We now pass the Microsoft SMB2 fileio test with EA's and streams...
[ira/wip.git] / source3 / smbd / smb2_create.c
1 /*
2    Unix SMB/CIFS implementation.
3    Core SMB2 server
4
5    Copyright (C) Stefan Metzmacher 2009
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/globals.h"
23 #include "../libcli/smb/smb_common.h"
24
25 static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
26                         struct tevent_context *ev,
27                         struct smbd_smb2_request *smb2req,
28                         uint8_t in_oplock_level,
29                         uint32_t in_impersonation_level,
30                         uint32_t in_desired_access,
31                         uint32_t in_file_attributes,
32                         uint32_t in_share_access,
33                         uint32_t in_create_disposition,
34                         uint32_t in_create_options,
35                         const char *in_name,
36                         struct smb2_create_blobs in_context_blobs);
37 static NTSTATUS smbd_smb2_create_recv(struct tevent_req *req,
38                         TALLOC_CTX *mem_ctx,
39                         uint8_t *out_oplock_level,
40                         uint32_t *out_create_action,
41                         NTTIME *out_creation_time,
42                         NTTIME *out_last_access_time,
43                         NTTIME *out_last_write_time,
44                         NTTIME *out_change_time,
45                         uint64_t *out_allocation_size,
46                         uint64_t *out_end_of_file,
47                         uint32_t *out_file_attributes,
48                         uint64_t *out_file_id_volatile,
49                         struct smb2_create_blobs *out_context_blobs);
50
51 static void smbd_smb2_request_create_done(struct tevent_req *subreq);
52 NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *req)
53 {
54         const uint8_t *inbody;
55         int i = req->current_idx;
56         size_t expected_body_size = 0x39;
57         size_t body_size;
58         uint8_t in_oplock_level;
59         uint32_t in_impersonation_level;
60         uint32_t in_desired_access;
61         uint32_t in_file_attributes;
62         uint32_t in_share_access;
63         uint32_t in_create_disposition;
64         uint32_t in_create_options;
65         uint16_t in_name_offset;
66         uint16_t in_name_length;
67         DATA_BLOB in_name_buffer;
68         char *in_name_string;
69         size_t in_name_string_size;
70         uint32_t name_offset = 0;
71         uint32_t name_available_length = 0;
72         uint32_t in_context_offset;
73         uint32_t in_context_length;
74         DATA_BLOB in_context_buffer;
75         struct smb2_create_blobs in_context_blobs;
76         uint32_t context_offset = 0;
77         uint32_t context_available_length = 0;
78         uint32_t dyn_offset;
79         NTSTATUS status;
80         bool ok;
81         struct tevent_req *subreq;
82
83         if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
84                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
85         }
86
87         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
88
89         body_size = SVAL(inbody, 0x00);
90         if (body_size != expected_body_size) {
91                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
92         }
93
94         in_oplock_level         = CVAL(inbody, 0x03);
95         in_impersonation_level  = IVAL(inbody, 0x04);
96         in_desired_access       = IVAL(inbody, 0x18);
97         in_file_attributes      = IVAL(inbody, 0x1C);
98         in_share_access         = IVAL(inbody, 0x20);
99         in_create_disposition   = IVAL(inbody, 0x24);
100         in_create_options       = IVAL(inbody, 0x28);
101         in_name_offset          = SVAL(inbody, 0x2C);
102         in_name_length          = SVAL(inbody, 0x2E);
103         in_context_offset       = IVAL(inbody, 0x30);
104         in_context_length       = IVAL(inbody, 0x34);
105
106         /*
107          * First check if the dynamic name and context buffers
108          * are correctly specified.
