s4-pvfs: change the handling of access checking on create
[ira/wip.git] / source4 / ntvfs / posix / pvfs_open.c
index a01352f60cff54cf5064e5d9d850d85e799b5edf..59bd67b08d65dd482617cb71d975e3effe5e5049 100644 (file)
@@ -23,7 +23,7 @@
 #include "vfs_posix.h"
 #include "system/dir.h"
 #include "system/time.h"
-#include "lib/util/dlinklist.h"
+#include "../lib/util/dlinklist.h"
 #include "messaging/messaging.h"
 #include "librpc/gen_ndr/xattr.h"
 
@@ -50,29 +50,10 @@ struct pvfs_file *pvfs_find_fd(struct pvfs_state *pvfs,
 */
 static int pvfs_dir_handle_destructor(struct pvfs_file_handle *h)
 {
-       int open_count;
-       char *path = NULL;
-
-       if (h->name->stream_name == NULL && 
-           pvfs_delete_on_close_set(h->pvfs, h, &open_count, &path) &&
-           open_count == 1) {
-               NTSTATUS status;
-               status = pvfs_xattr_unlink_hook(h->pvfs, path);
-               if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
-                                path, nt_errstr(status)));
-               }
-               if (rmdir(path) != 0) {
-                       DEBUG(0,("pvfs_dir_handle_destructor: failed to rmdir '%s' - %s\n", 
-                                path, strerror(errno)));
-               }
-       }
-
-       talloc_free(path);
-
        if (h->have_opendb_entry) {
                struct odb_lock *lck;
                NTSTATUS status;
+               const char *delete_path = NULL;
 
                lck = odb_lock(h, h->pvfs->odb_context, &h->odb_locking_key);
                if (lck == NULL) {
@@ -80,12 +61,24 @@ static int pvfs_dir_handle_destructor(struct pvfs_file_handle *h)
                        return 0;
                }
 
-               status = odb_close_file(lck, h);
+               status = odb_close_file(lck, h, &delete_path);
                if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(0,("Unable to remove opendb entry for '%s' - %s\n", 
+                       DEBUG(0,("Unable to remove opendb entry for '%s' - %s\n",
                                 h->name->full_name, nt_errstr(status)));
                }
 
+               if (h->name->stream_name == NULL && delete_path) {
+                       status = pvfs_xattr_unlink_hook(h->pvfs, delete_path);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
+                                        delete_path, nt_errstr(status)));
+                       }
+                       if (rmdir(delete_path) != 0) {
+                               DEBUG(0,("pvfs_dir_handle_destructor: failed to rmdir '%s' - %s\n",
+                                        delete_path, strerror(errno)));
+                       }
+               }
+
                talloc_free(lck);
        }
 
@@ -110,7 +103,8 @@ static NTSTATUS pvfs_open_setup_eas_acl(struct pvfs_state *pvfs,
                                        struct ntvfs_request *req,
                                        struct pvfs_filename *name,
                                        int fd, struct pvfs_file *f,
-                                       union smb_open *io)
+                                       union smb_open *io,
+                                       struct security_descriptor *sd)
 {
        NTSTATUS status;
 
@@ -125,7 +119,7 @@ static NTSTATUS pvfs_open_setup_eas_acl(struct pvfs_state *pvfs,
        }
 
        /* setup an initial sec_desc if requested */
-       if (io->ntcreatex.in.sec_desc) {
+       if (sd && (sd->type & SEC_DESC_DACL_PRESENT)) {
                union smb_setfileinfo set;
 /* 
  * TODO: set the full ACL! 
@@ -136,12 +130,9 @@ static NTSTATUS pvfs_open_setup_eas_acl(struct pvfs_state *pvfs,
  */
                set.set_secdesc.in.file.ntvfs = f->ntvfs;
                set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
-               set.set_secdesc.in.sd = io->ntcreatex.in.sec_desc;
+               set.set_secdesc.in.sd = sd;
 
                status = pvfs_acl_set(pvfs, req, name, fd, SEC_STD_WRITE_DAC, &set);
-       } else {
-               /* otherwise setup an inherited acl from the parent */
-               status = pvfs_acl_inherit(pvfs, req, name, fd);
        }
 
        return status;
@@ -151,8 +142,8 @@ static NTSTATUS pvfs_open_setup_eas_acl(struct pvfs_state *pvfs,
   form the lock context used for opendb locking. Note that we must
   zero here to take account of possible padding on some architectures
 */
-static NTSTATUS pvfs_locking_key(struct pvfs_filename *name, 
-                                TALLOC_CTX *mem_ctx, DATA_BLOB *key)
+NTSTATUS pvfs_locking_key(struct pvfs_filename *name,
+                         TALLOC_CTX *mem_ctx, DATA_BLOB *key)
 {
        struct {
                dev_t device;
@@ -189,12 +180,20 @@ static NTSTATUS pvfs_open_directory(struct pvfs_state *pvfs,
        bool del_on_close;
        uint32_t create_options;
        uint32_t share_access;
+       bool forced;
+       struct security_descriptor *sd = NULL;
 
        create_options = io->generic.in.create_options;
        share_access   = io->generic.in.share_access;
 
+       forced = (io->generic.in.create_options & NTCREATEX_OPTIONS_DIRECTORY)?true:false;
+
        if (name->stream_name) {
-               return NT_STATUS_NOT_A_DIRECTORY;
+               if (forced) {
+                       return NT_STATUS_NOT_A_DIRECTORY;
+               } else {
+                       return NT_STATUS_FILE_IS_A_DIRECTORY;
+               }
        }
 
        /* if the client says it must be a directory, and it isn't,
@@ -203,6 +202,13 @@ static NTSTATUS pvfs_open_directory(struct pvfs_state *pvfs,
                return NT_STATUS_NOT_A_DIRECTORY;
        }
 
