source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28
  29 /* look in server.c for some explanation of these variables */
  30 extern enum protocol_types Protocol;
  31 extern int max_recv;
  32 extern uint32 global_client_caps;
  33
  34 extern bool global_encrypted_passwords_negotiated;
  35
  36 /****************************************************************************
  37  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  38  path or anything including wildcards.
  39  We're assuming here that '/' is not the second byte in any multibyte char
  40  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  41  set.
  42 ****************************************************************************/
  43
  44 /* Custom version for processing POSIX paths. */
  45 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  46
  47 static NTSTATUS check_path_syntax_internal(char *path,
  48                                            bool posix_path,
  49                                            bool *p_last_component_contains_wcard)
  50 {
  51         char *d = path;
  52         const char *s = path;
  53         NTSTATUS ret = NT_STATUS_OK;
  54         bool start_of_name_component = True;
  55
  56         *p_last_component_contains_wcard = False;
  57
  58         while (*s) {
  59                 if (IS_PATH_SEP(*s,posix_path)) {
  60                         /*
  61                          * Safe to assume is not the second part of a mb char
  62                          * as this is handled below.
  63                          */
  64                         /* Eat multiple '/' or '\\' */
  65                         while (IS_PATH_SEP(*s,posix_path)) {
  66                                 s++;
  67                         }
  68                         if ((d != path) && (*s != '\0')) {
  69                                 /* We only care about non-leading or trailing '/' or '\\' */
  70                                 *d++ = '/';
  71                         }
  72
  73                         start_of_name_component = True;
  74                         /* New component. */
  75                         *p_last_component_contains_wcard = False;
  76                         continue;
  77                 }
  78
  79                 if (start_of_name_component) {
  80                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
  81                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
  82
  83                                 /*
  84                                  * No mb char starts with '.' so we're safe checking the directory separator here.
  85                                  */
  86
  87                                 /* If  we just added a '/' - delete it */
  88                                 if ((d > path) && (*(d-1) == '/')) {
  89                                         *(d-1) = '\0';
  90                                         d--;
  91                                 }
  92
  93                                 /* Are we at the start ? Can't go back further if so. */
  94                                 if (d <= path) {
  95                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
  96                                         break;
  97                                 }
  98                                 /* Go back one level... */
  99                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 100                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 101                                 /* Decrement d first as d points to the *next* char to write into. */
 102                                 for (d--; d > path; d--) {
 103                                         if (*d == '/')
 104                                                 break;
 105                                 }
 106                                 s += 2; /* Else go past the .. */
 107                                 /* We're still at the start of a name component, just the previous one. */
 108                                 continue;
 109
 110                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 111                                 if (posix_path) {
 112                                         /* Eat the '.' */
 113                                         s++;
 114                                         continue;
 115                                 }
 116                         }
 117
 118                 }
 119
 120                 if (!(*s & 0x80)) {
 121                         if (!posix_path) {
 122                                 if (*s <= 0x1f) {
 123                                         return NT_STATUS_OBJECT_NAME_INVALID;
 124                                 }
 125                                 switch (*s) {
 126                                         case '*':
 127                                         case '?':
 128                                         case '<':
 129                                         case '>':
 130                                         case '"':
 131                                                 *p_last_component_contains_wcard = True;
 132                                                 break;
 133                                         default:
 134                                                 break;
 135                                 }
 136                         }
 137                         *d++ = *s++;
 138                 } else {
 139                         size_t siz;
 140                         /* Get the size of the next MB character. */
 141                         next_codepoint(s,&siz);
 142                         switch(siz) {
 143                                 case 5:
 144                                         *d++ = *s++;
 145                                         /*fall through*/
 146                                 case 4:
 147                                         *d++ = *s++;
 148                                         /*fall through*/
 149                                 case 3:
 150                                         *d++ = *s++;
 151                                         /*fall through*/
 152                                 case 2:
 153                                         *d++ = *s++;
 154                                         /*fall through*/
 155                                 case 1:
 156                                         *d++ = *s++;
 157                                         break;
 158                                 default:
 159                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 160                                         *d = '\0';
 161                                         return NT_STATUS_INVALID_PARAMETER;
 162                         }
 163                 }
 164                 start_of_name_component = False;
 165         }
 166
 167         *d = '\0';
 168
 169         return ret;
 170 }
 171
 172 /****************************************************************************
 173  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 174  No wildcards allowed.
 175 ****************************************************************************/
 176
 177 NTSTATUS check_path_syntax(char *path)
 178 {
 179         bool ignore;
 180         return check_path_syntax_internal(path, False, &ignore);
 181 }
 182
 183 /****************************************************************************
 184  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 185  Wildcards allowed - p_contains_wcard returns true if the last component contained
 186  a wildcard.
 187 ****************************************************************************/
 188
 189 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 190 {
 191         return check_path_syntax_internal(path, False, p_contains_wcard);
 192 }
 193
 194 /****************************************************************************
 195  Check the path for a POSIX client.
 196  We're assuming here that '/' is not the second byte in any multibyte char
 197  set (a safe assumption).
 198 ****************************************************************************/
 199
 200 NTSTATUS check_path_syntax_posix(char *path)
 201 {
 202         bool ignore;
 203         return check_path_syntax_internal(path, True, &ignore);
 204 }
 205
 206 /****************************************************************************
 207  Pull a string and check the path allowing a wilcard - provide for error return.
 208 ****************************************************************************/
 209
 210 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 211                         const char *inbuf,
 212                         uint16 smb_flags2,
 213                         char **pp_dest,
 214                         const char *src,
 215                         size_t src_len,
 216                         int flags,
 217                         NTSTATUS *err,
 218                         bool *contains_wcard)
 219 {
 220         size_t ret;
 221
 222         *pp_dest = NULL;
 223
 224         if (src_len == 0) {
 225                 ret = srvstr_pull_buf_talloc(ctx,
 226                                 inbuf,
 227                                 smb_flags2,
 228                                 pp_dest,
 229                                 src,
 230                                 flags);
 231         } else {
 232                 ret = srvstr_pull_talloc(ctx,
 233                                 inbuf,
 234                                 smb_flags2,
 235                                 pp_dest,
 236                                 src,
 237                                 src_len,
 238                                 flags);
 239         }
 240
 241         if (!*pp_dest) {
 242                 *err = NT_STATUS_INVALID_PARAMETER;
 243                 return ret;
 244         }
 245
 246         *contains_wcard = False;
 247
 248         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 249                 /*
 250                  * For a DFS path the function parse_dfs_path()
 251                  * will do the path processing, just make a copy.
 252                  */
 253                 *err = NT_STATUS_OK;
 254                 return ret;
 255         }
 256
 257         if (lp_posix_pathnames()) {
 258                 *err = check_path_syntax_posix(*pp_dest);
 259         } else {
 260                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 261         }
 262
 263         return ret;
 264 }
 265
 266 /****************************************************************************
 267  Pull a string and check the path - provide for error return.
 268 ****************************************************************************/
 269
 270 size_t srvstr_get_path(TALLOC_CTX *ctx,
 271                         const char *inbuf,
 272                         uint16 smb_flags2,
 273                         char **pp_dest,
 274                         const char *src,
 275                         size_t src_len,
 276                         int flags,
 277                         NTSTATUS *err)
 278 {
 279         size_t ret;
 280
 281         *pp_dest = NULL;
 282
 283         if (src_len == 0) {
 284                 ret = srvstr_pull_buf_talloc(ctx,
 285                                         inbuf,
 286                                         smb_flags2,
 287                                         pp_dest,
 288                                         src,
 289                                         flags);
 290         } else {
 291                 ret = srvstr_pull_talloc(ctx,
 292                                 inbuf,
 293                                 smb_flags2,
 294                                 pp_dest,
 295                                 src,
 296                                 src_len,
 297                                 flags);
 298         }
 299
 300         if (!*pp_dest) {
 301                 *err = NT_STATUS_INVALID_PARAMETER;
 302                 return ret;
 303         }
 304
 305         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 306                 /*
 307                  * For a DFS path the function parse_dfs_path()
 308                  * will do the path processing, just make a copy.
 309                  */
 310                 *err = NT_STATUS_OK;
 311                 return ret;
 312         }
 313
 314         if (lp_posix_pathnames()) {
 315                 *err = check_path_syntax_posix(*pp_dest);
 316         } else {
 317                 *err = check_path_syntax(*pp_dest);
 318         }
 319
 320         return ret;
 321 }
 322
 323 /****************************************************************************
 324  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 325 ****************************************************************************/
 326
 327 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 328                     files_struct *fsp)
 329 {
 330         if (!(fsp) || !(conn)) {
 331                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 332                 return False;
 333         }
 334         if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
 335                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 336                 return False;
 337         }
 338         return True;
 339 }
 340
 341 /****************************************************************************
 342  Check if we have a correct fsp pointing to a file.
 343 ****************************************************************************/
 344
 345 bool check_fsp(connection_struct *conn, struct smb_request *req,
 346                files_struct *fsp)
 347 {
 348         if (!check_fsp_open(conn, req, fsp)) {
 349                 return False;
 350         }
 351         if ((fsp)->is_directory) {
 352                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 353                 return False;
 354         }
 355         if ((fsp)->fh->fd == -1) {
 356                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 357                 return False;
 358         }
 359         (fsp)->num_smb_operations++;
 360         return True;
 361 }
 362
 363 /****************************************************************************
 364  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 365  the CHECK_NTQUOTA_HANDLE_OK macro.
 366 ****************************************************************************/
 367
 368 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 369                               files_struct *fsp)
 370 {
 371         if (!check_fsp_open(conn, req, fsp)) {
 372                 return false;
 373         }
 374
 375         if (fsp->is_directory) {
 376                 return false;
 377         }
 378
 379         if (fsp->fake_file_handle == NULL) {
 380                 return false;
 381         }
 382
 383         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 384                 return false;
 385         }
 386
 387         if (fsp->fake_file_handle->private_data == NULL) {
 388                 return false;
 389         }
 390
 391         return true;
 392 }
 393
 394 /****************************************************************************
 395  Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
 396 ****************************************************************************/
 397
 398 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
 399                       files_struct *fsp)
 400 {
 401         if ((fsp) && (conn) && ((conn)==(fsp)->conn)
 402             && (req->vuid == (fsp)->vuid)) {
 403                 return True;
 404         }
 405
 406         reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 407         return False;
 408 }
 409
 410 /****************************************************************************
 411  Reply to a (netbios-level) special message.
 412 ****************************************************************************/
 413
 414 void reply_special(char *inbuf)
 415 {
 416         int msg_type = CVAL(inbuf,0);
 417         int msg_flags = CVAL(inbuf,1);
 418         fstring name1,name2;
 419         char name_type = 0;
 420
 421         /*
 422          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 423          * calculation & friends (srv_send_smb uses that) we need the full smb
 424          * header.
 425          */
 426         char outbuf[smb_size];
 427
 428         static bool already_got_session = False;
 429
 430         *name1 = *name2 = 0;
 431
 432         memset(outbuf, '\0', sizeof(outbuf));
 433
 434         smb_setlen(outbuf,0);
 435
 436         switch (msg_type) {
 437         case 0x81: /* session request */
 438
 439                 if (already_got_session) {
 440                         exit_server_cleanly("multiple session request not permitted");
 441                 }
 442
 443                 SCVAL(outbuf,0,0x82);
 444                 SCVAL(outbuf,3,0);
 445                 if (name_len(inbuf+4) > 50 ||
 446                     name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
 447                         DEBUG(0,("Invalid name length in session request\n"));
 448                         return;
 449                 }
 450                 name_extract(inbuf,4,name1);
 451                 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
 452                 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
 453                          name1,name2));
 454
 455                 set_local_machine_name(name1, True);
 456                 set_remote_machine_name(name2, True);
 457
 458                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 459                          get_local_machine_name(), get_remote_machine_name(),
 460                          name_type));
 461
 462                 if (name_type == 'R') {
 463                         /* We are being asked for a pathworks session ---
 464                            no thanks! */
 465                         SCVAL(outbuf, 0,0x83);
 466                         break;
 467                 }
 468
 469                 /* only add the client's machine name to the list
 470                    of possibly valid usernames if we are operating
 471                    in share mode security */
 472                 if (lp_security() == SEC_SHARE) {
 473                         add_session_user(get_remote_machine_name());
 474                 }
 475
 476                 reload_services(True);
 477                 reopen_logs();
 478
 479                 already_got_session = True;
 480                 break;
 481
 482         case 0x89: /* session keepalive request
 483                       (some old clients produce this?) */
 484                 SCVAL(outbuf,0,SMBkeepalive);
 485                 SCVAL(outbuf,3,0);
 486                 break;
 487
 488         case 0x82: /* positive session response */
 489         case 0x83: /* negative session response */
 490         case 0x84: /* retarget session response */
 491                 DEBUG(0,("Unexpected session response\n"));
 492                 break;
 493
 494         case SMBkeepalive: /* session keepalive */
 495         default:
 496                 return;
 497         }
 498
 499         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 500                     msg_type, msg_flags));
 501
 502         srv_send_smb(smbd_server_fd(), outbuf, false);
 503         return;
 504 }
 505
 506 /****************************************************************************
 507  Reply to a tcon.
 508  conn POINTER CAN BE NULL HERE !
 509 ****************************************************************************/
 510
 511 void reply_tcon(struct smb_request *req)
 512 {
 513         connection_struct *conn = req->conn;
 514         const char *service;
 515         char *service_buf = NULL;
 516         char *password = NULL;
 517         char *dev = NULL;
 518         int pwlen=0;
 519         NTSTATUS nt_status;
 520         char *p;
 521         DATA_BLOB password_blob;
 522         TALLOC_CTX *ctx = talloc_tos();
 523
 524         START_PROFILE(SMBtcon);
 525
 526         if (smb_buflen(req->inbuf) < 4) {
 527                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 528                 END_PROFILE(SMBtcon);
 529                 return;
 530         }
 531
 532         p = smb_buf(req->inbuf)+1;
 533         p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
 534                                     &service_buf, p, STR_TERMINATE) + 1;
 535         pwlen = srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
 536                                        &password, p, STR_TERMINATE) + 1;
 537         p += pwlen;
 538         p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
 539                                     &dev, p, STR_TERMINATE) + 1;
 540
 541         if (service_buf == NULL || password == NULL || dev == NULL) {
 542                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 543                 END_PROFILE(SMBtcon);
 544                 return;
 545         }
 546         p = strrchr_m(service_buf,'\\');
 547         if (p) {
 548                 service = p+1;
 549         } else {
 550                 service = service_buf;
 551         }
 552
 553         password_blob = data_blob(password, pwlen+1);
 554
 555         conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
 556         req->conn = conn;
 557
 558         data_blob_clear_free(&password_blob);
 559
 560         if (!conn) {
 561                 reply_nterror(req, nt_status);
 562                 END_PROFILE(SMBtcon);
 563                 return;
 564         }
 565
 566         reply_outbuf(req, 2, 0);
 567         SSVAL(req->outbuf,smb_vwv0,max_recv);
 568         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 569         SSVAL(req->outbuf,smb_tid,conn->cnum);
 570
 571         DEBUG(3,("tcon service=%s cnum=%d\n",
 572                  service, conn->cnum));
 573
 574         END_PROFILE(SMBtcon);
 575         return;
 576 }
 577
 578 /****************************************************************************
 579  Reply to a tcon and X.
 580  conn POINTER CAN BE NULL HERE !
 581 ****************************************************************************/
 582
 583 void reply_tcon_and_X(struct smb_request *req)
 584 {
 585         connection_struct *conn = req->conn;
 586         char *service = NULL;
 587         DATA_BLOB password;
 588         TALLOC_CTX *ctx = talloc_tos();
 589         /* what the cleint thinks the device is */
 590         char *client_devicetype = NULL;
 591         /* what the server tells the client the share represents */
 592         const char *server_devicetype;
 593         NTSTATUS nt_status;
 594         int passlen;
 595         char *path = NULL;
 596         char *p, *q;
 597         uint16 tcon_flags;
 598
 599         START_PROFILE(SMBtconX);
 600
 601         if (req->wct < 4) {
 602                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 603                 END_PROFILE(SMBtconX);
 604                 return;
 605         }
 606
 607         passlen = SVAL(req->inbuf,smb_vwv3);
 608         tcon_flags = SVAL(req->inbuf,smb_vwv2);
 609
 610         /* we might have to close an old one */
 611         if ((tcon_flags & 0x1) && conn) {
 612                 close_cnum(conn,req->vuid);
 613                 req->conn = NULL;
 614                 conn = NULL;
 615         }
 616
 617         if ((passlen > MAX_PASS_LEN) || (passlen >= smb_buflen(req->inbuf))) {
 618                 reply_doserror(req, ERRDOS, ERRbuftoosmall);
 619                 END_PROFILE(SMBtconX);
 620                 return;
 621         }
 622
 623         if (global_encrypted_passwords_negotiated) {
 624                 password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
 625                                             passlen);
 626                 if (lp_security() == SEC_SHARE) {
 627                         /*
 628                          * Security = share always has a pad byte
 629                          * after the password.
 630                          */
 631                         p = smb_buf(req->inbuf) + passlen + 1;
 632                 } else {
 633                         p = smb_buf(req->inbuf) + passlen;
 634                 }
 635         } else {
 636                 password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
 637                                             passlen+1);
 638                 /* Ensure correct termination */
 639                 password.data[passlen]=0;
 640                 p = smb_buf(req->inbuf) + passlen + 1;
 641         }
 642
 643         p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &path, p,
 644                              STR_TERMINATE);
 645
 646         if (path == NULL) {
 647                 data_blob_clear_free(&password);
 648                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 649                 END_PROFILE(SMBtconX);
 650                 return;
 651         }
 652
 653         /*
 654          * the service name can be either: \\server\share
 655          * or share directly like on the DELL PowerVault 705
 656          */
 657         if (*path=='\\') {
 658                 q = strchr_m(path+2,'\\');
 659                 if (!q) {
 660                         data_blob_clear_free(&password);
 661                         reply_doserror(req, ERRDOS, ERRnosuchshare);
 662                         END_PROFILE(SMBtconX);
 663                         return;
 664                 }
 665                 service = q+1;
 666         } else {
 667                 service = path;
 668         }
 669
 670         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 671                                 &client_devicetype, p,
 672                                 MIN(6,smb_bufrem(req->inbuf, p)), STR_ASCII);
 673
 674         if (client_devicetype == NULL) {
 675                 data_blob_clear_free(&password);
 676                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 677                 END_PROFILE(SMBtconX);
 678                 return;
 679         }
 680
 681         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 682
 683         conn = make_connection(service, password, client_devicetype,
 684                                req->vuid, &nt_status);
 685         req->conn =conn;
 686
 687         data_blob_clear_free(&password);
 688
 689         if (!conn) {
 690                 reply_nterror(req, nt_status);
 691                 END_PROFILE(SMBtconX);
 692                 return;
 693         }
 694
 695         if ( IS_IPC(conn) )
 696                 server_devicetype = "IPC";
 697         else if ( IS_PRINT(conn) )
 698                 server_devicetype = "LPT1:";
 699         else
 700                 server_devicetype = "A:";
 701
 702         if (Protocol < PROTOCOL_NT1) {
 703                 reply_outbuf(req, 2, 0);
 704                 if (message_push_string(&req->outbuf, server_devicetype,
 705                                         STR_TERMINATE|STR_ASCII) == -1) {
 706                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 707                         END_PROFILE(SMBtconX);
 708                         return;
 709                 }
 710         } else {
 711                 /* NT sets the fstype of IPC$ to the null string */
 712                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 713
 714                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 715                         /* Return permissions. */
 716                         uint32 perm1 = 0;
 717                         uint32 perm2 = 0;
 718
 719                         reply_outbuf(req, 7, 0);
 720
 721                         if (IS_IPC(conn)) {
 722                                 perm1 = FILE_ALL_ACCESS;
 723                                 perm2 = FILE_ALL_ACCESS;
 724                         } else {
 725                                 perm1 = CAN_WRITE(conn) ?