109          *
110          * Note: That we don't check if the name and context buffers
111          *       overlap
112          */
113
114         dyn_offset = SMB2_HDR_BODY + (body_size & 0xFFFFFFFE);
115
116         if (in_name_offset == 0 && in_name_length == 0) {
117                 /* This is ok */
118                 name_offset = 0;
119         } else if (in_name_offset < dyn_offset) {
120                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
121         } else {
122                 name_offset = in_name_offset - dyn_offset;
123         }
124
125         if (name_offset > req->in.vector[i+2].iov_len) {
126                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
127         }
128
129         name_available_length = req->in.vector[i+2].iov_len - name_offset;
130
131         if (in_name_length > name_available_length) {
132                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
133         }
134
135         in_name_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base +
136                               name_offset;
137         in_name_buffer.length = in_name_length;
138
139         if (in_context_offset == 0 && in_context_length == 0) {
140                 /* This is ok */
141                 context_offset = 0;
142         } else if (in_context_offset < dyn_offset) {
143                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
144         } else {
145                 context_offset = in_context_offset - dyn_offset;
146         }
147
148         if (context_offset > req->in.vector[i+2].iov_len) {
149                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
150         }
151
152         context_available_length = req->in.vector[i+2].iov_len - context_offset;
153
154         if (in_context_length > context_available_length) {
155                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
156         }
157
158         in_context_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base +
159                                   context_offset;
160         in_context_buffer.length = in_context_length;
161
162         /*
163          * Now interpret the name and context buffers
164          */
165
166         ok = convert_string_talloc(req, CH_UTF16, CH_UNIX,
167                                    in_name_buffer.data,
168                                    in_name_buffer.length,
169                                    &in_name_string,
170                                    &in_name_string_size, false);
171         if (!ok) {
172                 return smbd_smb2_request_error(req, NT_STATUS_ILLEGAL_CHARACTER);
173         }
174
175         ZERO_STRUCT(in_context_blobs);
176         status = smb2_create_blob_parse(req, in_context_buffer, &in_context_blobs);
177         if (!NT_STATUS_IS_OK(status)) {
178                 return smbd_smb2_request_error(req, status);
179         }
180
181         subreq = smbd_smb2_create_send(req,
182                                        req->sconn->smb2.event_ctx,
183                                        req,
184                                        in_oplock_level,
185                                        in_impersonation_level,
186                                        in_desired_access,
187                                        in_file_attributes,
188                                        in_share_access,
189                                        in_create_disposition,
190                                        in_create_options,
191                                        in_name_string,
192                                        in_context_blobs);
193         if (subreq == NULL) {
194                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
195         }
196         tevent_req_set_callback(subreq, smbd_smb2_request_create_done, req);
197
198         return smbd_smb2_request_pending_queue(req, subreq);
199 }
200
201 static void smbd_smb2_request_create_done(struct tevent_req *subreq)
202 {
203         struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
204                                         struct smbd_smb2_request);
205         int i = req->current_idx;
206         uint8_t *outhdr;
207         DATA_BLOB outbody;
208         DATA_BLOB outdyn;
209         uint8_t out_oplock_level = 0;
210         uint32_t out_create_action = 0;
211         NTTIME out_creation_time = 0;
212         NTTIME out_last_access_time = 0;
213         NTTIME out_last_write_time = 0;
214         NTTIME out_change_time = 0;
215         uint64_t out_allocation_size = 0;
216         uint64_t out_end_of_file = 0;
217         uint32_t out_file_attributes = 0;
218         uint64_t out_file_id_volatile = 0;
219         struct smb2_create_blobs out_context_blobs;
220         DATA_BLOB out_context_buffer;
221         uint16_t out_context_buffer_offset = 0;
222         NTSTATUS status;
223         NTSTATUS error; /* transport error */
224
225         status = smbd_smb2_create_recv(subreq,
226                                        req,
227                                        &out_oplock_level,
228                                        &out_create_action,
229                                        &out_creation_time,
230                                        &out_last_access_time,
231                                        &out_last_write_time,
232                                        &out_change_time,
233                                        &out_allocation_size,
234                                        &out_end_of_file,
235                                        &out_file_attributes,
236                                        &out_file_id_volatile,
237                                        &out_context_blobs);
238         TALLOC_FREE(subreq);
239         if (!NT_STATUS_IS_OK(status)) {
240                 error = smbd_smb2_request_error(req, status);
241                 if (!NT_STATUS_IS_OK(error)) {
242                         smbd_server_connection_terminate(req->sconn,