+       /* found with gentest */
+       if (io->ntcreatex.in.access_mask == SEC_FLAG_MAXIMUM_ALLOWED &&
+           (io->ntcreatex.in.create_options & NTCREATEX_OPTIONS_DIRECTORY) &&
+           (io->ntcreatex.in.create_options & NTCREATEX_OPTIONS_DELETE_ON_CLOSE)) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+       
        switch (io->generic.in.open_disposition) {
        case NTCREATEX_DISP_OPEN_IF:
                break;
@@ -242,11 +248,16 @@ static NTSTATUS pvfs_open_directory(struct pvfs_state *pvfs,
        if (name->exists) {
                /* check the security descriptor */
                status = pvfs_access_check(pvfs, req, name, &access_mask);
-       } else {
-               status = pvfs_access_check_create(pvfs, req, name, &access_mask);
+       } else {                
+               sd = io->ntcreatex.in.sec_desc;
+               status = pvfs_access_check_create(pvfs, req, name, &access_mask, true, &sd);
        }
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
+       NT_STATUS_NOT_OK_RETURN(status);
+
+       if (io->generic.in.query_maximal_access) {
+               status = pvfs_access_maximal_allowed(pvfs, req, name, 
+                                                    &io->generic.out.maximal_access);
+               NT_STATUS_NOT_OK_RETURN(status);
        }
 
        f->ntvfs         = h;
@@ -269,7 +280,7 @@ static NTSTATUS pvfs_open_directory(struct pvfs_state *pvfs,
        f->handle->position          = 0;
        f->handle->mode              = 0;
        f->handle->oplock            = NULL;
-       f->handle->sticky_write_time = false;
+       ZERO_STRUCT(f->handle->write_time);
        f->handle->open_completed    = false;
 
        if ((create_options & NTCREATEX_OPTIONS_DELETE_ON_CLOSE) &&
@@ -297,9 +308,17 @@ static NTSTATUS pvfs_open_directory(struct pvfs_state *pvfs,
                }
                
                /* see if we are allowed to open at the same time as existing opens */
-               status = odb_open_file(lck, f->handle, name->full_name, name->stream_id,
-                                      share_access, access_mask, del_on_close, 
-                                      io->generic.in.open_disposition,
+               status = odb_can_open(lck, name->stream_id,
+                                     share_access, access_mask, del_on_close,
+                                     io->generic.in.open_disposition, false);
+               if (!NT_STATUS_IS_OK(status)) {
+                       talloc_free(lck);
+                       return status;
+               }
+
+               /* now really mark the file as open */
+               status = odb_open_file(lck, f->handle, name->full_name,
+                                      NULL, name->dos.write_time,
                                       false, OPLOCK_NONE, NULL);
 
                if (!NT_STATUS_IS_OK(status)) {
@@ -331,7 +350,7 @@ static NTSTATUS pvfs_open_directory(struct pvfs_state *pvfs,
                        goto cleanup_delete;
                }
 
-               status = pvfs_open_setup_eas_acl(pvfs, req, name, -1, f, io);
+               status = pvfs_open_setup_eas_acl(pvfs, req, name, -1, f, io, sd);
                if (!NT_STATUS_IS_OK(status)) {
                        goto cleanup_delete;
                }
@@ -351,9 +370,16 @@ static NTSTATUS pvfs_open_directory(struct pvfs_state *pvfs,
                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
                }
 
-               status = odb_open_file(lck, f->handle, name->full_name, name->stream_id,
-                                      share_access, access_mask, del_on_close, 
-                                      io->generic.in.open_disposition,
+               status = odb_can_open(lck, name->stream_id,
+                                     share_access, access_mask, del_on_close,
+                                     io->generic.in.open_disposition, false);
+
+               if (!NT_STATUS_IS_OK(status)) {
+                       goto cleanup_delete;
+               }
+
+               status = odb_open_file(lck, f->handle, name->full_name,
+                                      NULL, name->dos.write_time,
                                       false, OPLOCK_NONE, NULL);
 
                if (!NT_STATUS_IS_OK(status)) {
@@ -410,19 +436,9 @@ cleanup_delete:
 */
 static int pvfs_handle_destructor(struct pvfs_file_handle *h)
 {
-       int open_count;
-       char *path = NULL;
+       talloc_free(h->write_time.update_event);
+       h->write_time.update_event = NULL;
 
-       /* the write time is no longer sticky */
-       if (h->sticky_write_time) {
-               NTSTATUS status;
-               status = pvfs_dosattrib_load(h->pvfs, h->name, h->fd);
-               if (NT_STATUS_IS_OK(status)) {
-                       h->name->dos.flags &= ~XATTR_ATTRIB_FLAG_STICKY_WRITE_TIME;
-                       pvfs_dosattrib_save(h->pvfs, h->name, h->fd);
-               }
-       }
-       
        if ((h->create_options & NTCREATEX_OPTIONS_DELETE_ON_CLOSE) &&
            h->name->stream_name) {
                NTSTATUS status;
@@ -441,32 +457,18 @@ static int pvfs_handle_destructor(struct pvfs_file_handle *h)
                h->fd = -1;
        }
 
-       if (h->name->stream_name == NULL && 
-           h->open_completed &&
-           pvfs_delete_on_close_set(h->pvfs, h, &open_count, &path) &&
-           open_count == 1) {
-               NTSTATUS status;
-               status = pvfs_xattr_unlink_hook(h->pvfs, path);
-               if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
-                                path, nt_errstr(status)));
-               }
-               if (unlink(path) != 0) {
-                       DEBUG(0,("pvfs_close: failed to delete '%s' - %s\n", 
-                                path, strerror(errno)));
-               } else {
-                       notify_trigger(h->pvfs->notify_context, 
-                                      NOTIFY_ACTION_REMOVED, 
-                                      FILE_NOTIFY_CHANGE_FILE_NAME,
-                                      path);
-               }
+       if (!h->write_time.update_forced &&
+           h->write_time.update_on_close &&
+           h->write_time.close_time == 0) {
+               struct timeval tv;
+               tv = timeval_current();
+               h->write_time.close_time = timeval_to_nttime(&tv);
        }
 