 726                                                 SHARE_ALL_ACCESS :
 727                                                 SHARE_READ_ONLY;
 728                         }
 729
 730                         SIVAL(req->outbuf, smb_vwv3, perm1);
 731                         SIVAL(req->outbuf, smb_vwv5, perm2);
 732                 } else {
 733                         reply_outbuf(req, 3, 0);
 734                 }
 735
 736                 if ((message_push_string(&req->outbuf, server_devicetype,
 737                                          STR_TERMINATE|STR_ASCII) == -1)
 738                     || (message_push_string(&req->outbuf, fstype,
 739                                             STR_TERMINATE) == -1)) {
 740                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 741                         END_PROFILE(SMBtconX);
 742                         return;
 743                 }
 744
 745                 /* what does setting this bit do? It is set by NT4 and
 746                    may affect the ability to autorun mounted cdroms */
 747                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 748                       (lp_csc_policy(SNUM(conn)) << 2));
 749
 750                 init_dfsroot(conn, req->inbuf, req->outbuf);
 751         }
 752
 753
 754         DEBUG(3,("tconX service=%s \n",
 755                  service));
 756
 757         /* set the incoming and outgoing tid to the just created one */
 758         SSVAL(req->inbuf,smb_tid,conn->cnum);
 759         SSVAL(req->outbuf,smb_tid,conn->cnum);
 760
 761         END_PROFILE(SMBtconX);
 762
 763         chain_reply(req);
 764         return;
 765 }
 766
 767 /****************************************************************************
 768  Reply to an unknown type.
 769 ****************************************************************************/
 770
 771 void reply_unknown_new(struct smb_request *req, uint8 type)
 772 {
 773         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 774                   smb_fn_name(type), type, type));
 775         reply_doserror(req, ERRSRV, ERRunknownsmb);
 776         return;
 777 }
 778
 779 /****************************************************************************
 780  Reply to an ioctl.
 781  conn POINTER CAN BE NULL HERE !
 782 ****************************************************************************/
 783
 784 void reply_ioctl(struct smb_request *req)
 785 {
 786         connection_struct *conn = req->conn;
 787         uint16 device;
 788         uint16 function;
 789         uint32 ioctl_code;
 790         int replysize;
 791         char *p;
 792
 793         START_PROFILE(SMBioctl);
 794
 795         if (req->wct < 3) {
 796                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 797                 END_PROFILE(SMBioctl);
 798                 return;
 799         }
 800
 801         device     = SVAL(req->inbuf,smb_vwv1);
 802         function   = SVAL(req->inbuf,smb_vwv2);
 803         ioctl_code = (device << 16) + function;
 804
 805         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 806
 807         switch (ioctl_code) {
 808             case IOCTL_QUERY_JOB_INFO:
 809                     replysize = 32;
 810                     break;
 811             default:
 812                     reply_doserror(req, ERRSRV, ERRnosupport);
 813                     END_PROFILE(SMBioctl);
 814                     return;
 815         }
 816
 817         reply_outbuf(req, 8, replysize+1);
 818         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 819         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 820         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 821         p = smb_buf(req->outbuf);
 822         memset(p, '\0', replysize+1); /* valgrind-safe. */
 823         p += 1;          /* Allow for alignment */
 824
 825         switch (ioctl_code) {
 826                 case IOCTL_QUERY_JOB_INFO:
 827                 {
 828                         files_struct *fsp = file_fsp(SVAL(req->inbuf,
 829                                                           smb_vwv0));
 830                         if (!fsp) {
 831                                 reply_doserror(req, ERRDOS, ERRbadfid);
 832                                 END_PROFILE(SMBioctl);
 833                                 return;
 834                         }
 835                         SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
 836                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 837                                     global_myname(), 15,
 838                                     STR_TERMINATE|STR_ASCII);
 839                         if (conn) {
 840                                 srvstr_push((char *)req->outbuf, req->flags2,
 841                                             p+18, lp_servicename(SNUM(conn)),
 842                                             13, STR_TERMINATE|STR_ASCII);
 843                         } else {
 844                                 memset(p+18, 0, 13);
 845                         }
 846                         break;
 847                 }
 848         }
 849
 850         END_PROFILE(SMBioctl);
 851         return;
 852 }
 853
 854 /****************************************************************************
 855  Strange checkpath NTSTATUS mapping.
 856 ****************************************************************************/
 857
 858 static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
 859 {
 860         /* Strange DOS error code semantics only for checkpath... */
 861         if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
 862                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 863                         /* We need to map to ERRbadpath */
 864                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 865                 }
 866         }
 867         return status;
 868 }
 869
 870 /****************************************************************************
 871  Reply to a checkpath.
 872 ****************************************************************************/
 873
 874 void reply_checkpath(struct smb_request *req)
 875 {
 876         connection_struct *conn = req->conn;
 877         char *name = NULL;
 878         SMB_STRUCT_STAT sbuf;
 879         NTSTATUS status;
 880         TALLOC_CTX *ctx = talloc_tos();
 881
 882         START_PROFILE(SMBcheckpath);
 883
 884         srvstr_get_path(ctx,(char *)req->inbuf, req->flags2, &name,
 885                         smb_buf(req->inbuf) + 1, 0,
 886                         STR_TERMINATE, &status);
 887         if (!NT_STATUS_IS_OK(status)) {
 888                 status = map_checkpath_error((char *)req->inbuf, status);
 889                 reply_nterror(req, status);
 890                 END_PROFILE(SMBcheckpath);
 891                 return;
 892         }
 893
 894         status = resolve_dfspath(ctx, conn,
 895                         req->flags2 & FLAGS2_DFS_PATHNAMES,
 896                         name,
 897                         &name);
 898         if (!NT_STATUS_IS_OK(status)) {
 899                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
 900                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
 901                                         ERRSRV, ERRbadpath);
 902                         END_PROFILE(SMBcheckpath);
 903                         return;
 904                 }
 905                 goto path_err;
 906         }
 907
 908         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->inbuf,smb_vwv0)));
 909
 910         status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
 911         if (!NT_STATUS_IS_OK(status)) {
 912                 goto path_err;
 913         }
 914
 915         status = check_name(conn, name);
 916         if (!NT_STATUS_IS_OK(status)) {
 917                 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
 918                 goto path_err;
 919         }
 920
 921         if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
 922                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
 923                 status = map_nt_error_from_unix(errno);
 924                 goto path_err;
 925         }
 926
 927         if (!S_ISDIR(sbuf.st_mode)) {
 928                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
 929                                 ERRDOS, ERRbadpath);
 930                 END_PROFILE(SMBcheckpath);
 931                 return;
 932         }
 933
 934         reply_outbuf(req, 0, 0);
 935
 936         END_PROFILE(SMBcheckpath);
 937         return;
 938
 939   path_err:
 940
 941         END_PROFILE(SMBcheckpath);
 942
 943         /* We special case this - as when a Windows machine
 944                 is parsing a path is steps through the components
 945                 one at a time - if a component fails it expects
 946                 ERRbadpath, not ERRbadfile.
 947         */
 948         status = map_checkpath_error((char *)req->inbuf, status);
 949         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 950                 /*
 951                  * Windows returns different error codes if
 952                  * the parent directory is valid but not the
 953                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
 954                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
 955                  * if the path is invalid.
 956                  */
 957                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
 958                                 ERRDOS, ERRbadpath);
 959                 return;
 960         }
 961
 962         reply_nterror(req, status);
 963 }
 964
 965 /****************************************************************************
 966  Reply to a getatr.
 967 ****************************************************************************/
 968
 969 void reply_getatr(struct smb_request *req)
 970 {
 971         connection_struct *conn = req->conn;
 972         char *fname = NULL;
 973         SMB_STRUCT_STAT sbuf;
 974         int mode=0;
 975         SMB_OFF_T size=0;
 976         time_t mtime=0;
 977         char *p;
 978         NTSTATUS status;
 979         TALLOC_CTX *ctx = talloc_tos();
 980
 981         START_PROFILE(SMBgetatr);
 982
 983         p = smb_buf(req->inbuf) + 1;
 984         p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
 985                              0, STR_TERMINATE, &status);
 986         if (!NT_STATUS_IS_OK(status)) {
 987                 reply_nterror(req, status);
 988                 END_PROFILE(SMBgetatr);
 989                 return;
 990         }
 991
 992         status = resolve_dfspath(ctx, conn,
 993                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
 994                                 fname,
 995                                 &fname);
 996         if (!NT_STATUS_IS_OK(status)) {
 997                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
 998                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
 999                                         ERRSRV, ERRbadpath);
1000                         END_PROFILE(SMBgetatr);
1001                         return;
1002                 }
1003                 reply_nterror(req, status);
1004                 END_PROFILE(SMBgetatr);
1005                 return;
1006         }
1007
1008         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1009                 under WfWg - weird! */
1010         if (*fname == '\0') {
1011                 mode = aHIDDEN | aDIR;
1012                 if (!CAN_WRITE(conn)) {
1013                         mode |= aRONLY;
1014                 }
1015                 size = 0;
1016                 mtime = 0;
1017         } else {
1018                 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
1019                 if (!NT_STATUS_IS_OK(status)) {
1020                         reply_nterror(req, status);
1021                         END_PROFILE(SMBgetatr);
1022                         return;
1023                 }
1024                 status = check_name(conn, fname);
1025                 if (!NT_STATUS_IS_OK(status)) {
1026                         DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
1027                         reply_nterror(req, status);
1028                         END_PROFILE(SMBgetatr);
1029                         return;
1030                 }
1031                 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
1032                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1033                         reply_unixerror(req, ERRDOS,ERRbadfile);
1034                         END_PROFILE(SMBgetatr);
1035                         return;
1036                 }
1037
1038                 mode = dos_mode(conn,fname,&sbuf);
1039                 size = sbuf.st_size;
1040                 mtime = sbuf.st_mtime;
1041                 if (mode & aDIR) {
1042                         size = 0;
1043                 }
1044         }
1045
1046         reply_outbuf(req, 10, 0);
1047
1048         SSVAL(req->outbuf,smb_vwv0,mode);
1049         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1050                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1051         } else {
1052                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1053         }
1054         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1055
1056         if (Protocol >= PROTOCOL_NT1) {
1057                 SSVAL(req->outbuf, smb_flg2,
1058                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1059         }
1060
1061         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1062
1063         END_PROFILE(SMBgetatr);
1064         return;
1065 }
1066
1067 /****************************************************************************
1068  Reply to a setatr.
1069 ****************************************************************************/
1070
1071 void reply_setatr(struct smb_request *req)
1072 {
1073         struct timespec ts[2];
1074         connection_struct *conn = req->conn;
1075         char *fname = NULL;
1076         int mode;
1077         time_t mtime;
1078         SMB_STRUCT_STAT sbuf;
1079         char *p;
1080         NTSTATUS status;
1081         TALLOC_CTX *ctx = talloc_tos();
1082
1083         START_PROFILE(SMBsetatr);
1084
1085         ZERO_STRUCT(ts);
1086
1087         if (req->wct < 2) {
1088                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1089                 return;
1090         }
1091
1092         p = smb_buf(req->inbuf) + 1;
1093         p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
1094                                 0, STR_TERMINATE, &status);
1095         if (!NT_STATUS_IS_OK(status)) {
1096                 reply_nterror(req, status);
1097                 END_PROFILE(SMBsetatr);
1098                 return;
1099         }
1100
1101         status = resolve_dfspath(ctx, conn,
1102                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1103                                 fname,
1104                                 &fname);
1105         if (!NT_STATUS_IS_OK(status)) {
1106                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1107                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1108                                         ERRSRV, ERRbadpath);
1109                         END_PROFILE(SMBsetatr);
1110                         return;
1111                 }
1112                 reply_nterror(req, status);
1113                 END_PROFILE(SMBsetatr);
1114                 return;
1115         }
1116
1117         status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1118         if (!NT_STATUS_IS_OK(status)) {
1119                 reply_nterror(req, status);
1120                 END_PROFILE(SMBsetatr);
1121                 return;
1122         }
1123
1124         status = check_name(conn, fname);
1125         if (!NT_STATUS_IS_OK(status)) {
1126                 reply_nterror(req, status);
1127                 END_PROFILE(SMBsetatr);
1128                 return;
1129         }
1130
1131         if (fname[0] == '.' && fname[1] == '\0') {
1132                 /*
1133                  * Not sure here is the right place to catch this
1134                  * condition. Might be moved to somewhere else later -- vl
1135                  */
1136                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1137                 END_PROFILE(SMBsetatr);
1138                 return;
1139         }
1140
1141         mode = SVAL(req->inbuf,smb_vwv0);
1142         mtime = srv_make_unix_date3(req->inbuf+smb_vwv1);
1143
1144         ts[1] = convert_time_t_to_timespec(mtime);
1145         status = smb_set_file_time(conn, NULL, fname,
1146                                    &sbuf, ts, true);
1147         if (!NT_STATUS_IS_OK(status)) {
1148                 reply_unixerror(req, ERRDOS, ERRnoaccess);
1149                 END_PROFILE(SMBsetatr);
1150                 return;
1151         }
1152
1153         if (mode != FILE_ATTRIBUTE_NORMAL) {
1154                 if (VALID_STAT_OF_DIR(sbuf))
1155                         mode |= aDIR;
1156                 else
1157                         mode &= ~aDIR;
1158
1159                 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1160                         reply_unixerror(req, ERRDOS, ERRnoaccess);
1161                         END_PROFILE(SMBsetatr);
1162                         return;
1163                 }
1164         }
1165
1166         reply_outbuf(req, 0, 0);
1167
1168         DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1169
1170         END_PROFILE(SMBsetatr);
1171         return;
1172 }
1173
1174 /****************************************************************************
1175  Reply to a dskattr.
1176 ****************************************************************************/
1177
1178 void reply_dskattr(struct smb_request *req)
1179 {
1180         connection_struct *conn = req->conn;
1181         SMB_BIG_UINT dfree,dsize,bsize;
1182         START_PROFILE(SMBdskattr);
1183
1184         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
1185                 reply_unixerror(req, ERRHRD, ERRgeneral);
1186                 END_PROFILE(SMBdskattr);
1187                 return;
1188         }
1189
1190         reply_outbuf(req, 5, 0);
1191
1192         if (Protocol <= PROTOCOL_LANMAN2) {
1193                 double total_space, free_space;
1194                 /* we need to scale this to a number that DOS6 can handle. We
1195                    use floating point so we can handle large drives on systems
1196                    that don't have 64 bit integers
1197
1198                    we end up displaying a maximum of 2G to DOS systems
1199                 */
1200                 total_space = dsize * (double)bsize;
1201                 free_space = dfree * (double)bsize;
1202
1203                 dsize = (SMB_BIG_UINT)((total_space+63*512) / (64*512));
1204                 dfree = (SMB_BIG_UINT)((free_space+63*512) / (64*512));
1205
1206                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1207                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1208
1209                 SSVAL(req->outbuf,smb_vwv0,dsize);
1210                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1211                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1212                 SSVAL(req->outbuf,smb_vwv3,dfree);
1213         } else {
1214                 SSVAL(req->outbuf,smb_vwv0,dsize);
1215                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1216                 SSVAL(req->outbuf,smb_vwv2,512);
1217                 SSVAL(req->outbuf,smb_vwv3,dfree);
1218         }
1219
1220         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1221
1222         END_PROFILE(SMBdskattr);
1223         return;
1224 }
1225
1226 /****************************************************************************
1227  Reply to a search.
1228  Can be called from SMBsearch, SMBffirst or SMBfunique.
1229 ****************************************************************************/
1230
1231 void reply_search(struct smb_request *req)
1232 {
1233         connection_struct *conn = req->conn;
1234         char *mask = NULL;
1235         char *directory = NULL;
1236         char *fname = NULL;
1237         SMB_OFF_T size;
1238         uint32 mode;
1239         time_t date;
1240         uint32 dirtype;
1241         unsigned int numentries = 0;
1242         unsigned int maxentries = 0;
1243         bool finished = False;
1244         char *p;
1245         int status_len;
1246         char *path = NULL;
1247         char status[21];
1248         int dptr_num= -1;
1249         bool check_descend = False;
1250         bool expect_close = False;
1251         NTSTATUS nt_status;
1252         bool mask_contains_wcard = False;
1253         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1254         TALLOC_CTX *ctx = talloc_tos();
1255         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1256
1257         START_PROFILE(SMBsearch);
1258
1259         if (req->wct < 2) {
1260                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1261                 END_PROFILE(SMBsearch);
1262                 return;
1263         }
1264
1265         if (lp_posix_pathnames()) {
1266                 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1267                 END_PROFILE(SMBsearch);
1268                 return;
1269         }
1270
1271         /* If we were called as SMBffirst then we must expect close. */
1272         if(CVAL(req->inbuf,smb_com) == SMBffirst) {
1273                 expect_close = True;
1274         }
1275
1276         reply_outbuf(req, 1, 3);
1277         maxentries = SVAL(req->inbuf,smb_vwv0);
1278         dirtype = SVAL(req->inbuf,smb_vwv1);
1279         p = smb_buf(req->inbuf) + 1;
1280         p += srvstr_get_path_wcard(ctx,
1281                                 (char *)req->inbuf,
1282                                 req->flags2,
1283                                 &path,
1284                                 p,
1285                                 0,
1286                                 STR_TERMINATE,
1287                                 &nt_status,
1288                                 &mask_contains_wcard);
1289         if (!NT_STATUS_IS_OK(nt_status)) {
1290                 reply_nterror(req, nt_status);
1291                 END_PROFILE(SMBsearch);
1292                 return;
1293         }
1294
1295         nt_status = resolve_dfspath_wcard(ctx, conn,
1296                                           req->flags2 & FLAGS2_DFS_PATHNAMES,
1297                                           path,
1298                                           &path,
1299                                           &mask_contains_wcard);
1300         if (!NT_STATUS_IS_OK(nt_status)) {
1301                 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1302                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1303                                         ERRSRV, ERRbadpath);
1304                         END_PROFILE(SMBsearch);
1305                         return;
1306                 }
1307                 reply_nterror(req, nt_status);
1308                 END_PROFILE(SMBsearch);
1309                 return;
1310         }
1311
1312         p++;
1313         status_len = SVAL(p, 0);
1314         p += 2;
1315
1316         /* dirtype &= ~aDIR; */
1317
1318         if (status_len == 0) {
1319                 SMB_STRUCT_STAT sbuf;
1320
1321                 nt_status = unix_convert(ctx, conn, path, True,
1322                                 &directory, NULL, &sbuf);
1323                 if (!NT_STATUS_IS_OK(nt_status)) {
1324                         reply_nterror(req, nt_status);
1325                         END_PROFILE(SMBsearch);
1326                         return;
1327                 }
1328
1329                 nt_status = check_name(conn, directory);
1330                 if (!NT_STATUS_IS_OK(nt_status)) {
1331                         reply_nterror(req, nt_status);
1332                         END_PROFILE(SMBsearch);
1333                         return;
1334                 }
1335
1336                 p = strrchr_m(directory,'/');
1337                 if (!p) {
1338                         mask = directory;
1339                         directory = talloc_strdup(ctx,".");
1340                         if (!directory) {
1341                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1342                                 END_PROFILE(SMBsearch);
1343                                 return;
1344                         }
1345                 } else {
1346                         *p = 0;
1347                         mask = p+1;
1348                 }
1349
1350                 if (*directory == '\0') {
1351                         directory = talloc_strdup(ctx,".");
1352                         if (!directory) {
1353                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1354                                 END_PROFILE(SMBsearch);
1355                                 return;
1356                         }
1357                 }
1358                 memset((char *)status,'\0',21);
1359                 SCVAL(status,0,(dirtype & 0x1F));
1360
1361                 nt_status = dptr_create(conn,
1362                                         directory,
1363                                         True,
1364                                         expect_close,
1365                                         req->smbpid,
1366                                         mask,
1367                                         mask_contains_wcard,
1368                                         dirtype,
1369                                         &conn->dirptr);
1370                 if (!NT_STATUS_IS_OK(nt_status)) {
1371                         reply_nterror(req, nt_status);
1372                         END_PROFILE(SMBsearch);
1373                         return;
1374                 }
1375                 dptr_num = dptr_dnum(conn->dirptr);
1376         } else {
1377                 int status_dirtype;
1378
1379                 memcpy(status,p,21);
1380                 status_dirtype = CVAL(status,0) & 0x1F;
1381                 if (status_dirtype != (dirtype & 0x1F)) {
1382                         dirtype = status_dirtype;
1383                 }
1384
1385                 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1386                 if (!conn->dirptr) {
1387                         goto SearchEmpty;
1388                 }
1389                 string_set(&conn->dirpath,dptr_path(dptr_num));
1390                 mask = dptr_wcard(dptr_num);
1391                 if (!mask) {
1392                         goto SearchEmpty;
1393                 }
1394                 /*
1395                  * For a 'continue' search we have no string. So
1396                  * check from the initial saved string.
