3380                 if (ret < nread)
3381                         ret = 0;
3382 #endif
3383         }
3384
3385         _smb_setlen(outbuf,ret);
3386         if (write_data(xconn->transport.sock, outbuf, 4+ret) != 4+ret) {
3387                 int saved_errno = errno;
3388                 /*
3389                  * Try and give an error message saying what
3390                  * client failed.
3391                  */
3392                 DEBUG(0, ("write_data failed for client %s. Error %s\n",
3393                           smbXsrv_connection_dbg(xconn),
3394                           strerror(saved_errno)));
3395                 errno = saved_errno;
3396
3397                 fail_readraw();
3398         }
3399
3400         TALLOC_FREE(outbuf);
3401 }
3402
3403 /****************************************************************************
3404  Reply to a readbraw (core+ protocol).
3405 ****************************************************************************/
3406
3407 void reply_readbraw(struct smb_request *req)
3408 {
3409         connection_struct *conn = req->conn;
3410         struct smbXsrv_connection *xconn = req->xconn;
3411         ssize_t maxcount,mincount;
3412         size_t nread = 0;
3413         off_t startpos;
3414         files_struct *fsp;
3415         struct lock_struct lock;
3416         off_t size = 0;
3417
3418         START_PROFILE(SMBreadbraw);
3419
3420         if (srv_is_signing_active(xconn) || req->encrypted) {
3421                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3422                         "raw reads/writes are disallowed.");
3423         }
3424
3425         if (req->wct < 8) {
3426                 reply_readbraw_error(xconn);
3427                 END_PROFILE(SMBreadbraw);
3428                 return;
3429         }
3430
3431         if (xconn->smb1.echo_handler.trusted_fde) {
3432                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3433                          "'async smb echo handler = yes'\n"));
3434                 reply_readbraw_error(xconn);
3435                 END_PROFILE(SMBreadbraw);
3436                 return;
3437         }
3438
3439         /*
3440          * Special check if an oplock break has been issued
3441          * and the readraw request croses on the wire, we must
3442          * return a zero length response here.
3443          */
3444
3445         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3446
3447         /*
3448          * We have to do a check_fsp by hand here, as
3449          * we must always return 4 zero bytes on error,
3450          * not a NTSTATUS.
3451          */
3452
3453         if (!fsp || !conn || conn != fsp->conn ||
3454                         req->vuid != fsp->vuid ||
3455                         fsp->is_directory || fsp->fh->fd == -1) {
3456                 /*
3457                  * fsp could be NULL here so use the value from the packet. JRA.
3458                  */
3459                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3460                         "- cache prime?\n",
3461                         (int)SVAL(req->vwv+0, 0)));
3462                 reply_readbraw_error(xconn);
3463                 END_PROFILE(SMBreadbraw);
3464                 return;
3465         }
3466
3467         /* Do a "by hand" version of CHECK_READ. */
3468         if (!(fsp->can_read ||
3469                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3470                                 (fsp->access_mask & FILE_EXECUTE)))) {
3471                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3472                                 (int)SVAL(req->vwv+0, 0)));
3473                 reply_readbraw_error(xconn);
3474                 END_PROFILE(SMBreadbraw);
3475                 return;
3476         }
3477
3478         flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3479
3480         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3481         if(req->wct == 10) {
3482                 /*
3483                  * This is a large offset (64 bit) read.
3484                  */
3485
3486                 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3487
3488                 if(startpos < 0) {
3489                         DEBUG(0,("reply_readbraw: negative 64 bit "
3490                                 "readraw offset (%.0f) !\n",
3491                                 (double)startpos ));
3492                         reply_readbraw_error(xconn);
3493                         END_PROFILE(SMBreadbraw);
3494                         return;
3495                 }
3496         }
3497
3498         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3499         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3500
3501         /* ensure we don't overrun the packet size */
3502         maxcount = MIN(65535,maxcount);
3503
3504         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3505             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3506             &lock);
3507
3508         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3509                 reply_readbraw_error(xconn);
3510                 END_PROFILE(SMBreadbraw);
3511                 return;
3512         }
3513
3514         if (fsp_stat(fsp) == 0) {
3515                 size = fsp->fsp_name->st.st_ex_size;
3516         }
3517
3518         if (startpos >= size) {
3519                 nread = 0;
3520         } else {
3521                 nread = MIN(maxcount,(size - startpos));
3522         }
3523
3524 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3525         if (nread < mincount)
3526                 nread = 0;
3527 #endif
3528
3529         DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3530                 "min=%lu nread=%lu\n",
3531                 fsp_fnum_dbg(fsp), (double)startpos,
3532                 (unsigned long)maxcount,
3533                 (unsigned long)mincount,
3534                 (unsigned long)nread ) );
3535
3536         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3537
3538         DEBUG(5,("reply_readbraw finished\n"));
3539
3540         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3541
3542         END_PROFILE(SMBreadbraw);
3543         return;
3544 }
3545
3546 #undef DBGC_CLASS
3547 #define DBGC_CLASS DBGC_LOCKING
3548
3549 /****************************************************************************
3550  Reply to a lockread (core+ protocol).
3551 ****************************************************************************/
3552
3553 void reply_lockread(struct smb_request *req)
3554 {
3555         connection_struct *conn = req->conn;
3556         ssize_t nread = -1;
3557         char *data;
3558         off_t startpos;
3559         size_t numtoread;
3560         size_t maxtoread;
3561         NTSTATUS status;
3562         files_struct *fsp;
3563         struct byte_range_lock *br_lck = NULL;
3564         char *p = NULL;
3565         struct smbXsrv_connection *xconn = req->xconn;
3566
3567         START_PROFILE(SMBlockread);
3568
3569         if (req->wct < 5) {
3570                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3571                 END_PROFILE(SMBlockread);
3572                 return;
3573         }
3574
3575         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3576
3577         if (!check_fsp(conn, req, fsp)) {
3578                 END_PROFILE(SMBlockread);
3579                 return;
3580         }
3581
3582         if (!CHECK_READ(fsp,req)) {
3583                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3584                 END_PROFILE(SMBlockread);
3585                 return;
3586         }
3587
3588         numtoread = SVAL(req->vwv+1, 0);
3589         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3590
3591         /*
3592          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3593          * protocol request that predates the read/write lock concept.
3594          * Thus instead of asking for a read lock here we need to ask
3595          * for a write lock. JRA.
3596          * Note that the requested lock size is unaffected by max_send.
3597          */
3598
3599         br_lck = do_lock(req->sconn->msg_ctx,
3600                         fsp,
3601                         (uint64_t)req->smbpid,
3602                         (uint64_t)numtoread,
3603                         (uint64_t)startpos,
3604                         WRITE_LOCK,
3605                         WINDOWS_LOCK,
3606                         False, /* Non-blocking lock. */
3607                         &status,
3608                         NULL);
3609         TALLOC_FREE(br_lck);
3610
3611         if (NT_STATUS_V(status)) {
3612                 reply_nterror(req, status);
3613                 END_PROFILE(SMBlockread);
3614                 return;
3615         }
3616
3617         /*
3618          * However the requested READ size IS affected by max_send. Insanity.... JRA.
3619          */
3620         maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3621
3622         if (numtoread > maxtoread) {
3623                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3624 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3625                         (unsigned int)numtoread, (unsigned int)maxtoread,
3626                         (unsigned int)xconn->smb1.sessions.max_send));
3627                 numtoread = maxtoread;
3628         }
3629
3630         reply_outbuf(req, 5, numtoread + 3);
3631
3632         data = smb_buf(req->outbuf) + 3;
3633
3634         nread = read_file(fsp,data,startpos,numtoread);
3635
3636         if (nread < 0) {
3637                 reply_nterror(req, map_nt_error_from_unix(errno));
3638                 END_PROFILE(SMBlockread);
3639                 return;
3640         }
3641
3642         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3643
3644         SSVAL(req->outbuf,smb_vwv0,nread);
3645         SSVAL(req->outbuf,smb_vwv5,nread+3);
3646         p = smb_buf(req->outbuf);
3647         SCVAL(p,0,0); /* pad byte. */
3648         SSVAL(p,1,nread);
3649
3650         DEBUG(3,("lockread %s num=%d nread=%d\n",
3651                  fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3652
3653         END_PROFILE(SMBlockread);
3654         return;
3655 }
3656
3657 #undef DBGC_CLASS
3658 #define DBGC_CLASS DBGC_ALL
3659
3660 /****************************************************************************
3661  Reply to a read.
3662 ****************************************************************************/
3663
3664 void reply_read(struct smb_request *req)
3665 {
3666         connection_struct *conn = req->conn;
3667         size_t numtoread;
3668         size_t maxtoread;
3669         ssize_t nread = 0;
3670         char *data;
3671         off_t startpos;
3672         files_struct *fsp;
3673         struct lock_struct lock;
3674         struct smbXsrv_connection *xconn = req->xconn;
3675
3676         START_PROFILE(SMBread);
3677
3678         if (req->wct < 3) {
3679                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3680                 END_PROFILE(SMBread);
3681                 return;
3682         }
3683
3684         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3685
3686         if (!check_fsp(conn, req, fsp)) {
3687                 END_PROFILE(SMBread);
3688                 return;
3689         }
3690
3691         if (!CHECK_READ(fsp,req)) {
3692                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3693                 END_PROFILE(SMBread);
3694                 return;
3695         }
3696
3697         numtoread = SVAL(req->vwv+1, 0);
3698         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3699
3700         /*
3701          * The requested read size cannot be greater than max_send. JRA.
3702          */
3703         maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3704
3705         if (numtoread > maxtoread) {
3706                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3707 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3708                         (unsigned int)numtoread, (unsigned int)maxtoread,
3709                         (unsigned int)xconn->smb1.sessions.max_send));
3710                 numtoread = maxtoread;
3711         }
3712
3713         reply_outbuf(req, 5, numtoread+3);
3714
3715         data = smb_buf(req->outbuf) + 3;
3716
3717         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3718             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3719             &lock);
3720
3721         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3722                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3723                 END_PROFILE(SMBread);
3724                 return;
3725         }
3726
3727         if (numtoread > 0)
3728                 nread = read_file(fsp,data,startpos,numtoread);
3729
3730         if (nread < 0) {
3731                 reply_nterror(req, map_nt_error_from_unix(errno));
3732                 goto strict_unlock;
3733         }
3734
3735         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3736
3737         SSVAL(req->outbuf,smb_vwv0,nread);
3738         SSVAL(req->outbuf,smb_vwv5,nread+3);
3739         SCVAL(smb_buf(req->outbuf),0,1);
3740         SSVAL(smb_buf(req->outbuf),1,nread);
3741
3742         DEBUG(3, ("read %s num=%d nread=%d\n",
3743                   fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3744
3745 strict_unlock:
3746         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3747
3748         END_PROFILE(SMBread);
3749         return;
3750 }
3751
3752 /****************************************************************************
3753  Setup readX header.
3754 ****************************************************************************/
3755
3756 static int setup_readX_header(struct smb_request *req, char *outbuf,
3757                               size_t smb_maxcnt)
3758 {
3759         int outsize;
3760
3761         outsize = srv_set_message(outbuf,12,smb_maxcnt + 1 /* padding byte */,
3762                                   False);
3763
3764         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3765
3766         SCVAL(outbuf,smb_vwv0,0xFF);
3767         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3768         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3769         SSVAL(outbuf,smb_vwv6,
3770               (smb_wct - 4)     /* offset from smb header to wct */
3771               + 1               /* the wct field */
3772               + 12 * sizeof(uint16_t) /* vwv */
3773               + 2               /* the buflen field */
3774               + 1);             /* padding byte */
3775         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3776         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3777         SCVAL(smb_buf(outbuf), 0, 0); /* padding byte */
3778         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3779         _smb_setlen_large(outbuf,
3780                           smb_size + 12*2 + smb_maxcnt - 4 + 1 /* pad */);
3781         return outsize;
3782 }
3783
3784 /****************************************************************************
3785  Reply to a read and X - possibly using sendfile.
3786 ****************************************************************************/
3787
3788 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3789                             files_struct *fsp, off_t startpos,
3790                             size_t smb_maxcnt)
3791 {
3792         struct smbXsrv_connection *xconn = req->xconn;
3793         ssize_t nread = -1;
3794         struct lock_struct lock;
3795         int saved_errno = 0;
3796
3797         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3798             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3799             &lock);
3800
3801         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3802                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3803                 return;
3804         }
3805
3806         /*
3807          * We can only use sendfile on a non-chained packet
3808          * but we can use on a non-oplocked file. tridge proved this
3809          * on a train in Germany :-). JRA.
3810          */
3811
3812         if (!req_is_in_chain(req) &&
3813             !req->encrypted &&
3814             (fsp->base_fsp == NULL) &&
3815             (fsp->wcp == NULL) &&
3816             lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3817                 uint8_t headerbuf[smb_size + 12 * 2 + 1 /* padding byte */];
3818                 DATA_BLOB header;
3819
3820                 if(fsp_stat(fsp) == -1) {
3821                         reply_nterror(req, map_nt_error_from_unix(errno));
3822                         goto strict_unlock;
3823                 }
3824
3825                 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3826                     (startpos > fsp->fsp_name->st.st_ex_size) ||
3827                     (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3828                         /*
3829                          * We already know that we would do a short read, so don't
3830                          * try the sendfile() path.
3831                          */
3832                         goto nosendfile_read;
3833                 }
3834
3835                 /*
3836                  * Set up the packet header before send. We
3837                  * assume here the sendfile will work (get the
3838                  * correct amount of data).
3839                  */
3840
3841                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3842
3843                 construct_reply_common_req(req, (char *)headerbuf);
3844                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3845
3846                 nread = SMB_VFS_SENDFILE(xconn->transport.sock, fsp, &header,
3847                                          startpos, smb_maxcnt);
3848                 if (nread == -1) {
3849                         saved_errno = errno;
3850
3851                         /* Returning ENOSYS means no data at all was sent.
3852                            Do this as a normal read. */
3853                         if (errno == ENOSYS) {
3854                                 goto normal_read;
3855                         }
3856
3857                         /*
3858                          * Special hack for broken Linux with no working sendfile. If we
3859                          * return EINTR we sent the header but not the rest of the data.
3860                          * Fake this up by doing read/write calls.
3861                          */
3862
3863                         if (errno == EINTR) {
3864                                 /* Ensure we don't do this again. */
3865                                 set_use_sendfile(SNUM(conn), False);
3866                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3867                                 nread = fake_sendfile(xconn, fsp, startpos,
3868                                                       smb_maxcnt);
3869                                 if (nread == -1) {
3870                                         saved_errno = errno;
3871                                         DEBUG(0,("send_file_readX: "
3872                                                  "fake_sendfile failed for "
3873                                                  "file %s (%s) for client %s. "
3874                                                  "Terminating\n",
3875                                                  fsp_str_dbg(fsp),
3876                                                  smbXsrv_connection_dbg(xconn),
3877                                                  strerror(saved_errno)));
3878                                         errno = saved_errno;
3879                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3880                                 }
3881                                 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3882                                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3883                                 /* No outbuf here means successful sendfile. */
3884                                 goto strict_unlock;
3885                         }
3886
3887                         DEBUG(0,("send_file_readX: sendfile failed for file "
3888                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3889                                  strerror(errno)));
3890                         exit_server_cleanly("send_file_readX sendfile failed");
3891                 } else if (nread == 0) {
3892                         /*
3893                          * Some sendfile implementations return 0 to indicate
3894                          * that there was a short read, but nothing was
3895                          * actually written to the socket.  In this case,
3896                          * fallback to the normal read path so the header gets
3897                          * the correct byte count.
3898                          */
3899                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3900                                   "falling back to the normal read: %s\n",
3901                                   fsp_str_dbg(fsp)));
3902                         goto normal_read;
3903                 }
3904
3905                 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3906                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3907
3908                 /* Deal with possible short send. */
3909                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3910                         ssize_t ret;
3911
3912                         ret = sendfile_short_send(xconn, fsp, nread,
3913                                                   sizeof(headerbuf), smb_maxcnt);
3914                         if (ret == -1) {
3915                                 const char *r;
3916                                 r = "send_file_readX: sendfile_short_send failed";
3917                                 DEBUG(0,("%s for file %s (%s).\n",
3918                                          r, fsp_str_dbg(fsp), strerror(errno)));
3919                                 exit_server_cleanly(r);
3920                         }
3921                 }
3922                 /* No outbuf here means successful sendfile. */
3923                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3924                 SMB_PERFCOUNT_END(&req->pcd);
3925                 goto strict_unlock;
3926         }
3927
3928 normal_read:
3929
3930         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3931                 uint8_t headerbuf[smb_size + 2*12 + 1 /* padding byte */];
3932                 ssize_t ret;
3933
3934                 construct_reply_common_req(req, (char *)headerbuf);
3935                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3936
3937                 /* Send out the header. */
3938                 ret = write_data(xconn->transport.sock, (char *)headerbuf,
3939                                  sizeof(headerbuf));
3940                 if (ret != sizeof(headerbuf)) {
3941                         saved_errno = errno;
3942                         /*
3943                          * Try and give an error message saying what
3944                          * client failed.
3945                          */
3946                         DEBUG(0,("send_file_readX: write_data failed for file "
3947                                  "%s (%s) for client %s. Terminating\n",
3948                                  fsp_str_dbg(fsp),
3949                                  smbXsrv_connection_dbg(xconn),
3950                                  strerror(saved_errno)));
3951                         errno = saved_errno;
3952                         exit_server_cleanly("send_file_readX sendfile failed");
3953                 }
3954                 nread = fake_sendfile(xconn, fsp, startpos, smb_maxcnt);
3955                 if (nread == -1) {
3956                         saved_errno = errno;
3957                         DEBUG(0,("send_file_readX: fake_sendfile failed for file "
3958                                  "%s (%s) for client %s. Terminating\n",
3959                                  fsp_str_dbg(fsp),
3960                                  smbXsrv_connection_dbg(xconn),
3961                                  strerror(saved_errno)));
3962                         errno = saved_errno;
3963                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3964                 }
3965                 goto strict_unlock;
3966         }
3967
3968 nosendfile_read:
3969
3970         reply_outbuf(req, 12, smb_maxcnt + 1 /* padding byte */);
3971         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3972         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
3973
3974         nread = read_file(fsp, smb_buf(req->outbuf) + 1 /* padding byte */,
3975                           startpos, smb_maxcnt);
3976         saved_errno = errno;
3977
3978         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3979
3980         if (nread < 0) {
3981                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3982                 return;
3983         }
3984
3985         setup_readX_header(req, (char *)req->outbuf, nread);
3986
3987         DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3988                   fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3989         return;
3990
3991  strict_unlock:
3992         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3993         TALLOC_FREE(req->outbuf);
3994         return;
3995 }
3996
3997 /****************************************************************************
3998  Work out how much space we have for a read return.
3999 ****************************************************************************/
4000
4001 static size_t calc_max_read_pdu(const struct smb_request *req)
4002 {
4003         struct smbXsrv_connection *xconn = req->xconn;
4004
4005         if (xconn->protocol < PROTOCOL_NT1) {
4006                 return xconn->smb1.sessions.max_send;
4007         }
4008
4009         if (!lp_large_readwrite()) {
4010                 return xconn->smb1.sessions.max_send;
4011         }
4012
4013         if (req_is_in_chain(req)) {
4014                 return xconn->smb1.sessions.max_send;
4015         }
4016
4017         if (req->encrypted) {
4018                 /*
4019                  * Don't take encrypted traffic up to the
4020                  * limit. There are padding considerations
4021                  * that make that tricky.