-       talloc_free(path);
-
        if (h->have_opendb_entry) {
                struct odb_lock *lck;
                NTSTATUS status;
+               const char *delete_path = NULL;
 
                lck = odb_lock(h, h->pvfs->odb_context, &h->odb_locking_key);
                if (lck == NULL) {
@@ -474,15 +476,68 @@ static int pvfs_handle_destructor(struct pvfs_file_handle *h)
                        return 0;
                }
 
-               status = odb_close_file(lck, h);
+               if (h->write_time.update_forced) {
+                       status = odb_get_file_infos(h->pvfs->odb_context,
+                                                   &h->odb_locking_key,
+                                                   NULL,
+                                                   &h->write_time.close_time);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               DEBUG(0,("Unable get write time for '%s' - %s\n",
+                                        h->name->full_name, nt_errstr(status)));
+                       }
+
+                       h->write_time.update_forced = false;
+                       h->write_time.update_on_close = true;
+               } else if (h->write_time.update_on_close) {
+                       status = odb_set_write_time(lck, h->write_time.close_time, true);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               DEBUG(0,("Unable set write time for '%s' - %s\n",
+                                        h->name->full_name, nt_errstr(status)));
+                       }
+               }
+
+               status = odb_close_file(lck, h, &delete_path);
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(0,("Unable to remove opendb entry for '%s' - %s\n", 
                                 h->name->full_name, nt_errstr(status)));
                }
 
+               if (h->name->stream_name == NULL &&
+                   h->open_completed && delete_path) {
+                       status = pvfs_xattr_unlink_hook(h->pvfs, delete_path);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
+                                        delete_path, nt_errstr(status)));
+                       }
+                       if (unlink(delete_path) != 0) {
+                               DEBUG(0,("pvfs_close: failed to delete '%s' - %s\n",
+                                        delete_path, strerror(errno)));
+                       } else {
+                               notify_trigger(h->pvfs->notify_context,
+                                              NOTIFY_ACTION_REMOVED,
+                                              FILE_NOTIFY_CHANGE_FILE_NAME,
+                                              delete_path);
+                       }
+                       h->write_time.update_on_close = false;
+               }
+
                talloc_free(lck);
        }
 
+       if (h->write_time.update_on_close) {
+               struct timeval tv[2];
+
+               nttime_to_timeval(&tv[0], h->name->dos.access_time);
+               nttime_to_timeval(&tv[1], h->write_time.close_time);
+
+               if (!timeval_is_zero(&tv[0]) || !timeval_is_zero(&tv[1])) {
+                       if (utimes(h->name->full_name, tv) == -1) {
+                               DEBUG(3,("pvfs_handle_destructor: utimes() failed '%s' - %s\n",
+                                        h->name->full_name, strerror(errno)));
+                       }
+               }
+       }
+
        return 0;
 }
 
@@ -558,13 +613,24 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
        bool del_on_close;
        struct pvfs_filename *parent;
        uint32_t oplock_level = OPLOCK_NONE, oplock_granted;
+       bool allow_level_II_oplock = false;
+       struct security_descriptor *sd = NULL;
+
+       if (io->ntcreatex.in.file_attr & ~FILE_ATTRIBUTE_ALL_MASK) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
 
+       if (io->ntcreatex.in.file_attr & FILE_ATTRIBUTE_ENCRYPTED) {
+               return NT_STATUS_ACCESS_DENIED;
+       }
+           
        if ((io->ntcreatex.in.file_attr & FILE_ATTRIBUTE_READONLY) &&
            (create_options & NTCREATEX_OPTIONS_DELETE_ON_CLOSE)) {
                return NT_STATUS_CANNOT_DELETE;
        }
-       
-       status = pvfs_access_check_create(pvfs, req, name, &access_mask);
+
+       sd = io->ntcreatex.in.sec_desc;
+       status = pvfs_access_check_create(pvfs, req, name, &access_mask, false, &sd);
        NT_STATUS_NOT_OK_RETURN(status);
 
        /* check that the parent isn't opened with delete on close set */
@@ -573,8 +639,8 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
                DATA_BLOB locking_key;
                status = pvfs_locking_key(parent, req, &locking_key);
                NT_STATUS_NOT_OK_RETURN(status);
-               status = odb_get_delete_on_close(pvfs->odb_context, &locking_key, 
-                                                &del_on_close, NULL, NULL);
+               status = odb_get_file_infos(pvfs->odb_context, &locking_key,
+                                           &del_on_close, NULL);
                NT_STATUS_NOT_OK_RETURN(status);
                if (del_on_close) {
                        return NT_STATUS_DELETE_PENDING;
@@ -600,7 +666,7 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
        mode = pvfs_fileperms(pvfs, attrib);
 
        /* create the file */
-       fd = open(name->full_name, flags | O_CREAT | O_EXCL, mode);
+       fd = open(name->full_name, flags | O_CREAT | O_EXCL| O_NONBLOCK, mode);
        if (fd == -1) {
                return pvfs_map_errno(pvfs, errno);
        }
@@ -617,12 +683,14 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
        }
 
        /* re-resolve the open fd */
-       status = pvfs_resolve_name_fd(pvfs, fd, name);
+       status = pvfs_resolve_name_fd(pvfs, fd, name, 0);
        if (!NT_STATUS_IS_OK(status)) {
                close(fd);
                return status;
        }
 