1397                  */
1398                 mask_contains_wcard = ms_has_wild(mask);
1399                 dirtype = dptr_attr(dptr_num);
1400         }
1401
1402         DEBUG(4,("dptr_num is %d\n",dptr_num));
1403
1404         if ((dirtype&0x1F) == aVOLID) {
1405                 char buf[DIR_STRUCT_SIZE];
1406                 memcpy(buf,status,21);
1407                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1408                                 0,aVOLID,0,!allow_long_path_components)) {
1409                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1410                         END_PROFILE(SMBsearch);
1411                         return;
1412                 }
1413                 dptr_fill(buf+12,dptr_num);
1414                 if (dptr_zero(buf+12) && (status_len==0)) {
1415                         numentries = 1;
1416                 } else {
1417                         numentries = 0;
1418                 }
1419                 if (message_push_blob(&req->outbuf,
1420                                       data_blob_const(buf, sizeof(buf)))
1421                     == -1) {
1422                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1423                         END_PROFILE(SMBsearch);
1424                         return;
1425                 }
1426         } else {
1427                 unsigned int i;
1428                 maxentries = MIN(
1429                         maxentries,
1430                         ((BUFFER_SIZE -
1431                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1432                          /DIR_STRUCT_SIZE));
1433
1434                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1435                         conn->dirpath,lp_dontdescend(SNUM(conn))));
1436                 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1437                         check_descend = True;
1438                 }
1439
1440                 for (i=numentries;(i<maxentries) && !finished;i++) {
1441                         finished = !get_dir_entry(ctx,
1442                                                   conn,
1443                                                   mask,
1444                                                   dirtype,
1445                                                   &fname,
1446                                                   &size,
1447                                                   &mode,
1448                                                   &date,
1449                                                   check_descend,
1450                                                   ask_sharemode);
1451                         if (!finished) {
1452                                 char buf[DIR_STRUCT_SIZE];
1453                                 memcpy(buf,status,21);
1454                                 if (!make_dir_struct(ctx,
1455                                                 buf,
1456                                                 mask,
1457                                                 fname,
1458                                                 size,
1459                                                 mode,
1460                                                 date,
1461                                                 !allow_long_path_components)) {
1462                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1463                                         END_PROFILE(SMBsearch);
1464                                         return;
1465                                 }
1466                                 if (!dptr_fill(buf+12,dptr_num)) {
1467                                         break;
1468                                 }
1469                                 if (message_push_blob(&req->outbuf,
1470                                                       data_blob_const(buf, sizeof(buf)))
1471                                     == -1) {
1472                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1473                                         END_PROFILE(SMBsearch);
1474                                         return;
1475                                 }
1476                                 numentries++;
1477                         }
1478                 }
1479         }
1480
1481   SearchEmpty:
1482
1483         /* If we were called as SMBffirst with smb_search_id == NULL
1484                 and no entries were found then return error and close dirptr
1485                 (X/Open spec) */
1486
1487         if (numentries == 0) {
1488                 dptr_close(&dptr_num);
1489         } else if(expect_close && status_len == 0) {
1490                 /* Close the dptr - we know it's gone */
1491                 dptr_close(&dptr_num);
1492         }
1493
1494         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1495         if(dptr_num >= 0 && CVAL(req->inbuf,smb_com) == SMBfunique) {
1496                 dptr_close(&dptr_num);
1497         }
1498
1499         if ((numentries == 0) && !mask_contains_wcard) {
1500                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1501                 END_PROFILE(SMBsearch);
1502                 return;
1503         }
1504
1505         SSVAL(req->outbuf,smb_vwv0,numentries);
1506         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1507         SCVAL(smb_buf(req->outbuf),0,5);
1508         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1509
1510         /* The replies here are never long name. */
1511         SSVAL(req->outbuf, smb_flg2,
1512               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1513         if (!allow_long_path_components) {
1514                 SSVAL(req->outbuf, smb_flg2,
1515                       SVAL(req->outbuf, smb_flg2)
1516                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1517         }
1518
1519         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1520         SSVAL(req->outbuf, smb_flg2,
1521               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1522
1523         if (!directory) {
1524                 directory = dptr_path(dptr_num);
1525         }
1526
1527         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1528                 smb_fn_name(CVAL(req->inbuf,smb_com)),
1529                 mask,
1530                 directory ? directory : "./",
1531                 dirtype,
1532                 numentries,
1533                 maxentries ));
1534
1535         END_PROFILE(SMBsearch);
1536         return;
1537 }
1538
1539 /****************************************************************************
1540  Reply to a fclose (stop directory search).
1541 ****************************************************************************/
1542
1543 void reply_fclose(struct smb_request *req)
1544 {
1545         int status_len;
1546         char status[21];
1547         int dptr_num= -2;
1548         char *p;
1549         char *path = NULL;
1550         NTSTATUS err;
1551         bool path_contains_wcard = False;
1552         TALLOC_CTX *ctx = talloc_tos();
1553
1554         START_PROFILE(SMBfclose);
1555
1556         if (lp_posix_pathnames()) {
1557                 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1558                 END_PROFILE(SMBfclose);
1559                 return;
1560         }
1561
1562         p = smb_buf(req->inbuf) + 1;
1563         p += srvstr_get_path_wcard(ctx,
1564                                 (char *)req->inbuf,
1565                                 req->flags2,
1566                                 &path,
1567                                 p,
1568                                 0,
1569                                 STR_TERMINATE,
1570                                 &err,
1571                                 &path_contains_wcard);
1572         if (!NT_STATUS_IS_OK(err)) {
1573                 reply_nterror(req, err);
1574                 END_PROFILE(SMBfclose);
1575                 return;
1576         }
1577         p++;
1578         status_len = SVAL(p,0);
1579         p += 2;
1580
1581         if (status_len == 0) {
1582                 reply_doserror(req, ERRSRV, ERRsrverror);
1583                 END_PROFILE(SMBfclose);
1584                 return;
1585         }
1586
1587         memcpy(status,p,21);
1588
1589         if(dptr_fetch(status+12,&dptr_num)) {
1590                 /*  Close the dptr - we know it's gone */
1591                 dptr_close(&dptr_num);
1592         }
1593
1594         reply_outbuf(req, 1, 0);
1595         SSVAL(req->outbuf,smb_vwv0,0);
1596
1597         DEBUG(3,("search close\n"));
1598
1599         END_PROFILE(SMBfclose);
1600         return;
1601 }
1602
1603 /****************************************************************************
1604  Reply to an open.
1605 ****************************************************************************/
1606
1607 void reply_open(struct smb_request *req)
1608 {
1609         connection_struct *conn = req->conn;
1610         char *fname = NULL;
1611         uint32 fattr=0;
1612         SMB_OFF_T size = 0;
1613         time_t mtime=0;
1614         int info;
1615         SMB_STRUCT_STAT sbuf;
1616         files_struct *fsp;
1617         int oplock_request;
1618         int deny_mode;
1619         uint32 dos_attr;
1620         uint32 access_mask;
1621         uint32 share_mode;
1622         uint32 create_disposition;
1623         uint32 create_options = 0;
1624         NTSTATUS status;
1625         TALLOC_CTX *ctx = talloc_tos();
1626
1627         START_PROFILE(SMBopen);
1628
1629         if (req->wct < 2) {
1630                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1631                 END_PROFILE(SMBopen);
1632                 return;
1633         }
1634
1635         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1636         deny_mode = SVAL(req->inbuf,smb_vwv0);
1637         dos_attr = SVAL(req->inbuf,smb_vwv1);
1638
1639         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1640                         smb_buf(req->inbuf)+1, 0,
1641                         STR_TERMINATE, &status);
1642         if (!NT_STATUS_IS_OK(status)) {
1643                 reply_nterror(req, status);
1644                 END_PROFILE(SMBopen);
1645                 return;
1646         }
1647
1648         if (!map_open_params_to_ntcreate(
1649                     fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1650                     &share_mode, &create_disposition, &create_options)) {
1651                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1652                 END_PROFILE(SMBopen);
1653                 return;
1654         }
1655
1656         status = create_file(conn,                      /* conn */
1657                              req,                       /* req */
1658                              0,                         /* root_dir_fid */
1659                              fname,                     /* fname */
1660                              access_mask,               /* access_mask */
1661                              share_mode,                /* share_access */
1662                              create_disposition,        /* create_disposition*/
1663                              create_options,            /* create_options */
1664                              dos_attr,                  /* file_attributes */
1665                              oplock_request,            /* oplock_request */
1666                              0,                         /* allocation_size */
1667                              NULL,                      /* sd */
1668                              NULL,                      /* ea_list */
1669                              &fsp,                      /* result */
1670                              &info,                     /* pinfo */
1671                              &sbuf);                    /* psbuf */
1672
1673         if (!NT_STATUS_IS_OK(status)) {
1674                 if (open_was_deferred(req->mid)) {
1675                         /* We have re-scheduled this call. */
1676                         END_PROFILE(SMBopen);
1677                         return;
1678                 }
1679                 reply_openerror(req, status);
1680                 END_PROFILE(SMBopen);
1681                 return;
1682         }
1683
1684         size = sbuf.st_size;
1685         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1686         mtime = sbuf.st_mtime;
1687
1688         if (fattr & aDIR) {
1689                 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1690                 close_file(fsp,ERROR_CLOSE);
1691                 reply_doserror(req, ERRDOS,ERRnoaccess);
1692                 END_PROFILE(SMBopen);
1693                 return;
1694         }
1695
1696         reply_outbuf(req, 7, 0);
1697         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1698         SSVAL(req->outbuf,smb_vwv1,fattr);
1699         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1700                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1701         } else {
1702                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1703         }
1704         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1705         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1706
1707         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1708                 SCVAL(req->outbuf,smb_flg,
1709                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1710         }
1711
1712         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1713                 SCVAL(req->outbuf,smb_flg,
1714                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1715         }
1716         END_PROFILE(SMBopen);
1717         return;
1718 }
1719
1720 /****************************************************************************
1721  Reply to an open and X.
1722 ****************************************************************************/
1723
1724 void reply_open_and_X(struct smb_request *req)
1725 {
1726         connection_struct *conn = req->conn;
1727         char *fname = NULL;
1728         uint16 open_flags;
1729         int deny_mode;
1730         uint32 smb_attr;
1731         /* Breakout the oplock request bits so we can set the
1732                 reply bits separately. */
1733         int ex_oplock_request;
1734         int core_oplock_request;
1735         int oplock_request;
1736 #if 0
1737         int smb_sattr = SVAL(req->inbuf,smb_vwv4);
1738         uint32 smb_time = make_unix_date3(req->inbuf+smb_vwv6);
1739 #endif
1740         int smb_ofun;
1741         uint32 fattr=0;
1742         int mtime=0;
1743         SMB_STRUCT_STAT sbuf;
1744         int smb_action = 0;
1745         files_struct *fsp;
1746         NTSTATUS status;
1747         SMB_BIG_UINT allocation_size;
1748         ssize_t retval = -1;
1749         uint32 access_mask;
1750         uint32 share_mode;
1751         uint32 create_disposition;
1752         uint32 create_options = 0;
1753         TALLOC_CTX *ctx = talloc_tos();
1754
1755         START_PROFILE(SMBopenX);
1756
1757         if (req->wct < 15) {
1758                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1759                 END_PROFILE(SMBopenX);
1760                 return;
1761         }
1762
1763         open_flags = SVAL(req->inbuf,smb_vwv2);
1764         deny_mode = SVAL(req->inbuf,smb_vwv3);
1765         smb_attr = SVAL(req->inbuf,smb_vwv5);
1766         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1767         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1768         oplock_request = ex_oplock_request | core_oplock_request;
1769         smb_ofun = SVAL(req->inbuf,smb_vwv8);
1770         allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv9);
1771
1772         /* If it's an IPC, pass off the pipe handler. */
1773         if (IS_IPC(conn)) {
1774                 if (lp_nt_pipe_support()) {
1775                         reply_open_pipe_and_X(conn, req);
1776                 } else {
1777                         reply_doserror(req, ERRSRV, ERRaccess);
1778                 }
1779                 END_PROFILE(SMBopenX);
1780                 return;
1781         }
1782
1783         /* XXXX we need to handle passed times, sattr and flags */
1784         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1785                         smb_buf(req->inbuf), 0, STR_TERMINATE,
1786                         &status);
1787         if (!NT_STATUS_IS_OK(status)) {
1788                 reply_nterror(req, status);
1789                 END_PROFILE(SMBopenX);
1790                 return;
1791         }
1792
1793         if (!map_open_params_to_ntcreate(
1794                     fname, deny_mode, smb_ofun, &access_mask,
1795                     &share_mode, &create_disposition, &create_options)) {
1796                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1797                 END_PROFILE(SMBopenX);
1798                 return;
1799         }
1800
1801         status = create_file(conn,                      /* conn */
1802                              req,                       /* req */
1803                              0,                         /* root_dir_fid */
1804                              fname,                     /* fname */
1805                              access_mask,               /* access_mask */
1806                              share_mode,                /* share_access */
1807                              create_disposition,        /* create_disposition*/
1808                              create_options,            /* create_options */
1809                              smb_attr,                  /* file_attributes */
1810                              oplock_request,            /* oplock_request */
1811                              0,                         /* allocation_size */
1812                              NULL,                      /* sd */
1813                              NULL,                      /* ea_list */
1814                              &fsp,                      /* result */
1815                              &smb_action,               /* pinfo */
1816                              &sbuf);                    /* psbuf */
1817
1818         if (!NT_STATUS_IS_OK(status)) {
1819                 END_PROFILE(SMBopenX);
1820                 if (open_was_deferred(req->mid)) {
1821                         /* We have re-scheduled this call. */
1822                         return;
1823                 }
1824                 reply_openerror(req, status);
1825                 return;
1826         }
1827
1828         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1829            if the file is truncated or created. */
1830         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1831                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1832                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1833                         close_file(fsp,ERROR_CLOSE);
1834                         reply_nterror(req, NT_STATUS_DISK_FULL);
1835                         END_PROFILE(SMBopenX);
1836                         return;
1837                 }
1838                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1839                 if (retval < 0) {
1840                         close_file(fsp,ERROR_CLOSE);
1841                         reply_nterror(req, NT_STATUS_DISK_FULL);
1842                         END_PROFILE(SMBopenX);
1843                         return;
1844                 }
1845                 sbuf.st_size = get_allocation_size(conn,fsp,&sbuf);
1846         }
1847
1848         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1849         mtime = sbuf.st_mtime;
1850         if (fattr & aDIR) {
1851                 close_file(fsp,ERROR_CLOSE);
1852                 reply_doserror(req, ERRDOS, ERRnoaccess);
1853                 END_PROFILE(SMBopenX);
1854                 return;
1855         }
1856
1857         /* If the caller set the extended oplock request bit
1858                 and we granted one (by whatever means) - set the
1859                 correct bit for extended oplock reply.
1860         */
1861
1862         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1863                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1864         }
1865
1866         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1867                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1868         }
1869
1870         /* If the caller set the core oplock request bit
1871                 and we granted one (by whatever means) - set the
1872                 correct bit for core oplock reply.
1873         */
1874
1875         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1876                 reply_outbuf(req, 19, 0);
1877         } else {
1878                 reply_outbuf(req, 15, 0);
1879         }
1880
1881         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1882                 SCVAL(req->outbuf, smb_flg,
1883                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1884         }
1885
1886         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1887                 SCVAL(req->outbuf, smb_flg,
1888                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1889         }
1890
1891         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1892         SSVAL(req->outbuf,smb_vwv3,fattr);
1893         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1894                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1895         } else {
1896                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1897         }
1898         SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1899         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1900         SSVAL(req->outbuf,smb_vwv11,smb_action);
1901
1902         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1903                 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1904         }
1905
1906         END_PROFILE(SMBopenX);
1907         chain_reply(req);
1908         return;
1909 }
1910
1911 /****************************************************************************
1912  Reply to a SMBulogoffX.
1913 ****************************************************************************/
1914
1915 void reply_ulogoffX(struct smb_request *req)
1916 {
1917         user_struct *vuser;
1918
1919         START_PROFILE(SMBulogoffX);
1920
1921         vuser = get_valid_user_struct(req->vuid);
1922
1923         if(vuser == NULL) {
1924                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1925                          req->vuid));
1926         }
1927
1928         /* in user level security we are supposed to close any files
1929                 open by this user */
1930         if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1931                 file_close_user(req->vuid);
1932         }
1933
1934         invalidate_vuid(req->vuid);
1935
1936         reply_outbuf(req, 2, 0);
1937
1938         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1939
1940         END_PROFILE(SMBulogoffX);
1941         chain_reply(req);
1942 }
1943
1944 /****************************************************************************