4022                  */
4023                 return xconn->smb1.sessions.max_send;
4024         }
4025
4026         if (srv_is_signing_active(xconn)) {
4027                 return 0x1FFFF;
4028         }
4029
4030         if (!lp_unix_extensions()) {
4031                 return 0x1FFFF;
4032         }
4033
4034         /*
4035          * We can do ultra-large POSIX reads.
4036          */
4037         return 0xFFFFFF;
4038 }
4039
4040 /****************************************************************************
4041  Calculate how big a read can be. Copes with all clients. It's always
4042  safe to return a short read - Windows does this.
4043 ****************************************************************************/
4044
4045 static size_t calc_read_size(const struct smb_request *req,
4046                              size_t upper_size,
4047                              size_t lower_size)
4048 {
4049         struct smbXsrv_connection *xconn = req->xconn;
4050         size_t max_pdu = calc_max_read_pdu(req);
4051         size_t total_size = 0;
4052         size_t hdr_len = MIN_SMB_SIZE + VWV(12);
4053         size_t max_len = max_pdu - hdr_len - 1 /* padding byte */;
4054
4055         /*
4056          * Windows explicitly ignores upper size of 0xFFFF.
4057          * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
4058          * We must do the same as these will never fit even in
4059          * an extended size NetBIOS packet.
4060          */
4061         if (upper_size == 0xFFFF) {
4062                 upper_size = 0;
4063         }
4064
4065         if (xconn->protocol < PROTOCOL_NT1) {
4066                 upper_size = 0;
4067         }
4068
4069         total_size = ((upper_size<<16) | lower_size);
4070
4071         /*
4072          * LARGE_READX test shows it's always safe to return
4073          * a short read. Windows does so.
4074          */
4075         return MIN(total_size, max_len);
4076 }
4077
4078 /****************************************************************************
4079  Reply to a read and X.
4080 ****************************************************************************/
4081
4082 void reply_read_and_X(struct smb_request *req)
4083 {
4084         connection_struct *conn = req->conn;
4085         files_struct *fsp;
4086         off_t startpos;
4087         size_t smb_maxcnt;
4088         size_t upper_size;
4089         bool big_readX = False;
4090 #if 0
4091         size_t smb_mincnt = SVAL(req->vwv+6, 0);
4092 #endif
4093
4094         START_PROFILE(SMBreadX);
4095
4096         if ((req->wct != 10) && (req->wct != 12)) {
4097                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4098                 return;
4099         }
4100
4101         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4102         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4103         smb_maxcnt = SVAL(req->vwv+5, 0);
4104
4105         /* If it's an IPC, pass off the pipe handler. */
4106         if (IS_IPC(conn)) {
4107                 reply_pipe_read_and_X(req);
4108                 END_PROFILE(SMBreadX);
4109                 return;
4110         }
4111
4112         if (!check_fsp(conn, req, fsp)) {
4113                 END_PROFILE(SMBreadX);
4114                 return;
4115         }
4116
4117         if (!CHECK_READ(fsp,req)) {
4118                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4119                 END_PROFILE(SMBreadX);
4120                 return;
4121         }
4122
4123         upper_size = SVAL(req->vwv+7, 0);
4124         smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4125         if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4126                 /*
4127                  * This is a heuristic to avoid keeping large
4128                  * outgoing buffers around over long-lived aio
4129                  * requests.
4130                  */
4131                 big_readX = True;
4132         }
4133
4134         if (req->wct == 12) {
4135                 /*
4136                  * This is a large offset (64 bit) read.
4137                  */
4138                 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4139
4140         }
4141
4142         if (!big_readX) {
4143                 NTSTATUS status = schedule_aio_read_and_X(conn,
4144                                         req,
4145                                         fsp,
4146                                         startpos,
4147                                         smb_maxcnt);
4148                 if (NT_STATUS_IS_OK(status)) {
4149                         /* Read scheduled - we're done. */
4150                         goto out;
4151                 }
4152                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4153                         /* Real error - report to client. */
4154                         END_PROFILE(SMBreadX);
4155                         reply_nterror(req, status);
4156                         return;
4157                 }
4158                 /* NT_STATUS_RETRY - fall back to sync read. */
4159         }
4160
4161         smbd_lock_socket(req->xconn);
4162         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4163         smbd_unlock_socket(req->xconn);
4164
4165  out:
4166         END_PROFILE(SMBreadX);
4167         return;
4168 }
4169
4170 /****************************************************************************
4171  Error replies to writebraw must have smb_wct == 1. Fix this up.
4172 ****************************************************************************/
4173
4174 void error_to_writebrawerr(struct smb_request *req)
4175 {
4176         uint8_t *old_outbuf = req->outbuf;
4177
4178         reply_outbuf(req, 1, 0);
4179
4180         memcpy(req->outbuf, old_outbuf, smb_size);
4181         TALLOC_FREE(old_outbuf);
4182 }
4183
4184 /****************************************************************************
4185  Read 4 bytes of a smb packet and return the smb length of the packet.
4186  Store the result in the buffer. This version of the function will
4187  never return a session keepalive (length of zero).
4188  Timeout is in milliseconds.
4189 ****************************************************************************/
4190
4191 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4192                                 size_t *len)
4193 {
4194         uint8_t msgtype = NBSSkeepalive;
4195
4196         while (msgtype == NBSSkeepalive) {
4197                 NTSTATUS status;
4198
4199                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4200                                                           len);
4201                 if (!NT_STATUS_IS_OK(status)) {
4202                         char addr[INET6_ADDRSTRLEN];
4203                         /* Try and give an error message
4204                          * saying what client failed. */
4205                         DEBUG(0, ("read_fd_with_timeout failed for "
4206                                   "client %s read error = %s.\n",
4207                                   get_peer_addr(fd,addr,sizeof(addr)),
4208                                   nt_errstr(status)));
4209                         return status;
4210                 }
4211
4212                 msgtype = CVAL(inbuf, 0);
4213         }
4214
4215         DEBUG(10,("read_smb_length: got smb length of %lu\n",
4216                   (unsigned long)len));
4217
4218         return NT_STATUS_OK;
4219 }
4220
4221 /****************************************************************************
4222  Reply to a writebraw (core+ or LANMAN1.0 protocol).
4223 ****************************************************************************/
4224
4225 void reply_writebraw(struct smb_request *req)
4226 {
4227         connection_struct *conn = req->conn;
4228         struct smbXsrv_connection *xconn = req->xconn;
4229         char *buf = NULL;
4230         ssize_t nwritten=0;
4231         ssize_t total_written=0;
4232         size_t numtowrite=0;
4233         size_t tcount;
4234         off_t startpos;
4235         const char *data=NULL;
4236         bool write_through;
4237         files_struct *fsp;
4238         struct lock_struct lock;
4239         NTSTATUS status;
4240
4241         START_PROFILE(SMBwritebraw);
4242
4243         /*
4244          * If we ever reply with an error, it must have the SMB command
4245          * type of SMBwritec, not SMBwriteBraw, as this tells the client
4246          * we're finished.
4247          */
4248         SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4249
4250         if (srv_is_signing_active(xconn)) {
4251                 END_PROFILE(SMBwritebraw);
4252                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4253                                 "raw reads/writes are disallowed.");
4254         }
4255
4256         if (req->wct < 12) {
4257                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4258                 error_to_writebrawerr(req);
4259                 END_PROFILE(SMBwritebraw);
4260                 return;
4261         }
4262
4263         if (xconn->smb1.echo_handler.trusted_fde) {
4264                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4265                          "'async smb echo handler = yes'\n"));
4266                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4267                 error_to_writebrawerr(req);
4268                 END_PROFILE(SMBwritebraw);
4269                 return;
4270         }
4271
4272         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4273         if (!check_fsp(conn, req, fsp)) {
4274                 error_to_writebrawerr(req);
4275                 END_PROFILE(SMBwritebraw);
4276                 return;
4277         }
4278
4279         if (!CHECK_WRITE(fsp)) {
4280                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4281                 error_to_writebrawerr(req);
4282                 END_PROFILE(SMBwritebraw);
4283                 return;
4284         }
4285
4286         tcount = IVAL(req->vwv+1, 0);
4287         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4288         write_through = BITSETW(req->vwv+7,0);
4289
4290         /* We have to deal with slightly different formats depending
4291                 on whether we are using the core+ or lanman1.0 protocol */
4292
4293         if(get_Protocol() <= PROTOCOL_COREPLUS) {
4294                 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4295                 data = smb_buf_const(req->inbuf);
4296         } else {
4297                 numtowrite = SVAL(req->vwv+10, 0);
4298                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4299         }
4300
4301         /* Ensure we don't write bytes past the end of this packet. */
4302         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4303                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4304                 error_to_writebrawerr(req);
4305                 END_PROFILE(SMBwritebraw);
4306                 return;
4307         }
4308
4309         if (!fsp->print_file) {
4310                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4311                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4312                     &lock);
4313
4314                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4315                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4316                         error_to_writebrawerr(req);
4317                         END_PROFILE(SMBwritebraw);
4318                         return;
4319                 }
4320         }
4321
4322         if (numtowrite>0) {
4323                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4324         }
4325
4326         DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4327                         "wrote=%d sync=%d\n",
4328                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4329                 (int)nwritten, (int)write_through));
4330
4331         if (nwritten < (ssize_t)numtowrite)  {
4332                 reply_nterror(req, NT_STATUS_DISK_FULL);
4333                 error_to_writebrawerr(req);
4334                 goto strict_unlock;
4335         }
4336
4337         total_written = nwritten;
4338
4339         /* Allocate a buffer of 64k + length. */
4340         buf = talloc_array(NULL, char, 65540);
4341         if (!buf) {
4342                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4343                 error_to_writebrawerr(req);
4344                 goto strict_unlock;
4345         }
4346
4347         /* Return a SMBwritebraw message to the redirector to tell
4348          * it to send more bytes */
4349
4350         memcpy(buf, req->inbuf, smb_size);
4351         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4352         SCVAL(buf,smb_com,SMBwritebraw);
4353         SSVALS(buf,smb_vwv0,0xFFFF);
4354         show_msg(buf);
4355         if (!srv_send_smb(req->xconn,
4356                           buf,
4357                           false, 0, /* no signing */
4358                           IS_CONN_ENCRYPTED(conn),
4359                           &req->pcd)) {
4360                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4361                         "failed.");
4362         }
4363
4364         /* Now read the raw data into the buffer and write it */
4365         status = read_smb_length(xconn->transport.sock, buf, SMB_SECONDARY_WAIT,
4366                                  &numtowrite);
4367         if (!NT_STATUS_IS_OK(status)) {
4368                 exit_server_cleanly("secondary writebraw failed");
4369         }
4370
4371         /* Set up outbuf to return the correct size */
4372         reply_outbuf(req, 1, 0);
4373
4374         if (numtowrite != 0) {
4375
4376                 if (numtowrite > 0xFFFF) {
4377                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4378                                 "raw requested (%u). Terminating\n",
4379                                 (unsigned int)numtowrite ));
4380                         exit_server_cleanly("secondary writebraw failed");
4381                 }
4382
4383                 if (tcount > nwritten+numtowrite) {
4384                         DEBUG(3,("reply_writebraw: Client overestimated the "
4385                                 "write %d %d %d\n",
4386                                 (int)tcount,(int)nwritten,(int)numtowrite));
4387                 }
4388
4389                 status = read_data_ntstatus(xconn->transport.sock, buf+4,
4390                                             numtowrite);
4391
4392                 if (!NT_STATUS_IS_OK(status)) {
4393                         /* Try and give an error message
4394                          * saying what client failed. */
4395                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4396                                   "raw read failed (%s) for client %s. "
4397                                   "Terminating\n", nt_errstr(status),
4398                                   smbXsrv_connection_dbg(xconn)));
4399                         exit_server_cleanly("secondary writebraw failed");
4400                 }
4401
4402                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4403                 if (nwritten == -1) {
4404                         TALLOC_FREE(buf);
4405                         reply_nterror(req, map_nt_error_from_unix(errno));
4406                         error_to_writebrawerr(req);
4407                         goto strict_unlock;
4408                 }
4409
4410                 if (nwritten < (ssize_t)numtowrite) {
4411                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4412                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4413                 }
4414
4415                 if (nwritten > 0) {
4416                         total_written += nwritten;
4417                 }
4418         }
4419
4420         TALLOC_FREE(buf);
4421         SSVAL(req->outbuf,smb_vwv0,total_written);
4422
4423         status = sync_file(conn, fsp, write_through);
4424         if (!NT_STATUS_IS_OK(status)) {
4425                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4426                          fsp_str_dbg(fsp), nt_errstr(status)));
4427                 reply_nterror(req, status);
4428                 error_to_writebrawerr(req);
4429                 goto strict_unlock;
4430         }
4431
4432         DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4433                 "wrote=%d\n",
4434                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4435                 (int)total_written));
4436
4437         if (!fsp->print_file) {
4438                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4439         }
4440
4441         /* We won't return a status if write through is not selected - this
4442          * follows what WfWg does */
4443         END_PROFILE(SMBwritebraw);
4444
4445         if (!write_through && total_written==tcount) {
4446
4447 #if RABBIT_PELLET_FIX
4448                 /*
4449                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4450                  * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4451                  * JRA.
4452                  */
4453                 if (!send_keepalive(xconn->transport.sock)) {
4454                         exit_server_cleanly("reply_writebraw: send of "
4455                                 "keepalive failed");
4456                 }
4457 #endif
4458                 TALLOC_FREE(req->outbuf);
4459         }
4460         return;
4461
4462 strict_unlock:
4463         if (!fsp->print_file) {
4464                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4465         }
4466
4467         END_PROFILE(SMBwritebraw);
4468         return;
4469 }
4470
4471 #undef DBGC_CLASS
4472 #define DBGC_CLASS DBGC_LOCKING
4473
4474 /****************************************************************************
4475  Reply to a writeunlock (core+).
4476 ****************************************************************************/
4477
4478 void reply_writeunlock(struct smb_request *req)
4479 {
4480         connection_struct *conn = req->conn;
4481         ssize_t nwritten = -1;
4482         size_t numtowrite;
4483         off_t startpos;
4484         const char *data;
4485         NTSTATUS status = NT_STATUS_OK;
4486         files_struct *fsp;
4487         struct lock_struct lock;
4488         int saved_errno = 0;
4489
4490         START_PROFILE(SMBwriteunlock);
4491
4492         if (req->wct < 5) {
4493                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4494                 END_PROFILE(SMBwriteunlock);
4495                 return;
4496         }
4497
4498         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4499
4500         if (!check_fsp(conn, req, fsp)) {
4501                 END_PROFILE(SMBwriteunlock);
4502                 return;
4503         }
4504
4505         if (!CHECK_WRITE(fsp)) {
4506                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4507                 END_PROFILE(SMBwriteunlock);
4508                 return;
4509         }
4510
4511         numtowrite = SVAL(req->vwv+1, 0);
4512         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4513         data = (const char *)req->buf + 3;
4514
4515         if (!fsp->print_file && numtowrite > 0) {
4516                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4517                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4518                     &lock);
4519
4520                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4521                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4522                         END_PROFILE(SMBwriteunlock);
4523                         return;
4524                 }
4525         }
4526
4527         /* The special X/Open SMB protocol handling of
4528            zero length writes is *NOT* done for
4529            this call */
4530         if(numtowrite == 0) {
4531                 nwritten = 0;
4532         } else {
4533                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4534                 saved_errno = errno;
4535         }
4536
4537         status = sync_file(conn, fsp, False /* write through */);
4538         if (!NT_STATUS_IS_OK(status)) {
4539                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4540                          fsp_str_dbg(fsp), nt_errstr(status)));
4541                 reply_nterror(req, status);
4542                 goto strict_unlock;
4543         }
4544
4545         if(nwritten < 0) {
4546                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4547                 goto strict_unlock;
4548         }
4549
4550         if((nwritten < numtowrite) && (numtowrite != 0)) {
4551                 reply_nterror(req, NT_STATUS_DISK_FULL);
4552                 goto strict_unlock;
4553         }
4554
4555         if (numtowrite && !fsp->print_file) {
4556                 status = do_unlock(req->sconn->msg_ctx,
4557                                 fsp,
4558                                 (uint64_t)req->smbpid,
4559                                 (uint64_t)numtowrite,
4560                                 (uint64_t)startpos,
4561                                 WINDOWS_LOCK);
4562
4563                 if (NT_STATUS_V(status)) {
4564                         reply_nterror(req, status);
4565                         goto strict_unlock;
4566                 }
4567         }
4568
4569         reply_outbuf(req, 1, 0);
4570
4571         SSVAL(req->outbuf,smb_vwv0,nwritten);
4572
4573         DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4574                   fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4575
4576 strict_unlock:
4577         if (numtowrite && !fsp->print_file) {
4578                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4579         }
4580
4581         END_PROFILE(SMBwriteunlock);
4582         return;
4583 }
4584
4585 #undef DBGC_CLASS
4586 #define DBGC_CLASS DBGC_ALL
4587
4588 /****************************************************************************
4589  Reply to a write.
4590 ****************************************************************************/
4591
4592 void reply_write(struct smb_request *req)
4593 {
4594         connection_struct *conn = req->conn;
4595         size_t numtowrite;
4596         ssize_t nwritten = -1;
4597         off_t startpos;
4598         const char *data;
4599         files_struct *fsp;
4600         struct lock_struct lock;
4601         NTSTATUS status;
4602         int saved_errno = 0;
4603
4604         START_PROFILE(SMBwrite);
4605
4606         if (req->wct < 5) {
4607                 END_PROFILE(SMBwrite);
4608                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4609                 return;
4610         }
4611
4612         /* If it's an IPC, pass off the pipe handler. */
4613         if (IS_IPC(conn)) {
4614                 reply_pipe_write(req);
4615                 END_PROFILE(SMBwrite);
4616                 return;
4617         }
4618
4619         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4620
4621         if (!check_fsp(conn, req, fsp)) {
4622                 END_PROFILE(SMBwrite);
4623                 return;
4624         }
4625
4626         if (!CHECK_WRITE(fsp)) {
4627                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4628                 END_PROFILE(SMBwrite);
4629                 return;
4630         }
4631
4632         numtowrite = SVAL(req->vwv+1, 0);
4633         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4634         data = (const char *)req->buf + 3;
4635
4636         if (!fsp->print_file) {
4637                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4638                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4639                         &lock);
4640
4641                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4642                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4643                         END_PROFILE(SMBwrite);
4644                         return;
4645                 }
4646         }
4647
4648         /*
4649          * X/Open SMB protocol says that if smb_vwv1 is
4650          * zero then the file size should be extended or
4651          * truncated to the size given in smb_vwv[2-3].