+       /* support initial alloc sizes */
+       name->dos.alloc_size = io->ntcreatex.in.alloc_size;
        name->dos.attrib = attrib;
        status = pvfs_dosattrib_save(pvfs, name, fd);
        if (!NT_STATUS_IS_OK(status)) {
@@ -630,11 +698,17 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
        }
 
 
-       status = pvfs_open_setup_eas_acl(pvfs, req, name, fd, f, io);
+       status = pvfs_open_setup_eas_acl(pvfs, req, name, fd, f, io, sd);
        if (!NT_STATUS_IS_OK(status)) {
                goto cleanup_delete;
        }
 
+       if (io->generic.in.query_maximal_access) {
+               status = pvfs_access_maximal_allowed(pvfs, req, name, 
+                                                    &io->generic.out.maximal_access);
+               NT_STATUS_NOT_OK_RETURN(status);
+       }
+
        /* form the lock context used for byte range locking and
           opendb locking */
        status = pvfs_locking_key(name, f->handle, &f->handle->odb_locking_key);
@@ -672,20 +746,22 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
                oplock_level = OPLOCK_EXCLUSIVE;
        }
 
-       status = odb_open_file(lck, f->handle, name->full_name, name->stream_id,
-                              share_access, access_mask, del_on_close, 
-                              io->generic.in.open_disposition,
-                              false, oplock_level, &oplock_granted);
-       talloc_free(lck);
+       if (req->client_caps & NTVFS_CLIENT_CAP_LEVEL_II_OPLOCKS) {
+               allow_level_II_oplock = true;
+       }
+
+       status = odb_can_open(lck, name->stream_id,
+                             share_access, access_mask, del_on_close,
+                             io->generic.in.open_disposition, false);
        if (!NT_STATUS_IS_OK(status)) {
+               talloc_free(lck);
                /* bad news, we must have hit a race - we don't delete the file
-                  here as the most likely scenario is that someone else created 
+                  here as the most likely scenario is that someone else created
                   the file at the same time */
                close(fd);
                return status;
        }
 
-
        f->ntvfs             = h;
        f->pvfs              = pvfs;
        f->pending_list      = NULL;
@@ -705,26 +781,38 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
        f->handle->mode              = 0;
        f->handle->oplock            = NULL;
        f->handle->have_opendb_entry = true;
-       f->handle->sticky_write_time = false;
+       ZERO_STRUCT(f->handle->write_time);
        f->handle->open_completed    = false;
 
+       status = odb_open_file(lck, f->handle, name->full_name,
+                              &f->handle->fd, name->dos.write_time,
+                              allow_level_II_oplock,
+                              oplock_level, &oplock_granted);
+       talloc_free(lck);
+       if (!NT_STATUS_IS_OK(status)) {
+               /* bad news, we must have hit a race - we don't delete the file
+                  here as the most likely scenario is that someone else created
+                  the file at the same time */
+               close(fd);
+               return status;
+       }
+
        DLIST_ADD(pvfs->files.list, f);
 
+       /* setup a destructor to avoid file descriptor leaks on
+          abnormal termination */
+       talloc_set_destructor(f, pvfs_fnum_destructor);
+       talloc_set_destructor(f->handle, pvfs_handle_destructor);
+
        if (pvfs->flags & PVFS_FLAG_FAKE_OPLOCKS) {
                oplock_granted = OPLOCK_BATCH;
        } else if (oplock_granted != OPLOCK_NONE) {
                status = pvfs_setup_oplock(f, oplock_granted);
                if (!NT_STATUS_IS_OK(status)) {
-                       talloc_free(lck);
                        return status;
                }
        }
 
-       /* setup a destructor to avoid file descriptor leaks on
-          abnormal termination */
-       talloc_set_destructor(f, pvfs_fnum_destructor);
-       talloc_set_destructor(f->handle, pvfs_handle_destructor);
-
        io->generic.out.oplock_level  = oplock_granted;
        io->generic.out.file.ntvfs    = f->ntvfs;
        io->generic.out.create_action = NTCREATEX_ACTION_CREATED;
@@ -780,7 +868,8 @@ struct pvfs_odb_retry {
 /* destroy a pending request */
 static int pvfs_odb_retry_destructor(struct pvfs_odb_retry *r)
 {
-       struct pvfs_state *pvfs = r->ntvfs->private_data;
+       struct pvfs_state *pvfs = talloc_get_type(r->ntvfs->private_data,
+                                 struct pvfs_state);
        if (r->odb_locking_key.data) {
                struct odb_lock *lck;
                lck = odb_lock(r->req, pvfs->odb_context, &r->odb_locking_key);
@@ -810,7 +899,7 @@ static void pvfs_odb_retry_callback(void *_r, enum pvfs_wait_notice reason)
 
 /*
   setup for a retry of a request that was rejected
-  by odb_open_file() or odb_can_open()
+  by odb_can_open()
 */
 NTSTATUS pvfs_odb_retry_setup(struct ntvfs_module_context *ntvfs,
                              struct ntvfs_request *req,
@@ -825,7 +914,8 @@ NTSTATUS pvfs_odb_retry_setup(struct ntvfs_module_context *ntvfs,
                                               void *private_data,
                                               enum pvfs_wait_notice reason))
 {
-       struct pvfs_state *pvfs = ntvfs->private_data;
+       struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+                                 struct pvfs_state);
        struct pvfs_odb_retry *r;
        struct pvfs_wait *wait_handle;
        NTSTATUS status;
@@ -845,7 +935,13 @@ NTSTATUS pvfs_odb_retry_setup(struct ntvfs_module_context *ntvfs,
 