1945  Reply to a mknew or a create.
1946 ****************************************************************************/
1947
1948 void reply_mknew(struct smb_request *req)
1949 {
1950         connection_struct *conn = req->conn;
1951         char *fname = NULL;
1952         int com;
1953         uint32 fattr = 0;
1954         struct timespec ts[2];
1955         files_struct *fsp;
1956         int oplock_request = 0;
1957         SMB_STRUCT_STAT sbuf;
1958         NTSTATUS status;
1959         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1960         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1961         uint32 create_disposition;
1962         uint32 create_options = 0;
1963         TALLOC_CTX *ctx = talloc_tos();
1964
1965         START_PROFILE(SMBcreate);
1966
1967         if (req->wct < 3) {
1968                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1969                 END_PROFILE(SMBcreate);
1970                 return;
1971         }
1972
1973         fattr = SVAL(req->inbuf,smb_vwv0);
1974         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1975         com = SVAL(req->inbuf,smb_com);
1976
1977         ts[1] =convert_time_t_to_timespec(
1978                         srv_make_unix_date3(req->inbuf + smb_vwv1));
1979                         /* mtime. */
1980
1981         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1982                         smb_buf(req->inbuf) + 1, 0,
1983                         STR_TERMINATE, &status);
1984         if (!NT_STATUS_IS_OK(status)) {
1985                 reply_nterror(req, status);
1986                 END_PROFILE(SMBcreate);
1987                 return;
1988         }
1989
1990         if (fattr & aVOLID) {
1991                 DEBUG(0,("Attempt to create file (%s) with volid set - "
1992                         "please report this\n", fname));
1993         }
1994
1995         if(com == SMBmknew) {
1996                 /* We should fail if file exists. */
1997                 create_disposition = FILE_CREATE;
1998         } else {
1999                 /* Create if file doesn't exist, truncate if it does. */
2000                 create_disposition = FILE_OVERWRITE_IF;
2001         }
2002
2003         status = create_file(conn,                      /* conn */
2004                              req,                       /* req */
2005                              0,                         /* root_dir_fid */
2006                              fname,                     /* fname */
2007                              access_mask,               /* access_mask */
2008                              share_mode,                /* share_access */
2009                              create_disposition,        /* create_disposition*/
2010                              create_options,            /* create_options */
2011                              fattr,                     /* file_attributes */
2012                              oplock_request,            /* oplock_request */
2013                              0,                         /* allocation_size */
2014                              NULL,                      /* sd */
2015                              NULL,                      /* ea_list */
2016                              &fsp,                      /* result */
2017                              NULL,                      /* pinfo */
2018                              &sbuf);                    /* psbuf */
2019
2020         if (!NT_STATUS_IS_OK(status)) {
2021                 END_PROFILE(SMBcreate);
2022                 if (open_was_deferred(req->mid)) {
2023                         /* We have re-scheduled this call. */
2024                         return;
2025                 }
2026                 reply_openerror(req, status);
2027                 return;
2028         }
2029
2030         ts[0] = get_atimespec(&sbuf); /* atime. */
2031         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, ts, true);
2032         if (!NT_STATUS_IS_OK(status)) {
2033                 END_PROFILE(SMBcreate);
2034                 reply_openerror(req, status);
2035                 return;
2036         }
2037
2038         reply_outbuf(req, 1, 0);
2039         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2040
2041         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2042                 SCVAL(req->outbuf,smb_flg,
2043                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2044         }
2045
2046         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2047                 SCVAL(req->outbuf,smb_flg,
2048                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2049         }
2050
2051         DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2052         DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2053                     fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2054
2055         END_PROFILE(SMBcreate);
2056         return;
2057 }
2058
2059 /****************************************************************************
2060  Reply to a create temporary file.
2061 ****************************************************************************/
2062
2063 void reply_ctemp(struct smb_request *req)
2064 {
2065         connection_struct *conn = req->conn;
2066         char *fname = NULL;
2067         uint32 fattr;
2068         files_struct *fsp;
2069         int oplock_request;
2070         int tmpfd;
2071         SMB_STRUCT_STAT sbuf;
2072         char *s;
2073         NTSTATUS status;
2074         TALLOC_CTX *ctx = talloc_tos();
2075
2076         START_PROFILE(SMBctemp);
2077
2078         if (req->wct < 3) {
2079                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2080                 END_PROFILE(SMBctemp);
2081                 return;
2082         }
2083
2084         fattr = SVAL(req->inbuf,smb_vwv0);
2085         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2086
2087         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
2088                         smb_buf(req->inbuf)+1, 0, STR_TERMINATE,
2089                         &status);
2090         if (!NT_STATUS_IS_OK(status)) {
2091                 reply_nterror(req, status);
2092                 END_PROFILE(SMBctemp);
2093                 return;
2094         }
2095         if (*fname) {
2096                 fname = talloc_asprintf(ctx,
2097                                 "%s/TMXXXXXX",
2098                                 fname);
2099         } else {
2100                 fname = talloc_strdup(ctx, "TMXXXXXX");
2101         }
2102
2103         if (!fname) {
2104                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2105                 END_PROFILE(SMBctemp);
2106                 return;
2107         }
2108
2109         status = resolve_dfspath(ctx, conn,
2110                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2111                                 fname,
2112                                 &fname);
2113         if (!NT_STATUS_IS_OK(status)) {
2114                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2115                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2116                                         ERRSRV, ERRbadpath);
2117                         END_PROFILE(SMBctemp);
2118                         return;
2119                 }
2120                 reply_nterror(req, status);
2121                 END_PROFILE(SMBctemp);
2122                 return;
2123         }
2124
2125         status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2126         if (!NT_STATUS_IS_OK(status)) {
2127                 reply_nterror(req, status);
2128                 END_PROFILE(SMBctemp);
2129                 return;
2130         }
2131
2132         status = check_name(conn, fname);
2133         if (!NT_STATUS_IS_OK(status)) {
2134                 reply_nterror(req, status);
2135                 END_PROFILE(SMBctemp);
2136                 return;
2137         }
2138
2139         tmpfd = smb_mkstemp(fname);
2140         if (tmpfd == -1) {
2141                 reply_unixerror(req, ERRDOS, ERRnoaccess);
2142                 END_PROFILE(SMBctemp);
2143                 return;
2144         }
2145
2146         SMB_VFS_STAT(conn,fname,&sbuf);
2147
2148         /* We should fail if file does not exist. */
2149         status = open_file_ntcreate(conn, req, fname, &sbuf,
2150                                 FILE_GENERIC_READ | FILE_GENERIC_WRITE,
2151                                 FILE_SHARE_READ|FILE_SHARE_WRITE,
2152                                 FILE_OPEN,
2153                                 0,
2154                                 fattr,
2155                                 oplock_request,
2156                                 NULL, &fsp);
2157
2158         /* close fd from smb_mkstemp() */
2159         close(tmpfd);
2160
2161         if (!NT_STATUS_IS_OK(status)) {
2162                 if (open_was_deferred(req->mid)) {
2163                         /* We have re-scheduled this call. */
2164                         END_PROFILE(SMBctemp);
2165                         return;
2166                 }
2167                 reply_openerror(req, status);
2168                 END_PROFILE(SMBctemp);
2169                 return;
2170         }
2171
2172         reply_outbuf(req, 1, 0);
2173         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2174
2175         /* the returned filename is relative to the directory */
2176         s = strrchr_m(fsp->fsp_name, '/');
2177         if (!s) {
2178                 s = fsp->fsp_name;
2179         } else {
2180                 s++;
2181         }
2182
2183 #if 0
2184         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2185            thing in the byte section. JRA */
2186         SSVALS(p, 0, -1); /* what is this? not in spec */
2187 #endif
2188         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2189             == -1) {
2190                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2191                 END_PROFILE(SMBctemp);
2192                 return;
2193         }
2194
2195         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2196                 SCVAL(req->outbuf, smb_flg,
2197                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2198         }
2199
2200         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2201                 SCVAL(req->outbuf, smb_flg,
2202                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2203         }
2204
2205         DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2206         DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2207                     fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2208
2209         END_PROFILE(SMBctemp);
2210         return;
2211 }
2212
2213 /*******************************************************************
2214  Check if a user is allowed to rename a file.
2215 ********************************************************************/
2216
2217 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2218                            uint16 dirtype, SMB_STRUCT_STAT *pst)
2219 {
2220         uint32 fmode;
2221
2222         if (!CAN_WRITE(conn)) {
2223                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2224         }
2225
2226         fmode = dos_mode(conn, fsp->fsp_name, pst);
2227         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2228                 return NT_STATUS_NO_SUCH_FILE;
2229         }
2230
2231         if (S_ISDIR(pst->st_mode)) {
2232                 return NT_STATUS_OK;
2233         }
2234
2235         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2236                 return NT_STATUS_OK;
2237         }
2238
2239         return NT_STATUS_ACCESS_DENIED;
2240 }
2241
2242 /*******************************************************************
2243  * unlink a file with all relevant access checks
2244  *******************************************************************/
2245
2246 static NTSTATUS do_unlink(connection_struct *conn,
2247                         struct smb_request *req,
2248                         const char *fname,
2249                         uint32 dirtype)
2250 {
2251         SMB_STRUCT_STAT sbuf;
2252         uint32 fattr;
2253         files_struct *fsp;
2254         uint32 dirtype_orig = dirtype;
2255         NTSTATUS status;
2256
2257         DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2258
2259         if (!CAN_WRITE(conn)) {
2260                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2261         }
2262
2263         if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2264                 return map_nt_error_from_unix(errno);
2265         }
2266
2267         fattr = dos_mode(conn,fname,&sbuf);
2268
2269         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2270                 dirtype = aDIR|aARCH|aRONLY;
2271         }
2272
2273         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2274         if (!dirtype) {
2275                 return NT_STATUS_NO_SUCH_FILE;
2276         }
2277
2278         if (!dir_check_ftype(conn, fattr, dirtype)) {
2279                 if (fattr & aDIR) {
2280                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2281                 }
2282                 return NT_STATUS_NO_SUCH_FILE;
2283         }
2284
2285         if (dirtype_orig & 0x8000) {
2286                 /* These will never be set for POSIX. */
2287                 return NT_STATUS_NO_SUCH_FILE;
2288         }
2289
2290 #if 0
2291         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2292                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2293         }
2294
2295         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2296                 return NT_STATUS_NO_SUCH_FILE;
2297         }
2298
2299         if (dirtype & 0xFF00) {
2300                 /* These will never be set for POSIX. */
2301                 return NT_STATUS_NO_SUCH_FILE;
2302         }
2303
2304         dirtype &= 0xFF;
2305         if (!dirtype) {
2306                 return NT_STATUS_NO_SUCH_FILE;
2307         }
2308
2309         /* Can't delete a directory. */
2310         if (fattr & aDIR) {
2311                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2312         }
2313 #endif
2314
2315 #if 0 /* JRATEST */
2316         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2317                 return NT_STATUS_OBJECT_NAME_INVALID;
2318 #endif /* JRATEST */
2319
2320         /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2321
2322           On a Windows share, a file with read-only dosmode can be opened with
2323           DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2324           fails with NT_STATUS_CANNOT_DELETE error.
2325
2326           This semantic causes a problem that a user can not
2327           rename a file with read-only dosmode on a Samba share
2328           from a Windows command prompt (i.e. cmd.exe, but can rename
2329           from Windows Explorer).
2330         */
2331
2332         if (!lp_delete_readonly(SNUM(conn))) {
2333                 if (fattr & aRONLY) {
2334                         return NT_STATUS_CANNOT_DELETE;
2335                 }
2336         }
2337
2338         /* On open checks the open itself will check the share mode, so
2339            don't do it here as we'll get it wrong. */
2340
2341         status = create_file_unixpath
2342                 (conn,                  /* conn */
2343                  req,                   /* req */
2344                  fname,                 /* fname */
2345                  DELETE_ACCESS,         /* access_mask */
2346                  FILE_SHARE_NONE,       /* share_access */
2347                  FILE_OPEN,             /* create_disposition*/
2348                  FILE_NON_DIRECTORY_FILE, /* create_options */
2349                  FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2350                  0,                     /* oplock_request */
2351                  0,                     /* allocation_size */
2352                  NULL,                  /* sd */
2353                  NULL,                  /* ea_list */
2354                  &fsp,                  /* result */
2355                  NULL,                  /* pinfo */
2356                  &sbuf);                /* psbuf */
2357
2358         if (!NT_STATUS_IS_OK(status)) {
2359                 DEBUG(10, ("create_file_unixpath failed: %s\n",
2360                            nt_errstr(status)));
2361                 return status;
2362         }
2363
2364         /* The set is across all open files on this dev/inode pair. */
2365         if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2366                 close_file(fsp, NORMAL_CLOSE);
2367                 return NT_STATUS_ACCESS_DENIED;
2368         }
2369
2370         return close_file(fsp,NORMAL_CLOSE);
2371 }
2372
2373 /****************************************************************************
2374  The guts of the unlink command, split out so it may be called by the NT SMB
2375  code.
2376 ****************************************************************************/
2377
2378 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2379                           uint32 dirtype, const char *name_in, bool has_wild)
2380 {
2381         const char *directory = NULL;
2382         char *mask = NULL;
2383         char *name = NULL;
2384         char *p = NULL;
2385         int count=0;
2386         NTSTATUS status = NT_STATUS_OK;
2387         SMB_STRUCT_STAT sbuf;
2388         TALLOC_CTX *ctx = talloc_tos();
2389
2390         status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2391         if (!NT_STATUS_IS_OK(status)) {
2392                 return status;
2393         }
2394
2395         p = strrchr_m(name,'/');
2396         if (!p) {
2397                 directory = talloc_strdup(ctx, ".");
2398                 if (!directory) {
2399                         return NT_STATUS_NO_MEMORY;
2400                 }
2401                 mask = name;
2402         } else {
2403                 *p = 0;
2404                 directory = name;
2405                 mask = p+1;
2406         }
2407
2408         /*
2409          * We should only check the mangled cache
2410          * here if unix_convert failed. This means
2411          * that the path in 'mask' doesn't exist
2412          * on the file system and so we need to look
2413          * for a possible mangle. This patch from
2414          * Tine Smukavec <valentin.smukavec@hermes.si>.
2415          */
2416
2417         if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2418                 char *new_mask = NULL;
2419                 mangle_lookup_name_from_8_3(ctx,
2420                                 mask,
2421                                 &new_mask,
2422                                 conn->params );
2423                 if (new_mask) {
2424                         mask = new_mask;
2425                 }
2426         }
2427
2428         if (!has_wild) {
2429                 directory = talloc_asprintf(ctx,
2430                                 "%s/%s",
2431                                 directory,
2432                                 mask);
2433                 if (!directory) {
2434                         return NT_STATUS_NO_MEMORY;
2435                 }
2436                 if (dirtype == 0) {
2437                         dirtype = FILE_ATTRIBUTE_NORMAL;
2438                 }
2439
2440                 status = check_name(conn, directory);
2441                 if (!NT_STATUS_IS_OK(status)) {
2442                         return status;
2443                 }
2444
2445                 status = do_unlink(conn, req, directory, dirtype);
2446                 if (!NT_STATUS_IS_OK(status)) {
2447                         return status;
2448                 }
2449
2450                 count++;
2451         } else {
2452                 struct smb_Dir *dir_hnd = NULL;
2453                 long offset = 0;
2454                 const char *dname;
2455
2456                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2457                         return NT_STATUS_OBJECT_NAME_INVALID;
2458                 }
2459
2460                 if (strequal(mask,"????????.???")) {
2461                         mask[0] = '*';
2462                         mask[1] = '\0';
2463                 }
2464
2465                 status = check_name(conn, directory);
2466                 if (!NT_STATUS_IS_OK(status)) {
2467                         return status;
2468                 }
2469
2470                 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2471                                   dirtype);
2472                 if (dir_hnd == NULL) {
2473                         return map_nt_error_from_unix(errno);
2474                 }
2475
2476                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2477                    the pattern matches against the long name, otherwise the short name
2478                    We don't implement this yet XXXX
2479                 */
2480
2481                 status = NT_STATUS_NO_SUCH_FILE;
2482
2483                 while ((dname = ReadDirName(dir_hnd, &offset))) {
2484                         SMB_STRUCT_STAT st;
2485                         char *fname = NULL;
2486
2487                         if (!is_visible_file(conn, directory, dname, &st, True)) {
2488                                 continue;
2489                         }
2490
2491                         /* Quick check for "." and ".." */
2492                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2493                                 continue;
2494                         }
2495
2496                         if(!mask_match(dname, mask, conn->case_sensitive)) {
2497                                 continue;
2498                         }
2499
2500                         fname = talloc_asprintf(ctx, "%s/%s",
2501                                         directory,
2502                                         dname);
2503                         if (!fname) {
2504                                 return NT_STATUS_NO_MEMORY;
2505                         }
2506
2507                         status = check_name(conn, fname);
2508                         if (!NT_STATUS_IS_OK(status)) {
2509                                 TALLOC_FREE(dir_hnd);
2510                                 return status;
2511                         }
2512
2513                         status = do_unlink(conn, req, fname, dirtype);
2514                         if (!NT_STATUS_IS_OK(status)) {
2515                                 TALLOC_FREE(fname);
2516                                 continue;
2517                         }
2518
2519                         count++;
2520                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2521                                  fname));
2522
2523                         TALLOC_FREE(fname);
2524                 }
2525                 TALLOC_FREE(dir_hnd);
2526         }
2527
2528         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2529                 status = map_nt_error_from_unix(errno);
2530         }
2531
2532         return status;
2533 }
2534
2535 /****************************************************************************
2536  Reply to a unlink
2537 ****************************************************************************/
2538
2539 void reply_unlink(struct smb_request *req)
2540 {
2541         connection_struct *conn = req->conn;
2542         char *name = NULL;
2543         uint32 dirtype;
2544         NTSTATUS status;
2545         bool path_contains_wcard = False;
2546         TALLOC_CTX *ctx = talloc_tos();
2547
2548         START_PROFILE(SMBunlink);
2549
2550         if (req->wct < 1) {
2551                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2552                 END_PROFILE(SMBunlink);
2553                 return;
2554         }
2555
2556         dirtype = SVAL(req->inbuf,smb_vwv0);
2557
2558         srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name,
2559                               smb_buf(req->inbuf) + 1, 0,
2560                               STR_TERMINATE, &status, &path_contains_wcard);
2561         if (!NT_STATUS_IS_OK(status)) {
2562                 reply_nterror(req, status);
2563                 END_PROFILE(SMBunlink);
2564                 return;
2565         }
2566
2567         status = resolve_dfspath_wcard(ctx, conn,
2568                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
2569                                        name,
2570                                        &name,
2571                                        &path_contains_wcard);
2572         if (!NT_STATUS_IS_OK(status)) {
2573                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2574                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2575                                         ERRSRV, ERRbadpath);
2576                         END_PROFILE(SMBunlink);
2577                         return;
2578                 }
2579                 reply_nterror(req, status);
2580                 END_PROFILE(SMBunlink);
2581                 return;
2582         }
2583
2584         DEBUG(3,("reply_unlink : %s\n",name));
2585
2586         status = unlink_internals(conn, req, dirtype, name,
2587                                   path_contains_wcard);
2588         if (!NT_STATUS_IS_OK(status)) {
2589                 if (open_was_deferred(req->mid)) {
2590                         /* We have re-scheduled this call. */
2591                         END_PROFILE(SMBunlink);
2592                         return;
2593                 }
2594                 reply_nterror(req, status);
2595                 END_PROFILE(SMBunlink);
2596                 return;
2597         }
2598
2599         reply_outbuf(req, 0, 0);
2600         END_PROFILE(SMBunlink);
2601
2602         return;
2603 }
2604
2605 /****************************************************************************
2606  Fail for readbraw.
2607 ****************************************************************************/
2608
2609 static void fail_readraw(void)
2610 {
2611         const char *errstr = talloc_asprintf(talloc_tos(),
2612                         "FAIL ! reply_readbraw: socket write fail (%s)",
2613                         strerror(errno));
2614         if (!errstr) {
2615                 errstr = "";
2616         }
2617         exit_server_cleanly(errstr);
2618 }
2619
2620 /****************************************************************************
2621  Fake (read/write) sendfile. Returns -1 on read or write fail.
2622 ****************************************************************************/
2623
2624 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2625                              size_t nread)
2626 {
2627         size_t bufsize;
2628         size_t tosend = nread;
2629         char *buf;
2630
2631         if (nread == 0) {
2632                 return 0;
2633         }
2634
2635         bufsize = MIN(nread, 65536);
2636
2637         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2638                 return -1;
2639         }
2640
2641         while (tosend > 0) {
2642                 ssize_t ret;
2643                 size_t cur_read;
2644
2645                 if (tosend > bufsize) {
2646                         cur_read = bufsize;
2647                 } else {
2648                         cur_read = tosend;
2649                 }
2650                 ret = read_file(fsp,buf,startpos,cur_read);
2651                 if (ret == -1) {
2652                         SAFE_FREE(buf);
2653                         return -1;
2654                 }
2655
2656                 /* If we had a short read, fill with zeros. */
2657                 if (ret < cur_read) {
2658                         memset(buf, '\0', cur_read - ret);
2659                 }
2660
2661                 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2662                         SAFE_FREE(buf);
2663                         return -1;
2664                 }
2665                 tosend -= cur_read;
2666                 startpos += cur_read;
2667         }
2668
2669         SAFE_FREE(buf);
2670         return (ssize_t)nread;
2671 }
2672
2673 /****************************************************************************
2674  Return a readbraw error (4 bytes of zero).
2675 ****************************************************************************/
2676
2677 static void reply_readbraw_error(void)
2678 {
2679         char header[4];
2680         SIVAL(header,0,0);
2681         if (write_data(smbd_server_fd(),header,4) != 4) {
2682                 fail_readraw();
2683         }
2684 }
2685
2686 /****************************************************************************
2687  Use sendfile in readbraw.
2688 ****************************************************************************/
2689
2690 void send_file_readbraw(connection_struct *conn,
2691                         files_struct *fsp,
2692                         SMB_OFF_T startpos,
2693                         size_t nread,
2694                         ssize_t mincount)
2695 {
2696         char *outbuf = NULL;
2697         ssize_t ret=0;
2698
2699 #if defined(WITH_SENDFILE)
2700         /*
2701          * We can only use sendfile on a non-chained packet
2702          * but we can use on a non-oplocked file. tridge proved this
2703          * on a train in Germany :-). JRA.