4652          */
4653
4654         if(numtowrite == 0) {
4655                 /*
4656                  * This is actually an allocate call, and set EOF. JRA.
4657                  */
4658                 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4659                 if (nwritten < 0) {
4660                         reply_nterror(req, NT_STATUS_DISK_FULL);
4661                         goto strict_unlock;
4662                 }
4663                 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4664                 if (nwritten < 0) {
4665                         reply_nterror(req, NT_STATUS_DISK_FULL);
4666                         goto strict_unlock;
4667                 }
4668                 trigger_write_time_update_immediate(fsp);
4669         } else {
4670                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4671         }
4672
4673         status = sync_file(conn, fsp, False);
4674         if (!NT_STATUS_IS_OK(status)) {
4675                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4676                          fsp_str_dbg(fsp), nt_errstr(status)));
4677                 reply_nterror(req, status);
4678                 goto strict_unlock;
4679         }
4680
4681         if(nwritten < 0) {
4682                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4683                 goto strict_unlock;
4684         }
4685
4686         if((nwritten == 0) && (numtowrite != 0)) {
4687                 reply_nterror(req, NT_STATUS_DISK_FULL);
4688                 goto strict_unlock;
4689         }
4690
4691         reply_outbuf(req, 1, 0);
4692
4693         SSVAL(req->outbuf,smb_vwv0,nwritten);
4694
4695         if (nwritten < (ssize_t)numtowrite) {
4696                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4697                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4698         }
4699
4700         DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4701
4702 strict_unlock:
4703         if (!fsp->print_file) {
4704                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4705         }
4706
4707         END_PROFILE(SMBwrite);
4708         return;
4709 }
4710
4711 /****************************************************************************
4712  Ensure a buffer is a valid writeX for recvfile purposes.
4713 ****************************************************************************/
4714
4715 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4716                                                 (2*14) + /* word count (including bcc) */ \
4717                                                 1 /* pad byte */)
4718
4719 bool is_valid_writeX_buffer(struct smbXsrv_connection *xconn,
4720                             const uint8_t *inbuf)
4721 {
4722         size_t numtowrite;
4723         unsigned int doff = 0;
4724         size_t len = smb_len_large(inbuf);
4725         uint16_t fnum;
4726         struct smbXsrv_open *op = NULL;
4727         struct files_struct *fsp = NULL;
4728         NTSTATUS status;
4729
4730         if (is_encrypted_packet(inbuf)) {
4731                 /* Can't do this on encrypted
4732                  * connections. */
4733                 return false;
4734         }
4735
4736         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4737                 return false;
4738         }
4739
4740         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4741                         CVAL(inbuf,smb_wct) != 14) {
4742                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4743                         "invalid word length.\n"));
4744                 return false;
4745         }
4746
4747         fnum = SVAL(inbuf, smb_vwv2);
4748         status = smb1srv_open_lookup(xconn,
4749                                      fnum,
4750                                      0, /* now */
4751                                      &op);
4752         if (!NT_STATUS_IS_OK(status)) {
4753                 DEBUG(10,("is_valid_writeX_buffer: bad fnum\n"));
4754                 return false;
4755         }
4756         fsp = op->compat;
4757         if (fsp == NULL) {
4758                 DEBUG(10,("is_valid_writeX_buffer: bad fsp\n"));
4759                 return false;
4760         }
4761         if (fsp->conn == NULL) {
4762                 DEBUG(10,("is_valid_writeX_buffer: bad fsp->conn\n"));
4763                 return false;
4764         }
4765
4766         if (IS_IPC(fsp->conn)) {
4767                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4768                 return false;
4769         }
4770         if (IS_PRINT(fsp->conn)) {
4771                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4772                 return false;
4773         }
4774         doff = SVAL(inbuf,smb_vwv11);
4775
4776         numtowrite = SVAL(inbuf,smb_vwv10);
4777
4778         if (len > doff && len - doff > 0xFFFF) {
4779                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4780         }
4781
4782         if (numtowrite == 0) {
4783                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4784                 return false;
4785         }
4786
4787         /* Ensure the sizes match up. */
4788         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4789                 /* no pad byte...old smbclient :-( */
4790                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4791                         (unsigned int)doff,
4792                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4793                 return false;
4794         }
4795
4796         if (len - doff != numtowrite) {
4797                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4798                         "len = %u, doff = %u, numtowrite = %u\n",
4799                         (unsigned int)len,
4800                         (unsigned int)doff,
4801                         (unsigned int)numtowrite ));
4802                 return false;
4803         }
4804
4805         DEBUG(10,("is_valid_writeX_buffer: true "
4806                 "len = %u, doff = %u, numtowrite = %u\n",
4807                 (unsigned int)len,
4808                 (unsigned int)doff,
4809                 (unsigned int)numtowrite ));
4810
4811         return true;
4812 }
4813
4814 /****************************************************************************
4815  Reply to a write and X.
4816 ****************************************************************************/
4817
4818 void reply_write_and_X(struct smb_request *req)
4819 {
4820         connection_struct *conn = req->conn;
4821         struct smbXsrv_connection *xconn = req->xconn;
4822         files_struct *fsp;
4823         struct lock_struct lock;
4824         off_t startpos;
4825         size_t numtowrite;
4826         bool write_through;
4827         ssize_t nwritten;
4828         unsigned int smb_doff;
4829         unsigned int smblen;
4830         const char *data;
4831         NTSTATUS status;
4832         int saved_errno = 0;
4833
4834         START_PROFILE(SMBwriteX);
4835
4836         if ((req->wct != 12) && (req->wct != 14)) {
4837                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4838                 goto out;
4839         }
4840
4841         numtowrite = SVAL(req->vwv+10, 0);
4842         smb_doff = SVAL(req->vwv+11, 0);
4843         smblen = smb_len(req->inbuf);
4844
4845         if (req->unread_bytes > 0xFFFF ||
4846                         (smblen > smb_doff &&
4847                                 smblen - smb_doff > 0xFFFF)) {
4848                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4849         }
4850
4851         if (req->unread_bytes) {
4852                 /* Can't do a recvfile write on IPC$ */
4853                 if (IS_IPC(conn)) {
4854                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4855                         goto out;
4856                 }
4857                 if (numtowrite != req->unread_bytes) {
4858                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4859                         goto out;
4860                 }
4861         } else {
4862                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4863                                 smb_doff + numtowrite > smblen) {
4864                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4865                         goto out;
4866                 }
4867         }
4868
4869         /* If it's an IPC, pass off the pipe handler. */
4870         if (IS_IPC(conn)) {
4871                 if (req->unread_bytes) {
4872                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4873                         goto out;
4874                 }
4875                 reply_pipe_write_and_X(req);
4876                 goto out;
4877         }
4878
4879         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4880         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4881         write_through = BITSETW(req->vwv+7,0);
4882
4883         if (!check_fsp(conn, req, fsp)) {
4884                 goto out;
4885         }
4886
4887         if (!CHECK_WRITE(fsp)) {
4888                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4889                 goto out;
4890         }
4891
4892         data = smb_base(req->inbuf) + smb_doff;
4893
4894         if(req->wct == 14) {
4895                 /*
4896                  * This is a large offset (64 bit) write.
4897                  */
4898                 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4899
4900         }
4901
4902         /* X/Open SMB protocol says that, unlike SMBwrite
4903         if the length is zero then NO truncation is
4904         done, just a write of zero. To truncate a file,
4905         use SMBwrite. */
4906
4907         if(numtowrite == 0) {
4908                 nwritten = 0;
4909         } else {
4910                 if (req->unread_bytes == 0) {
4911                         status = schedule_aio_write_and_X(conn,
4912                                                 req,
4913                                                 fsp,
4914                                                 data,
4915                                                 startpos,
4916                                                 numtowrite);
4917
4918                         if (NT_STATUS_IS_OK(status)) {
4919                                 /* write scheduled - we're done. */
4920                                 goto out;
4921                         }
4922                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4923                                 /* Real error - report to client. */
4924                                 reply_nterror(req, status);
4925                                 goto out;
4926                         }
4927                         /* NT_STATUS_RETRY - fall through to sync write. */
4928                 }
4929
4930                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4931                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4932                     &lock);
4933
4934                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4935                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4936                         goto out;
4937                 }
4938
4939                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4940                 saved_errno = errno;
4941
4942                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4943         }
4944
4945         if(nwritten < 0) {
4946                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4947                 goto out;
4948         }
4949
4950         if((nwritten == 0) && (numtowrite != 0)) {
4951                 reply_nterror(req, NT_STATUS_DISK_FULL);
4952                 goto out;
4953         }
4954
4955         reply_outbuf(req, 6, 0);
4956         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4957         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
4958         SSVAL(req->outbuf,smb_vwv2,nwritten);
4959         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4960
4961         DEBUG(3,("writeX %s num=%d wrote=%d\n",
4962                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4963
4964         status = sync_file(conn, fsp, write_through);
4965         if (!NT_STATUS_IS_OK(status)) {
4966                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4967                          fsp_str_dbg(fsp), nt_errstr(status)));
4968                 reply_nterror(req, status);
4969                 goto out;
4970         }
4971
4972         END_PROFILE(SMBwriteX);
4973         return;
4974
4975 out:
4976         if (req->unread_bytes) {
4977                 /* writeX failed. drain socket. */
4978                 if (drain_socket(xconn->transport.sock, req->unread_bytes) !=
4979                                 req->unread_bytes) {
4980                         smb_panic("failed to drain pending bytes");
4981                 }
4982                 req->unread_bytes = 0;
4983         }
4984
4985         END_PROFILE(SMBwriteX);
4986         return;
4987 }
4988
4989 /****************************************************************************
4990  Reply to a lseek.
4991 ****************************************************************************/
4992
4993 void reply_lseek(struct smb_request *req)
4994 {
4995         connection_struct *conn = req->conn;
4996         off_t startpos;
4997         off_t res= -1;
4998         int mode,umode;
4999         files_struct *fsp;
5000
5001         START_PROFILE(SMBlseek);
5002
5003         if (req->wct < 4) {
5004                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5005                 END_PROFILE(SMBlseek);
5006                 return;
5007         }
5008
5009         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5010
5011         if (!check_fsp(conn, req, fsp)) {
5012                 return;
5013         }
5014
5015         flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
5016
5017         mode = SVAL(req->vwv+1, 0) & 3;
5018         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
5019         startpos = (off_t)IVALS(req->vwv+2, 0);
5020
5021         switch (mode) {
5022                 case 0:
5023                         umode = SEEK_SET;
5024                         res = startpos;
5025                         break;
5026                 case 1:
5027                         umode = SEEK_CUR;
5028                         res = fsp->fh->pos + startpos;
5029                         break;
5030                 case 2:
5031                         umode = SEEK_END;
5032                         break;
5033                 default:
5034                         umode = SEEK_SET;
5035                         res = startpos;
5036                         break;
5037         }
5038
5039         if (umode == SEEK_END) {
5040                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
5041                         if(errno == EINVAL) {
5042                                 off_t current_pos = startpos;
5043
5044                                 if(fsp_stat(fsp) == -1) {
5045                                         reply_nterror(req,
5046                                                 map_nt_error_from_unix(errno));
5047                                         END_PROFILE(SMBlseek);
5048                                         return;
5049                                 }
5050
5051                                 current_pos += fsp->fsp_name->st.st_ex_size;
5052                                 if(current_pos < 0)
5053                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
5054                         }
5055                 }
5056
5057                 if(res == -1) {
5058                         reply_nterror(req, map_nt_error_from_unix(errno));
5059                         END_PROFILE(SMBlseek);
5060                         return;
5061                 }
5062         }
5063
5064         fsp->fh->pos = res;
5065
5066         reply_outbuf(req, 2, 0);
5067         SIVAL(req->outbuf,smb_vwv0,res);
5068
5069         DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
5070                 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
5071
5072         END_PROFILE(SMBlseek);
5073         return;
5074 }
5075
5076 /****************************************************************************
5077  Reply to a flush.
5078 ****************************************************************************/
5079
5080 void reply_flush(struct smb_request *req)
5081 {
5082         connection_struct *conn = req->conn;
5083         uint16_t fnum;
5084         files_struct *fsp;
5085
5086         START_PROFILE(SMBflush);
5087
5088         if (req->wct < 1) {
5089                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5090                 return;
5091         }
5092
5093         fnum = SVAL(req->vwv+0, 0);
5094         fsp = file_fsp(req, fnum);
5095
5096         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
5097                 return;
5098         }
5099
5100         if (!fsp) {
5101                 file_sync_all(conn);
5102         } else {
5103                 NTSTATUS status = sync_file(conn, fsp, True);
5104                 if (!NT_STATUS_IS_OK(status)) {
5105                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
5106                                 fsp_str_dbg(fsp), nt_errstr(status)));
5107                         reply_nterror(req, status);
5108                         END_PROFILE(SMBflush);
5109                         return;
5110                 }
5111         }
5112
5113         reply_outbuf(req, 0, 0);
5114
5115         DEBUG(3,("flush\n"));
5116         END_PROFILE(SMBflush);
5117         return;
5118 }
5119
5120 /****************************************************************************
5121  Reply to a exit.
5122  conn POINTER CAN BE NULL HERE !
5123 ****************************************************************************/
5124
5125 void reply_exit(struct smb_request *req)
5126 {
5127         START_PROFILE(SMBexit);
5128
5129         file_close_pid(req->sconn, req->smbpid, req->vuid);
5130
5131         reply_outbuf(req, 0, 0);
5132
5133         DEBUG(3,("exit\n"));
5134
5135         END_PROFILE(SMBexit);
5136         return;
5137 }
5138
5139 struct reply_close_state {
5140         files_struct *fsp;
5141         struct smb_request *smbreq;
5142 };
5143
5144 static void do_smb1_close(struct tevent_req *req);
5145
5146 void reply_close(struct smb_request *req)
5147 {
5148         connection_struct *conn = req->conn;
5149         NTSTATUS status = NT_STATUS_OK;
5150         files_struct *fsp = NULL;
5151         START_PROFILE(SMBclose);
5152
5153         if (req->wct < 3) {
5154                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5155                 END_PROFILE(SMBclose);
5156                 return;
5157         }
5158
5159         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5160
5161         /*
5162          * We can only use check_fsp if we know it's not a directory.
5163          */
5164
5165         if (!check_fsp_open(conn, req, fsp)) {
5166                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5167                 END_PROFILE(SMBclose);
5168                 return;
5169         }
5170
5171         DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5172                   fsp->is_directory ? "directory" : "file",
5173                   fsp->fh->fd, fsp_fnum_dbg(fsp),
5174                   conn->num_files_open));
5175
5176         if (!fsp->is_directory) {
5177                 time_t t;
5178
5179                 /*
5180                  * Take care of any time sent in the close.
5181                  */
5182
5183                 t = srv_make_unix_date3(req->vwv+1);
5184                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5185         }
5186
5187         if (fsp->num_aio_requests != 0) {
5188
5189                 struct reply_close_state *state;
5190
5191                 DEBUG(10, ("closing with aio %u requests pending\n",
5192                            fsp->num_aio_requests));
5193
5194                 /*
5195                  * We depend on the aio_extra destructor to take care of this
5196                  * close request once fsp->num_aio_request drops to 0.
5197                  */
5198
5199                 fsp->deferred_close = tevent_wait_send(
5200                         fsp, fsp->conn->sconn->ev_ctx);
5201                 if (fsp->deferred_close == NULL) {
5202                         status = NT_STATUS_NO_MEMORY;
5203                         goto done;
5204                 }
5205
5206                 state = talloc(fsp, struct reply_close_state);
5207                 if (state == NULL) {
5208                         TALLOC_FREE(fsp->deferred_close);
5209                         status = NT_STATUS_NO_MEMORY;
5210                         goto done;
5211                 }
5212                 state->fsp = fsp;
5213                 state->smbreq = talloc_move(fsp, &req);
5214                 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5215                                         state);
5216                 END_PROFILE(SMBclose);
5217                 return;
5218         }
5219
5220         /*
5221          * close_file() returns the unix errno if an error was detected on
5222          * close - normally this is due to a disk full error. If not then it
5223          * was probably an I/O error.
5224          */
5225
5226         status = close_file(req, fsp, NORMAL_CLOSE);
5227 done:
5228         if (!NT_STATUS_IS_OK(status)) {
5229                 reply_nterror(req, status);
5230                 END_PROFILE(SMBclose);
5231                 return;
5232         }
5233
5234         reply_outbuf(req, 0, 0);
5235         END_PROFILE(SMBclose);
5236         return;
5237 }
5238
5239 static void do_smb1_close(struct tevent_req *req)
5240 {
5241         struct reply_close_state *state = tevent_req_callback_data(
5242                 req, struct reply_close_state);
5243         struct smb_request *smbreq;
5244         NTSTATUS status;
5245         int ret;
5246
5247         ret = tevent_wait_recv(req);
5248         TALLOC_FREE(req);
5249         if (ret != 0) {
5250                 DEBUG(10, ("tevent_wait_recv returned %s\n",
5251                            strerror(ret)));
5252                 /*
5253                  * Continue anyway, this should never happen
5254                  */
5255         }
5256
5257         /*
5258          * fsp->smb2_close_request right now is a talloc grandchild of
5259          * fsp. When we close_file(fsp), it would go with it. No chance to
5260          * reply...
5261          */
5262         smbreq = talloc_move(talloc_tos(), &state->smbreq);
5263
5264         status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5265         if (NT_STATUS_IS_OK(status)) {
5266                 reply_outbuf(smbreq, 0, 0);
5267         } else {
5268                 reply_nterror(smbreq, status);
5269         }
5270         if (!srv_send_smb(smbreq->xconn,
5271                         (char *)smbreq->outbuf,
5272                         true,
5273                         smbreq->seqnum+1,
5274                         IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5275                         NULL)) {
5276                 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5277                                     "failed.");
5278         }
5279         TALLOC_FREE(smbreq);
5280 }
5281
5282 /****************************************************************************
5283  Reply to a writeclose (Core+ protocol).
5284 ****************************************************************************/
5285
5286 void reply_writeclose(struct smb_request *req)
5287 {
5288         connection_struct *conn = req->conn;
5289         size_t numtowrite;
5290         ssize_t nwritten = -1;
5291         NTSTATUS close_status = NT_STATUS_OK;
5292         off_t startpos;
5293         const char *data;
5294         struct timespec mtime;
5295         files_struct *fsp;
5296         struct lock_struct lock;
5297
5298         START_PROFILE(SMBwriteclose);
5299
5300         if (req->wct < 6) {
5301                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5302                 END_PROFILE(SMBwriteclose);
5303                 return;
5304         }
5305
5306         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5307
5308         if (!check_fsp(conn, req, fsp)) {
5309                 END_PROFILE(SMBwriteclose);
5310                 return;
5311         }
5312         if (!CHECK_WRITE(fsp)) {
5313                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5314                 END_PROFILE(SMBwriteclose);
5315                 return;
5316         }
5317
5318         numtowrite = SVAL(req->vwv+1, 0);
5319         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5320         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5321         data = (const char *)req->buf + 1;
5322
5323         if (fsp->print_file == NULL) {
5324                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5325                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5326                     &lock);
5327
5328                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5329                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5330                         END_PROFILE(SMBwriteclose);
5331                         return;
5332                 }
5333         }
5334
5335         nwritten = write_file(req,fsp,data,startpos,numtowrite);
5336
5337         if (fsp->print_file == NULL) {
5338                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5339         }
5340
5341         set_close_write_time(fsp, mtime);
5342
5343         /*
5344          * More insanity. W2K only closes the file if writelen > 0.