        /* setup a pending lock */
        status = odb_open_file_pending(lck, r);
-       if (!NT_STATUS_IS_OK(status)) {
+       if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_NOT_FOUND,status)) {
+               /*
+                * maybe only a unix application
+                * has the file open
+                */
+               data_blob_free(&r->odb_locking_key);
+       } else if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
 
@@ -862,8 +958,6 @@ NTSTATUS pvfs_odb_retry_setup(struct ntvfs_module_context *ntvfs,
 
        talloc_steal(r, wait_handle);
 
-       talloc_steal(pvfs, r);
-
        return NT_STATUS_OK;
 }
 
@@ -878,8 +972,14 @@ static void pvfs_retry_open_sharing(struct pvfs_odb_retry *r,
                                    enum pvfs_wait_notice reason)
 {
        union smb_open *io = talloc_get_type(_io, union smb_open);
+       struct timeval *final_timeout = NULL;
        NTSTATUS status;
 
+       if (private_data) {
+               final_timeout = talloc_get_type(private_data,
+                                               struct timeval);
+       }
+
        /* w2k3 ignores SMBntcancel for outstanding open requests. It's probably
           just a bug in their server, but we better do the same */
        if (reason == PVFS_WAIT_CANCEL) {
@@ -887,6 +987,16 @@ static void pvfs_retry_open_sharing(struct pvfs_odb_retry *r,
        }
 
        if (reason == PVFS_WAIT_TIMEOUT) {
+               if (final_timeout &&
+                   !timeval_expired(final_timeout)) {
+                       /*
+                        * we need to retry periodictly
+                        * after an EAGAIN as there's
+                        * no way the kernel tell us
+                        * an oplock is released.
+                        */
+                       goto retry;
+               }
                /* if it timed out, then give the failure
                   immediately */
                talloc_free(r);
@@ -895,6 +1005,7 @@ static void pvfs_retry_open_sharing(struct pvfs_odb_retry *r,
                return;
        }
 
+retry:
        talloc_free(r);
 
        /* try the open again, which could trigger another retry setup
@@ -930,7 +1041,8 @@ static NTSTATUS pvfs_open_deny_dos(struct ntvfs_module_context *ntvfs,
                                   struct ntvfs_request *req, union smb_open *io,
                                   struct pvfs_file *f, struct odb_lock *lck)
 {
-       struct pvfs_state *pvfs = ntvfs->private_data;
+       struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+                                 struct pvfs_state);
        struct pvfs_file *f2;
        struct pvfs_filename *name;
        NTSTATUS status;
@@ -1011,9 +1123,11 @@ static NTSTATUS pvfs_open_setup_retry(struct ntvfs_module_context *ntvfs,
                                      struct odb_lock *lck,
                                      NTSTATUS parent_status)
 {
-       struct pvfs_state *pvfs = ntvfs->private_data;
+       struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+                                 struct pvfs_state);
        NTSTATUS status;
        struct timeval end_time;
+       struct timeval *final_timeout = NULL;
 
        if (io->generic.in.create_options & 
            (NTCREATEX_OPTIONS_PRIVATE_DENY_DOS | NTCREATEX_OPTIONS_PRIVATE_DENY_FCB)) {
@@ -1034,12 +1148,28 @@ static NTSTATUS pvfs_open_setup_retry(struct ntvfs_module_context *ntvfs,
        } else if (NT_STATUS_EQUAL(parent_status, NT_STATUS_OPLOCK_NOT_GRANTED)) {
                end_time = timeval_add(&req->statistics.request_time,
                                       pvfs->oplock_break_timeout, 0);
+       } else if (NT_STATUS_EQUAL(parent_status, STATUS_MORE_ENTRIES)) {
+               /*
+                * we got EAGAIN which means a unix application
+                * has an oplock or share mode
+                *
+                * we retry every 4/5 of the sharing violation delay
+                * to see if the unix application
+                * has released the oplock or share mode.
+                */
+               final_timeout = talloc(req, struct timeval);
+               NT_STATUS_HAVE_NO_MEMORY(final_timeout);
+               *final_timeout = timeval_add(&req->statistics.request_time,
+                                            pvfs->oplock_break_timeout,
+                                            0);
+               end_time = timeval_current_ofs(0, (pvfs->sharing_violation_delay*4)/5);
+               end_time = timeval_min(final_timeout, &end_time);
        } else {
                return NT_STATUS_INTERNAL_ERROR;
        }
 
-       return pvfs_odb_retry_setup(ntvfs, req, lck, end_time, io, NULL,
-                                   pvfs_retry_open_sharing);
+       return pvfs_odb_retry_setup(ntvfs, req, lck, end_time, io,
+                                   final_timeout, pvfs_retry_open_sharing);
 }
 
 /*
@@ -1048,8 +1178,9 @@ static NTSTATUS pvfs_open_setup_retry(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
                   struct ntvfs_request *req, union smb_open *io)
 {
-       struct pvfs_state *pvfs = ntvfs->private_data;
-       int flags;
+       struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+                                 struct pvfs_state);
+       int flags = 0;
        struct pvfs_filename *name;
        struct pvfs_file *f;
        struct ntvfs_handle *h;
@@ -1057,11 +1188,14 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
        int fd;
        struct odb_lock *lck;
        uint32_t create_options;
+       uint32_t create_options_must_ignore_mask;
        uint32_t share_access;
        uint32_t access_mask;
+       uint32_t create_action = NTCREATEX_ACTION_EXISTED;
        bool del_on_close;
        bool stream_existed, stream_truncate=false;
        uint32_t oplock_level = OPLOCK_NONE, oplock_granted;
+       bool allow_level_II_oplock = false;
 
        /* use the generic mapping code to avoid implementing all the
           different open calls. */
@@ -1070,6 +1204,102 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
                return ntvfs_map_open(ntvfs, req, io);
        }
 