2704          * reply_readbraw has already checked the length.
2705          */
2706
2707         if ( (chain_size == 0) && (nread > 0) && (fsp->base_fsp == NULL) &&
2708             (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2709                 char header[4];
2710                 DATA_BLOB header_blob;
2711
2712                 _smb_setlen(header,nread);
2713                 header_blob = data_blob_const(header, 4);
2714
2715                 if (SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2716                                 &header_blob, startpos, nread) == -1) {
2717                         /* Returning ENOSYS means no data at all was sent.
2718                          * Do this as a normal read. */
2719                         if (errno == ENOSYS) {
2720                                 goto normal_readbraw;
2721                         }
2722
2723                         /*
2724                          * Special hack for broken Linux with no working sendfile. If we
2725                          * return EINTR we sent the header but not the rest of the data.
2726                          * Fake this up by doing read/write calls.
2727                          */
2728                         if (errno == EINTR) {
2729                                 /* Ensure we don't do this again. */
2730                                 set_use_sendfile(SNUM(conn), False);
2731                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2732
2733                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
2734                                         DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2735                                                 fsp->fsp_name, strerror(errno) ));
2736                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2737                                 }
2738                                 return;
2739                         }
2740
2741                         DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2742                                 fsp->fsp_name, strerror(errno) ));
2743                         exit_server_cleanly("send_file_readbraw sendfile failed");
2744                 }
2745
2746                 return;
2747         }
2748 #endif
2749
2750 normal_readbraw:
2751
2752         outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2753         if (!outbuf) {
2754                 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2755                         (unsigned)(nread+4)));
2756                 reply_readbraw_error();
2757                 return;
2758         }
2759
2760         if (nread > 0) {
2761                 ret = read_file(fsp,outbuf+4,startpos,nread);
2762 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2763                 if (ret < mincount)
2764                         ret = 0;
2765 #else
2766                 if (ret < nread)
2767                         ret = 0;
2768 #endif
2769         }
2770
2771         _smb_setlen(outbuf,ret);
2772         if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2773                 fail_readraw();
2774
2775         TALLOC_FREE(outbuf);
2776 }
2777
2778 /****************************************************************************
2779  Reply to a readbraw (core+ protocol).
2780 ****************************************************************************/
2781
2782 void reply_readbraw(struct smb_request *req)
2783 {
2784         connection_struct *conn = req->conn;
2785         ssize_t maxcount,mincount;
2786         size_t nread = 0;
2787         SMB_OFF_T startpos;
2788         files_struct *fsp;
2789         SMB_STRUCT_STAT st;
2790         SMB_OFF_T size = 0;
2791
2792         START_PROFILE(SMBreadbraw);
2793
2794         if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
2795                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2796                         "raw reads/writes are disallowed.");
2797         }
2798
2799         if (req->wct < 8) {
2800                 reply_readbraw_error();
2801                 END_PROFILE(SMBreadbraw);
2802                 return;
2803         }
2804
2805         /*
2806          * Special check if an oplock break has been issued
2807          * and the readraw request croses on the wire, we must
2808          * return a zero length response here.
2809          */
2810
2811         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
2812
2813         /*
2814          * We have to do a check_fsp by hand here, as
2815          * we must always return 4 zero bytes on error,
2816          * not a NTSTATUS.
2817          */
2818
2819         if (!fsp || !conn || conn != fsp->conn ||
2820                         req->vuid != fsp->vuid ||
2821                         fsp->is_directory || fsp->fh->fd == -1) {
2822                 /*
2823                  * fsp could be NULL here so use the value from the packet. JRA.
2824                  */
2825                 DEBUG(3,("reply_readbraw: fnum %d not valid "
2826                         "- cache prime?\n",
2827                         (int)SVAL(req->inbuf,smb_vwv0)));
2828                 reply_readbraw_error();
2829                 END_PROFILE(SMBreadbraw);
2830                 return;
2831         }
2832
2833         /* Do a "by hand" version of CHECK_READ. */
2834         if (!(fsp->can_read ||
2835                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2836                                 (fsp->access_mask & FILE_EXECUTE)))) {
2837                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2838                                 (int)SVAL(req->inbuf,smb_vwv0)));
2839                 reply_readbraw_error();
2840                 END_PROFILE(SMBreadbraw);
2841                 return;
2842         }
2843
2844         flush_write_cache(fsp, READRAW_FLUSH);
2845
2846         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv1);
2847         if(req->wct == 10) {
2848                 /*
2849                  * This is a large offset (64 bit) read.
2850                  */
2851 #ifdef LARGE_SMB_OFF_T
2852
2853                 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv8)) << 32);
2854
2855 #else /* !LARGE_SMB_OFF_T */
2856
2857                 /*
2858                  * Ensure we haven't been sent a >32 bit offset.
2859                  */
2860
2861                 if(IVAL(req->inbuf,smb_vwv8) != 0) {
2862                         DEBUG(0,("reply_readbraw: large offset "
2863                                 "(%x << 32) used and we don't support "
2864                                 "64 bit offsets.\n",
2865                         (unsigned int)IVAL(req->inbuf,smb_vwv8) ));
2866                         reply_readbraw_error();
2867                         END_PROFILE(SMBreadbraw);
2868                         return;
2869                 }
2870
2871 #endif /* LARGE_SMB_OFF_T */
2872
2873                 if(startpos < 0) {
2874                         DEBUG(0,("reply_readbraw: negative 64 bit "
2875                                 "readraw offset (%.0f) !\n",
2876                                 (double)startpos ));
2877                         reply_readbraw_error();
2878                         END_PROFILE(SMBreadbraw);
2879                         return;
2880                 }
2881         }
2882
2883         maxcount = (SVAL(req->inbuf,smb_vwv3) & 0xFFFF);
2884         mincount = (SVAL(req->inbuf,smb_vwv4) & 0xFFFF);
2885
2886         /* ensure we don't overrun the packet size */
2887         maxcount = MIN(65535,maxcount);
2888
2889         if (is_locked(fsp,(uint32)req->smbpid,
2890                         (SMB_BIG_UINT)maxcount,
2891                         (SMB_BIG_UINT)startpos,
2892                         READ_LOCK)) {
2893                 reply_readbraw_error();
2894                 END_PROFILE(SMBreadbraw);
2895                 return;
2896         }
2897
2898         if (SMB_VFS_FSTAT(fsp, &st) == 0) {
2899                 size = st.st_size;
2900         }
2901
2902         if (startpos >= size) {
2903                 nread = 0;
2904         } else {
2905                 nread = MIN(maxcount,(size - startpos));
2906         }
2907
2908 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2909         if (nread < mincount)
2910                 nread = 0;
2911 #endif
2912
2913         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
2914                 "min=%lu nread=%lu\n",
2915                 fsp->fnum, (double)startpos,
2916                 (unsigned long)maxcount,
2917                 (unsigned long)mincount,
2918                 (unsigned long)nread ) );
2919
2920         send_file_readbraw(conn, fsp, startpos, nread, mincount);
2921
2922         DEBUG(5,("reply_readbraw finished\n"));
2923         END_PROFILE(SMBreadbraw);
2924 }
2925
2926 #undef DBGC_CLASS
2927 #define DBGC_CLASS DBGC_LOCKING
2928
2929 /****************************************************************************
2930  Reply to a lockread (core+ protocol).
2931 ****************************************************************************/
2932
2933 void reply_lockread(struct smb_request *req)
2934 {
2935         connection_struct *conn = req->conn;
2936         ssize_t nread = -1;
2937         char *data;
2938         SMB_OFF_T startpos;
2939         size_t numtoread;
2940         NTSTATUS status;
2941         files_struct *fsp;
2942         struct byte_range_lock *br_lck = NULL;
2943         char *p = NULL;
2944
2945         START_PROFILE(SMBlockread);
2946
2947         if (req->wct < 5) {
2948                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2949                 END_PROFILE(SMBlockread);
2950                 return;
2951         }
2952
2953         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
2954
2955         if (!check_fsp(conn, req, fsp)) {
2956                 END_PROFILE(SMBlockread);
2957                 return;
2958         }
2959
2960         if (!CHECK_READ(fsp,req->inbuf)) {
2961                 reply_doserror(req, ERRDOS, ERRbadaccess);
2962                 END_PROFILE(SMBlockread);
2963                 return;
2964         }
2965
2966         release_level_2_oplocks_on_change(fsp);
2967
2968         numtoread = SVAL(req->inbuf,smb_vwv1);
2969         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
2970
2971         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
2972
2973         reply_outbuf(req, 5, numtoread + 3);
2974
2975         data = smb_buf(req->outbuf) + 3;
2976
2977         /*
2978          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
2979          * protocol request that predates the read/write lock concept.
2980          * Thus instead of asking for a read lock here we need to ask
2981          * for a write lock. JRA.
2982          * Note that the requested lock size is unaffected by max_recv.
2983          */
2984
2985         br_lck = do_lock(smbd_messaging_context(),
2986                         fsp,
2987                         req->smbpid,
2988                         (SMB_BIG_UINT)numtoread,
2989                         (SMB_BIG_UINT)startpos,
2990                         WRITE_LOCK,
2991                         WINDOWS_LOCK,
2992                         False, /* Non-blocking lock. */
2993                         &status,
2994                         NULL);
2995         TALLOC_FREE(br_lck);
2996
2997         if (NT_STATUS_V(status)) {
2998                 reply_nterror(req, status);
2999                 END_PROFILE(SMBlockread);
3000                 return;
3001         }
3002
3003         /*
3004          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3005          */
3006
3007         if (numtoread > max_recv) {
3008                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3009 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3010                         (unsigned int)numtoread, (unsigned int)max_recv ));
3011                 numtoread = MIN(numtoread,max_recv);
3012         }
3013         nread = read_file(fsp,data,startpos,numtoread);
3014
3015         if (nread < 0) {
3016                 reply_unixerror(req, ERRDOS, ERRnoaccess);
3017                 END_PROFILE(SMBlockread);
3018                 return;
3019         }
3020
3021         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3022
3023         SSVAL(req->outbuf,smb_vwv0,nread);
3024         SSVAL(req->outbuf,smb_vwv5,nread+3);
3025         p = smb_buf(req->outbuf);
3026         SCVAL(p,0,0); /* pad byte. */
3027         SSVAL(p,1,nread);
3028
3029         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3030                  fsp->fnum, (int)numtoread, (int)nread));
3031
3032         END_PROFILE(SMBlockread);
3033         return;
3034 }
3035
3036 #undef DBGC_CLASS
3037 #define DBGC_CLASS DBGC_ALL
3038
3039 /****************************************************************************
3040  Reply to a read.
3041 ****************************************************************************/
3042
3043 void reply_read(struct smb_request *req)
3044 {
3045         connection_struct *conn = req->conn;
3046         size_t numtoread;
3047         ssize_t nread = 0;
3048         char *data;
3049         SMB_OFF_T startpos;
3050         int outsize = 0;
3051         files_struct *fsp;
3052
3053         START_PROFILE(SMBread);
3054
3055         if (req->wct < 3) {
3056                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3057                 END_PROFILE(SMBread);
3058                 return;
3059         }
3060
3061         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3062
3063         if (!check_fsp(conn, req, fsp)) {
3064                 END_PROFILE(SMBread);
3065                 return;
3066         }
3067
3068         if (!CHECK_READ(fsp,req->inbuf)) {
3069                 reply_doserror(req, ERRDOS, ERRbadaccess);
3070                 END_PROFILE(SMBread);
3071                 return;
3072         }
3073
3074         numtoread = SVAL(req->inbuf,smb_vwv1);
3075         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3076
3077         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3078
3079         /*
3080          * The requested read size cannot be greater than max_recv. JRA.
3081          */
3082         if (numtoread > max_recv) {
3083                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3084 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3085                         (unsigned int)numtoread, (unsigned int)max_recv ));
3086                 numtoread = MIN(numtoread,max_recv);
3087         }
3088
3089         reply_outbuf(req, 5, numtoread+3);
3090
3091         data = smb_buf(req->outbuf) + 3;
3092
3093         if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtoread,
3094                       (SMB_BIG_UINT)startpos, READ_LOCK)) {
3095                 reply_doserror(req, ERRDOS,ERRlock);
3096                 END_PROFILE(SMBread);
3097                 return;
3098         }
3099
3100         if (numtoread > 0)
3101                 nread = read_file(fsp,data,startpos,numtoread);
3102
3103         if (nread < 0) {
3104                 reply_unixerror(req, ERRDOS,ERRnoaccess);
3105                 END_PROFILE(SMBread);
3106                 return;
3107         }
3108
3109         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3110
3111         SSVAL(req->outbuf,smb_vwv0,nread);
3112         SSVAL(req->outbuf,smb_vwv5,nread+3);
3113         SCVAL(smb_buf(req->outbuf),0,1);
3114         SSVAL(smb_buf(req->outbuf),1,nread);
3115
3116         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3117                 fsp->fnum, (int)numtoread, (int)nread ) );
3118
3119         END_PROFILE(SMBread);
3120         return;
3121 }
3122
3123 /****************************************************************************
3124  Setup readX header.
3125 ****************************************************************************/
3126
3127 static int setup_readX_header(char *outbuf, size_t smb_maxcnt)
3128 {
3129         int outsize;
3130         char *data;
3131
3132         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3133         data = smb_buf(outbuf);
3134
3135         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3136
3137         SCVAL(outbuf,smb_vwv0,0xFF);
3138         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3139         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3140         SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
3141         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3142         SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
3143         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3144         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3145         return outsize;
3146 }
3147
3148 /****************************************************************************
3149  Reply to a read and X - possibly using sendfile.
3150 ****************************************************************************/
3151
3152 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3153                             files_struct *fsp, SMB_OFF_T startpos,
3154                             size_t smb_maxcnt)
3155 {
3156         SMB_STRUCT_STAT sbuf;
3157         ssize_t nread = -1;
3158
3159         if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3160                 reply_unixerror(req, ERRDOS, ERRnoaccess);
3161                 return;
3162         }
3163
3164         if (startpos > sbuf.st_size) {
3165                 smb_maxcnt = 0;
3166         } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
3167                 smb_maxcnt = (sbuf.st_size - startpos);
3168         }
3169
3170         if (smb_maxcnt == 0) {
3171                 goto normal_read;
3172         }
3173
3174 #if defined(WITH_SENDFILE)
3175         /*
3176          * We can only use sendfile on a non-chained packet
3177          * but we can use on a non-oplocked file. tridge proved this
3178          * on a train in Germany :-). JRA.
3179          */
3180
3181         if ((chain_size == 0) && (CVAL(req->inbuf,smb_vwv0) == 0xFF) &&
3182             !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3183             lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
3184                 uint8 headerbuf[smb_size + 12 * 2];
3185                 DATA_BLOB header;
3186
3187                 /*
3188                  * Set up the packet header before send. We
3189                  * assume here the sendfile will work (get the
3190                  * correct amount of data).
3191                  */
3192
3193                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3194
3195                 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3196                 setup_readX_header((char *)headerbuf, smb_maxcnt);
3197
3198                 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3199                         /* Returning ENOSYS or EINVAL means no data at all was sent.
3200                            Do this as a normal read. */
3201                         if (errno == ENOSYS || errno == EINVAL) {
3202                                 goto normal_read;
3203                         }
3204
3205                         /*
3206                          * Special hack for broken Linux with no working sendfile. If we
3207                          * return EINTR we sent the header but not the rest of the data.
3208                          * Fake this up by doing read/write calls.
3209                          */
3210
3211                         if (errno == EINTR) {
3212                                 /* Ensure we don't do this again. */
3213                                 set_use_sendfile(SNUM(conn), False);
3214                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3215                                 nread = fake_sendfile(fsp, startpos,
3216                                                       smb_maxcnt);
3217                                 if (nread == -1) {
3218                                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3219                                                 fsp->fsp_name, strerror(errno) ));
3220                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3221                                 }
3222                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3223                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3224                                 /* No outbuf here means successful sendfile. */
3225                                 TALLOC_FREE(req->outbuf);
3226                                 return;
3227                         }
3228
3229                         DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3230                                 fsp->fsp_name, strerror(errno) ));
3231                         exit_server_cleanly("send_file_readX sendfile failed");
3232                 }
3233
3234                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3235                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3236                 /* No outbuf here means successful sendfile. */
3237                 TALLOC_FREE(req->outbuf);
3238                 return;
3239         }
3240 #endif
3241
3242 normal_read:
3243
3244         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3245                 uint8 headerbuf[smb_size + 2*12];
3246
3247                 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3248                 setup_readX_header((char *)headerbuf, smb_maxcnt);
3249
3250                 /* Send out the header. */
3251                 if (write_data(smbd_server_fd(), (char *)headerbuf,
3252                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3253                         DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3254                                 fsp->fsp_name, strerror(errno) ));
3255                         exit_server_cleanly("send_file_readX sendfile failed");
3256                 }
3257                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3258                 if (nread == -1) {
3259                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3260                                 fsp->fsp_name, strerror(errno) ));
3261                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3262                 }
3263                 TALLOC_FREE(req->outbuf);
3264                 return;
3265         }
3266
3267         reply_outbuf(req, 12, smb_maxcnt);
3268
3269         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3270         if (nread < 0) {
3271                 reply_unixerror(req, ERRDOS, ERRnoaccess);
3272                 return;
3273         }
3274
3275         setup_readX_header((char *)req->outbuf, nread);
3276
3277         DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3278                     fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3279
3280         chain_reply(req);
3281 }
3282
3283 /****************************************************************************
3284  Reply to a read and X.
3285 ****************************************************************************/
3286
3287 void reply_read_and_X(struct smb_request *req)
3288 {
3289         connection_struct *conn = req->conn;
3290         files_struct *fsp;
3291         SMB_OFF_T startpos;
3292         size_t smb_maxcnt;
3293         bool big_readX = False;
3294 #if 0
3295         size_t smb_mincnt = SVAL(req->inbuf,smb_vwv6);
3296 #endif
3297
3298         START_PROFILE(SMBreadX);
3299
3300         if ((req->wct != 10) && (req->wct != 12)) {
3301                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3302                 return;
3303         }
3304
3305         fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
3306         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3307         smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
3308
3309         /* If it's an IPC, pass off the pipe handler. */
3310         if (IS_IPC(conn)) {
3311                 reply_pipe_read_and_X(req);
3312                 END_PROFILE(SMBreadX);
3313                 return;
3314         }
3315
3316         if (!check_fsp(conn, req, fsp)) {
3317                 END_PROFILE(SMBreadX);
3318                 return;
3319         }
3320
3321         if (!CHECK_READ(fsp,req->inbuf)) {
3322                 reply_doserror(req, ERRDOS,ERRbadaccess);
3323                 END_PROFILE(SMBreadX);
3324                 return;
3325         }
3326
3327         if (global_client_caps & CAP_LARGE_READX) {
3328                 size_t upper_size = SVAL(req->inbuf,smb_vwv7);
3329                 smb_maxcnt |= (upper_size<<16);
3330                 if (upper_size > 1) {
3331                         /* Can't do this on a chained packet. */
3332                         if ((CVAL(req->inbuf,smb_vwv0) != 0xFF)) {
3333                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3334                                 END_PROFILE(SMBreadX);
3335                                 return;
3336                         }
3337                         /* We currently don't do this on signed or sealed data. */
3338                         if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
3339                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3340                                 END_PROFILE(SMBreadX);
3341                                 return;
3342                         }
3343                         /* Is there room in the reply for this data ? */
3344                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3345                                 reply_nterror(req,
3346                                               NT_STATUS_INVALID_PARAMETER);
3347                                 END_PROFILE(SMBreadX);
3348                                 return;
3349                         }
3350                         big_readX = True;
3351                 }
3352         }
3353
3354         if (req->wct == 12) {
3355 #ifdef LARGE_SMB_OFF_T
3356                 /*
3357                  * This is a large offset (64 bit) read.