5345          * JRA.
5346          */
5347
5348         DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5349                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5350                 (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
5351
5352         if (numtowrite) {
5353                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5354                          "file %s\n", fsp_str_dbg(fsp)));
5355                 close_status = close_file(req, fsp, NORMAL_CLOSE);
5356                 fsp = NULL;
5357         }
5358
5359         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5360                 reply_nterror(req, NT_STATUS_DISK_FULL);
5361                 goto out;
5362         }
5363
5364         if(!NT_STATUS_IS_OK(close_status)) {
5365                 reply_nterror(req, close_status);
5366                 goto out;
5367         }
5368
5369         reply_outbuf(req, 1, 0);
5370
5371         SSVAL(req->outbuf,smb_vwv0,nwritten);
5372
5373 out:
5374
5375         END_PROFILE(SMBwriteclose);
5376         return;
5377 }
5378
5379 #undef DBGC_CLASS
5380 #define DBGC_CLASS DBGC_LOCKING
5381
5382 /****************************************************************************
5383  Reply to a lock.
5384 ****************************************************************************/
5385
5386 void reply_lock(struct smb_request *req)
5387 {
5388         connection_struct *conn = req->conn;
5389         uint64_t count,offset;
5390         NTSTATUS status;
5391         files_struct *fsp;
5392         struct byte_range_lock *br_lck = NULL;
5393
5394         START_PROFILE(SMBlock);
5395
5396         if (req->wct < 5) {
5397                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5398                 END_PROFILE(SMBlock);
5399                 return;
5400         }
5401
5402         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5403
5404         if (!check_fsp(conn, req, fsp)) {
5405                 END_PROFILE(SMBlock);
5406                 return;
5407         }
5408
5409         count = (uint64_t)IVAL(req->vwv+1, 0);
5410         offset = (uint64_t)IVAL(req->vwv+3, 0);
5411
5412         DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5413                  fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5414
5415         br_lck = do_lock(req->sconn->msg_ctx,
5416                         fsp,
5417                         (uint64_t)req->smbpid,
5418                         count,
5419                         offset,
5420                         WRITE_LOCK,
5421                         WINDOWS_LOCK,
5422                         False, /* Non-blocking lock. */
5423                         &status,
5424                         NULL);
5425
5426         TALLOC_FREE(br_lck);
5427
5428         if (NT_STATUS_V(status)) {
5429                 reply_nterror(req, status);
5430                 END_PROFILE(SMBlock);
5431                 return;
5432         }
5433
5434         reply_outbuf(req, 0, 0);
5435
5436         END_PROFILE(SMBlock);
5437         return;
5438 }
5439
5440 /****************************************************************************
5441  Reply to a unlock.
5442 ****************************************************************************/
5443
5444 void reply_unlock(struct smb_request *req)
5445 {
5446         connection_struct *conn = req->conn;
5447         uint64_t count,offset;
5448         NTSTATUS status;
5449         files_struct *fsp;
5450
5451         START_PROFILE(SMBunlock);
5452
5453         if (req->wct < 5) {
5454                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5455                 END_PROFILE(SMBunlock);
5456                 return;
5457         }
5458
5459         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5460
5461         if (!check_fsp(conn, req, fsp)) {
5462                 END_PROFILE(SMBunlock);
5463                 return;
5464         }
5465
5466         count = (uint64_t)IVAL(req->vwv+1, 0);
5467         offset = (uint64_t)IVAL(req->vwv+3, 0);
5468
5469         status = do_unlock(req->sconn->msg_ctx,
5470                         fsp,
5471                         (uint64_t)req->smbpid,
5472                         count,
5473                         offset,
5474                         WINDOWS_LOCK);
5475
5476         if (NT_STATUS_V(status)) {
5477                 reply_nterror(req, status);
5478                 END_PROFILE(SMBunlock);
5479                 return;
5480         }
5481
5482         DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5483                     fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5484
5485         reply_outbuf(req, 0, 0);
5486
5487         END_PROFILE(SMBunlock);
5488         return;
5489 }
5490
5491 #undef DBGC_CLASS
5492 #define DBGC_CLASS DBGC_ALL
5493
5494 /****************************************************************************
5495  Reply to a tdis.
5496  conn POINTER CAN BE NULL HERE !
5497 ****************************************************************************/
5498
5499 void reply_tdis(struct smb_request *req)
5500 {
5501         NTSTATUS status;
5502         connection_struct *conn = req->conn;
5503         struct smbXsrv_tcon *tcon;
5504
5505         START_PROFILE(SMBtdis);
5506
5507         if (!conn) {
5508                 DEBUG(4,("Invalid connection in tdis\n"));
5509                 reply_force_doserror(req, ERRSRV, ERRinvnid);
5510                 END_PROFILE(SMBtdis);
5511                 return;
5512         }
5513
5514         tcon = conn->tcon;
5515         req->conn = NULL;
5516
5517         /*
5518          * TODO: cancel all outstanding requests on the tcon
5519          */
5520         status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5521         if (!NT_STATUS_IS_OK(status)) {
5522                 DEBUG(0, ("reply_tdis: "
5523                           "smbXsrv_tcon_disconnect() failed: %s\n",
5524                           nt_errstr(status)));
5525                 /*
5526                  * If we hit this case, there is something completely
5527                  * wrong, so we better disconnect the transport connection.
5528                  */
5529                 END_PROFILE(SMBtdis);
5530                 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5531                 return;
5532         }
5533
5534         TALLOC_FREE(tcon);
5535
5536         reply_outbuf(req, 0, 0);
5537         END_PROFILE(SMBtdis);
5538         return;
5539 }
5540
5541 /****************************************************************************
5542  Reply to a echo.
5543  conn POINTER CAN BE NULL HERE !
5544 ****************************************************************************/
5545
5546 void reply_echo(struct smb_request *req)
5547 {
5548         connection_struct *conn = req->conn;
5549         struct smb_perfcount_data local_pcd;
5550         struct smb_perfcount_data *cur_pcd;
5551         int smb_reverb;
5552         int seq_num;
5553
5554         START_PROFILE(SMBecho);
5555
5556         smb_init_perfcount_data(&local_pcd);
5557
5558         if (req->wct < 1) {
5559                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5560                 END_PROFILE(SMBecho);
5561                 return;
5562         }
5563
5564         smb_reverb = SVAL(req->vwv+0, 0);
5565
5566         reply_outbuf(req, 1, req->buflen);
5567
5568         /* copy any incoming data back out */
5569         if (req->buflen > 0) {
5570                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5571         }
5572
5573         if (smb_reverb > 100) {
5574                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5575                 smb_reverb = 100;
5576         }
5577
5578         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5579
5580                 /* this makes sure we catch the request pcd */
5581                 if (seq_num == smb_reverb) {
5582                         cur_pcd = &req->pcd;
5583                 } else {
5584                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5585                         cur_pcd = &local_pcd;
5586                 }
5587
5588                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5589
5590                 show_msg((char *)req->outbuf);
5591                 if (!srv_send_smb(req->xconn,
5592                                 (char *)req->outbuf,
5593                                 true, req->seqnum+1,
5594                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5595                                 cur_pcd))
5596                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5597         }
5598
5599         DEBUG(3,("echo %d times\n", smb_reverb));
5600
5601         TALLOC_FREE(req->outbuf);
5602
5603         END_PROFILE(SMBecho);
5604         return;
5605 }
5606
5607 /****************************************************************************
5608  Reply to a printopen.
5609 ****************************************************************************/
5610
5611 void reply_printopen(struct smb_request *req)
5612 {
5613         connection_struct *conn = req->conn;
5614         files_struct *fsp;
5615         NTSTATUS status;
5616
5617         START_PROFILE(SMBsplopen);
5618
5619         if (req->wct < 2) {
5620                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5621                 END_PROFILE(SMBsplopen);
5622                 return;
5623         }
5624
5625         if (!CAN_PRINT(conn)) {
5626                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5627                 END_PROFILE(SMBsplopen);
5628                 return;
5629         }
5630
5631         status = file_new(req, conn, &fsp);
5632         if(!NT_STATUS_IS_OK(status)) {
5633                 reply_nterror(req, status);
5634                 END_PROFILE(SMBsplopen);
5635                 return;
5636         }
5637
5638         /* Open for exclusive use, write only. */
5639         status = print_spool_open(fsp, NULL, req->vuid);
5640
5641         if (!NT_STATUS_IS_OK(status)) {
5642                 file_free(req, fsp);
5643                 reply_nterror(req, status);
5644                 END_PROFILE(SMBsplopen);
5645                 return;
5646         }
5647
5648         reply_outbuf(req, 1, 0);
5649         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5650
5651         DEBUG(3,("openprint fd=%d %s\n",
5652                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5653
5654         END_PROFILE(SMBsplopen);
5655         return;
5656 }
5657
5658 /****************************************************************************
5659  Reply to a printclose.
5660 ****************************************************************************/
5661
5662 void reply_printclose(struct smb_request *req)
5663 {
5664         connection_struct *conn = req->conn;
5665         files_struct *fsp;
5666         NTSTATUS status;
5667
5668         START_PROFILE(SMBsplclose);
5669
5670         if (req->wct < 1) {
5671                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5672                 END_PROFILE(SMBsplclose);
5673                 return;
5674         }
5675
5676         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5677
5678         if (!check_fsp(conn, req, fsp)) {
5679                 END_PROFILE(SMBsplclose);
5680                 return;
5681         }
5682
5683         if (!CAN_PRINT(conn)) {
5684                 reply_force_doserror(req, ERRSRV, ERRerror);
5685                 END_PROFILE(SMBsplclose);
5686                 return;
5687         }
5688
5689         DEBUG(3,("printclose fd=%d %s\n",
5690                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5691
5692         status = close_file(req, fsp, NORMAL_CLOSE);
5693
5694         if(!NT_STATUS_IS_OK(status)) {
5695                 reply_nterror(req, status);
5696                 END_PROFILE(SMBsplclose);
5697                 return;
5698         }
5699
5700         reply_outbuf(req, 0, 0);
5701
5702         END_PROFILE(SMBsplclose);
5703         return;
5704 }
5705
5706 /****************************************************************************
5707  Reply to a printqueue.
5708 ****************************************************************************/
5709
5710 void reply_printqueue(struct smb_request *req)
5711 {
5712         connection_struct *conn = req->conn;
5713         int max_count;
5714         int start_index;
5715
5716         START_PROFILE(SMBsplretq);
5717
5718         if (req->wct < 2) {
5719                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5720                 END_PROFILE(SMBsplretq);
5721                 return;
5722         }
5723
5724         max_count = SVAL(req->vwv+0, 0);
5725         start_index = SVAL(req->vwv+1, 0);
5726
5727         /* we used to allow the client to get the cnum wrong, but that
5728            is really quite gross and only worked when there was only
5729            one printer - I think we should now only accept it if they
5730            get it right (tridge) */
5731         if (!CAN_PRINT(conn)) {
5732                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5733                 END_PROFILE(SMBsplretq);
5734                 return;
5735         }
5736
5737         reply_outbuf(req, 2, 3);
5738         SSVAL(req->outbuf,smb_vwv0,0);
5739         SSVAL(req->outbuf,smb_vwv1,0);
5740         SCVAL(smb_buf(req->outbuf),0,1);
5741         SSVAL(smb_buf(req->outbuf),1,0);
5742
5743         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5744                  start_index, max_count));
5745
5746         {
5747                 TALLOC_CTX *mem_ctx = talloc_tos();
5748                 NTSTATUS status;
5749                 WERROR werr;
5750                 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5751                 struct rpc_pipe_client *cli = NULL;
5752                 struct dcerpc_binding_handle *b = NULL;
5753                 struct policy_handle handle;
5754                 struct spoolss_DevmodeContainer devmode_ctr;
5755                 union spoolss_JobInfo *info;
5756                 uint32_t count;
5757                 uint32_t num_to_get;
5758                 uint32_t first;
5759                 uint32_t i;
5760
5761                 ZERO_STRUCT(handle);
5762
5763                 status = rpc_pipe_open_interface(conn,
5764                                                  &ndr_table_spoolss,
5765                                                  conn->session_info,
5766                                                  conn->sconn->remote_address,
5767                                                  conn->sconn->msg_ctx,
5768                                                  &cli);
5769                 if (!NT_STATUS_IS_OK(status)) {
5770                         DEBUG(0, ("reply_printqueue: "
5771                                   "could not connect to spoolss: %s\n",
5772                                   nt_errstr(status)));
5773                         reply_nterror(req, status);
5774                         goto out;
5775                 }
5776                 b = cli->binding_handle;
5777
5778                 ZERO_STRUCT(devmode_ctr);
5779
5780                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5781                                                 sharename,
5782                                                 NULL, devmode_ctr,
5783                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5784                                                 &handle,
5785                                                 &werr);
5786                 if (!NT_STATUS_IS_OK(status)) {
5787                         reply_nterror(req, status);
5788                         goto out;
5789                 }
5790                 if (!W_ERROR_IS_OK(werr)) {
5791                         reply_nterror(req, werror_to_ntstatus(werr));
5792                         goto out;
5793                 }
5794
5795                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5796                                                &handle,
5797                                                0, /* firstjob */
5798                                                0xff, /* numjobs */
5799                                                2, /* level */
5800                                                0, /* offered */
5801                                                &count,
5802                                                &info);
5803                 if (!W_ERROR_IS_OK(werr)) {
5804                         reply_nterror(req, werror_to_ntstatus(werr));
5805                         goto out;
5806                 }
5807
5808                 if (max_count > 0) {
5809                         first = start_index;
5810                 } else {
5811                         first = start_index + max_count + 1;
5812                 }
5813
5814                 if (first >= count) {
5815                         num_to_get = first;
5816                 } else {
5817                         num_to_get = first + MIN(ABS(max_count), count - first);
5818                 }
5819
5820                 for (i = first; i < num_to_get; i++) {
5821                         char blob[28];
5822                         char *p = blob;
5823                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5824                         int qstatus;
5825                         size_t len = 0;
5826                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5827                                                         info[i].info2.job_id);
5828
5829                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5830                                 qstatus = 2;
5831                         } else {
5832                                 qstatus = 3;
5833                         }
5834
5835                         srv_put_dos_date2(p, 0, qtime);
5836                         SCVAL(p, 4, qstatus);
5837                         SSVAL(p, 5, qrapjobid);
5838                         SIVAL(p, 7, info[i].info2.size);
5839                         SCVAL(p, 11, 0);
5840                         status = srvstr_push(blob, req->flags2, p+12,
5841                                     info[i].info2.notify_name, 16, STR_ASCII, &len);
5842                         if (!NT_STATUS_IS_OK(status)) {
5843                                 reply_nterror(req, status);
5844                                 goto out;
5845                         }
5846                         if (message_push_blob(
5847                                     &req->outbuf,
5848                                     data_blob_const(
5849                                             blob, sizeof(blob))) == -1) {
5850                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5851                                 goto out;
5852                         }
5853                 }
5854
5855                 if (count > 0) {
5856                         SSVAL(req->outbuf,smb_vwv0,count);
5857                         SSVAL(req->outbuf,smb_vwv1,
5858                               (max_count>0?first+count:first-1));
5859                         SCVAL(smb_buf(req->outbuf),0,1);
5860                         SSVAL(smb_buf(req->outbuf),1,28*count);
5861                 }
5862
5863
5864                 DEBUG(3, ("%u entries returned in queue\n",
5865                           (unsigned)count));
5866
5867 out:
5868                 if (b && is_valid_policy_hnd(&handle)) {
5869                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5870                 }
5871
5872         }
5873
5874         END_PROFILE(SMBsplretq);
5875         return;
5876 }
5877
5878 /****************************************************************************
5879  Reply to a printwrite.
5880 ****************************************************************************/
5881
5882 void reply_printwrite(struct smb_request *req)
5883 {
5884         connection_struct *conn = req->conn;
5885         int numtowrite;
5886         const char *data;
5887         files_struct *fsp;
5888
5889         START_PROFILE(SMBsplwr);
5890
5891         if (req->wct < 1) {
5892                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5893                 END_PROFILE(SMBsplwr);
5894                 return;
5895         }
5896
5897         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5898
5899         if (!check_fsp(conn, req, fsp)) {
5900                 END_PROFILE(SMBsplwr);
5901                 return;
5902         }
5903
5904         if (!fsp->print_file) {
5905                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5906                 END_PROFILE(SMBsplwr);
5907                 return;
5908         }
5909
5910         if (!CHECK_WRITE(fsp)) {
5911                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5912                 END_PROFILE(SMBsplwr);
5913                 return;
5914         }
5915
5916         numtowrite = SVAL(req->buf, 1);
5917
5918         if (req->buflen < numtowrite + 3) {
5919                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5920                 END_PROFILE(SMBsplwr);
5921                 return;
5922         }
5923
5924         data = (const char *)req->buf + 3;
5925
5926         if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5927                 reply_nterror(req, map_nt_error_from_unix(errno));
5928                 END_PROFILE(SMBsplwr);
5929                 return;
5930         }
5931
5932         DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5933
5934         END_PROFILE(SMBsplwr);
5935         return;
5936 }
5937
5938 /****************************************************************************
5939  Reply to a mkdir.
5940 ****************************************************************************/
5941
5942 void reply_mkdir(struct smb_request *req)
5943 {
5944         connection_struct *conn = req->conn;
5945         struct smb_filename *smb_dname = NULL;
5946         char *directory = NULL;
5947         NTSTATUS status;
5948         TALLOC_CTX *ctx = talloc_tos();
5949
5950         START_PROFILE(SMBmkdir);
5951
5952         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5953                             STR_TERMINATE, &status);
5954         if (!NT_STATUS_IS_OK(status)) {
5955                 reply_nterror(req, status);
5956                 goto out;
5957         }
5958
5959         status = filename_convert(ctx, conn,
5960                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5961                                  directory,
5962                                  UCF_PREP_CREATEFILE,
5963                                  NULL,
5964                                  &smb_dname);
5965         if (!NT_STATUS_IS_OK(status)) {
5966                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5967                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5968                                         ERRSRV, ERRbadpath);
5969                         goto out;
5970                 }
5971                 reply_nterror(req, status);
5972                 goto out;
5973         }
5974
5975         status = create_directory(conn, req, smb_dname);
5976
5977         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5978
5979         if (!NT_STATUS_IS_OK(status)) {
5980
5981                 if (!use_nt_status()
5982                     && NT_STATUS_EQUAL(status,
5983                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5984                         /*
5985                          * Yes, in the DOS error code case we get a
5986                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5987                          * samba4 torture test.