+       ZERO_STRUCT(io->generic.out);
+
+       create_options = io->generic.in.create_options;
+       share_access   = io->generic.in.share_access;
+       access_mask    = io->generic.in.access_mask;
+
+       if (share_access & ~NTCREATEX_SHARE_ACCESS_MASK) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       /*
+        * These options are ignored,
+        * but we reuse some of them as private values for the generic mapping
+        */
+       create_options_must_ignore_mask = NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
+       create_options_must_ignore_mask &= ~NTCREATEX_OPTIONS_PRIVATE_MASK;
+       create_options &= ~create_options_must_ignore_mask;
+
+       if (create_options & NTCREATEX_OPTIONS_NOT_SUPPORTED_MASK) {
+               DEBUG(2,(__location__ " create_options 0x%x not supported\n", 
+                        create_options));
+               return NT_STATUS_NOT_SUPPORTED;
+       }
+
+       if (create_options & NTCREATEX_OPTIONS_INVALID_PARAM_MASK) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       /* TODO: When we implement HSM, add a hook here not to pull
+        * the actual file off tape, when this option is passed from
+        * the client */
+       if (create_options & NTCREATEX_OPTIONS_NO_RECALL) {
+               /* no-op */
+       }
+
+       /* TODO: If (unlikely) Linux does a good compressed
+        * filesystem, we might need an ioctl call for this */
+       if (create_options & NTCREATEX_OPTIONS_NO_COMPRESSION) {
+               /* no-op */
+       }
+
+       if (create_options & NTCREATEX_OPTIONS_NO_INTERMEDIATE_BUFFERING) {
+               create_options |= NTCREATEX_OPTIONS_WRITE_THROUGH;
+       }
+
+       /* Open the file with sync, if they asked for it, but
+          'strict sync = no' turns this client request into a no-op */
+       if (create_options & (NTCREATEX_OPTIONS_WRITE_THROUGH) && !(pvfs->flags | PVFS_FLAG_STRICT_SYNC)) {
+               flags |= O_SYNC;
+       }
+
+
+       /* other create options are not allowed */
+       if ((create_options & NTCREATEX_OPTIONS_DELETE_ON_CLOSE) &&
+           !(access_mask & SEC_STD_DELETE)) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       if (access_mask & SEC_MASK_INVALID) {
+               return NT_STATUS_ACCESS_DENIED;
+       }
+
+       /* what does this bit really mean?? */
+       if (req->ctx->protocol == PROTOCOL_SMB2 &&
+           access_mask == SEC_STD_SYNCHRONIZE) {
+               return NT_STATUS_ACCESS_DENIED;
+       }
+
+       /* cope with non-zero root_fid */
+       if (io->ntcreatex.in.root_fid.ntvfs != NULL) {
+               f = pvfs_find_fd(pvfs, req, io->ntcreatex.in.root_fid.ntvfs);
+               if (f == NULL) {
+                       return NT_STATUS_INVALID_HANDLE;
+               }
+               if (f->handle->fd != -1) {
+                       return NT_STATUS_INVALID_DEVICE_REQUEST;
+               }
+               io->ntcreatex.in.fname = talloc_asprintf(req, "%s\\%s", 
+                                                        f->handle->name->original_name,
+                                                        io->ntcreatex.in.fname);
+               NT_STATUS_HAVE_NO_MEMORY(io->ntcreatex.in.fname);                       
+       }
+
+       if (io->ntcreatex.in.file_attr & (FILE_ATTRIBUTE_DEVICE|
+                                         FILE_ATTRIBUTE_VOLUME| 
+                                         (~FILE_ATTRIBUTE_ALL_MASK))) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       /* we ignore some file_attr bits */
+       io->ntcreatex.in.file_attr &= ~(FILE_ATTRIBUTE_NONINDEXED | 
+                                       FILE_ATTRIBUTE_COMPRESSED |
+                                       FILE_ATTRIBUTE_REPARSE_POINT |
+                                       FILE_ATTRIBUTE_SPARSE |
+                                       FILE_ATTRIBUTE_NORMAL);
+
        /* resolve the cifs name to a posix name */
        status = pvfs_resolve_name(pvfs, req, io->ntcreatex.in.fname, 
                                   PVFS_RESOLVE_STREAMS, &name);
@@ -1077,6 +1307,20 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
                return status;
        }
 
+       /* if the client specified that it must not be a directory then
+          check that it isn't */
+       if (name->exists && (name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY) &&
+           (io->generic.in.create_options & NTCREATEX_OPTIONS_NON_DIRECTORY_FILE)) {
+               return NT_STATUS_FILE_IS_A_DIRECTORY;
+       }
+
+       /* if the client specified that it must be a directory then
+          check that it is */
+       if (name->exists && !(name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY) &&
+           (io->generic.in.create_options & NTCREATEX_OPTIONS_DIRECTORY)) {
+               return NT_STATUS_NOT_A_DIRECTORY;
+       }
+
        /* directory opens are handled separately */
        if ((name->exists && (name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY)) ||
            (io->generic.in.create_options & NTCREATEX_OPTIONS_DIRECTORY)) {
@@ -1087,18 +1331,6 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
           open doesn't match */
        io->generic.in.file_attr &= ~FILE_ATTRIBUTE_DIRECTORY;
 