3358                  */
3359                 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv10)) << 32);
3360
3361 #else /* !LARGE_SMB_OFF_T */
3362
3363                 /*
3364                  * Ensure we haven't been sent a >32 bit offset.
3365                  */
3366
3367                 if(IVAL(req->inbuf,smb_vwv10) != 0) {
3368                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3369                                  "used and we don't support 64 bit offsets.\n",
3370                                  (unsigned int)IVAL(req->inbuf,smb_vwv10) ));
3371                         END_PROFILE(SMBreadX);
3372                         reply_doserror(req, ERRDOS, ERRbadaccess);
3373                         return;
3374                 }
3375
3376 #endif /* LARGE_SMB_OFF_T */
3377
3378         }
3379
3380         if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)smb_maxcnt,
3381                       (SMB_BIG_UINT)startpos, READ_LOCK)) {
3382                 END_PROFILE(SMBreadX);
3383                 reply_doserror(req, ERRDOS, ERRlock);
3384                 return;
3385         }
3386
3387         if (!big_readX &&
3388             schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3389                 END_PROFILE(SMBreadX);
3390                 return;
3391         }
3392
3393         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3394
3395         END_PROFILE(SMBreadX);
3396         return;
3397 }
3398
3399 /****************************************************************************
3400  Error replies to writebraw must have smb_wct == 1. Fix this up.
3401 ****************************************************************************/
3402
3403 void error_to_writebrawerr(struct smb_request *req)
3404 {
3405         uint8 *old_outbuf = req->outbuf;
3406
3407         reply_outbuf(req, 1, 0);
3408
3409         memcpy(req->outbuf, old_outbuf, smb_size);
3410         TALLOC_FREE(old_outbuf);
3411 }
3412
3413 /****************************************************************************
3414  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3415 ****************************************************************************/
3416
3417 void reply_writebraw(struct smb_request *req)
3418 {
3419         connection_struct *conn = req->conn;
3420         char *buf = NULL;
3421         ssize_t nwritten=0;
3422         ssize_t total_written=0;
3423         size_t numtowrite=0;
3424         size_t tcount;
3425         SMB_OFF_T startpos;
3426         char *data=NULL;
3427         bool write_through;
3428         files_struct *fsp;
3429         NTSTATUS status;
3430
3431         START_PROFILE(SMBwritebraw);
3432
3433         /*
3434          * If we ever reply with an error, it must have the SMB command
3435          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3436          * we're finished.
3437          */
3438         SCVAL(req->inbuf,smb_com,SMBwritec);
3439
3440         if (srv_is_signing_active()) {
3441                 END_PROFILE(SMBwritebraw);
3442                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3443                                 "raw reads/writes are disallowed.");
3444         }
3445
3446         if (req->wct < 12) {
3447                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3448                 error_to_writebrawerr(req);
3449                 END_PROFILE(SMBwritebraw);
3450                 return;
3451         }
3452
3453         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3454         if (!check_fsp(conn, req, fsp)) {
3455                 error_to_writebrawerr(req);
3456                 END_PROFILE(SMBwritebraw);
3457                 return;
3458         }
3459
3460         if (!CHECK_WRITE(fsp)) {
3461                 reply_doserror(req, ERRDOS, ERRbadaccess);
3462                 error_to_writebrawerr(req);
3463                 END_PROFILE(SMBwritebraw);
3464                 return;
3465         }
3466
3467         tcount = IVAL(req->inbuf,smb_vwv1);
3468         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3469         write_through = BITSETW(req->inbuf+smb_vwv7,0);
3470
3471         /* We have to deal with slightly different formats depending
3472                 on whether we are using the core+ or lanman1.0 protocol */
3473
3474         if(Protocol <= PROTOCOL_COREPLUS) {
3475                 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3476                 data = smb_buf(req->inbuf);
3477         } else {
3478                 numtowrite = SVAL(req->inbuf,smb_vwv10);
3479                 data = smb_base(req->inbuf) + SVAL(req->inbuf, smb_vwv11);
3480         }
3481
3482         /* Ensure we don't write bytes past the end of this packet. */
3483         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3484                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3485                 error_to_writebrawerr(req);
3486                 END_PROFILE(SMBwritebraw);
3487                 return;
3488         }
3489
3490         if (is_locked(fsp,(uint32)req->smbpid,(SMB_BIG_UINT)tcount,
3491                                 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3492                 reply_doserror(req, ERRDOS, ERRlock);
3493                 error_to_writebrawerr(req);
3494                 END_PROFILE(SMBwritebraw);
3495                 return;
3496         }
3497
3498         if (numtowrite>0) {
3499                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3500         }
3501
3502         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3503                         "wrote=%d sync=%d\n",
3504                 fsp->fnum, (double)startpos, (int)numtowrite,
3505                 (int)nwritten, (int)write_through));
3506
3507         if (nwritten < (ssize_t)numtowrite)  {
3508                 reply_unixerror(req, ERRHRD, ERRdiskfull);
3509                 error_to_writebrawerr(req);
3510                 END_PROFILE(SMBwritebraw);
3511                 return;
3512         }
3513
3514         total_written = nwritten;
3515
3516         /* Allocate a buffer of 64k + length. */
3517         buf = TALLOC_ARRAY(NULL, char, 65540);
3518         if (!buf) {
3519                 reply_doserror(req, ERRDOS, ERRnomem);
3520                 error_to_writebrawerr(req);
3521                 END_PROFILE(SMBwritebraw);
3522                 return;
3523         }
3524
3525         /* Return a SMBwritebraw message to the redirector to tell
3526          * it to send more bytes */
3527
3528         memcpy(buf, req->inbuf, smb_size);
3529         srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3530         SCVAL(buf,smb_com,SMBwritebraw);
3531         SSVALS(buf,smb_vwv0,0xFFFF);
3532         show_msg(buf);
3533         if (!srv_send_smb(smbd_server_fd(),
3534                         buf,
3535                         IS_CONN_ENCRYPTED(conn))) {
3536                 exit_server_cleanly("reply_writebraw: srv_send_smb "
3537                         "failed.");
3538         }
3539
3540         /* Now read the raw data into the buffer and write it */
3541         status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3542                                  &numtowrite);
3543         if (!NT_STATUS_IS_OK(status)) {
3544                 exit_server_cleanly("secondary writebraw failed");
3545         }
3546
3547         /* Set up outbuf to return the correct size */
3548         reply_outbuf(req, 1, 0);
3549
3550         if (numtowrite != 0) {
3551
3552                 if (numtowrite > 0xFFFF) {
3553                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3554                                 "raw requested (%u). Terminating\n",
3555                                 (unsigned int)numtowrite ));
3556                         exit_server_cleanly("secondary writebraw failed");
3557                 }
3558
3559                 if (tcount > nwritten+numtowrite) {
3560                         DEBUG(3,("reply_writebraw: Client overestimated the "
3561                                 "write %d %d %d\n",
3562                                 (int)tcount,(int)nwritten,(int)numtowrite));
3563                 }
3564
3565                 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3566
3567                 if (!NT_STATUS_IS_OK(status)) {
3568                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3569                                  "raw read failed (%s). Terminating\n",
3570                                  nt_errstr(status)));
3571                         exit_server_cleanly("secondary writebraw failed");
3572                 }
3573
3574                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3575                 if (nwritten == -1) {
3576                         TALLOC_FREE(buf);
3577                         reply_unixerror(req, ERRHRD, ERRdiskfull);
3578                         error_to_writebrawerr(req);
3579                         END_PROFILE(SMBwritebraw);
3580                         return;
3581                 }
3582
3583                 if (nwritten < (ssize_t)numtowrite) {
3584                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
3585                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
3586                 }
3587
3588                 if (nwritten > 0) {
3589                         total_written += nwritten;
3590                 }
3591         }
3592
3593         TALLOC_FREE(buf);
3594         SSVAL(req->outbuf,smb_vwv0,total_written);
3595
3596         status = sync_file(conn, fsp, write_through);
3597         if (!NT_STATUS_IS_OK(status)) {
3598                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3599                         fsp->fsp_name, nt_errstr(status) ));
3600                 reply_nterror(req, status);
3601                 error_to_writebrawerr(req);
3602                 END_PROFILE(SMBwritebraw);
3603                 return;
3604         }
3605
3606         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3607                 "wrote=%d\n",
3608                 fsp->fnum, (double)startpos, (int)numtowrite,
3609                 (int)total_written));
3610
3611         /* We won't return a status if write through is not selected - this
3612          * follows what WfWg does */
3613         END_PROFILE(SMBwritebraw);
3614
3615         if (!write_through && total_written==tcount) {
3616
3617 #if RABBIT_PELLET_FIX
3618                 /*
3619                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3620                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3621                  * JRA.
3622                  */
3623                 if (!send_keepalive(smbd_server_fd())) {
3624                         exit_server_cleanly("reply_writebraw: send of "
3625                                 "keepalive failed");
3626                 }
3627 #endif
3628                 TALLOC_FREE(req->outbuf);
3629         }
3630         return;
3631 }
3632
3633 #undef DBGC_CLASS
3634 #define DBGC_CLASS DBGC_LOCKING
3635
3636 /****************************************************************************
3637  Reply to a writeunlock (core+).
3638 ****************************************************************************/
3639
3640 void reply_writeunlock(struct smb_request *req)
3641 {
3642         connection_struct *conn = req->conn;
3643         ssize_t nwritten = -1;
3644         size_t numtowrite;
3645         SMB_OFF_T startpos;
3646         char *data;
3647         NTSTATUS status = NT_STATUS_OK;
3648         files_struct *fsp;
3649
3650         START_PROFILE(SMBwriteunlock);
3651
3652         if (req->wct < 5) {
3653                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3654                 END_PROFILE(SMBwriteunlock);
3655                 return;
3656         }
3657
3658         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3659
3660         if (!check_fsp(conn, req, fsp)) {
3661                 END_PROFILE(SMBwriteunlock);
3662                 return;
3663         }
3664
3665         if (!CHECK_WRITE(fsp)) {
3666                 reply_doserror(req, ERRDOS,ERRbadaccess);
3667                 END_PROFILE(SMBwriteunlock);
3668                 return;
3669         }
3670
3671         numtowrite = SVAL(req->inbuf,smb_vwv1);
3672         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3673         data = smb_buf(req->inbuf) + 3;
3674
3675         if (numtowrite
3676             && is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
3677                          (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3678                 reply_doserror(req, ERRDOS, ERRlock);
3679                 END_PROFILE(SMBwriteunlock);
3680                 return;
3681         }
3682
3683         /* The special X/Open SMB protocol handling of
3684            zero length writes is *NOT* done for
3685            this call */
3686         if(numtowrite == 0) {
3687                 nwritten = 0;
3688         } else {
3689                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3690         }
3691
3692         status = sync_file(conn, fsp, False /* write through */);
3693         if (!NT_STATUS_IS_OK(status)) {
3694                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3695                         fsp->fsp_name, nt_errstr(status) ));
3696                 reply_nterror(req, status);
3697                 END_PROFILE(SMBwriteunlock);
3698                 return;
3699         }
3700
3701         if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3702                 reply_unixerror(req, ERRHRD, ERRdiskfull);
3703                 END_PROFILE(SMBwriteunlock);
3704                 return;
3705         }
3706
3707         if (numtowrite) {
3708                 status = do_unlock(smbd_messaging_context(),
3709                                 fsp,
3710                                 req->smbpid,
3711                                 (SMB_BIG_UINT)numtowrite,
3712                                 (SMB_BIG_UINT)startpos,
3713                                 WINDOWS_LOCK);
3714
3715                 if (NT_STATUS_V(status)) {
3716                         reply_nterror(req, status);
3717                         END_PROFILE(SMBwriteunlock);
3718                         return;
3719                 }
3720         }
3721
3722         reply_outbuf(req, 1, 0);
3723
3724         SSVAL(req->outbuf,smb_vwv0,nwritten);
3725
3726         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3727                  fsp->fnum, (int)numtowrite, (int)nwritten));
3728
3729         END_PROFILE(SMBwriteunlock);
3730         return;
3731 }
3732
3733 #undef DBGC_CLASS
3734 #define DBGC_CLASS DBGC_ALL
3735
3736 /****************************************************************************
3737  Reply to a write.
3738 ****************************************************************************/
3739
3740 void reply_write(struct smb_request *req)
3741 {
3742         connection_struct *conn = req->conn;
3743         size_t numtowrite;
3744         ssize_t nwritten = -1;
3745         SMB_OFF_T startpos;
3746         char *data;
3747         files_struct *fsp;
3748         NTSTATUS status;
3749
3750         START_PROFILE(SMBwrite);
3751
3752         if (req->wct < 5) {
3753                 END_PROFILE(SMBwrite);
3754                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3755                 return;
3756         }
3757
3758         /* If it's an IPC, pass off the pipe handler. */
3759         if (IS_IPC(conn)) {
3760                 reply_pipe_write(req);
3761                 END_PROFILE(SMBwrite);
3762                 return;
3763         }
3764
3765         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3766
3767         if (!check_fsp(conn, req, fsp)) {
3768                 END_PROFILE(SMBwrite);
3769                 return;
3770         }
3771
3772         if (!CHECK_WRITE(fsp)) {
3773                 reply_doserror(req, ERRDOS, ERRbadaccess);
3774                 END_PROFILE(SMBwrite);
3775                 return;
3776         }
3777
3778         numtowrite = SVAL(req->inbuf,smb_vwv1);
3779         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3780         data = smb_buf(req->inbuf) + 3;
3781
3782         if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
3783                       (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3784                 reply_doserror(req, ERRDOS, ERRlock);
3785                 END_PROFILE(SMBwrite);
3786                 return;
3787         }
3788
3789         /*
3790          * X/Open SMB protocol says that if smb_vwv1 is
3791          * zero then the file size should be extended or
3792          * truncated to the size given in smb_vwv[2-3].
3793          */
3794
3795         if(numtowrite == 0) {
3796                 /*
3797                  * This is actually an allocate call, and set EOF. JRA.
3798                  */
3799                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3800                 if (nwritten < 0) {
3801                         reply_nterror(req, NT_STATUS_DISK_FULL);
3802                         END_PROFILE(SMBwrite);
3803                         return;
3804                 }
3805                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3806                 if (nwritten < 0) {
3807                         reply_nterror(req, NT_STATUS_DISK_FULL);
3808                         END_PROFILE(SMBwrite);
3809                         return;
3810                 }
3811                 trigger_write_time_update_immediate(fsp);
3812         } else {
3813                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3814         }
3815
3816         status = sync_file(conn, fsp, False);
3817         if (!NT_STATUS_IS_OK(status)) {
3818                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
3819                         fsp->fsp_name, nt_errstr(status) ));
3820                 reply_nterror(req, status);
3821                 END_PROFILE(SMBwrite);
3822                 return;
3823         }
3824
3825         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3826                 reply_unixerror(req, ERRHRD, ERRdiskfull);
3827                 END_PROFILE(SMBwrite);
3828                 return;
3829         }
3830
3831         reply_outbuf(req, 1, 0);
3832
3833         SSVAL(req->outbuf,smb_vwv0,nwritten);
3834
3835         if (nwritten < (ssize_t)numtowrite) {
3836                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3837                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3838         }
3839
3840         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3841
3842         END_PROFILE(SMBwrite);
3843         return;
3844 }
3845
3846 /****************************************************************************
3847  Ensure a buffer is a valid writeX for recvfile purposes.
3848 ****************************************************************************/
3849
3850 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
3851                                                 (2*14) + /* word count (including bcc) */ \
3852                                                 1 /* pad byte */)
3853
3854 bool is_valid_writeX_buffer(const uint8_t *inbuf)
3855 {
3856         size_t numtowrite;
3857         connection_struct *conn = NULL;
3858         unsigned int doff = 0;
3859         size_t len = smb_len_large(inbuf);
3860
3861         if (is_encrypted_packet(inbuf)) {
3862                 /* Can't do this on encrypted
3863                  * connections. */
3864                 return false;
3865         }
3866
3867         if (CVAL(inbuf,smb_com) != SMBwriteX) {
3868                 return false;
3869         }
3870
3871         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
3872                         CVAL(inbuf,smb_wct) != 14) {
3873                 DEBUG(10,("is_valid_writeX_buffer: chained or "
3874                         "invalid word length.\n"));
3875                 return false;
3876         }
3877
3878         conn = conn_find(SVAL(inbuf, smb_tid));
3879         if (conn == NULL) {
3880                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
3881                 return false;
3882         }
3883         if (IS_IPC(conn)) {
3884                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
3885                 return false;
3886         }
3887         doff = SVAL(inbuf,smb_vwv11);
3888
3889         numtowrite = SVAL(inbuf,smb_vwv10);
3890
3891         if (len > doff && len - doff > 0xFFFF) {
3892                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
3893         }
3894
3895         if (numtowrite == 0) {
3896                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
3897                 return false;
3898         }
3899
3900         /* Ensure the sizes match up. */
3901         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
3902                 /* no pad byte...old smbclient :-( */
3903                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
3904                         (unsigned int)doff,
3905                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
3906                 return false;
3907         }
3908
3909         if (len - doff != numtowrite) {
3910                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
3911                         "len = %u, doff = %u, numtowrite = %u\n",
3912                         (unsigned int)len,
3913                         (unsigned int)doff,
3914                         (unsigned int)numtowrite ));
3915                 return false;
3916         }
3917
3918         DEBUG(10,("is_valid_writeX_buffer: true "
3919                 "len = %u, doff = %u, numtowrite = %u\n",
3920                 (unsigned int)len,
3921                 (unsigned int)doff,
3922                 (unsigned int)numtowrite ));
3923
3924         return true;
3925 }
3926
3927 /****************************************************************************
3928  Reply to a write and X.
3929 ****************************************************************************/
3930
3931 void reply_write_and_X(struct smb_request *req)
3932 {
3933         connection_struct *conn = req->conn;
3934         files_struct *fsp;
3935         SMB_OFF_T startpos;
3936         size_t numtowrite;
3937         bool write_through;
3938         ssize_t nwritten;
3939         unsigned int smb_doff;
3940         unsigned int smblen;
3941         char *data;
3942         NTSTATUS status;
3943
3944         START_PROFILE(SMBwriteX);
3945
3946         if ((req->wct != 12) && (req->wct != 14)) {
3947                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3948                 END_PROFILE(SMBwriteX);
3949                 return;
3950         }
3951
3952         numtowrite = SVAL(req->inbuf,smb_vwv10);
3953         smb_doff = SVAL(req->inbuf,smb_vwv11);
3954         smblen = smb_len(req->inbuf);
3955
3956         if (req->unread_bytes > 0xFFFF ||
3957                         (smblen > smb_doff &&
3958                                 smblen - smb_doff > 0xFFFF)) {
3959                 numtowrite |= (((size_t)SVAL(req->inbuf,smb_vwv9))<<16);
3960         }
3961
3962         if (req->unread_bytes) {
3963                 /* Can't do a recvfile write on IPC$ */
3964                 if (IS_IPC(conn)) {
3965                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3966                         END_PROFILE(SMBwriteX);
3967                         return;
3968                 }
3969                 if (numtowrite != req->unread_bytes) {
3970                         reply_doserror(req, ERRDOS, ERRbadmem);
3971                         END_PROFILE(SMBwriteX);
3972                         return;
3973                 }
3974         } else {
3975                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
3976                                 smb_doff + numtowrite > smblen) {
3977                         reply_doserror(req, ERRDOS, ERRbadmem);
3978                         END_PROFILE(SMBwriteX);
3979                         return;
3980                 }
3981         }
3982
3983         /* If it's an IPC, pass off the pipe handler. */
3984         if (IS_IPC(conn)) {
3985                 if (req->unread_bytes) {
3986                         reply_doserror(req, ERRDOS, ERRbadmem);
3987                         END_PROFILE(SMBwriteX);
3988                         return;
3989                 }
3990                 reply_pipe_write_and_X(req);
3991                 END_PROFILE(SMBwriteX);
3992                 return;
3993         }
3994
3995         fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
3996         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3997         write_through = BITSETW(req->inbuf+smb_vwv7,0);
3998
3999         if (!check_fsp(conn, req, fsp)) {
4000                 END_PROFILE(SMBwriteX);
4001                 return;
4002         }
4003
4004         if (!CHECK_WRITE(fsp)) {
4005                 reply_doserror(req, ERRDOS, ERRbadaccess);
4006                 END_PROFILE(SMBwriteX);
4007                 return;
4008         }
4009
4010         data = smb_base(req->inbuf) + smb_doff;
4011
4012         if(req->wct == 14) {
4013 #ifdef LARGE_SMB_OFF_T
4014                 /*
4015                  * This is a large offset (64 bit) write.