5988                          */
5989                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5990                 }
5991
5992                 reply_nterror(req, status);
5993                 goto out;
5994         }
5995
5996         reply_outbuf(req, 0, 0);
5997
5998         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5999  out:
6000         TALLOC_FREE(smb_dname);
6001         END_PROFILE(SMBmkdir);
6002         return;
6003 }
6004
6005 /****************************************************************************
6006  Reply to a rmdir.
6007 ****************************************************************************/
6008
6009 void reply_rmdir(struct smb_request *req)
6010 {
6011         connection_struct *conn = req->conn;
6012         struct smb_filename *smb_dname = NULL;
6013         char *directory = NULL;
6014         NTSTATUS status;
6015         TALLOC_CTX *ctx = talloc_tos();
6016         files_struct *fsp = NULL;
6017         int info = 0;
6018         struct smbd_server_connection *sconn = req->sconn;
6019
6020         START_PROFILE(SMBrmdir);
6021
6022         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
6023                             STR_TERMINATE, &status);
6024         if (!NT_STATUS_IS_OK(status)) {
6025                 reply_nterror(req, status);
6026                 goto out;
6027         }
6028
6029         status = filename_convert(ctx, conn,
6030                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
6031                                  directory,
6032                                  0,
6033                                  NULL,
6034                                  &smb_dname);
6035         if (!NT_STATUS_IS_OK(status)) {
6036                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6037                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6038                                         ERRSRV, ERRbadpath);
6039                         goto out;
6040                 }
6041                 reply_nterror(req, status);
6042                 goto out;
6043         }
6044
6045         if (is_ntfs_stream_smb_fname(smb_dname)) {
6046                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
6047                 goto out;
6048         }
6049
6050         status = SMB_VFS_CREATE_FILE(
6051                 conn,                                   /* conn */
6052                 req,                                    /* req */
6053                 0,                                      /* root_dir_fid */
6054                 smb_dname,                              /* fname */
6055                 DELETE_ACCESS,                          /* access_mask */
6056                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
6057                         FILE_SHARE_DELETE),
6058                 FILE_OPEN,                              /* create_disposition*/
6059                 FILE_DIRECTORY_FILE,                    /* create_options */
6060                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
6061                 0,                                      /* oplock_request */
6062                 NULL,                                   /* lease */
6063                 0,                                      /* allocation_size */
6064                 0,                                      /* private_flags */
6065                 NULL,                                   /* sd */
6066                 NULL,                                   /* ea_list */
6067                 &fsp,                                   /* result */
6068                 &info,                                  /* pinfo */
6069                 NULL, NULL);                            /* create context */
6070
6071         if (!NT_STATUS_IS_OK(status)) {
6072                 if (open_was_deferred(req->xconn, req->mid)) {
6073                         /* We have re-scheduled this call. */
6074                         goto out;
6075                 }
6076                 reply_nterror(req, status);
6077                 goto out;
6078         }
6079
6080         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
6081         if (!NT_STATUS_IS_OK(status)) {
6082                 close_file(req, fsp, ERROR_CLOSE);
6083                 reply_nterror(req, status);
6084                 goto out;
6085         }
6086
6087         if (!set_delete_on_close(fsp, true,
6088                         conn->session_info->security_token,
6089                         conn->session_info->unix_token)) {
6090                 close_file(req, fsp, ERROR_CLOSE);
6091                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
6092                 goto out;
6093         }
6094
6095         status = close_file(req, fsp, NORMAL_CLOSE);
6096         if (!NT_STATUS_IS_OK(status)) {
6097                 reply_nterror(req, status);
6098         } else {
6099                 reply_outbuf(req, 0, 0);
6100         }
6101
6102         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
6103
6104         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
6105  out:
6106         TALLOC_FREE(smb_dname);
6107         END_PROFILE(SMBrmdir);
6108         return;
6109 }
6110
6111 /*******************************************************************
6112  Resolve wildcards in a filename rename.
6113 ********************************************************************/
6114
6115 static bool resolve_wildcards(TALLOC_CTX *ctx,
6116                                 const char *name1,
6117                                 const char *name2,
6118                                 char **pp_newname)
6119 {
6120         char *name2_copy = NULL;
6121         char *root1 = NULL;
6122         char *root2 = NULL;
6123         char *ext1 = NULL;
6124         char *ext2 = NULL;
6125         char *p,*p2, *pname1, *pname2;
6126
6127         name2_copy = talloc_strdup(ctx, name2);
6128         if (!name2_copy) {
6129                 return False;
6130         }
6131
6132         pname1 = strrchr_m(name1,'/');
6133         pname2 = strrchr_m(name2_copy,'/');
6134
6135         if (!pname1 || !pname2) {
6136                 return False;
6137         }
6138
6139         /* Truncate the copy of name2 at the last '/' */
6140         *pname2 = '\0';
6141
6142         /* Now go past the '/' */
6143         pname1++;
6144         pname2++;
6145
6146         root1 = talloc_strdup(ctx, pname1);
6147         root2 = talloc_strdup(ctx, pname2);
6148
6149         if (!root1 || !root2) {
6150                 return False;
6151         }
6152
6153         p = strrchr_m(root1,'.');
6154         if (p) {
6155                 *p = 0;
6156                 ext1 = talloc_strdup(ctx, p+1);
6157         } else {
6158                 ext1 = talloc_strdup(ctx, "");
6159         }
6160         p = strrchr_m(root2,'.');
6161         if (p) {
6162                 *p = 0;
6163                 ext2 = talloc_strdup(ctx, p+1);
6164         } else {
6165                 ext2 = talloc_strdup(ctx, "");
6166         }
6167
6168         if (!ext1 || !ext2) {
6169                 return False;
6170         }
6171
6172         p = root1;
6173         p2 = root2;
6174         while (*p2) {
6175                 if (*p2 == '?') {
6176                         /* Hmmm. Should this be mb-aware ? */
6177                         *p2 = *p;
6178                         p2++;
6179                 } else if (*p2 == '*') {
6180                         *p2 = '\0';
6181                         root2 = talloc_asprintf(ctx, "%s%s",
6182                                                 root2,
6183                                                 p);
6184                         if (!root2) {
6185                                 return False;
6186                         }
6187                         break;
6188                 } else {
6189                         p2++;
6190                 }
6191                 if (*p) {
6192                         p++;
6193                 }
6194         }
6195
6196         p = ext1;
6197         p2 = ext2;
6198         while (*p2) {
6199                 if (*p2 == '?') {
6200                         /* Hmmm. Should this be mb-aware ? */
6201                         *p2 = *p;
6202                         p2++;
6203                 } else if (*p2 == '*') {
6204                         *p2 = '\0';
6205                         ext2 = talloc_asprintf(ctx, "%s%s",
6206                                                 ext2,
6207                                                 p);
6208                         if (!ext2) {
6209                                 return False;
6210                         }
6211                         break;
6212                 } else {
6213                         p2++;
6214                 }
6215                 if (*p) {
6216                         p++;
6217                 }
6218         }
6219
6220         if (*ext2) {
6221                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6222                                 name2_copy,
6223                                 root2,
6224                                 ext2);
6225         } else {
6226                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6227                                 name2_copy,
6228                                 root2);
6229         }
6230
6231         if (!*pp_newname) {
6232                 return False;
6233         }
6234
6235         return True;
6236 }
6237
6238 /****************************************************************************
6239  Ensure open files have their names updated. Updated to notify other smbd's
6240  asynchronously.
6241 ****************************************************************************/
6242
6243 static void rename_open_files(connection_struct *conn,
6244                               struct share_mode_lock *lck,
6245                               struct file_id id,
6246                               uint32_t orig_name_hash,
6247                               const struct smb_filename *smb_fname_dst)
6248 {
6249         files_struct *fsp;
6250         bool did_rename = False;
6251         NTSTATUS status;
6252         uint32_t new_name_hash = 0;
6253
6254         for(fsp = file_find_di_first(conn->sconn, id); fsp;
6255             fsp = file_find_di_next(fsp)) {
6256                 /* fsp_name is a relative path under the fsp. To change this for other
6257                    sharepaths we need to manipulate relative paths. */
6258                 /* TODO - create the absolute path and manipulate the newname
6259                    relative to the sharepath. */
6260                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6261                         continue;
6262                 }
6263                 if (fsp->name_hash != orig_name_hash) {
6264                         continue;
6265                 }
6266                 DEBUG(10, ("rename_open_files: renaming file %s "
6267                            "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6268                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6269                            smb_fname_str_dbg(smb_fname_dst)));
6270
6271                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6272                 if (NT_STATUS_IS_OK(status)) {
6273                         did_rename = True;
6274                         new_name_hash = fsp->name_hash;
6275                 }
6276         }
6277
6278         if (!did_rename) {
6279                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6280                            "for %s\n", file_id_string_tos(&id),
6281                            smb_fname_str_dbg(smb_fname_dst)));
6282         }
6283
6284         /* Send messages to all smbd's (not ourself) that the name has changed. */
6285         rename_share_filename(conn->sconn->msg_ctx, lck, id, conn->connectpath,
6286                               orig_name_hash, new_name_hash,
6287                               smb_fname_dst);
6288
6289 }
6290
6291 /****************************************************************************
6292  We need to check if the source path is a parent directory of the destination
6293  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6294  refuse the rename with a sharing violation. Under UNIX the above call can
6295  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6296  probably need to check that the client is a Windows one before disallowing
6297  this as a UNIX client (one with UNIX extensions) can know the source is a
6298  symlink and make this decision intelligently. Found by an excellent bug
6299  report from <AndyLiebman@aol.com>.
6300 ****************************************************************************/
6301
6302 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6303                                      const struct smb_filename *smb_fname_dst)
6304 {
6305         const char *psrc = smb_fname_src->base_name;
6306         const char *pdst = smb_fname_dst->base_name;
6307         size_t slen;
6308
6309         if (psrc[0] == '.' && psrc[1] == '/') {
6310                 psrc += 2;
6311         }
6312         if (pdst[0] == '.' && pdst[1] == '/') {
6313                 pdst += 2;
6314         }
6315         if ((slen = strlen(psrc)) > strlen(pdst)) {
6316                 return False;
6317         }
6318         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6319 }
6320
6321 /*
6322  * Do the notify calls from a rename
6323  */
6324
6325 static void notify_rename(connection_struct *conn, bool is_dir,
6326                           const struct smb_filename *smb_fname_src,
6327                           const struct smb_filename *smb_fname_dst)
6328 {
6329         char *parent_dir_src = NULL;
6330         char *parent_dir_dst = NULL;
6331         uint32_t mask;
6332
6333         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6334                 : FILE_NOTIFY_CHANGE_FILE_NAME;
6335
6336         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6337                             &parent_dir_src, NULL) ||
6338             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6339                             &parent_dir_dst, NULL)) {
6340                 goto out;
6341         }
6342
6343         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6344                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6345                              smb_fname_src->base_name);
6346                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6347                              smb_fname_dst->base_name);
6348         }
6349         else {
6350                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6351                              smb_fname_src->base_name);
6352                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6353                              smb_fname_dst->base_name);
6354         }
6355
6356         /* this is a strange one. w2k3 gives an additional event for
6357            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6358            files, but not directories */
6359         if (!is_dir) {
6360                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6361                              FILE_NOTIFY_CHANGE_ATTRIBUTES
6362                              |FILE_NOTIFY_CHANGE_CREATION,
6363                              smb_fname_dst->base_name);
6364         }
6365  out:
6366         TALLOC_FREE(parent_dir_src);
6367         TALLOC_FREE(parent_dir_dst);
6368 }
6369
6370 /****************************************************************************
6371  Returns an error if the parent directory for a filename is open in an
6372  incompatible way.
6373 ****************************************************************************/
6374
6375 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6376                                         const struct smb_filename *smb_fname_dst_in)
6377 {
6378         char *parent_dir = NULL;
6379         struct smb_filename smb_fname_parent;
6380         struct file_id id;
6381         files_struct *fsp = NULL;
6382         int ret;
6383
6384         if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6385                         &parent_dir, NULL)) {
6386                 return NT_STATUS_NO_MEMORY;
6387         }
6388         ZERO_STRUCT(smb_fname_parent);
6389         smb_fname_parent.base_name = parent_dir;
6390
6391         ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6392         if (ret == -1) {
6393                 return map_nt_error_from_unix(errno);
6394         }
6395
6396         /*
6397          * We're only checking on this smbd here, mostly good
6398          * enough.. and will pass tests.
6399          */
6400
6401         id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6402         for (fsp = file_find_di_first(conn->sconn, id); fsp;
6403                         fsp = file_find_di_next(fsp)) {
6404                 if (fsp->access_mask & DELETE_ACCESS) {
6405                         return NT_STATUS_SHARING_VIOLATION;
6406                 }
6407         }
6408         return NT_STATUS_OK;
6409 }
6410
6411 /****************************************************************************
6412  Rename an open file - given an fsp.
6413 ****************************************************************************/
6414
6415 NTSTATUS rename_internals_fsp(connection_struct *conn,
6416                         files_struct *fsp,
6417                         const struct smb_filename *smb_fname_dst_in,
6418                         uint32_t attrs,
6419                         bool replace_if_exists)
6420 {
6421         TALLOC_CTX *ctx = talloc_tos();
6422         struct smb_filename *smb_fname_dst = NULL;
6423         NTSTATUS status = NT_STATUS_OK;
6424         struct share_mode_lock *lck = NULL;
6425         bool dst_exists, old_is_stream, new_is_stream;
6426
6427         status = check_name(conn, smb_fname_dst_in->base_name);
6428         if (!NT_STATUS_IS_OK(status)) {
6429                 return status;
6430         }
6431
6432         status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6433         if (!NT_STATUS_IS_OK(status)) {
6434                 return status;
6435         }
6436
6437         /* Make a copy of the dst smb_fname structs */
6438
6439         smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6440         if (smb_fname_dst == NULL) {
6441                 status = NT_STATUS_NO_MEMORY;
6442                 goto out;
6443         }
6444
6445         /*
6446          * Check for special case with case preserving and not
6447          * case sensitive. If the old last component differs from the original
6448          * last component only by case, then we should allow
6449          * the rename (user is trying to change the case of the
6450          * filename).
6451          */
6452         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6453             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6454             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6455                 char *last_slash;
6456                 char *fname_dst_lcomp_base_mod = NULL;
6457                 struct smb_filename *smb_fname_orig_lcomp = NULL;
6458
6459                 /*
6460                  * Get the last component of the destination name.
6461                  */
6462                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6463                 if (last_slash) {
6464                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6465                 } else {
6466                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6467                 }
6468                 if (!fname_dst_lcomp_base_mod) {
6469                         status = NT_STATUS_NO_MEMORY;
6470                         goto out;
6471                 }
6472
6473                 /*
6474                  * Create an smb_filename struct using the original last
6475                  * component of the destination.
6476                  */
6477                 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6478                         ctx, smb_fname_dst->original_lcomp, NULL);
6479                 if (smb_fname_orig_lcomp == NULL) {
6480                         status = NT_STATUS_NO_MEMORY;
6481                         TALLOC_FREE(fname_dst_lcomp_base_mod);
6482                         goto out;
6483                 }
6484
6485                 /* If the base names only differ by case, use original. */
6486                 if(!strcsequal(fname_dst_lcomp_base_mod,
6487                                smb_fname_orig_lcomp->base_name)) {
6488                         char *tmp;
6489                         /*
6490                          * Replace the modified last component with the
6491                          * original.
6492                          */
6493                         if (last_slash) {
6494                                 *last_slash = '\0'; /* Truncate at the '/' */
6495                                 tmp = talloc_asprintf(smb_fname_dst,
6496                                         "%s/%s",
6497                                         smb_fname_dst->base_name,
6498                                         smb_fname_orig_lcomp->base_name);
6499                         } else {
6500                                 tmp = talloc_asprintf(smb_fname_dst,
6501                                         "%s",
6502                                         smb_fname_orig_lcomp->base_name);
6503                         }
6504                         if (tmp == NULL) {
6505                                 status = NT_STATUS_NO_MEMORY;
6506                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6507                                 TALLOC_FREE(smb_fname_orig_lcomp);
6508                                 goto out;
6509                         }
6510                         TALLOC_FREE(smb_fname_dst->base_name);
6511                         smb_fname_dst->base_name = tmp;
6512                 }
6513
6514                 /* If the stream_names only differ by case, use original. */
6515                 if(!strcsequal(smb_fname_dst->stream_name,
6516                                smb_fname_orig_lcomp->stream_name)) {
6517                         char *tmp = NULL;
6518                         /* Use the original stream. */
6519                         tmp = talloc_strdup(smb_fname_dst,
6520                                             smb_fname_orig_lcomp->stream_name);
6521                         if (tmp == NULL) {
6522                                 status = NT_STATUS_NO_MEMORY;
6523                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6524                                 TALLOC_FREE(smb_fname_orig_lcomp);
6525                                 goto out;
6526                         }
6527                         TALLOC_FREE(smb_fname_dst->stream_name);
6528                         smb_fname_dst->stream_name = tmp;
6529                 }
6530                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6531                 TALLOC_FREE(smb_fname_orig_lcomp);
6532         }
6533
6534         /*
6535          * If the src and dest names are identical - including case,
6536          * don't do the rename, just return success.
6537          */
6538
6539         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6540             strcsequal(fsp->fsp_name->stream_name,
6541                        smb_fname_dst->stream_name)) {
6542                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6543                           "- returning success\n",
6544                           smb_fname_str_dbg(smb_fname_dst)));
6545                 status = NT_STATUS_OK;
6546                 goto out;
6547         }
6548
6549         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6550         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6551
6552         /* Return the correct error code if both names aren't streams. */
6553         if (!old_is_stream && new_is_stream) {
6554                 status = NT_STATUS_OBJECT_NAME_INVALID;
6555                 goto out;
6556         }
6557
6558         if (old_is_stream && !new_is_stream) {
6559                 status = NT_STATUS_INVALID_PARAMETER;
6560                 goto out;
6561         }
6562
6563         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6564
6565         if(!replace_if_exists && dst_exists) {
6566                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6567                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6568                           smb_fname_str_dbg(smb_fname_dst)));
6569                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6570                 goto out;
6571         }
6572
6573         if (dst_exists) {
6574                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6575                     &smb_fname_dst->st);
6576                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6577                                                            fileid);
6578                 /* The file can be open when renaming a stream */
6579                 if (dst_fsp && !new_is_stream) {
6580                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6581                         status = NT_STATUS_ACCESS_DENIED;
6582                         goto out;
6583                 }
6584         }
6585
6586         /* Ensure we have a valid stat struct for the source. */
6587         status = vfs_stat_fsp(fsp);
6588         if (!NT_STATUS_IS_OK(status)) {
6589                 goto out;
6590         }
6591
6592         status = can_rename(conn, fsp, attrs);
6593
6594         if (!NT_STATUS_IS_OK(status)) {
6595                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6596                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6597                           smb_fname_str_dbg(smb_fname_dst)));
6598                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6599                         status = NT_STATUS_ACCESS_DENIED;
6600                 goto out;
6601         }
6602
6603         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6604                 status = NT_STATUS_ACCESS_DENIED;
6605         }
6606
6607         lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6608
6609         /*
6610          * We have the file open ourselves, so not being able to get the
6611          * corresponding share mode lock is a fatal error.