243                                                          nt_errstr(error));
244                         return;
245                 }
246                 return;
247         }
248
249         status = smb2_create_blob_push(req, &out_context_buffer, out_context_blobs);
250         if (!NT_STATUS_IS_OK(status)) {
251                 error = smbd_smb2_request_error(req, status);
252                 if (!NT_STATUS_IS_OK(error)) {
253                         smbd_server_connection_terminate(req->sconn,
254                                                          nt_errstr(error));
255                         return;
256                 }
257                 return;
258         }
259
260         if (out_context_buffer.length > 0) {
261                 out_context_buffer_offset = SMB2_HDR_BODY + 0x58;
262         }
263
264         outhdr = (uint8_t *)req->out.vector[i].iov_base;
265
266         outbody = data_blob_talloc(req->out.vector, NULL, 0x58);
267         if (outbody.data == NULL) {
268                 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
269                 if (!NT_STATUS_IS_OK(error)) {
270                         smbd_server_connection_terminate(req->sconn,
271                                                          nt_errstr(error));
272                         return;
273                 }
274                 return;
275         }
276
277         SSVAL(outbody.data, 0x00, 0x58 + 1);    /* struct size */
278         SCVAL(outbody.data, 0x02,
279               out_oplock_level);                /* oplock level */
280         SCVAL(outbody.data, 0x03, 0);           /* reserved */
281         SIVAL(outbody.data, 0x04,
282               out_create_action);               /* create action */
283         SBVAL(outbody.data, 0x08,
284               out_creation_time);               /* creation time */
285         SBVAL(outbody.data, 0x10,
286               out_last_access_time);            /* last access time */
287         SBVAL(outbody.data, 0x18,
288               out_last_write_time);             /* last write time */
289         SBVAL(outbody.data, 0x20,
290               out_change_time);                 /* change time */
291         SBVAL(outbody.data, 0x28,
292               out_allocation_size);             /* allocation size */
293         SBVAL(outbody.data, 0x30,
294               out_end_of_file);                 /* end of file */
295         SIVAL(outbody.data, 0x38,
296               out_file_attributes);             /* file attributes */
297         SIVAL(outbody.data, 0x3C, 0);           /* reserved */
298         SBVAL(outbody.data, 0x40, 0);           /* file id (persistent) */
299         SBVAL(outbody.data, 0x48,
300               out_file_id_volatile);            /* file id (volatile) */
301         SIVAL(outbody.data, 0x50,
302               out_context_buffer_offset);       /* create contexts offset */
303         SIVAL(outbody.data, 0x54,
304               out_context_buffer.length);       /* create contexts length */
305
306         outdyn = out_context_buffer;
307
308         error = smbd_smb2_request_done(req, outbody, &outdyn);
309         if (!NT_STATUS_IS_OK(error)) {
310                 smbd_server_connection_terminate(req->sconn,
311                                                  nt_errstr(error));
312                 return;
313         }
314 }
315
316 struct smbd_smb2_create_state {
317         struct smbd_smb2_request *smb2req;
318         uint8_t out_oplock_level;
319         uint32_t out_create_action;
320         NTTIME out_creation_time;
321         NTTIME out_last_access_time;
322         NTTIME out_last_write_time;
323         NTTIME out_change_time;
324         uint64_t out_allocation_size;
325         uint64_t out_end_of_file;
326         uint32_t out_file_attributes;
327         uint64_t out_file_id_volatile;
328         struct smb2_create_blobs out_context_blobs;
329 };
330
331 static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
332                         struct tevent_context *ev,
333                         struct smbd_smb2_request *smb2req,
334                         uint8_t in_oplock_level,
335                         uint32_t in_impersonation_level,
336                         uint32_t in_desired_access,
337                         uint32_t in_file_attributes,
338                         uint32_t in_share_access,
339                         uint32_t in_create_disposition,
340                         uint32_t in_create_options,
341                         const char *in_name,
342                         struct smb2_create_blobs in_context_blobs)
343 {
344         struct tevent_req *req;
345         struct smbd_smb2_create_state *state;
346         NTSTATUS status;
347         struct smb_request *smbreq;
348         files_struct *result;
349         int info;
350         SMB_STRUCT_STAT sbuf;
351         struct smb2_create_blobs out_context_blobs;
352
353         ZERO_STRUCT(out_context_blobs);
354
355         req = tevent_req_create(mem_ctx, &state,
356                                 struct smbd_smb2_create_state);
357         if (req == NULL) {
358                 return NULL;
359         }
360         state->smb2req = smb2req;
361
362         DEBUG(10,("smbd_smb2_create: name[%s]\n",
363                   in_name));
364
365         smbreq = smbd_smb2_fake_smb_request(smb2req);
366         if (tevent_req_nomem(smbreq, req)) {
367                 return tevent_req_post(req, ev);
368         }
369
370         if (IS_IPC(smbreq->conn)) {
371                 const char *pipe_name = in_name;
372
373                 if (!lp_nt_pipe_support()) {
374                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
375                         return tevent_req_post(req, ev);
376                 }
377
378                 /* Strip \\ off the name. */
379                 if (pipe_name[0] == '\\') {
380                         pipe_name++;
381                 }
382