-       create_options = io->generic.in.create_options;
-       share_access   = io->generic.in.share_access;
-       access_mask    = io->generic.in.access_mask;
-
-       /* certain create options are not allowed */
-       if ((create_options & NTCREATEX_OPTIONS_DELETE_ON_CLOSE) &&
-           !(access_mask & SEC_STD_DELETE)) {
-               return NT_STATUS_INVALID_PARAMETER;
-       }
-
-       flags = 0;
-
        switch (io->generic.in.open_disposition) {
        case NTCREATEX_DISP_SUPERSEDE:
        case NTCREATEX_DISP_OVERWRITE_IF:
@@ -1107,6 +1339,7 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
                } else {
                        stream_truncate = true;
                }
+               create_action = NTCREATEX_ACTION_TRUNCATED;
                break;
 
        case NTCREATEX_DISP_OPEN:
@@ -1125,6 +1358,7 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
                } else {
                        stream_truncate = true;
                }
+               create_action = NTCREATEX_ACTION_TRUNCATED;
                break;
 
        case NTCREATEX_DISP_CREATE:
@@ -1169,8 +1403,12 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
 
        /* check the security descriptor */
        status = pvfs_access_check(pvfs, req, name, &access_mask);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
+       NT_STATUS_NOT_OK_RETURN(status);
+
+       if (io->generic.in.query_maximal_access) {
+               status = pvfs_access_maximal_allowed(pvfs, req, name, 
+                                                    &io->generic.out.maximal_access);
+               NT_STATUS_NOT_OK_RETURN(status);
        }
 
        status = ntvfs_handle_new(pvfs->ntvfs, req, &h);
@@ -1205,7 +1443,7 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
        f->handle->mode              = 0;
        f->handle->oplock            = NULL;
        f->handle->have_opendb_entry = false;
-       f->handle->sticky_write_time = false;
+       ZERO_STRUCT(f->handle->write_time);
        f->handle->open_completed    = false;
 
        /* form the lock context used for byte range locking and
@@ -1256,11 +1494,14 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
                oplock_level = OPLOCK_EXCLUSIVE;
        }
 
+       if (req->client_caps & NTVFS_CLIENT_CAP_LEVEL_II_OPLOCKS) {
+               allow_level_II_oplock = true;
+       }
+
        /* see if we are allowed to open at the same time as existing opens */
-       status = odb_open_file(lck, f->handle, name->full_name, name->stream_id,
-                              share_access, access_mask, del_on_close,
-                              io->generic.in.open_disposition,
-                              false, oplock_level, &oplock_granted);
+       status = odb_can_open(lck, name->stream_id,
+                             share_access, access_mask, del_on_close,
+                             io->generic.in.open_disposition, false);
 
        /*
         * on a sharing violation we need to retry when the file is closed by
@@ -1279,18 +1520,6 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
                return status;
        }
 
-       if (pvfs->flags & PVFS_FLAG_FAKE_OPLOCKS) {
-               oplock_granted = OPLOCK_BATCH;
-       } else if (oplock_granted != OPLOCK_NONE) {
-               status = pvfs_setup_oplock(f, oplock_granted);
-               if (!NT_STATUS_IS_OK(status)) {
-                       talloc_free(lck);
-                       return status;
-               }
-       }
-
-       f->handle->have_opendb_entry = true;
-
        if (access_mask & (SEC_FILE_WRITE_DATA | SEC_FILE_APPEND_DATA)) {
                flags |= O_RDWR;
        } else {
@@ -1298,14 +1527,49 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
        }
 
        /* do the actual open */
-       fd = open(f->handle->name->full_name, flags);
+       fd = open(f->handle->name->full_name, flags | O_NONBLOCK);
        if (fd == -1) {
+               status = pvfs_map_errno(f->pvfs, errno);
+
+               DEBUG(0,(__location__ " mapped errno %s for %s (was %d)\n", 
+                        nt_errstr(status), f->handle->name->full_name, errno));
+               /*
+                * STATUS_MORE_ENTRIES is EAGAIN or EWOULDBLOCK
+                */
+               if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
+                   (req->async_states->state & NTVFS_ASYNC_STATE_MAY_ASYNC)) {
+                       return pvfs_open_setup_retry(ntvfs, req, io, f, lck, status);
+               }
+
                talloc_free(lck);
-               return pvfs_map_errno(f->pvfs, errno);
+               return status;
        }
 
        f->handle->fd = fd;
 
+       /* now really mark the file as open */
+       status = odb_open_file(lck, f->handle, name->full_name,
+                              &f->handle->fd, name->dos.write_time,
+                              allow_level_II_oplock,
+                              oplock_level, &oplock_granted);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               talloc_free(lck);
+               return status;
+       }
+
+       f->handle->have_opendb_entry = true;
+
+       if (pvfs->flags & PVFS_FLAG_FAKE_OPLOCKS) {
+               oplock_granted = OPLOCK_BATCH;
+       } else if (oplock_granted != OPLOCK_NONE) {
+               status = pvfs_setup_oplock(f, oplock_granted);
+               if (!NT_STATUS_IS_OK(status)) {
+                       talloc_free(lck);
+                       return status;
+               }
+       }
+
        stream_existed = name->stream_exists;
 
        /* if this was a stream create then create the stream as well */
@@ -1325,7 +1589,7 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
        }
 