6612          */
6613
6614         SMB_ASSERT(lck != NULL);
6615
6616         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6617                 uint32_t create_options = fsp->fh->private_options;
6618
6619                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6620                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6621                           smb_fname_str_dbg(smb_fname_dst)));
6622
6623                 if (!fsp->is_directory &&
6624                     !lp_posix_pathnames() &&
6625                     (lp_map_archive(SNUM(conn)) ||
6626                     lp_store_dos_attributes(SNUM(conn)))) {
6627                         /* We must set the archive bit on the newly
6628                            renamed file. */
6629                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6630                                 uint32_t old_dosmode = dos_mode(conn,
6631                                                         smb_fname_dst);
6632                                 file_set_dosmode(conn,
6633                                         smb_fname_dst,
6634                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6635                                         NULL,
6636                                         true);
6637                         }
6638                 }
6639
6640                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6641                               smb_fname_dst);
6642
6643                 rename_open_files(conn, lck, fsp->file_id, fsp->name_hash,
6644                                   smb_fname_dst);
6645
6646                 /*
6647                  * A rename acts as a new file create w.r.t. allowing an initial delete
6648                  * on close, probably because in Windows there is a new handle to the
6649                  * new file. If initial delete on close was requested but not
6650                  * originally set, we need to set it here. This is probably not 100% correct,
6651                  * but will work for the CIFSFS client which in non-posix mode
6652                  * depends on these semantics. JRA.
6653                  */
6654
6655                 if (create_options & FILE_DELETE_ON_CLOSE) {
6656                         status = can_set_delete_on_close(fsp, 0);
6657
6658                         if (NT_STATUS_IS_OK(status)) {
6659                                 /* Note that here we set the *inital* delete on close flag,
6660                                  * not the regular one. The magic gets handled in close. */
6661                                 fsp->initial_delete_on_close = True;
6662                         }
6663                 }
6664                 TALLOC_FREE(lck);
6665                 status = NT_STATUS_OK;
6666                 goto out;
6667         }
6668
6669         TALLOC_FREE(lck);
6670
6671         if (errno == ENOTDIR || errno == EISDIR) {
6672                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6673         } else {
6674                 status = map_nt_error_from_unix(errno);
6675         }
6676
6677         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6678                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6679                   smb_fname_str_dbg(smb_fname_dst)));
6680
6681  out:
6682         TALLOC_FREE(smb_fname_dst);
6683
6684         return status;
6685 }
6686
6687 /****************************************************************************
6688  The guts of the rename command, split out so it may be called by the NT SMB
6689  code.
6690 ****************************************************************************/
6691
6692 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6693                         connection_struct *conn,
6694                         struct smb_request *req,
6695                         struct smb_filename *smb_fname_src,
6696                         struct smb_filename *smb_fname_dst,
6697                         uint32_t attrs,
6698                         bool replace_if_exists,
6699                         bool src_has_wild,
6700                         bool dest_has_wild,
6701                         uint32_t access_mask)
6702 {
6703         char *fname_src_dir = NULL;
6704         char *fname_src_mask = NULL;
6705         int count=0;
6706         NTSTATUS status = NT_STATUS_OK;
6707         struct smb_Dir *dir_hnd = NULL;
6708         const char *dname = NULL;
6709         char *talloced = NULL;
6710         long offset = 0;
6711         int create_options = 0;
6712         bool posix_pathnames = lp_posix_pathnames();
6713         int rc;
6714
6715         /*
6716          * Split the old name into directory and last component
6717          * strings. Note that unix_convert may have stripped off a
6718          * leading ./ from both name and newname if the rename is
6719          * at the root of the share. We need to make sure either both
6720          * name and newname contain a / character or neither of them do
6721          * as this is checked in resolve_wildcards().
6722          */
6723
6724         /* Split up the directory from the filename/mask. */
6725         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6726                                       &fname_src_dir, &fname_src_mask);
6727         if (!NT_STATUS_IS_OK(status)) {
6728                 status = NT_STATUS_NO_MEMORY;
6729                 goto out;
6730         }
6731
6732         /*
6733          * We should only check the mangled cache
6734          * here if unix_convert failed. This means
6735          * that the path in 'mask' doesn't exist
6736          * on the file system and so we need to look
6737          * for a possible mangle. This patch from
6738          * Tine Smukavec <valentin.smukavec@hermes.si>.
6739          */
6740
6741         if (!VALID_STAT(smb_fname_src->st) &&
6742             mangle_is_mangled(fname_src_mask, conn->params)) {
6743                 char *new_mask = NULL;
6744                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6745                                             conn->params);
6746                 if (new_mask) {
6747                         TALLOC_FREE(fname_src_mask);
6748                         fname_src_mask = new_mask;
6749                 }
6750         }
6751
6752         if (!src_has_wild) {
6753                 files_struct *fsp;
6754
6755                 /*
6756                  * Only one file needs to be renamed. Append the mask back
6757                  * onto the directory.
6758                  */
6759                 TALLOC_FREE(smb_fname_src->base_name);
6760                 if (ISDOT(fname_src_dir)) {
6761                         /* Ensure we use canonical names on open. */
6762                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6763                                                         "%s",
6764                                                         fname_src_mask);
6765                 } else {
6766                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6767                                                         "%s/%s",
6768                                                         fname_src_dir,
6769                                                         fname_src_mask);
6770                 }
6771                 if (!smb_fname_src->base_name) {
6772                         status = NT_STATUS_NO_MEMORY;
6773                         goto out;
6774                 }
6775
6776                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6777                           "case_preserve = %d, short case preserve = %d, "
6778                           "directory = %s, newname = %s, "
6779                           "last_component_dest = %s\n",
6780                           conn->case_sensitive, conn->case_preserve,
6781                           conn->short_case_preserve,
6782                           smb_fname_str_dbg(smb_fname_src),
6783                           smb_fname_str_dbg(smb_fname_dst),
6784                           smb_fname_dst->original_lcomp));
6785
6786                 /* The dest name still may have wildcards. */
6787                 if (dest_has_wild) {
6788                         char *fname_dst_mod = NULL;
6789                         if (!resolve_wildcards(smb_fname_dst,
6790                                                smb_fname_src->base_name,
6791                                                smb_fname_dst->base_name,
6792                                                &fname_dst_mod)) {
6793                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6794                                           "%s %s failed\n",
6795                                           smb_fname_src->base_name,
6796                                           smb_fname_dst->base_name));
6797                                 status = NT_STATUS_NO_MEMORY;
6798                                 goto out;
6799                         }
6800                         TALLOC_FREE(smb_fname_dst->base_name);
6801                         smb_fname_dst->base_name = fname_dst_mod;
6802                 }
6803
6804                 ZERO_STRUCT(smb_fname_src->st);
6805                 if (posix_pathnames) {
6806                         rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6807                 } else {
6808                         rc = SMB_VFS_STAT(conn, smb_fname_src);
6809                 }
6810                 if (rc == -1) {
6811                         status = map_nt_error_from_unix_common(errno);
6812                         goto out;
6813                 }
6814
6815                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6816                         create_options |= FILE_DIRECTORY_FILE;
6817                 }
6818
6819                 status = SMB_VFS_CREATE_FILE(
6820                         conn,                           /* conn */
6821                         req,                            /* req */
6822                         0,                              /* root_dir_fid */
6823                         smb_fname_src,                  /* fname */
6824                         access_mask,                    /* access_mask */
6825                         (FILE_SHARE_READ |              /* share_access */
6826                             FILE_SHARE_WRITE),
6827                         FILE_OPEN,                      /* create_disposition*/
6828                         create_options,                 /* create_options */
6829                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6830                         0,                              /* oplock_request */
6831                         NULL,                           /* lease */
6832                         0,                              /* allocation_size */
6833                         0,                              /* private_flags */
6834                         NULL,                           /* sd */
6835                         NULL,                           /* ea_list */
6836                         &fsp,                           /* result */
6837                         NULL,                           /* pinfo */
6838                         NULL, NULL);                    /* create context */
6839
6840                 if (!NT_STATUS_IS_OK(status)) {
6841                         DEBUG(3, ("Could not open rename source %s: %s\n",
6842                                   smb_fname_str_dbg(smb_fname_src),
6843                                   nt_errstr(status)));
6844                         goto out;
6845                 }
6846
6847                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6848                                               attrs, replace_if_exists);
6849
6850                 close_file(req, fsp, NORMAL_CLOSE);
6851
6852                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6853                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6854                           smb_fname_str_dbg(smb_fname_dst)));
6855
6856                 goto out;
6857         }
6858
6859         /*
6860          * Wildcards - process each file that matches.
6861          */
6862         if (strequal(fname_src_mask, "????????.???")) {
6863                 TALLOC_FREE(fname_src_mask);
6864                 fname_src_mask = talloc_strdup(ctx, "*");
6865                 if (!fname_src_mask) {
6866                         status = NT_STATUS_NO_MEMORY;
6867                         goto out;
6868                 }
6869         }
6870
6871         status = check_name(conn, fname_src_dir);
6872         if (!NT_STATUS_IS_OK(status)) {
6873                 goto out;
6874         }
6875
6876         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6877                           attrs);
6878         if (dir_hnd == NULL) {
6879                 status = map_nt_error_from_unix(errno);
6880                 goto out;
6881         }
6882
6883         status = NT_STATUS_NO_SUCH_FILE;
6884         /*
6885          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6886          * - gentest fix. JRA
6887          */
6888
6889         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6890                                     &talloced))) {
6891                 files_struct *fsp = NULL;
6892                 char *destname = NULL;
6893                 bool sysdir_entry = False;
6894
6895                 /* Quick check for "." and ".." */
6896                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6897                         if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6898                                 sysdir_entry = True;
6899                         } else {
6900                                 TALLOC_FREE(talloced);
6901                                 continue;
6902                         }
6903                 }
6904
6905                 if (!is_visible_file(conn, fname_src_dir, dname,
6906                                      &smb_fname_src->st, false)) {
6907                         TALLOC_FREE(talloced);
6908                         continue;
6909                 }
6910
6911                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6912                         TALLOC_FREE(talloced);
6913                         continue;
6914                 }
6915
6916                 if (sysdir_entry) {
6917                         status = NT_STATUS_OBJECT_NAME_INVALID;
6918                         break;
6919                 }
6920
6921                 TALLOC_FREE(smb_fname_src->base_name);
6922                 if (ISDOT(fname_src_dir)) {
6923                         /* Ensure we use canonical names on open. */
6924                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6925                                                         "%s",
6926                                                         dname);
6927                 } else {
6928                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6929                                                         "%s/%s",
6930                                                         fname_src_dir,
6931                                                         dname);
6932                 }
6933                 if (!smb_fname_src->base_name) {
6934                         status = NT_STATUS_NO_MEMORY;
6935                         goto out;
6936                 }
6937
6938                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6939                                        smb_fname_dst->base_name,
6940                                        &destname)) {
6941                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6942                                   smb_fname_src->base_name, destname));
6943                         TALLOC_FREE(talloced);
6944                         continue;
6945                 }
6946                 if (!destname) {
6947                         status = NT_STATUS_NO_MEMORY;
6948                         goto out;
6949                 }
6950
6951                 TALLOC_FREE(smb_fname_dst->base_name);
6952                 smb_fname_dst->base_name = destname;
6953
6954                 ZERO_STRUCT(smb_fname_src->st);
6955                 if (posix_pathnames) {
6956                         SMB_VFS_LSTAT(conn, smb_fname_src);
6957                 } else {
6958                         SMB_VFS_STAT(conn, smb_fname_src);
6959                 }
6960
6961                 create_options = 0;
6962
6963                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6964                         create_options |= FILE_DIRECTORY_FILE;
6965                 }
6966
6967                 status = SMB_VFS_CREATE_FILE(
6968                         conn,                           /* conn */
6969                         req,                            /* req */
6970                         0,                              /* root_dir_fid */
6971                         smb_fname_src,                  /* fname */
6972                         access_mask,                    /* access_mask */
6973                         (FILE_SHARE_READ |              /* share_access */
6974                             FILE_SHARE_WRITE),
6975                         FILE_OPEN,                      /* create_disposition*/
6976                         create_options,                 /* create_options */
6977                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6978                         0,                              /* oplock_request */
6979                         NULL,                           /* lease */
6980                         0,                              /* allocation_size */
6981                         0,                              /* private_flags */
6982                         NULL,                           /* sd */
6983                         NULL,                           /* ea_list */
6984                         &fsp,                           /* result */
6985                         NULL,                           /* pinfo */
6986                         NULL, NULL);                    /* create context */
6987
6988                 if (!NT_STATUS_IS_OK(status)) {
6989                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6990                                  "returned %s rename %s -> %s\n",
6991                                  nt_errstr(status),
6992                                  smb_fname_str_dbg(smb_fname_src),
6993                                  smb_fname_str_dbg(smb_fname_dst)));
6994                         break;
6995                 }
6996
6997                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6998                                                               dname);
6999                 if (!smb_fname_dst->original_lcomp) {
7000                         status = NT_STATUS_NO_MEMORY;
7001                         goto out;
7002                 }
7003
7004                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
7005                                               attrs, replace_if_exists);
7006
7007                 close_file(req, fsp, NORMAL_CLOSE);
7008
7009                 if (!NT_STATUS_IS_OK(status)) {
7010                         DEBUG(3, ("rename_internals_fsp returned %s for "
7011                                   "rename %s -> %s\n", nt_errstr(status),
7012                                   smb_fname_str_dbg(smb_fname_src),
7013                                   smb_fname_str_dbg(smb_fname_dst)));
7014                         break;
7015                 }
7016
7017                 count++;
7018
7019                 DEBUG(3,("rename_internals: doing rename on %s -> "
7020                          "%s\n", smb_fname_str_dbg(smb_fname_src),
7021                          smb_fname_str_dbg(smb_fname_src)));
7022                 TALLOC_FREE(talloced);
7023         }
7024         TALLOC_FREE(dir_hnd);
7025
7026         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
7027                 status = map_nt_error_from_unix(errno);
7028         }
7029
7030  out:
7031         TALLOC_FREE(talloced);
7032         TALLOC_FREE(fname_src_dir);
7033         TALLOC_FREE(fname_src_mask);
7034         return status;
7035 }
7036
7037 /****************************************************************************
7038  Reply to a mv.
7039 ****************************************************************************/
7040
7041 void reply_mv(struct smb_request *req)
7042 {
7043         connection_struct *conn = req->conn;
7044         char *name = NULL;
7045         char *newname = NULL;
7046         const char *p;
7047         uint32_t attrs;
7048         NTSTATUS status;
7049         bool src_has_wcard = False;
7050         bool dest_has_wcard = False;
7051         TALLOC_CTX *ctx = talloc_tos();
7052         struct smb_filename *smb_fname_src = NULL;
7053         struct smb_filename *smb_fname_dst = NULL;
7054         uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
7055         uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
7056         bool stream_rename = false;
7057
7058         START_PROFILE(SMBmv);
7059
7060         if (req->wct < 1) {
7061                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7062                 goto out;
7063         }
7064
7065         attrs = SVAL(req->vwv+0, 0);
7066
7067         p = (const char *)req->buf + 1;
7068         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
7069                                        &status, &src_has_wcard);
7070         if (!NT_STATUS_IS_OK(status)) {
7071                 reply_nterror(req, status);
7072                 goto out;
7073         }
7074         p++;
7075         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
7076                                        &status, &dest_has_wcard);
7077         if (!NT_STATUS_IS_OK(status)) {
7078                 reply_nterror(req, status);
7079                 goto out;
7080         }
7081
7082         if (!lp_posix_pathnames()) {
7083                 /* The newname must begin with a ':' if the
7084                    name contains a ':'. */
7085                 if (strchr_m(name, ':')) {
7086                         if (newname[0] != ':') {
7087                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7088                                 goto out;
7089                         }
7090                         stream_rename = true;
7091                 }
7092         }
7093
7094         status = filename_convert(ctx,
7095                                   conn,
7096                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7097                                   name,
7098                                   src_ucf_flags,
7099                                   &src_has_wcard,
7100                                   &smb_fname_src);
7101
7102         if (!NT_STATUS_IS_OK(status)) {
7103                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7104                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7105                                         ERRSRV, ERRbadpath);
7106                         goto out;
7107                 }
7108                 reply_nterror(req, status);
7109                 goto out;
7110         }
7111
7112         status = filename_convert(ctx,
7113                                   conn,
7114                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7115                                   newname,
7116                                   dst_ucf_flags,
7117                                   &dest_has_wcard,
7118                                   &smb_fname_dst);
7119
7120         if (!NT_STATUS_IS_OK(status)) {
7121                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7122                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7123                                         ERRSRV, ERRbadpath);
7124                         goto out;
7125                 }
7126                 reply_nterror(req, status);
7127                 goto out;
7128         }
7129
7130         if (stream_rename) {
7131                 /* smb_fname_dst->base_name must be the same as
7132                    smb_fname_src->base_name. */
7133                 TALLOC_FREE(smb_fname_dst->base_name);
7134                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
7135                                                 smb_fname_src->base_name);
7136                 if (!smb_fname_dst->base_name) {
7137                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7138                         goto out;
7139                 }
7140         }
7141
7142         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7143                  smb_fname_str_dbg(smb_fname_dst)));
7144
7145         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7146                                   attrs, False, src_has_wcard, dest_has_wcard,
7147                                   DELETE_ACCESS);
7148         if (!NT_STATUS_IS_OK(status)) {
7149                 if (open_was_deferred(req->xconn, req->mid)) {
7150                         /* We have re-scheduled this call. */
7151                         goto out;
7152                 }
7153                 reply_nterror(req, status);
7154                 goto out;
7155         }
7156
7157         reply_outbuf(req, 0, 0);
7158  out:
7159         TALLOC_FREE(smb_fname_src);
7160         TALLOC_FREE(smb_fname_dst);
7161         END_PROFILE(SMBmv);
7162         return;