383                 status = open_np_file(smbreq, pipe_name, &result);
384                 if (!NT_STATUS_IS_OK(status)) {
385                         tevent_req_nterror(req, status);
386                         return tevent_req_post(req, ev);
387                 }
388                 info = FILE_WAS_OPENED;
389                 ZERO_STRUCT(sbuf);
390         } else if (CAN_PRINT(smbreq->conn)) {
391                 status = file_new(smbreq, smbreq->conn, &result);
392                 if(!NT_STATUS_IS_OK(status)) {
393                         tevent_req_nterror(req, status);
394                         return tevent_req_post(req, ev);
395                 }
396
397                 status = print_fsp_open(smbreq,
398                                         smbreq->conn,
399                                         in_name,
400                                         smbreq->vuid,
401                                         result,
402                                         &sbuf);
403                 if (!NT_STATUS_IS_OK(status)) {
404                         file_free(smbreq, result);
405                         tevent_req_nterror(req, status);
406                         return tevent_req_post(req, ev);
407                 }
408                 info = FILE_WAS_CREATED;
409         } else {
410                 char *fname;
411                 struct smb_filename *smb_fname = NULL;
412                 struct smb2_create_blob *exta = NULL;
413                 struct ea_list *ea_list = NULL;
414                 struct smb2_create_blob *mxac = NULL;
415                 NTTIME max_access_time = 0;
416                 struct smb2_create_blob *secd = NULL;
417                 struct security_descriptor *sec_desc = NULL;
418                 struct smb2_create_blob *dhnq = NULL;
419                 struct smb2_create_blob *dhnc = NULL;
420                 struct smb2_create_blob *alsi = NULL;
421                 uint64_t allocation_size = 0;
422                 struct smb2_create_blob *twrp = NULL;
423                 struct smb2_create_blob *qfid = NULL;
424
425                 exta = smb2_create_blob_find(&in_context_blobs,
426                                              SMB2_CREATE_TAG_EXTA);
427                 mxac = smb2_create_blob_find(&in_context_blobs,
428                                              SMB2_CREATE_TAG_MXAC);
429                 secd = smb2_create_blob_find(&in_context_blobs,
430                                              SMB2_CREATE_TAG_SECD);
431                 dhnq = smb2_create_blob_find(&in_context_blobs,
432                                              SMB2_CREATE_TAG_DHNQ);
433                 dhnc = smb2_create_blob_find(&in_context_blobs,
434                                              SMB2_CREATE_TAG_DHNC);
435                 alsi = smb2_create_blob_find(&in_context_blobs,
436                                              SMB2_CREATE_TAG_ALSI);
437                 twrp = smb2_create_blob_find(&in_context_blobs,
438                                              SMB2_CREATE_TAG_TWRP);
439                 qfid = smb2_create_blob_find(&in_context_blobs,
440                                              SMB2_CREATE_TAG_QFID);
441
442                 fname = talloc_strdup(state, in_name);
443                 if (tevent_req_nomem(fname, req)) {
444                         return tevent_req_post(req, ev);
445                 }
446
447                 if (exta) {
448                         if (dhnc) {
449                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
450                                 return tevent_req_post(req, ev);
451                         }
452
453                         ea_list = read_nttrans_ea_list(mem_ctx,
454                                 (const char *)exta->data.data, exta->data.length);
455                         if (!ea_list) {
456                                 DEBUG(10,("smbd_smb2_create_send: read_ea_name_list failed.\n"));
457                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
458                                 return tevent_req_post(req, ev);
459                         }
460                 }
461
462                 if (mxac) {
463                         if (dhnc) {
464                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
465                                 return tevent_req_post(req, ev);
466                         }
467
468                         if (mxac->data.length == 0) {
469                                 max_access_time = 0;
470                         } else if (mxac->data.length == 8) {
471                                 max_access_time = BVAL(mxac->data.data, 0);
472                         } else {
473                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
474                                 return tevent_req_post(req, ev);
475                         }
476                 }
477
478                 if (secd) {
479                         enum ndr_err_code ndr_err;
480
481                         if (dhnc) {
482                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
483                                 return tevent_req_post(req, ev);
484                         }
485
486                         sec_desc = talloc_zero(state, struct security_descriptor);
487                         if (tevent_req_nomem(sec_desc, req)) {
488                                 return tevent_req_post(req, ev);
489                         }
490
491                         ndr_err = ndr_pull_struct_blob(&secd->data,
492                                 sec_desc, NULL, sec_desc,
493                                 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
494                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
495                                 DEBUG(2,("ndr_pull_security_descriptor failed: %s\n",
496                                          ndr_errstr(ndr_err)));
497                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