        /* re-resolve the open fd */
-       status = pvfs_resolve_name_fd(f->pvfs, fd, f->handle->name);
+       status = pvfs_resolve_name_fd(f->pvfs, fd, f->handle->name, PVFS_RESOLVE_NO_OPENDB);
        if (!NT_STATUS_IS_OK(status)) {
                talloc_free(lck);
                return status;
@@ -1334,13 +1598,16 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
        if (f->handle->name->stream_id == 0 &&
            (io->generic.in.open_disposition == NTCREATEX_DISP_OVERWRITE ||
             io->generic.in.open_disposition == NTCREATEX_DISP_OVERWRITE_IF)) {
-               /* for overwrite we need to replace file permissions */
+               /* for overwrite we may need to replace file permissions */
                uint32_t attrib = io->ntcreatex.in.file_attr | FILE_ATTRIBUTE_ARCHIVE;
                mode_t mode = pvfs_fileperms(pvfs, attrib);
-               if (fchmod(fd, mode) == -1) {
+               if (f->handle->name->st.st_mode != mode &&
+                   f->handle->name->dos.attrib != attrib &&
+                   fchmod(fd, mode) == -1) {
                        talloc_free(lck);
                        return pvfs_map_errno(pvfs, errno);
                }
+               name->dos.alloc_size = io->ntcreatex.in.alloc_size;
                name->dos.attrib = attrib;
                status = pvfs_dosattrib_save(pvfs, name, fd);
                if (!NT_STATUS_IS_OK(status)) {
@@ -1361,7 +1628,8 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
        io->generic.out.oplock_level  = oplock_granted;
        io->generic.out.file.ntvfs    = h;
        io->generic.out.create_action = stream_existed?
-               NTCREATEX_ACTION_EXISTED:NTCREATEX_ACTION_CREATED;
+               create_action:NTCREATEX_ACTION_CREATED;
+       
        io->generic.out.create_time   = name->dos.create_time;
        io->generic.out.access_time   = name->dos.access_time;
        io->generic.out.write_time    = name->dos.write_time;
@@ -1383,31 +1651,50 @@ NTSTATUS pvfs_open(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_close(struct ntvfs_module_context *ntvfs,
                    struct ntvfs_request *req, union smb_close *io)
 {
-       struct pvfs_state *pvfs = ntvfs->private_data;
+       struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+                                 struct pvfs_state);
        struct pvfs_file *f;
-       struct utimbuf unix_times;
 
        if (io->generic.level == RAW_CLOSE_SPLCLOSE) {
                return NT_STATUS_DOS(ERRSRV, ERRerror);
        }
 
-       if (io->generic.level != RAW_CLOSE_CLOSE) {
+       if (io->generic.level != RAW_CLOSE_GENERIC) {
                return ntvfs_map_close(ntvfs, req, io);
        }
 
-       f = pvfs_find_fd(pvfs, req, io->close.in.file.ntvfs);
+       f = pvfs_find_fd(pvfs, req, io->generic.in.file.ntvfs);
        if (!f) {
                return NT_STATUS_INVALID_HANDLE;
        }
 
-       if (!null_time(io->close.in.write_time)) {
-               unix_times.actime = 0;
-               unix_times.modtime = io->close.in.write_time;
-               utime(f->handle->name->full_name, &unix_times);
-       } else if (f->handle->sticky_write_time) {
-               unix_times.actime = 0;
-               unix_times.modtime = nt_time_to_unix(f->handle->name->dos.write_time);
-               utime(f->handle->name->full_name, &unix_times);
+       if (!null_time(io->generic.in.write_time)) {
+               f->handle->write_time.update_forced = false;
+               f->handle->write_time.update_on_close = true;
+               unix_to_nt_time(&f->handle->write_time.close_time, io->generic.in.write_time);
+       }
+
+       if (io->generic.in.flags & SMB2_CLOSE_FLAGS_FULL_INFORMATION) {
+               struct pvfs_filename *name;
+               NTSTATUS status;
+               struct pvfs_file_handle *h = f->handle;
+
+               status = pvfs_resolve_name_handle(pvfs, h);
+               if (!NT_STATUS_IS_OK(status)) {
+                       return status;
+               }
+               name = h->name;
+
+               io->generic.out.flags = SMB2_CLOSE_FLAGS_FULL_INFORMATION;
+               io->generic.out.create_time = name->dos.create_time;
+               io->generic.out.access_time = name->dos.access_time;
+               io->generic.out.write_time  = name->dos.write_time;
+               io->generic.out.change_time = name->dos.change_time;
+               io->generic.out.alloc_size  = name->dos.alloc_size;
+               io->generic.out.size        = name->st.st_size;
+               io->generic.out.file_attr   = name->dos.attrib;         
+       } else {
+               ZERO_STRUCT(io->generic.out);
        }
 
        talloc_free(f);
@@ -1422,7 +1709,8 @@ NTSTATUS pvfs_close(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_logoff(struct ntvfs_module_context *ntvfs,
                     struct ntvfs_request *req)
 {
-       struct pvfs_state *pvfs = ntvfs->private_data;
+       struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+                                 struct pvfs_state);
        struct pvfs_file *f, *next;
 
        for (f=pvfs->files.list;f;f=next) {
@@ -1442,7 +1730,8 @@ NTSTATUS pvfs_logoff(struct ntvfs_module_context *ntvfs,
 NTSTATUS pvfs_exit(struct ntvfs_module_context *ntvfs,
                   struct ntvfs_request *req)
 {
-       struct pvfs_state *pvfs = ntvfs->private_data;
+       struct pvfs_state *pvfs = talloc_get_type(ntvfs->private_data,
+                                 struct pvfs_state);
        struct pvfs_file *f, *next;
 
        for (f=pvfs->files.list;f;f=next) {
@@ -1738,14 +2027,13 @@ NTSTATUS pvfs_can_stat(struct pvfs_state *pvfs,
 /*
   determine if delete on close is set on 
 */
-bool pvfs_delete_on_close_set(struct pvfs_state *pvfs, struct pvfs_file_handle *h, 
-                             int *open_count, char **path)
+bool pvfs_delete_on_close_set(struct pvfs_state *pvfs, struct pvfs_file_handle *h)
 {
        NTSTATUS status;
        bool del_on_close;
 
-       status = odb_get_delete_on_close(pvfs->odb_context, &h->odb_locking_key, 
-                                        &del_on_close, open_count, path);
+       status = odb_get_file_infos(pvfs->odb_context, &h->odb_locking_key, 
+                                   &del_on_close, NULL);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(1,("WARNING: unable to determine delete on close status for open file\n"));
                return false;