7163 }
7164
7165 /*******************************************************************
7166  Copy a file as part of a reply_copy.
7167 ******************************************************************/
7168
7169 /*
7170  * TODO: check error codes on all callers
7171  */
7172
7173 NTSTATUS copy_file(TALLOC_CTX *ctx,
7174                         connection_struct *conn,
7175                         struct smb_filename *smb_fname_src,
7176                         struct smb_filename *smb_fname_dst,
7177                         int ofun,
7178                         int count,
7179                         bool target_is_directory)
7180 {
7181         struct smb_filename *smb_fname_dst_tmp = NULL;
7182         off_t ret=-1;
7183         files_struct *fsp1,*fsp2;
7184         uint32_t dosattrs;
7185         uint32_t new_create_disposition;
7186         NTSTATUS status;
7187
7188
7189         smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7190         if (smb_fname_dst_tmp == NULL) {
7191                 return NT_STATUS_NO_MEMORY;
7192         }
7193
7194         /*
7195          * If the target is a directory, extract the last component from the
7196          * src filename and append it to the dst filename
7197          */
7198         if (target_is_directory) {
7199                 const char *p;
7200
7201                 /* dest/target can't be a stream if it's a directory. */
7202                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7203
7204                 p = strrchr_m(smb_fname_src->base_name,'/');
7205                 if (p) {
7206                         p++;
7207                 } else {
7208                         p = smb_fname_src->base_name;
7209                 }
7210                 smb_fname_dst_tmp->base_name =
7211                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7212                                            p);
7213                 if (!smb_fname_dst_tmp->base_name) {
7214                         status = NT_STATUS_NO_MEMORY;
7215                         goto out;
7216                 }
7217         }
7218
7219         status = vfs_file_exist(conn, smb_fname_src);
7220         if (!NT_STATUS_IS_OK(status)) {
7221                 goto out;
7222         }
7223
7224         if (!target_is_directory && count) {
7225                 new_create_disposition = FILE_OPEN;
7226         } else {
7227                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7228                                                  0, ofun,
7229                                                  NULL, NULL,
7230                                                  &new_create_disposition,
7231                                                  NULL,
7232                                                  NULL)) {
7233                         status = NT_STATUS_INVALID_PARAMETER;
7234                         goto out;
7235                 }
7236         }
7237
7238         /* Open the src file for reading. */
7239         status = SMB_VFS_CREATE_FILE(
7240                 conn,                                   /* conn */
7241                 NULL,                                   /* req */
7242                 0,                                      /* root_dir_fid */
7243                 smb_fname_src,                          /* fname */
7244                 FILE_GENERIC_READ,                      /* access_mask */
7245                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7246                 FILE_OPEN,                              /* create_disposition*/
7247                 0,                                      /* create_options */
7248                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
7249                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7250                 NULL,                                   /* lease */
7251                 0,                                      /* allocation_size */
7252                 0,                                      /* private_flags */
7253                 NULL,                                   /* sd */
7254                 NULL,                                   /* ea_list */
7255                 &fsp1,                                  /* result */
7256                 NULL,                                   /* psbuf */
7257                 NULL, NULL);                            /* create context */
7258
7259         if (!NT_STATUS_IS_OK(status)) {
7260                 goto out;
7261         }
7262
7263         dosattrs = dos_mode(conn, smb_fname_src);
7264
7265         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7266                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7267         }
7268
7269         /* Open the dst file for writing. */
7270         status = SMB_VFS_CREATE_FILE(
7271                 conn,                                   /* conn */
7272                 NULL,                                   /* req */
7273                 0,                                      /* root_dir_fid */
7274                 smb_fname_dst,                          /* fname */
7275                 FILE_GENERIC_WRITE,                     /* access_mask */
7276                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7277                 new_create_disposition,                 /* create_disposition*/
7278                 0,                                      /* create_options */
7279                 dosattrs,                               /* file_attributes */
7280                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7281                 NULL,                                   /* lease */
7282                 0,                                      /* allocation_size */
7283                 0,                                      /* private_flags */
7284                 NULL,                                   /* sd */
7285                 NULL,                                   /* ea_list */
7286                 &fsp2,                                  /* result */
7287                 NULL,                                   /* psbuf */
7288                 NULL, NULL);                            /* create context */
7289
7290         if (!NT_STATUS_IS_OK(status)) {
7291                 close_file(NULL, fsp1, ERROR_CLOSE);
7292                 goto out;
7293         }
7294
7295         if (ofun & OPENX_FILE_EXISTS_OPEN) {
7296                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7297                 if (ret == -1) {
7298                         DEBUG(0, ("error - vfs lseek returned error %s\n",
7299                                 strerror(errno)));
7300                         status = map_nt_error_from_unix(errno);
7301                         close_file(NULL, fsp1, ERROR_CLOSE);
7302                         close_file(NULL, fsp2, ERROR_CLOSE);
7303                         goto out;
7304                 }
7305         }
7306
7307         /* Do the actual copy. */
7308         if (smb_fname_src->st.st_ex_size) {
7309                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7310         } else {
7311                 ret = 0;
7312         }
7313
7314         close_file(NULL, fsp1, NORMAL_CLOSE);
7315
7316         /* Ensure the modtime is set correctly on the destination file. */
7317         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7318
7319         /*
7320          * As we are opening fsp1 read-only we only expect
7321          * an error on close on fsp2 if we are out of space.
7322          * Thus we don't look at the error return from the
7323          * close of fsp1.
7324          */
7325         status = close_file(NULL, fsp2, NORMAL_CLOSE);
7326
7327         if (!NT_STATUS_IS_OK(status)) {
7328                 goto out;
7329         }
7330
7331         if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7332                 status = NT_STATUS_DISK_FULL;
7333                 goto out;
7334         }
7335
7336         status = NT_STATUS_OK;
7337
7338  out:
7339         TALLOC_FREE(smb_fname_dst_tmp);
7340         return status;
7341 }
7342
7343 /****************************************************************************
7344  Reply to a file copy.
7345 ****************************************************************************/
7346
7347 void reply_copy(struct smb_request *req)
7348 {
7349         connection_struct *conn = req->conn;
7350         struct smb_filename *smb_fname_src = NULL;
7351         struct smb_filename *smb_fname_dst = NULL;
7352         char *fname_src = NULL;
7353         char *fname_dst = NULL;
7354         char *fname_src_mask = NULL;
7355         char *fname_src_dir = NULL;
7356         const char *p;
7357         int count=0;
7358         int error = ERRnoaccess;
7359         int tid2;
7360         int ofun;
7361         int flags;
7362         bool target_is_directory=False;
7363         bool source_has_wild = False;
7364         bool dest_has_wild = False;
7365         NTSTATUS status;
7366         TALLOC_CTX *ctx = talloc_tos();
7367
7368         START_PROFILE(SMBcopy);
7369
7370         if (req->wct < 3) {
7371                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7372                 goto out;
7373         }
7374
7375         tid2 = SVAL(req->vwv+0, 0);
7376         ofun = SVAL(req->vwv+1, 0);
7377         flags = SVAL(req->vwv+2, 0);
7378
7379         p = (const char *)req->buf;
7380         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7381                                        &status, &source_has_wild);
7382         if (!NT_STATUS_IS_OK(status)) {
7383                 reply_nterror(req, status);
7384                 goto out;
7385         }
7386         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7387                                        &status, &dest_has_wild);
7388         if (!NT_STATUS_IS_OK(status)) {
7389                 reply_nterror(req, status);
7390                 goto out;
7391         }
7392
7393         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7394
7395         if (tid2 != conn->cnum) {
7396                 /* can't currently handle inter share copies XXXX */
7397                 DEBUG(3,("Rejecting inter-share copy\n"));
7398                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7399                 goto out;
7400         }
7401
7402         status = filename_convert(ctx, conn,
7403                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7404                                   fname_src,
7405                                   UCF_COND_ALLOW_WCARD_LCOMP,
7406                                   &source_has_wild,
7407                                   &smb_fname_src);
7408         if (!NT_STATUS_IS_OK(status)) {
7409                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7410                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7411                                         ERRSRV, ERRbadpath);
7412                         goto out;
7413                 }
7414                 reply_nterror(req, status);
7415                 goto out;
7416         }
7417
7418         status = filename_convert(ctx, conn,
7419                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7420                                   fname_dst,
7421                                   UCF_COND_ALLOW_WCARD_LCOMP,
7422                                   &dest_has_wild,
7423                                   &smb_fname_dst);
7424         if (!NT_STATUS_IS_OK(status)) {
7425                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7426                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7427                                         ERRSRV, ERRbadpath);
7428                         goto out;
7429                 }
7430                 reply_nterror(req, status);
7431                 goto out;
7432         }
7433
7434         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7435
7436         if ((flags&1) && target_is_directory) {
7437                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7438                 goto out;
7439         }
7440
7441         if ((flags&2) && !target_is_directory) {
7442                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7443                 goto out;
7444         }
7445
7446         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7447                 /* wants a tree copy! XXXX */
7448                 DEBUG(3,("Rejecting tree copy\n"));
7449                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7450                 goto out;
7451         }
7452
7453         /* Split up the directory from the filename/mask. */
7454         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7455                                       &fname_src_dir, &fname_src_mask);
7456         if (!NT_STATUS_IS_OK(status)) {
7457                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7458                 goto out;
7459         }
7460
7461         /*
7462          * We should only check the mangled cache
7463          * here if unix_convert failed. This means
7464          * that the path in 'mask' doesn't exist
7465          * on the file system and so we need to look
7466          * for a possible mangle. This patch from
7467          * Tine Smukavec <valentin.smukavec@hermes.si>.
7468          */
7469         if (!VALID_STAT(smb_fname_src->st) &&
7470             mangle_is_mangled(fname_src_mask, conn->params)) {
7471                 char *new_mask = NULL;
7472                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7473                                             &new_mask, conn->params);
7474
7475                 /* Use demangled name if one was successfully found. */
7476                 if (new_mask) {
7477                         TALLOC_FREE(fname_src_mask);
7478                         fname_src_mask = new_mask;
7479                 }
7480         }
7481
7482         if (!source_has_wild) {
7483
7484                 /*
7485                  * Only one file needs to be copied. Append the mask back onto
7486                  * the directory.
7487                  */
7488                 TALLOC_FREE(smb_fname_src->base_name);
7489                 if (ISDOT(fname_src_dir)) {
7490                         /* Ensure we use canonical names on open. */
7491                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7492                                                         "%s",
7493                                                         fname_src_mask);
7494                 } else {
7495                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7496                                                         "%s/%s",
7497                                                         fname_src_dir,
7498                                                         fname_src_mask);
7499                 }
7500                 if (!smb_fname_src->base_name) {
7501                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7502                         goto out;
7503                 }
7504
7505                 if (dest_has_wild) {
7506                         char *fname_dst_mod = NULL;
7507                         if (!resolve_wildcards(smb_fname_dst,
7508                                                smb_fname_src->base_name,
7509                                                smb_fname_dst->base_name,
7510                                                &fname_dst_mod)) {
7511                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7512                                 goto out;
7513                         }
7514                         TALLOC_FREE(smb_fname_dst->base_name);
7515                         smb_fname_dst->base_name = fname_dst_mod;
7516                 }
7517
7518                 status = check_name(conn, smb_fname_src->base_name);
7519                 if (!NT_STATUS_IS_OK(status)) {
7520                         reply_nterror(req, status);
7521                         goto out;
7522                 }
7523
7524                 status = check_name(conn, smb_fname_dst->base_name);
7525                 if (!NT_STATUS_IS_OK(status)) {
7526                         reply_nterror(req, status);
7527                         goto out;
7528                 }
7529
7530                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7531                                    ofun, count, target_is_directory);
7532
7533                 if(!NT_STATUS_IS_OK(status)) {
7534                         reply_nterror(req, status);
7535                         goto out;
7536                 } else {
7537                         count++;
7538                 }
7539         } else {
7540                 struct smb_Dir *dir_hnd = NULL;
7541                 const char *dname = NULL;
7542                 char *talloced = NULL;
7543                 long offset = 0;
7544
7545                 /*
7546                  * There is a wildcard that requires us to actually read the
7547                  * src dir and copy each file matching the mask to the dst.
7548                  * Right now streams won't be copied, but this could
7549                  * presumably be added with a nested loop for reach dir entry.
7550                  */
7551                 SMB_ASSERT(!smb_fname_src->stream_name);
7552                 SMB_ASSERT(!smb_fname_dst->stream_name);
7553
7554                 smb_fname_src->stream_name = NULL;
7555                 smb_fname_dst->stream_name = NULL;
7556
7557                 if (strequal(fname_src_mask,"????????.???")) {
7558                         TALLOC_FREE(fname_src_mask);
7559                         fname_src_mask = talloc_strdup(ctx, "*");
7560                         if (!fname_src_mask) {
7561                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7562                                 goto out;
7563                         }
7564                 }
7565
7566                 status = check_name(conn, fname_src_dir);
7567                 if (!NT_STATUS_IS_OK(status)) {
7568                         reply_nterror(req, status);
7569                         goto out;
7570                 }
7571
7572                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7573                 if (dir_hnd == NULL) {
7574                         status = map_nt_error_from_unix(errno);
7575                         reply_nterror(req, status);
7576                         goto out;
7577                 }
7578
7579                 error = ERRbadfile;
7580
7581                 /* Iterate over the src dir copying each entry to the dst. */
7582                 while ((dname = ReadDirName(dir_hnd, &offset,
7583                                             &smb_fname_src->st, &talloced))) {
7584                         char *destname = NULL;
7585
7586                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7587                                 TALLOC_FREE(talloced);
7588                                 continue;
7589                         }
7590
7591                         if (!is_visible_file(conn, fname_src_dir, dname,
7592                                              &smb_fname_src->st, false)) {
7593                                 TALLOC_FREE(talloced);
7594                                 continue;
7595                         }
7596
7597                         if(!mask_match(dname, fname_src_mask,
7598                                        conn->case_sensitive)) {
7599                                 TALLOC_FREE(talloced);
7600                                 continue;
7601                         }
7602
7603                         error = ERRnoaccess;
7604
7605                         /* Get the src smb_fname struct setup. */
7606                         TALLOC_FREE(smb_fname_src->base_name);
7607                         if (ISDOT(fname_src_dir)) {
7608                                 /* Ensure we use canonical names on open. */
7609                                 smb_fname_src->base_name =
7610                                         talloc_asprintf(smb_fname_src, "%s",
7611                                                 dname);
7612                         } else {
7613                                 smb_fname_src->base_name =
7614                                         talloc_asprintf(smb_fname_src, "%s/%s",
7615                                                 fname_src_dir, dname);
7616                         }
7617
7618                         if (!smb_fname_src->base_name) {
7619                                 TALLOC_FREE(dir_hnd);
7620                                 TALLOC_FREE(talloced);
7621                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7622                                 goto out;
7623                         }
7624
7625                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7626                                                smb_fname_dst->base_name,
7627                                                &destname)) {
7628                                 TALLOC_FREE(talloced);
7629                                 continue;
7630                         }
7631                         if (!destname) {
7632                                 TALLOC_FREE(dir_hnd);
7633                                 TALLOC_FREE(talloced);
7634                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7635                                 goto out;
7636                         }
7637
7638                         TALLOC_FREE(smb_fname_dst->base_name);
7639                         smb_fname_dst->base_name = destname;
7640
7641                         status = check_name(conn, smb_fname_src->base_name);
7642                         if (!NT_STATUS_IS_OK(status)) {
7643                                 TALLOC_FREE(dir_hnd);
7644                                 TALLOC_FREE(talloced);
7645                                 reply_nterror(req, status);
7646                                 goto out;
7647                         }
7648
7649                         status = check_name(conn, smb_fname_dst->base_name);
7650                         if (!NT_STATUS_IS_OK(status)) {
7651                                 TALLOC_FREE(dir_hnd);
7652                                 TALLOC_FREE(talloced);
7653                                 reply_nterror(req, status);
7654                                 goto out;
7655                         }
7656
7657                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7658                                 smb_fname_src->base_name,
7659                                 smb_fname_dst->base_name));
7660
7661                         status = copy_file(ctx, conn, smb_fname_src,
7662                                            smb_fname_dst, ofun, count,
7663                                            target_is_directory);
7664                         if (NT_STATUS_IS_OK(status)) {
7665                                 count++;
7666                         }
7667
7668                         TALLOC_FREE(talloced);
7669                 }
7670                 TALLOC_FREE(dir_hnd);
7671         }
7672
7673         if (count == 0) {
7674                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7675                 goto out;
7676         }
7677
7678         reply_outbuf(req, 1, 0);
7679         SSVAL(req->outbuf,smb_vwv0,count);
7680  out:
7681         TALLOC_FREE(smb_fname_src);
7682         TALLOC_FREE(smb_fname_dst);
7683         TALLOC_FREE(fname_src);
7684         TALLOC_FREE(fname_dst);
7685         TALLOC_FREE(fname_src_mask);
7686         TALLOC_FREE(fname_src_dir);
7687
7688         END_PROFILE(SMBcopy);
7689         return;
7690 }
7691
7692 #undef DBGC_CLASS
7693 #define DBGC_CLASS DBGC_LOCKING
7694
7695 /****************************************************************************
7696  Get a lock pid, dealing with large count requests.
7697 ****************************************************************************/
7698
7699 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7700                     bool large_file_format)
7701 {
7702         if(!large_file_format)
7703                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7704         else
7705                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7706 }
7707
7708 /****************************************************************************
7709  Get a lock count, dealing with large count requests.
7710 ****************************************************************************/
7711
7712 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7713                         bool large_file_format)
7714 {
7715         uint64_t count = 0;
7716
7717         if(!large_file_format) {
7718                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7719         } else {
7720                 /*
7721                  * No BVAL, this is reversed!
7722                  */
7723                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7724                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7725         }
7726
7727         return count;
7728 }
7729
7730 /****************************************************************************
7731  Get a lock offset, dealing with large offset requests.
7732 ****************************************************************************/
7733
7734 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7735                          bool large_file_format)
7736 {
7737         uint64_t offset = 0;
7738
7739         if(!large_file_format) {
7740                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7741         } else {
7742                 /*
7743                  * No BVAL, this is reversed!
7744                  */
7745                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7746                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7747         }
7748
7749         return offset;
7750 }
7751
7752 NTSTATUS smbd_do_locking(struct smb_request *req,
7753                          files_struct *fsp,
7754                          uint8_t type,
7755                          int32_t timeout,
7756                          uint16_t num_locks,
7757                          struct smbd_lock_element *locks,
7758                          bool *async)
7759 {
7760         connection_struct *conn = req->conn;
7761         int i;
7762         NTSTATUS status = NT_STATUS_OK;
7763
7764         *async = false;
7765
7766         /* Setup the timeout in seconds. */
7767
7768         if (!lp_blocking_locks(SNUM(conn))) {
7769                 timeout = 0;
7770         }
7771
7772         for(i = 0; i < (int)num_locks; i++) {
7773                 struct smbd_lock_element *e = &locks[i];
7774
7775                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7776                           "%llu, file %s timeout = %d\n",
7777                           (double)e->offset,
7778                           (double)e->count,
7779                           (unsigned long long)e->smblctx,
7780                           fsp_str_dbg(fsp),
7781                           (int)timeout));
7782
7783                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7784                         struct blocking_lock_record *blr = NULL;
7785
7786                         if (num_locks > 1) {
7787                                 /*
7788                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7789                                  * if the lock vector contains one entry. When given multiple cancel
7790                                  * requests in a single PDU we expect the server to return an
7791                                  * error. Windows servers seem to accept the request but only
7792                                  * cancel the first lock.
7793                                  * JRA - Do what Windows does (tm) :-).