4016                  */
4017                 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv12)) << 32);
4018
4019 #else /* !LARGE_SMB_OFF_T */
4020
4021                 /*
4022                  * Ensure we haven't been sent a >32 bit offset.
4023                  */
4024
4025                 if(IVAL(req->inbuf,smb_vwv12) != 0) {
4026                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4027                                  "used and we don't support 64 bit offsets.\n",
4028                                  (unsigned int)IVAL(req->inbuf,smb_vwv12) ));
4029                         reply_doserror(req, ERRDOS, ERRbadaccess);
4030                         END_PROFILE(SMBwriteX);
4031                         return;
4032                 }
4033
4034 #endif /* LARGE_SMB_OFF_T */
4035         }
4036
4037         if (is_locked(fsp,(uint32)req->smbpid,
4038                       (SMB_BIG_UINT)numtowrite,
4039                       (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
4040                 reply_doserror(req, ERRDOS, ERRlock);
4041                 END_PROFILE(SMBwriteX);
4042                 return;
4043         }
4044
4045         /* X/Open SMB protocol says that, unlike SMBwrite
4046         if the length is zero then NO truncation is
4047         done, just a write of zero. To truncate a file,
4048         use SMBwrite. */
4049
4050         if(numtowrite == 0) {
4051                 nwritten = 0;
4052         } else {
4053
4054                 if ((req->unread_bytes == 0) &&
4055                     schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4056                                              numtowrite)) {
4057                         END_PROFILE(SMBwriteX);
4058                         return;
4059                 }
4060
4061                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4062         }
4063
4064         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4065                 reply_unixerror(req, ERRHRD, ERRdiskfull);
4066                 END_PROFILE(SMBwriteX);
4067                 return;
4068         }
4069
4070         reply_outbuf(req, 6, 0);
4071         SSVAL(req->outbuf,smb_vwv2,nwritten);
4072         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4073
4074         if (nwritten < (ssize_t)numtowrite) {
4075                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4076                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4077         }
4078
4079         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4080                 fsp->fnum, (int)numtowrite, (int)nwritten));
4081
4082         status = sync_file(conn, fsp, write_through);
4083         if (!NT_STATUS_IS_OK(status)) {
4084                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4085                         fsp->fsp_name, nt_errstr(status) ));
4086                 reply_nterror(req, status);
4087                 END_PROFILE(SMBwriteX);
4088                 return;
4089         }
4090
4091         END_PROFILE(SMBwriteX);
4092         chain_reply(req);
4093         return;
4094 }
4095
4096 /****************************************************************************
4097  Reply to a lseek.
4098 ****************************************************************************/
4099
4100 void reply_lseek(struct smb_request *req)
4101 {
4102         connection_struct *conn = req->conn;
4103         SMB_OFF_T startpos;
4104         SMB_OFF_T res= -1;
4105         int mode,umode;
4106         files_struct *fsp;
4107
4108         START_PROFILE(SMBlseek);
4109
4110         if (req->wct < 4) {
4111                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4112                 END_PROFILE(SMBlseek);
4113                 return;
4114         }
4115
4116         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4117
4118         if (!check_fsp(conn, req, fsp)) {
4119                 return;
4120         }
4121
4122         flush_write_cache(fsp, SEEK_FLUSH);
4123
4124         mode = SVAL(req->inbuf,smb_vwv1) & 3;
4125         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4126         startpos = (SMB_OFF_T)IVALS(req->inbuf,smb_vwv2);
4127
4128         switch (mode) {
4129                 case 0:
4130                         umode = SEEK_SET;
4131                         res = startpos;
4132                         break;
4133                 case 1:
4134                         umode = SEEK_CUR;
4135                         res = fsp->fh->pos + startpos;
4136                         break;
4137                 case 2:
4138                         umode = SEEK_END;
4139                         break;
4140                 default:
4141                         umode = SEEK_SET;
4142                         res = startpos;
4143                         break;
4144         }
4145
4146         if (umode == SEEK_END) {
4147                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4148                         if(errno == EINVAL) {
4149                                 SMB_OFF_T current_pos = startpos;
4150                                 SMB_STRUCT_STAT sbuf;
4151
4152                                 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4153                                         reply_unixerror(req, ERRDOS,
4154                                                         ERRnoaccess);
4155                                         END_PROFILE(SMBlseek);
4156                                         return;
4157                                 }
4158
4159                                 current_pos += sbuf.st_size;
4160                                 if(current_pos < 0)
4161                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4162                         }
4163                 }
4164
4165                 if(res == -1) {
4166                         reply_unixerror(req, ERRDOS, ERRnoaccess);
4167                         END_PROFILE(SMBlseek);
4168                         return;
4169                 }
4170         }
4171
4172         fsp->fh->pos = res;
4173
4174         reply_outbuf(req, 2, 0);
4175         SIVAL(req->outbuf,smb_vwv0,res);
4176
4177         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4178                 fsp->fnum, (double)startpos, (double)res, mode));
4179
4180         END_PROFILE(SMBlseek);
4181         return;
4182 }
4183
4184 /****************************************************************************
4185  Reply to a flush.
4186 ****************************************************************************/
4187
4188 void reply_flush(struct smb_request *req)
4189 {
4190         connection_struct *conn = req->conn;
4191         uint16 fnum;
4192         files_struct *fsp;
4193
4194         START_PROFILE(SMBflush);
4195
4196         if (req->wct < 1) {
4197                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4198                 return;
4199         }
4200
4201         fnum = SVAL(req->inbuf,smb_vwv0);
4202         fsp = file_fsp(fnum);
4203
4204         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4205                 return;
4206         }
4207
4208         if (!fsp) {
4209                 file_sync_all(conn);
4210         } else {
4211                 NTSTATUS status = sync_file(conn, fsp, True);
4212                 if (!NT_STATUS_IS_OK(status)) {
4213                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4214                                 fsp->fsp_name, nt_errstr(status) ));
4215                         reply_nterror(req, status);
4216                         END_PROFILE(SMBflush);
4217                         return;
4218                 }
4219         }
4220
4221         reply_outbuf(req, 0, 0);
4222
4223         DEBUG(3,("flush\n"));
4224         END_PROFILE(SMBflush);
4225         return;
4226 }
4227
4228 /****************************************************************************
4229  Reply to a exit.
4230  conn POINTER CAN BE NULL HERE !
4231 ****************************************************************************/
4232
4233 void reply_exit(struct smb_request *req)
4234 {
4235         START_PROFILE(SMBexit);
4236
4237         file_close_pid(req->smbpid, req->vuid);
4238
4239         reply_outbuf(req, 0, 0);
4240
4241         DEBUG(3,("exit\n"));
4242
4243         END_PROFILE(SMBexit);
4244         return;
4245 }
4246
4247 /****************************************************************************
4248  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4249 ****************************************************************************/
4250
4251 void reply_close(struct smb_request *req)
4252 {
4253         connection_struct *conn = req->conn;
4254         NTSTATUS status = NT_STATUS_OK;
4255         files_struct *fsp = NULL;
4256         START_PROFILE(SMBclose);
4257
4258         if (req->wct < 3) {
4259                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4260                 END_PROFILE(SMBclose);
4261                 return;
4262         }
4263
4264         /* If it's an IPC, pass off to the pipe handler. */
4265         if (IS_IPC(conn)) {
4266                 reply_pipe_close(conn, req);
4267                 END_PROFILE(SMBclose);
4268                 return;
4269         }
4270
4271         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4272
4273         /*
4274          * We can only use check_fsp if we know it's not a directory.
4275          */
4276
4277         if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4278                 reply_doserror(req, ERRDOS, ERRbadfid);
4279                 END_PROFILE(SMBclose);
4280                 return;
4281         }
4282
4283         if(fsp->is_directory) {
4284                 /*
4285                  * Special case - close NT SMB directory handle.
4286                  */
4287                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4288                 status = close_file(fsp,NORMAL_CLOSE);
4289         } else {
4290                 time_t t;
4291                 /*
4292                  * Close ordinary file.
4293                  */
4294
4295                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4296                          fsp->fh->fd, fsp->fnum,
4297                          conn->num_files_open));
4298
4299                 /*
4300                  * Take care of any time sent in the close.
4301                  */
4302
4303                 t = srv_make_unix_date3(req->inbuf+smb_vwv1);
4304                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4305
4306                 /*
4307                  * close_file() returns the unix errno if an error
4308                  * was detected on close - normally this is due to
4309                  * a disk full error. If not then it was probably an I/O error.
4310                  */
4311
4312                 status = close_file(fsp,NORMAL_CLOSE);
4313         }
4314
4315         if (!NT_STATUS_IS_OK(status)) {
4316                 reply_nterror(req, status);
4317                 END_PROFILE(SMBclose);
4318                 return;
4319         }
4320
4321         reply_outbuf(req, 0, 0);
4322         END_PROFILE(SMBclose);
4323         return;
4324 }
4325
4326 /****************************************************************************
4327  Reply to a writeclose (Core+ protocol).
4328 ****************************************************************************/
4329
4330 void reply_writeclose(struct smb_request *req)
4331 {
4332         connection_struct *conn = req->conn;
4333         size_t numtowrite;
4334         ssize_t nwritten = -1;
4335         NTSTATUS close_status = NT_STATUS_OK;
4336         SMB_OFF_T startpos;
4337         char *data;
4338         struct timespec mtime;
4339         files_struct *fsp;
4340
4341         START_PROFILE(SMBwriteclose);
4342
4343         if (req->wct < 6) {
4344                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4345                 END_PROFILE(SMBwriteclose);
4346                 return;
4347         }
4348
4349         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4350
4351         if (!check_fsp(conn, req, fsp)) {
4352                 END_PROFILE(SMBwriteclose);
4353                 return;
4354         }
4355         if (!CHECK_WRITE(fsp)) {
4356                 reply_doserror(req, ERRDOS,ERRbadaccess);
4357                 END_PROFILE(SMBwriteclose);
4358                 return;
4359         }
4360
4361         numtowrite = SVAL(req->inbuf,smb_vwv1);
4362         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
4363         mtime = convert_time_t_to_timespec(srv_make_unix_date3(
4364                                                    req->inbuf+smb_vwv4));
4365         data = smb_buf(req->inbuf) + 1;
4366
4367         if (numtowrite
4368             && is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
4369                          (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
4370                 reply_doserror(req, ERRDOS,ERRlock);
4371                 END_PROFILE(SMBwriteclose);
4372                 return;
4373         }
4374
4375         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4376
4377         set_close_write_time(fsp, mtime);
4378
4379         /*
4380          * More insanity. W2K only closes the file if writelen > 0.
4381          * JRA.
4382          */
4383
4384         if (numtowrite) {
4385                 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4386                         fsp->fsp_name ));
4387                 close_status = close_file(fsp,NORMAL_CLOSE);
4388         }
4389
4390         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4391                  fsp->fnum, (int)numtowrite, (int)nwritten,
4392                  conn->num_files_open));
4393
4394         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4395                 reply_doserror(req, ERRHRD, ERRdiskfull);
4396                 END_PROFILE(SMBwriteclose);
4397                 return;
4398         }
4399
4400         if(!NT_STATUS_IS_OK(close_status)) {
4401                 reply_nterror(req, close_status);
4402                 END_PROFILE(SMBwriteclose);
4403                 return;
4404         }
4405
4406         reply_outbuf(req, 1, 0);
4407
4408         SSVAL(req->outbuf,smb_vwv0,nwritten);
4409         END_PROFILE(SMBwriteclose);
4410         return;
4411 }
4412
4413 #undef DBGC_CLASS
4414 #define DBGC_CLASS DBGC_LOCKING
4415
4416 /****************************************************************************
4417  Reply to a lock.
4418 ****************************************************************************/
4419
4420 void reply_lock(struct smb_request *req)
4421 {
4422         connection_struct *conn = req->conn;
4423         SMB_BIG_UINT count,offset;
4424         NTSTATUS status;
4425         files_struct *fsp;
4426         struct byte_range_lock *br_lck = NULL;
4427
4428         START_PROFILE(SMBlock);
4429
4430         if (req->wct < 5) {
4431                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4432                 END_PROFILE(SMBlock);
4433                 return;
4434         }
4435
4436         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4437
4438         if (!check_fsp(conn, req, fsp)) {
4439                 END_PROFILE(SMBlock);
4440                 return;
4441         }
4442
4443         release_level_2_oplocks_on_change(fsp);
4444
4445         count = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv1);
4446         offset = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv3);
4447
4448         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4449                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4450
4451         br_lck = do_lock(smbd_messaging_context(),
4452                         fsp,
4453                         req->smbpid,
4454                         count,
4455                         offset,
4456                         WRITE_LOCK,
4457                         WINDOWS_LOCK,
4458                         False, /* Non-blocking lock. */
4459                         &status,
4460                         NULL);
4461
4462         TALLOC_FREE(br_lck);
4463
4464         if (NT_STATUS_V(status)) {
4465                 reply_nterror(req, status);
4466                 END_PROFILE(SMBlock);
4467                 return;
4468         }
4469
4470         reply_outbuf(req, 0, 0);
4471
4472         END_PROFILE(SMBlock);
4473         return;
4474 }
4475
4476 /****************************************************************************
4477  Reply to a unlock.
4478 ****************************************************************************/
4479
4480 void reply_unlock(struct smb_request *req)
4481 {
4482         connection_struct *conn = req->conn;
4483         SMB_BIG_UINT count,offset;
4484         NTSTATUS status;
4485         files_struct *fsp;
4486
4487         START_PROFILE(SMBunlock);
4488
4489         if (req->wct < 5) {
4490                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4491                 END_PROFILE(SMBunlock);
4492                 return;
4493         }
4494
4495         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4496
4497         if (!check_fsp(conn, req, fsp)) {
4498                 END_PROFILE(SMBunlock);
4499                 return;
4500         }
4501
4502         count = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv1);
4503         offset = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv3);
4504
4505         status = do_unlock(smbd_messaging_context(),
4506                         fsp,
4507                         req->smbpid,
4508                         count,
4509                         offset,
4510                         WINDOWS_LOCK);
4511
4512         if (NT_STATUS_V(status)) {
4513                 reply_nterror(req, status);
4514                 END_PROFILE(SMBunlock);
4515                 return;
4516         }
4517
4518         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4519                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4520
4521         reply_outbuf(req, 0, 0);
4522
4523         END_PROFILE(SMBunlock);
4524         return;
4525 }
4526
4527 #undef DBGC_CLASS
4528 #define DBGC_CLASS DBGC_ALL
4529
4530 /****************************************************************************
4531  Reply to a tdis.
4532  conn POINTER CAN BE NULL HERE !
4533 ****************************************************************************/
4534
4535 void reply_tdis(struct smb_request *req)
4536 {
4537         connection_struct *conn = req->conn;
4538         START_PROFILE(SMBtdis);
4539
4540         if (!conn) {
4541                 DEBUG(4,("Invalid connection in tdis\n"));
4542                 reply_doserror(req, ERRSRV, ERRinvnid);
4543                 END_PROFILE(SMBtdis);
4544                 return;
4545         }
4546
4547         conn->used = False;
4548
4549         close_cnum(conn,req->vuid);
4550         req->conn = NULL;
4551
4552         reply_outbuf(req, 0, 0);
4553         END_PROFILE(SMBtdis);
4554         return;
4555 }
4556
4557 /****************************************************************************
4558  Reply to a echo.
4559  conn POINTER CAN BE NULL HERE !