498                                 return tevent_req_post(req, ev);
499                         }
500                 }
501
502                 if (dhnq) {
503                         if (dhnc) {
504                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
505                                 return tevent_req_post(req, ev);
506                         }
507
508                         if (dhnq->data.length != 16) {
509                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
510                                 return tevent_req_post(req, ev);
511                         }
512                         /*
513                          * we don't support durable handles yet
514                          * and have to ignore this
515                          */
516                 }
517
518                 if (dhnc) {
519                         if (dhnc->data.length != 16) {
520                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
521                                 return tevent_req_post(req, ev);
522                         }
523                         /* we don't support durable handles yet */
524                         tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
525                         return tevent_req_post(req, ev);
526                 }
527
528                 if (alsi) {
529                         if (dhnc) {
530                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
531                                 return tevent_req_post(req, ev);
532                         }
533
534                         if (alsi->data.length != 8) {
535                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
536                                 return tevent_req_post(req, ev);
537                         }
538                         allocation_size = BVAL(alsi->data.data, 0);
539                 }
540
541                 if (twrp) {
542                         NTTIME nttime;
543                         time_t t;
544                         struct tm *tm;
545
546                         if (dhnc) {
547                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
548                                 return tevent_req_post(req, ev);
549                         }
550
551                         if (twrp->data.length != 8) {
552                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
553                                 return tevent_req_post(req, ev);
554                         }
555
556                         nttime = BVAL(twrp->data.data, 0);
557                         t = nt_time_to_unix(nttime);
558                         tm = gmtime(&t);
559
560                         TALLOC_FREE(fname);
561                         fname = talloc_asprintf(state,
562                                         "@GMT-%04u.%02u.%02u-%02u.%02u.%02u\\%s",
563                                         tm->tm_year + 1900,
564                                         tm->tm_mon + 1,
565                                         tm->tm_mday,
566                                         tm->tm_hour,
567                                         tm->tm_min,
568                                         tm->tm_sec,
569                                         in_name);
570                         if (tevent_req_nomem(fname, req)) {
571                                 return tevent_req_post(req, ev);
572                         }
573                 }
574
575                 if (qfid) {
576                         if (qfid->data.length != 0) {
577                                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
578                                 return tevent_req_post(req, ev);
579                         }
580                 }
581
582                 /* these are ignored for SMB2 */
583                 in_create_options &= ~(0x10);/* NTCREATEX_OPTIONS_SYNC_ALERT */
584                 in_create_options &= ~(0x20);/* NTCREATEX_OPTIONS_ASYNC_ALERT */
585
586                 /* convert '\\' into '/' */
587                 status = check_path_syntax(fname);
588                 if (!NT_STATUS_IS_OK(status)) {
589                         tevent_req_nterror(req, status);
590                         return tevent_req_post(req, ev);
591                 }
592
593                 status = filename_convert(req,
594                                           smbreq->conn,
595                                           smbreq->flags2 & FLAGS2_DFS_PATHNAMES,
596                                           fname,
597                                           0,
598                                           NULL,
599                                           &smb_fname);
600                 if (!NT_STATUS_IS_OK(status)) {
601                         tevent_req_nterror(req, status);
602                         return tevent_req_post(req, ev);
603                 }
604
605                 status = SMB_VFS_CREATE_FILE(smbreq->conn,
606                                              smbreq,
607                                              0, /* root_dir_fid */
608                                              smb_fname,
609                                              in_desired_access,
610                                              in_share_access,
611                                              in_create_disposition,
612                                              in_create_options,
613                                              in_file_attributes,
614                                              0, /* oplock_request */
615                                              allocation_size,
616                                              sec_desc,
617                                              ea_list,
618                                              &result,
619                                              &info);
620                 if (!NT_STATUS_IS_OK(status)) {
621                         tevent_req_nterror(req, status);