7794                                  */
7795
7796 #if 0
7797                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7798                                 return NT_STATUS_DOS(ERRDOS,
7799                                                 ERRcancelviolation);
7800 #else
7801                                 /* Windows behavior. */
7802                                 if (i != 0) {
7803                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7804                                                 "cancel request\n"));
7805                                         continue;
7806                                 }
7807 #endif
7808                         }
7809
7810                         if (lp_blocking_locks(SNUM(conn))) {
7811
7812                                 /* Schedule a message to ourselves to
7813                                    remove the blocking lock record and
7814                                    return the right error. */
7815
7816                                 blr = blocking_lock_cancel_smb1(fsp,
7817                                                 e->smblctx,
7818                                                 e->offset,
7819                                                 e->count,
7820                                                 WINDOWS_LOCK,
7821                                                 type,
7822                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7823                                 if (blr == NULL) {
7824                                         return NT_STATUS_DOS(
7825                                                         ERRDOS,
7826                                                         ERRcancelviolation);
7827                                 }
7828                         }
7829                         /* Remove a matching pending lock. */
7830                         status = do_lock_cancel(fsp,
7831                                                 e->smblctx,
7832                                                 e->count,
7833                                                 e->offset,
7834                                                 WINDOWS_LOCK);
7835                 } else {
7836                         bool blocking_lock = timeout ? true : false;
7837                         bool defer_lock = false;
7838                         struct byte_range_lock *br_lck;
7839                         uint64_t block_smblctx;
7840
7841                         br_lck = do_lock(req->sconn->msg_ctx,
7842                                         fsp,
7843                                         e->smblctx,
7844                                         e->count,
7845                                         e->offset,
7846                                         e->brltype,
7847                                         WINDOWS_LOCK,
7848                                         blocking_lock,
7849                                         &status,
7850                                         &block_smblctx);
7851
7852                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7853                                 /* Windows internal resolution for blocking locks seems
7854                                    to be about 200ms... Don't wait for less than that. JRA. */
7855                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7856                                         timeout = lp_lock_spin_time();
7857                                 }
7858                                 defer_lock = true;
7859                         }
7860
7861                         /* If a lock sent with timeout of zero would fail, and
7862                          * this lock has been requested multiple times,
7863                          * according to brl_lock_failed() we convert this
7864                          * request to a blocking lock with a timeout of between
7865                          * 150 - 300 milliseconds.
7866                          *
7867                          * If lp_lock_spin_time() has been set to 0, we skip
7868                          * this blocking retry and fail immediately.
7869                          *
7870                          * Replacement for do_lock_spin(). JRA. */
7871
7872                         if (!req->sconn->using_smb2 &&
7873                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7874                             lp_lock_spin_time() && !blocking_lock &&
7875                             NT_STATUS_EQUAL((status),
7876                                 NT_STATUS_FILE_LOCK_CONFLICT))
7877                         {
7878                                 defer_lock = true;
7879                                 timeout = lp_lock_spin_time();
7880                         }
7881
7882                         if (br_lck && defer_lock) {
7883                                 /*
7884                                  * A blocking lock was requested. Package up
7885                                  * this smb into a queued request and push it
7886                                  * onto the blocking lock queue.
7887                                  */
7888                                 if(push_blocking_lock_request(br_lck,
7889                                                         req,
7890                                                         fsp,
7891                                                         timeout,
7892                                                         i,
7893                                                         e->smblctx,
7894                                                         e->brltype,
7895                                                         WINDOWS_LOCK,
7896                                                         e->offset,
7897                                                         e->count,
7898                                                         block_smblctx)) {
7899                                         TALLOC_FREE(br_lck);
7900                                         *async = true;
7901                                         return NT_STATUS_OK;
7902                                 }
7903                         }
7904
7905                         TALLOC_FREE(br_lck);
7906                 }
7907
7908                 if (!NT_STATUS_IS_OK(status)) {
7909                         break;
7910                 }
7911         }
7912
7913         /* If any of the above locks failed, then we must unlock
7914            all of the previous locks (X/Open spec). */
7915
7916         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7917
7918                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7919                         i = -1; /* we want to skip the for loop */
7920                 }
7921
7922                 /*
7923                  * Ensure we don't do a remove on the lock that just failed,
7924                  * as under POSIX rules, if we have a lock already there, we
7925                  * will delete it (and we shouldn't) .....
7926                  */
7927                 for(i--; i >= 0; i--) {
7928                         struct smbd_lock_element *e = &locks[i];
7929
7930                         do_unlock(req->sconn->msg_ctx,
7931                                 fsp,
7932                                 e->smblctx,
7933                                 e->count,
7934                                 e->offset,
7935                                 WINDOWS_LOCK);
7936                 }
7937                 return status;
7938         }
7939
7940         DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d\n",
7941                   fsp_fnum_dbg(fsp), (unsigned int)type, num_locks));
7942
7943         return NT_STATUS_OK;
7944 }
7945
7946 NTSTATUS smbd_do_unlocking(struct smb_request *req,
7947                            files_struct *fsp,
7948                            uint16_t num_ulocks,
7949                            struct smbd_lock_element *ulocks)
7950 {
7951         int i;
7952
7953         for(i = 0; i < (int)num_ulocks; i++) {
7954                 struct smbd_lock_element *e = &ulocks[i];
7955                 NTSTATUS status;
7956
7957                 DEBUG(10,("%s: unlock start=%.0f, len=%.0f for "
7958                           "pid %u, file %s\n", __func__,
7959                           (double)e->offset,
7960                           (double)e->count,
7961                           (unsigned int)e->smblctx,
7962                           fsp_str_dbg(fsp)));
7963
7964                 if (e->brltype != UNLOCK_LOCK) {
7965                         /* this can only happen with SMB2 */
7966                         return NT_STATUS_INVALID_PARAMETER;
7967                 }
7968
7969                 status = do_unlock(req->sconn->msg_ctx,
7970                                 fsp,
7971                                 e->smblctx,
7972                                 e->count,
7973                                 e->offset,
7974                                 WINDOWS_LOCK);
7975
7976                 DEBUG(10, ("%s: unlock returned %s\n", __func__,
7977                            nt_errstr(status)));
7978
7979                 if (!NT_STATUS_IS_OK(status)) {
7980                         return status;
7981                 }
7982         }
7983
7984         DEBUG(3, ("%s: %s num_ulocks=%d\n", __func__, fsp_fnum_dbg(fsp),
7985                   num_ulocks));
7986
7987         return NT_STATUS_OK;
7988 }
7989
7990 /****************************************************************************
7991  Reply to a lockingX request.
7992 ****************************************************************************/
7993
7994 void reply_lockingX(struct smb_request *req)
7995 {
7996         connection_struct *conn = req->conn;
7997         files_struct *fsp;
7998         unsigned char locktype;
7999         unsigned char oplocklevel;
8000         uint16_t num_ulocks;
8001         uint16_t num_locks;
8002         int32 lock_timeout;
8003         int i;
8004         const uint8_t *data;
8005         bool large_file_format;
8006         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
8007         struct smbd_lock_element *ulocks;
8008         struct smbd_lock_element *locks;
8009         bool async = false;
8010
8011         START_PROFILE(SMBlockingX);
8012
8013         if (req->wct < 8) {
8014                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8015                 END_PROFILE(SMBlockingX);
8016                 return;
8017         }
8018
8019         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
8020         locktype = CVAL(req->vwv+3, 0);
8021         oplocklevel = CVAL(req->vwv+3, 1);
8022         num_ulocks = SVAL(req->vwv+6, 0);
8023         num_locks = SVAL(req->vwv+7, 0);
8024         lock_timeout = IVAL(req->vwv+4, 0);
8025         large_file_format = ((locktype & LOCKING_ANDX_LARGE_FILES) != 0);
8026
8027         if (!check_fsp(conn, req, fsp)) {
8028                 END_PROFILE(SMBlockingX);
8029                 return;
8030         }
8031
8032         data = req->buf;
8033
8034         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
8035                 /* we don't support these - and CANCEL_LOCK makes w2k
8036                    and XP reboot so I don't really want to be
8037                    compatible! (tridge) */
8038                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
8039                 END_PROFILE(SMBlockingX);
8040                 return;
8041         }
8042
8043         /* Check if this is an oplock break on a file
8044            we have granted an oplock on.
8045         */
8046         if (locktype & LOCKING_ANDX_OPLOCK_RELEASE) {
8047                 /* Client can insist on breaking to none. */
8048                 bool break_to_none = (oplocklevel == 0);
8049                 bool result;
8050
8051                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
8052                          "for %s\n", (unsigned int)oplocklevel,
8053                          fsp_fnum_dbg(fsp)));
8054
8055                 /*
8056                  * Make sure we have granted an exclusive or batch oplock on
8057                  * this file.
8058                  */
8059
8060                 if (fsp->oplock_type == 0) {
8061
8062                         /* The Samba4 nbench simulator doesn't understand
8063                            the difference between break to level2 and break
8064                            to none from level2 - it sends oplock break
8065                            replies in both cases. Don't keep logging an error
8066                            message here - just ignore it. JRA. */
8067
8068                         DEBUG(5,("reply_lockingX: Error : oplock break from "
8069                                  "client for %s (oplock=%d) and no "
8070                                  "oplock granted on this file (%s).\n",
8071                                  fsp_fnum_dbg(fsp), fsp->oplock_type,
8072                                  fsp_str_dbg(fsp)));
8073
8074                         /* if this is a pure oplock break request then don't
8075                          * send a reply */
8076                         if (num_locks == 0 && num_ulocks == 0) {
8077                                 END_PROFILE(SMBlockingX);
8078                                 return;
8079                         } else {
8080                                 END_PROFILE(SMBlockingX);
8081                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8082                                 return;
8083                         }
8084                 }
8085
8086                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8087                     (break_to_none)) {
8088                         result = remove_oplock(fsp);
8089                 } else {
8090                         result = downgrade_oplock(fsp);
8091                 }
8092
8093                 if (!result) {
8094                         DEBUG(0, ("reply_lockingX: error in removing "
8095                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
8096                         /* Hmmm. Is this panic justified? */
8097                         smb_panic("internal tdb error");
8098                 }
8099
8100                 /* if this is a pure oplock break request then don't send a
8101                  * reply */
8102                 if (num_locks == 0 && num_ulocks == 0) {
8103                         /* Sanity check - ensure a pure oplock break is not a
8104                            chained request. */
8105                         if (CVAL(req->vwv+0, 0) != 0xff) {
8106                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
8107                                          "break is a chained %d request !\n",
8108                                          (unsigned int)CVAL(req->vwv+0, 0)));
8109                         }
8110                         END_PROFILE(SMBlockingX);
8111                         return;
8112                 }
8113         }
8114
8115         if (req->buflen <
8116             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8117                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8118                 END_PROFILE(SMBlockingX);
8119                 return;
8120         }
8121
8122         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8123         if (ulocks == NULL) {
8124                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8125                 END_PROFILE(SMBlockingX);
8126                 return;
8127         }
8128
8129         locks = talloc_array(req, struct smbd_lock_element, num_locks);
8130         if (locks == NULL) {
8131                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8132                 END_PROFILE(SMBlockingX);
8133                 return;
8134         }
8135
8136         /* Data now points at the beginning of the list
8137            of smb_unlkrng structs */
8138         for(i = 0; i < (int)num_ulocks; i++) {
8139                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8140                 ulocks[i].count = get_lock_count(data, i, large_file_format);
8141                 ulocks[i].offset = get_lock_offset(data, i, large_file_format);
8142                 ulocks[i].brltype = UNLOCK_LOCK;
8143         }
8144
8145         /* Now do any requested locks */
8146         data += ((large_file_format ? 20 : 10)*num_ulocks);
8147
8148         /* Data now points at the beginning of the list
8149            of smb_lkrng structs */
8150
8151         for(i = 0; i < (int)num_locks; i++) {
8152                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8153                 locks[i].count = get_lock_count(data, i, large_file_format);
8154                 locks[i].offset = get_lock_offset(data, i, large_file_format);
8155
8156                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8157                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8158                                 locks[i].brltype = PENDING_READ_LOCK;
8159                         } else {
8160                                 locks[i].brltype = READ_LOCK;
8161                         }
8162                 } else {
8163                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8164                                 locks[i].brltype = PENDING_WRITE_LOCK;
8165                         } else {
8166                                 locks[i].brltype = WRITE_LOCK;
8167                         }
8168                 }
8169         }
8170
8171         status = smbd_do_unlocking(req, fsp, num_ulocks, ulocks);
8172         if (!NT_STATUS_IS_OK(status)) {
8173                 END_PROFILE(SMBlockingX);
8174                 reply_nterror(req, status);
8175                 return;
8176         }
8177
8178         status = smbd_do_locking(req, fsp,
8179                                  locktype, lock_timeout,
8180                                  num_locks, locks,
8181                                  &async);
8182         if (!NT_STATUS_IS_OK(status)) {
8183                 END_PROFILE(SMBlockingX);
8184                 reply_nterror(req, status);
8185                 return;
8186         }
8187         if (async) {
8188                 END_PROFILE(SMBlockingX);
8189                 return;
8190         }
8191
8192         reply_outbuf(req, 2, 0);
8193         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8194         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
8195
8196         DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8197                   fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8198
8199         END_PROFILE(SMBlockingX);
8200 }
8201
8202 #undef DBGC_CLASS
8203 #define DBGC_CLASS DBGC_ALL
8204
8205 /****************************************************************************
8206  Reply to a SMBreadbmpx (read block multiplex) request.
8207  Always reply with an error, if someone has a platform really needs this,
8208  please contact vl@samba.org
8209 ****************************************************************************/
8210
8211 void reply_readbmpx(struct smb_request *req)
8212 {
8213         START_PROFILE(SMBreadBmpx);
8214         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8215         END_PROFILE(SMBreadBmpx);
8216         return;
8217 }
8218
8219 /****************************************************************************
8220  Reply to a SMBreadbs (read block multiplex secondary) request.
8221  Always reply with an error, if someone has a platform really needs this,
8222  please contact vl@samba.org
8223 ****************************************************************************/
8224
8225 void reply_readbs(struct smb_request *req)
8226 {
8227         START_PROFILE(SMBreadBs);
8228         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8229         END_PROFILE(SMBreadBs);
8230         return;
8231 }
8232
8233 /****************************************************************************
8234  Reply to a SMBsetattrE.
8235 ****************************************************************************/
8236
8237 void reply_setattrE(struct smb_request *req)
8238 {
8239         connection_struct *conn = req->conn;
8240         struct smb_file_time ft;
8241         files_struct *fsp;
8242         NTSTATUS status;
8243
8244         START_PROFILE(SMBsetattrE);
8245         ZERO_STRUCT(ft);
8246
8247         if (req->wct < 7) {
8248                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8249                 goto out;
8250         }
8251
8252         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8253
8254         if(!fsp || (fsp->conn != conn)) {
8255                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8256                 goto out;
8257         }
8258
8259         /*
8260          * Convert the DOS times into unix times.
8261          */
8262
8263         ft.atime = convert_time_t_to_timespec(
8264             srv_make_unix_date2(req->vwv+3));
8265         ft.mtime = convert_time_t_to_timespec(
8266             srv_make_unix_date2(req->vwv+5));
8267         ft.create_time = convert_time_t_to_timespec(
8268             srv_make_unix_date2(req->vwv+1));
8269
8270         reply_outbuf(req, 0, 0);
8271
8272         /*
8273          * Patch from Ray Frush <frush@engr.colostate.edu>
8274          * Sometimes times are sent as zero - ignore them.
8275          */
8276
8277         /* Ensure we have a valid stat struct for the source. */
8278         status = vfs_stat_fsp(fsp);
8279         if (!NT_STATUS_IS_OK(status)) {
8280                 reply_nterror(req, status);
8281                 goto out;
8282         }
8283
8284         if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8285                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8286                 goto out;
8287         }
8288
8289         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8290         if (!NT_STATUS_IS_OK(status)) {
8291                 reply_nterror(req, status);
8292                 goto out;
8293         }
8294
8295         DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8296                " createtime=%u\n",
8297                 fsp_fnum_dbg(fsp),
8298                 (unsigned int)ft.atime.tv_sec,
8299                 (unsigned int)ft.mtime.tv_sec,
8300                 (unsigned int)ft.create_time.tv_sec
8301                 ));
8302  out:
8303         END_PROFILE(SMBsetattrE);
8304         return;
8305 }
8306
8307
8308 /* Back from the dead for OS/2..... JRA. */
8309
8310 /****************************************************************************
8311  Reply to a SMBwritebmpx (write block multiplex primary) request.
8312  Always reply with an error, if someone has a platform really needs this,
8313  please contact vl@samba.org
8314 ****************************************************************************/
8315
8316 void reply_writebmpx(struct smb_request *req)
8317 {
8318         START_PROFILE(SMBwriteBmpx);
8319         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8320         END_PROFILE(SMBwriteBmpx);
8321         return;
8322 }
8323
8324 /****************************************************************************
8325  Reply to a SMBwritebs (write block multiplex secondary) request.
8326  Always reply with an error, if someone has a platform really needs this,
8327  please contact vl@samba.org
8328 ****************************************************************************/
8329
8330 void reply_writebs(struct smb_request *req)
8331 {
8332         START_PROFILE(SMBwriteBs);
8333         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8334         END_PROFILE(SMBwriteBs);
8335         return;
8336 }
8337
8338 /****************************************************************************
8339  Reply to a SMBgetattrE.
8340 ****************************************************************************/
8341
8342 void reply_getattrE(struct smb_request *req)
8343 {
8344         connection_struct *conn = req->conn;
8345         int mode;
8346         files_struct *fsp;
8347         struct timespec create_ts;
8348
8349         START_PROFILE(SMBgetattrE);
8350
8351         if (req->wct < 1) {
8352                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8353                 END_PROFILE(SMBgetattrE);
8354                 return;
8355         }
8356
8357         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8358
8359         if(!fsp || (fsp->conn != conn)) {
8360                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8361                 END_PROFILE(SMBgetattrE);
8362                 return;
8363         }
8364
8365         /* Do an fstat on this file */
8366         if(fsp_stat(fsp)) {
8367                 reply_nterror(req, map_nt_error_from_unix(errno));
8368                 END_PROFILE(SMBgetattrE);
8369                 return;
8370         }
8371
8372         mode = dos_mode(conn, fsp->fsp_name);
8373
8374         /*
8375          * Convert the times into dos times. Set create
8376          * date to be last modify date as UNIX doesn't save
8377          * this.
8378          */
8379
8380         reply_outbuf(req, 11, 0);
8381
8382         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8383         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8384         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8385                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8386         /* Should we check pending modtime here ? JRA */
8387         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8388                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8389
8390         if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8391                 SIVAL(req->outbuf, smb_vwv6, 0);
8392                 SIVAL(req->outbuf, smb_vwv8, 0);
8393         } else {
8394                 uint32_t allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8395                 SIVAL(req->outbuf, smb_vwv6, (uint32_t)fsp->fsp_name->st.st_ex_size);
8396                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8397         }
8398         SSVAL(req->outbuf,smb_vwv10, mode);
8399
8400         DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8401
8402         END_PROFILE(SMBgetattrE);
8403         return;
8404 }