622                         return tevent_req_post(req, ev);
623                 }
624
625                 if (mxac) {
626                         NTTIME last_write_time;
627
628                         unix_timespec_to_nt_time(&last_write_time,
629                                                  result->fsp_name->st.st_ex_mtime);
630                         if (last_write_time != max_access_time) {
631                                 uint8_t p[8];
632                                 uint32_t max_access_granted;
633                                 DATA_BLOB blob = data_blob_const(p, sizeof(p));
634
635                                 status = smbd_check_open_rights(smbreq->conn,
636                                                         result->fsp_name,
637                                                         SEC_FLAG_MAXIMUM_ALLOWED,
638                                                         &max_access_granted);
639
640                                 SIVAL(p, 0, NT_STATUS_V(status));
641                                 SIVAL(p, 4, max_access_granted);
642
643                                 status = smb2_create_blob_add(state,
644                                                         &out_context_blobs,
645                                                         SMB2_CREATE_TAG_MXAC,
646                                                         blob);
647                                 if (!NT_STATUS_IS_OK(status)) {
648                                         tevent_req_nterror(req, status);
649                                         return tevent_req_post(req, ev);
650                                 }
651                         }
652                 }
653
654                 if (qfid) {
655                         uint8_t p[32];
656                         DATA_BLOB blob = data_blob_const(p, sizeof(p));
657
658                         ZERO_STRUCT(p);
659
660                         /* TODO: maybe use result->file_id */
661                         SIVAL(p, 0, result->fsp_name->st.st_ex_ino);/* FileIndexLow */
662                         SIVAL(p, 4, result->fsp_name->st.st_ex_dev);/* FileIndexHigh */
663
664                         status = smb2_create_blob_add(state, &out_context_blobs,
665                                                       SMB2_CREATE_TAG_QFID,
666                                                       blob);
667                         if (!NT_STATUS_IS_OK(status)) {
668                                 tevent_req_nterror(req, status);
669                                 return tevent_req_post(req, ev);
670                         }
671                 }
672
673                 sbuf = result->fsp_name->st;
674         }
675
676         smb2req->compat_chain_fsp = smbreq->chain_fsp;
677
678         state->out_oplock_level = 0;
679         if ((in_create_disposition == FILE_SUPERSEDE)
680             && (info == FILE_WAS_OVERWRITTEN)) {
681                 state->out_create_action = FILE_WAS_SUPERSEDED;
682         } else {
683                 state->out_create_action = info;
684         }
685         unix_timespec_to_nt_time(&state->out_creation_time, sbuf.st_ex_btime);
686         unix_timespec_to_nt_time(&state->out_last_access_time, sbuf.st_ex_atime);
687         unix_timespec_to_nt_time(&state->out_last_write_time,sbuf.st_ex_mtime);
688         unix_timespec_to_nt_time(&state->out_change_time, sbuf.st_ex_ctime);
689         state->out_allocation_size      = sbuf.st_ex_blksize * sbuf.st_ex_blocks;
690         state->out_end_of_file          = sbuf.st_ex_size;
691         state->out_file_attributes      = dos_mode(result->conn,
692                                                    result->fsp_name);
693         if (state->out_file_attributes == 0) {
694                 state->out_file_attributes = FILE_ATTRIBUTE_NORMAL;
695         }
696         state->out_file_id_volatile = result->fnum;
697         state->out_context_blobs = out_context_blobs;
698
699         tevent_req_done(req);
700         return tevent_req_post(req, ev);
701 }
702
703 static NTSTATUS smbd_smb2_create_recv(struct tevent_req *req,
704                         TALLOC_CTX *mem_ctx,
705                         uint8_t *out_oplock_level,
706                         uint32_t *out_create_action,
707                         NTTIME *out_creation_time,
708                         NTTIME *out_last_access_time,
709                         NTTIME *out_last_write_time,
710                         NTTIME *out_change_time,
711                         uint64_t *out_allocation_size,
712                         uint64_t *out_end_of_file,
713                         uint32_t *out_file_attributes,
714                         uint64_t *out_file_id_volatile,
715                         struct smb2_create_blobs *out_context_blobs)
716 {
717         NTSTATUS status;
718         struct smbd_smb2_create_state *state = tevent_req_data(req,
719                                                struct smbd_smb2_create_state);
720
721         if (tevent_req_is_nterror(req, &status)) {
722                 tevent_req_received(req);
723                 return status;
724         }
725
726         *out_oplock_level       = state->out_oplock_level;
727         *out_create_action      = state->out_create_action;
728         *out_creation_time      = state->out_creation_time;
729         *out_last_access_time   = state->out_last_access_time;
730         *out_last_write_time    = state->out_last_write_time;
731         *out_change_time        = state->out_change_time;
732         *out_allocation_size    = state->out_allocation_size;
733         *out_end_of_file        = state->out_end_of_file;
734         *out_file_attributes    = state->out_file_attributes;
735         *out_file_id_volatile   = state->out_file_id_volatile;
736         *out_context_blobs      = state->out_context_blobs;
737
738         talloc_steal(mem_ctx, state->out_context_blobs.blobs);
739
740         tevent_req_received(req);
741         return NT_STATUS_OK;
742 }