4560 ****************************************************************************/
4561
4562 void reply_echo(struct smb_request *req)
4563 {
4564         connection_struct *conn = req->conn;
4565         int smb_reverb;
4566         int seq_num;
4567         unsigned int data_len = smb_buflen(req->inbuf);
4568
4569         START_PROFILE(SMBecho);
4570
4571         if (req->wct < 1) {
4572                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4573                 END_PROFILE(SMBecho);
4574                 return;
4575         }
4576
4577         if (data_len > BUFFER_SIZE) {
4578                 DEBUG(0,("reply_echo: data_len too large.\n"));
4579                 reply_nterror(req, NT_STATUS_INSUFFICIENT_RESOURCES);
4580                 END_PROFILE(SMBecho);
4581                 return;
4582         }
4583
4584         smb_reverb = SVAL(req->inbuf,smb_vwv0);
4585
4586         reply_outbuf(req, 1, data_len);
4587
4588         /* copy any incoming data back out */
4589         if (data_len > 0) {
4590                 memcpy(smb_buf(req->outbuf),smb_buf(req->inbuf),data_len);
4591         }
4592
4593         if (smb_reverb > 100) {
4594                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4595                 smb_reverb = 100;
4596         }
4597
4598         for (seq_num =1 ; seq_num <= smb_reverb ; seq_num++) {
4599                 SSVAL(req->outbuf,smb_vwv0,seq_num);
4600
4601                 show_msg((char *)req->outbuf);
4602                 if (!srv_send_smb(smbd_server_fd(),
4603                                 (char *)req->outbuf,
4604                                 IS_CONN_ENCRYPTED(conn)||req->encrypted))
4605                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
4606         }
4607
4608         DEBUG(3,("echo %d times\n", smb_reverb));
4609
4610         TALLOC_FREE(req->outbuf);
4611
4612         END_PROFILE(SMBecho);
4613         return;
4614 }
4615
4616 /****************************************************************************
4617  Reply to a printopen.
4618 ****************************************************************************/
4619
4620 void reply_printopen(struct smb_request *req)
4621 {
4622         connection_struct *conn = req->conn;
4623         files_struct *fsp;
4624         NTSTATUS status;
4625
4626         START_PROFILE(SMBsplopen);
4627
4628         if (req->wct < 2) {
4629                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4630                 END_PROFILE(SMBsplopen);
4631                 return;
4632         }
4633
4634         if (!CAN_PRINT(conn)) {
4635                 reply_doserror(req, ERRDOS, ERRnoaccess);
4636                 END_PROFILE(SMBsplopen);
4637                 return;
4638         }
4639
4640         /* Open for exclusive use, write only. */
4641         status = print_fsp_open(conn, NULL, req->vuid, &fsp);
4642
4643         if (!NT_STATUS_IS_OK(status)) {
4644                 reply_nterror(req, status);
4645                 END_PROFILE(SMBsplopen);
4646                 return;
4647         }
4648
4649         reply_outbuf(req, 1, 0);
4650         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4651
4652         DEBUG(3,("openprint fd=%d fnum=%d\n",
4653                  fsp->fh->fd, fsp->fnum));
4654
4655         END_PROFILE(SMBsplopen);
4656         return;
4657 }
4658
4659 /****************************************************************************
4660  Reply to a printclose.
4661 ****************************************************************************/
4662
4663 void reply_printclose(struct smb_request *req)
4664 {
4665         connection_struct *conn = req->conn;
4666         files_struct *fsp;
4667         NTSTATUS status;
4668
4669         START_PROFILE(SMBsplclose);
4670
4671         if (req->wct < 1) {
4672                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4673                 END_PROFILE(SMBsplclose);
4674                 return;
4675         }
4676
4677         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4678
4679         if (!check_fsp(conn, req, fsp)) {
4680                 END_PROFILE(SMBsplclose);
4681                 return;
4682         }
4683
4684         if (!CAN_PRINT(conn)) {
4685                 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4686                 END_PROFILE(SMBsplclose);
4687                 return;
4688         }
4689
4690         DEBUG(3,("printclose fd=%d fnum=%d\n",
4691                  fsp->fh->fd,fsp->fnum));
4692
4693         status = close_file(fsp,NORMAL_CLOSE);
4694
4695         if(!NT_STATUS_IS_OK(status)) {
4696                 reply_nterror(req, status);
4697                 END_PROFILE(SMBsplclose);
4698                 return;
4699         }
4700
4701         reply_outbuf(req, 0, 0);
4702
4703         END_PROFILE(SMBsplclose);
4704         return;
4705 }
4706
4707 /****************************************************************************
4708  Reply to a printqueue.
4709 ****************************************************************************/
4710
4711 void reply_printqueue(struct smb_request *req)
4712 {
4713         connection_struct *conn = req->conn;
4714         int max_count;
4715         int start_index;
4716
4717         START_PROFILE(SMBsplretq);
4718
4719         if (req->wct < 2) {
4720                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4721                 END_PROFILE(SMBsplretq);
4722                 return;
4723         }
4724
4725         max_count = SVAL(req->inbuf,smb_vwv0);
4726         start_index = SVAL(req->inbuf,smb_vwv1);
4727
4728         /* we used to allow the client to get the cnum wrong, but that
4729            is really quite gross and only worked when there was only
4730            one printer - I think we should now only accept it if they
4731            get it right (tridge) */
4732         if (!CAN_PRINT(conn)) {
4733                 reply_doserror(req, ERRDOS, ERRnoaccess);
4734                 END_PROFILE(SMBsplretq);
4735                 return;
4736         }
4737
4738         reply_outbuf(req, 2, 3);
4739         SSVAL(req->outbuf,smb_vwv0,0);
4740         SSVAL(req->outbuf,smb_vwv1,0);
4741         SCVAL(smb_buf(req->outbuf),0,1);
4742         SSVAL(smb_buf(req->outbuf),1,0);
4743
4744         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4745                  start_index, max_count));
4746
4747         {
4748                 print_queue_struct *queue = NULL;
4749                 print_status_struct status;
4750                 int count = print_queue_status(SNUM(conn), &queue, &status);
4751                 int num_to_get = ABS(max_count);
4752                 int first = (max_count>0?start_index:start_index+max_count+1);
4753                 int i;
4754
4755                 if (first >= count)
4756                         num_to_get = 0;
4757                 else
4758                         num_to_get = MIN(num_to_get,count-first);
4759
4760
4761                 for (i=first;i<first+num_to_get;i++) {
4762                         char blob[28];
4763                         char *p = blob;
4764
4765                         srv_put_dos_date2(p,0,queue[i].time);
4766                         SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4767                         SSVAL(p,5, queue[i].job);
4768                         SIVAL(p,7,queue[i].size);
4769                         SCVAL(p,11,0);
4770                         srvstr_push(blob, req->flags2, p+12,
4771                                     queue[i].fs_user, 16, STR_ASCII);
4772
4773                         if (message_push_blob(
4774                                     &req->outbuf,
4775                                     data_blob_const(
4776                                             blob, sizeof(blob))) == -1) {
4777                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4778                                 END_PROFILE(SMBsplretq);
4779                                 return;
4780                         }
4781                 }
4782
4783                 if (count > 0) {
4784                         SSVAL(req->outbuf,smb_vwv0,count);
4785                         SSVAL(req->outbuf,smb_vwv1,
4786                               (max_count>0?first+count:first-1));
4787                         SCVAL(smb_buf(req->outbuf),0,1);
4788                         SSVAL(smb_buf(req->outbuf),1,28*count);
4789                 }
4790
4791                 SAFE_FREE(queue);
4792
4793                 DEBUG(3,("%d entries returned in queue\n",count));
4794         }
4795
4796         END_PROFILE(SMBsplretq);
4797         return;
4798 }
4799
4800 /****************************************************************************
4801  Reply to a printwrite.
4802 ****************************************************************************/
4803
4804 void reply_printwrite(struct smb_request *req)
4805 {
4806         connection_struct *conn = req->conn;
4807         int numtowrite;
4808         char *data;
4809         files_struct *fsp;
4810
4811         START_PROFILE(SMBsplwr);
4812
4813         if (req->wct < 1) {
4814                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4815                 END_PROFILE(SMBsplwr);
4816                 return;
4817         }
4818
4819         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4820
4821         if (!check_fsp(conn, req, fsp)) {
4822                 END_PROFILE(SMBsplwr);
4823                 return;
4824         }
4825
4826         if (!CAN_PRINT(conn)) {
4827                 reply_doserror(req, ERRDOS, ERRnoaccess);
4828                 END_PROFILE(SMBsplwr);
4829                 return;
4830         }
4831
4832         if (!CHECK_WRITE(fsp)) {
4833                 reply_doserror(req, ERRDOS, ERRbadaccess);
4834                 END_PROFILE(SMBsplwr);
4835                 return;
4836         }
4837
4838         numtowrite = SVAL(smb_buf(req->inbuf),1);
4839
4840         if (smb_buflen(req->inbuf) < numtowrite + 3) {
4841                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4842                 END_PROFILE(SMBsplwr);
4843                 return;
4844         }
4845
4846         data = smb_buf(req->inbuf) + 3;
4847
4848         if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
4849                 reply_unixerror(req, ERRHRD, ERRdiskfull);
4850                 END_PROFILE(SMBsplwr);
4851                 return;
4852         }
4853
4854         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
4855
4856         END_PROFILE(SMBsplwr);
4857         return;
4858 }
4859
4860 /****************************************************************************
4861  Reply to a mkdir.
4862 ****************************************************************************/
4863
4864 void reply_mkdir(struct smb_request *req)
4865 {
4866         connection_struct *conn = req->conn;
4867         char *directory = NULL;
4868         NTSTATUS status;
4869         SMB_STRUCT_STAT sbuf;
4870         TALLOC_CTX *ctx = talloc_tos();
4871
4872         START_PROFILE(SMBmkdir);
4873
4874         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
4875                         smb_buf(req->inbuf) + 1, 0,
4876                         STR_TERMINATE, &status);
4877         if (!NT_STATUS_IS_OK(status)) {
4878                 reply_nterror(req, status);
4879                 END_PROFILE(SMBmkdir);
4880                 return;
4881         }
4882
4883         status = resolve_dfspath(ctx, conn,
4884                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
4885                                  directory,
4886                                  &directory);
4887         if (!NT_STATUS_IS_OK(status)) {
4888                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4889                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
4890                                         ERRSRV, ERRbadpath);
4891                         END_PROFILE(SMBmkdir);
4892                         return;
4893                 }
4894                 reply_nterror(req, status);
4895                 END_PROFILE(SMBmkdir);
4896                 return;
4897         }
4898
4899         status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
4900         if (!NT_STATUS_IS_OK(status)) {
4901                 reply_nterror(req, status);
4902                 END_PROFILE(SMBmkdir);
4903                 return;
4904         }
4905
4906         status = check_name(conn, directory);
4907         if (!NT_STATUS_IS_OK(status)) {
4908                 reply_nterror(req, status);
4909                 END_PROFILE(SMBmkdir);
4910                 return;
4911         }
4912
4913         status = create_directory(conn, req, directory);
4914
4915         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
4916
4917         if (!NT_STATUS_IS_OK(status)) {
4918
4919                 if (!use_nt_status()
4920                     && NT_STATUS_EQUAL(status,
4921                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
4922                         /*
4923                          * Yes, in the DOS error code case we get a
4924                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
4925                          * samba4 torture test.
4926                          */
4927                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
4928                 }
4929
4930                 reply_nterror(req, status);
4931                 END_PROFILE(SMBmkdir);
4932                 return;
4933         }
4934
4935         reply_outbuf(req, 0, 0);
4936
4937         DEBUG( 3, ( "mkdir %s\n", directory ) );
4938
4939         END_PROFILE(SMBmkdir);
4940         return;
4941 }
4942
4943 /****************************************************************************
4944  Static function used by reply_rmdir to delete an entire directory
4945  tree recursively. Return True on ok, False on fail.
4946 ****************************************************************************/
4947
4948 static bool recursive_rmdir(TALLOC_CTX *ctx,
4949                         connection_struct *conn,
4950                         char *directory)
4951 {
4952         const char *dname = NULL;
4953         bool ret = True;
4954         long offset = 0;
4955         struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
4956                                           NULL, 0);
4957
4958         if(dir_hnd == NULL)
4959                 return False;
4960
4961         while((dname = ReadDirName(dir_hnd, &offset))) {
4962                 char *fullname = NULL;
4963                 SMB_STRUCT_STAT st;
4964
4965                 if (ISDOT(dname) || ISDOTDOT(dname)) {
4966                         continue;
4967                 }
4968
4969                 if (!is_visible_file(conn, directory, dname, &st, False)) {
4970                         continue;
4971                 }
4972
4973                 /* Construct the full name. */
4974                 fullname = talloc_asprintf(ctx,
4975                                 "%s/%s",
4976                                 directory,
4977                                 dname);
4978                 if (!fullname) {
4979                         errno = ENOMEM;
4980                         ret = False;
4981                         break;
4982                 }
4983
4984                 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
4985                         ret = False;
4986                         break;
4987                 }
4988
4989                 if(st.st_mode & S_IFDIR) {
4990                         if(!recursive_rmdir(ctx, conn, fullname)) {
4991                                 ret = False;
4992                                 break;
4993                         }
4994                         if(SMB_VFS_RMDIR(conn,fullname) != 0) {
4995                                 ret = False;
4996                                 break;
4997                         }
4998                 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
4999                         ret = False;
5000                         break;
5001                 }
5002                 TALLOC_FREE(fullname);
5003         }
5004         TALLOC_FREE(dir_hnd);
5005         return ret;
5006 }
5007
5008 /****************************************************************************
5009  The internals of the rmdir code - called elsewhere.
5010 ****************************************************************************/
5011
5012 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5013                         connection_struct *conn,
5014                         const char *directory)
5015 {
5016         int ret;
5017         SMB_STRUCT_STAT st;
5018
5019         /* Might be a symlink. */
5020         if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
5021                 return map_nt_error_from_unix(errno);
5022         }
5023
5024         if (S_ISLNK(st.st_mode)) {
5025                 /* Is what it points to a directory ? */
5026                 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
5027                         return map_nt_error_from_unix(errno);
5028                 }
5029                 if (!(S_ISDIR(st.st_mode))) {
5030                         return NT_STATUS_NOT_A_DIRECTORY;
5031                 }
5032                 ret = SMB_VFS_UNLINK(conn,directory);
5033         } else {
5034                 ret = SMB_VFS_RMDIR(conn,directory);
5035         }
5036         if (ret == 0) {
5037                 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5038                              FILE_NOTIFY_CHANGE_DIR_NAME,
5039                              directory);
5040                 return NT_STATUS_OK;
5041         }
5042
5043         if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5044                 /*
5045                  * Check to see if the only thing in this directory are
5046                  * vetoed files/directories. If so then delete them and
5047                  * retry. If we fail to delete any of them (and we *don't*
5048                  * do a recursive delete) then fail the rmdir.
5049                  */
5050                 const char *dname;
5051                 long dirpos = 0;
5052                 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5053                                                   directory, NULL, 0);
5054
5055                 if(dir_hnd == NULL) {
5056                         errno = ENOTEMPTY;
5057                         goto err;
5058                 }
5059
5060                 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5061                         if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5062                                 continue;
5063                         if (!is_visible_file(conn, directory, dname, &st, False))
5064                                 continue;
5065                         if(!IS_VETO_PATH(conn, dname)) {
5066                                 TALLOC_FREE(dir_hnd);
5067                                 errno = ENOTEMPTY;
5068                                 goto err;
5069                         }
5070                 }
5071
5072                 /* We only have veto files/directories. Recursive delete. */
5073
5074                 RewindDir(dir_hnd,&dirpos);
5075                 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5076                         char *fullname = NULL;
5077
5078                         if (ISDOT(dname) || ISDOTDOT(dname)) {
5079                                 continue;
5080                         }
5081                         if (!is_visible_file(conn, directory, dname, &st, False)) {
5082                                 continue;
5083                         }
5084
5085                         fullname = talloc_asprintf(ctx,
5086                                         "%s/%s",
5087                                         directory,
5088                                         dname);
5089
5090                         if(!fullname) {
5091                                 errno = ENOMEM;
5092                                 break;
5093                         }
5094
5095                         if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5096                                 break;
5097                         }
5098                         if(st.st_mode & S_IFDIR) {
5099                                 if(lp_recursive_veto_delete(SNUM(conn))) {
5100                                         if(!recursive_rmdir(ctx, conn, fullname))
5101                                                 break;
5102                                 }
5103                                 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5104                                         break;
5105                                 }
5106                         } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5107                                 break;
5108                         }
5109                         TALLOC_FREE(fullname);
5110                 }
5111                 TALLOC_FREE(dir_hnd);
5112                 /* Retry the rmdir */
5113                 ret = SMB_VFS_RMDIR(conn,directory);
5114         }
5115
5116   err:
5117
5118         if (ret != 0) {
5119                 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5120                          "%s\n", directory,strerror(errno)));
5121                 return map_nt_error_from_unix(errno);
5122         }
5123
5124         notify_fname(conn, NOTIFY_ACTION_REMOVED,
5125                      FILE_NOTIFY_CHANGE_DIR_NAME,
5126                      directory);
5127
5128         return NT_STATUS_OK;
5129 }
5130
5131 /****************************************************************************
5132  Reply to a rmdir.
5133 ****************************************************************************/
5134
5135 void reply_rmdir(struct smb_request *req)
5136 {
5137         connection_struct *conn = req->conn;
5138         char *directory = NULL;
5139         SMB_STRUCT_STAT sbuf;
5140         NTSTATUS status;
5141         TALLOC_CTX *ctx = talloc_tos();
5142
5143         START_PROFILE(SMBrmdir);
5144
5145         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
5146                         smb_buf(req->inbuf) + 1, 0,
5147                         STR_TERMINATE, &status);
5148         if (!NT_STATUS_IS_OK(status)) {
5149                 reply_nterror(req, status);
5150                 END_PROFILE(SMBrmdir);
5151                 return;
5152         }
5153
5154         status = resolve_dfspath(ctx, conn,
5155                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5156                                  directory,
5157                                  &directory);
5158         if (!NT_STATUS_IS_OK(status)) {
5159                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5160                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5161                                         ERRSRV, ERRbadpath);
5162                         END_PROFILE(SMBrmdir);
5163                         return;
5164                 }
5165                 reply_nterror(req, status);
5166                 END_PROFILE(SMBrmdir);
5167                 return;
5168         }
5169
5170         status = unix_convert(ctx, conn, directory, False, &directory,
5171                         NULL, &sbuf);
5172         if (!NT_STATUS_IS_OK(status)) {
5173                 reply_nterror(req, status);
5174                 END_PROFILE(SMBrmdir);
5175                 return;
5176         }
5177
5178         status = check_name(conn, directory);
5179         if (!NT_STATUS_IS_OK(status)) {
5180                 reply_nterror(req, status);
5181                 END_PROFILE(SMBrmdir);
5182                 return;
5183         }
5184
5185         dptr_closepath(directory, req->smbpid);
5186         status = rmdir_internals(ctx, conn, directory);
5187         if (!NT_STATUS_IS_OK(status)) {
5188                 reply_nterror(req, status);
5189                 END_PROFILE(SMBrmdir);
5190                 return;
5191         }
5192
5193         reply_outbuf(req, 0, 0);
5194
5195         DEBUG( 3, ( "rmdir %s\n", directory ) );
5196
5197         END_PROFILE(SMBrmdir);
5198         return;
5199 }
5200
5201 /*******************************************************************
5202  Resolve wildcards in a filename rename.
5203 ********************************************************************/
5204
5205 static bool resolve_wildcards(TALLOC_CTX *ctx,
5206                                 const char *name1,
5207                                 const char *name2,
5208                                 char **pp_newname)
5209 {
5210         char *name2_copy = NULL;
5211         char *root1 = NULL;
5212         char *root2 = NULL;
5213         char *ext1 = NULL;
5214         char *ext2 = NULL;
5215         char *p,*p2, *pname1, *pname2;
5216
5217         name2_copy = talloc_strdup(ctx, name2);
5218         if (!name2_copy) {
5219                 return False;
5220         }
5221
5222         pname1 = strrchr_m(name1,'/');
5223         pname2 = strrchr_m(name2_copy,'/');
5224
5225         if (!pname1 || !pname2) {
5226                 return False;
5227         }
5228
5229         /* Truncate the copy of name2 at the last '/' */
5230         *pname2 = '\0';
5231
5232         /* Now go past the '/' */
5233         pname1++;
5234         pname2++;
5235
5236         root1 = talloc_strdup(ctx, pname1);
5237         root2 = talloc_strdup(ctx, pname2);
5238
5239         if (!root1 || !root2) {
5240                 return False;
5241         }
5242
5243         p = strrchr_m(root1,'.');
5244         if (p) {
5245                 *p = 0;
5246                 ext1 = talloc_strdup(ctx, p+1);
5247         } else {
5248                 ext1 = talloc_strdup(ctx, "");
5249         }
5250         p = strrchr_m(root2,'.');
5251         if (p) {
5252                 *p = 0;
5253                 ext2 = talloc_strdup(ctx, p+1);
5254         } else {
5255                 ext2 = talloc_strdup(ctx, "");
5256         }
5257
5258         if (!ext1 || !ext2) {
5259                 return False;
5260         }
5261
5262         p = root1;
5263         p2 = root2;
5264         while (*p2) {
5265                 if (*p2 == '?') {
5266                         /* Hmmm. Should this be mb-aware ? */
5267                         *p2 = *p;
5268                         p2++;
5269                 } else if (*p2 == '*') {
5270                         *p2 = '\0';
5271                         root2 = talloc_asprintf(ctx, "%s%s",
5272                                                 root2,
5273                                                 p);
5274                         if (!root2) {
5275                                 return False;
5276                         }
5277                         break;
5278                 } else {
5279                         p2++;
5280                 }
5281                 if (*p) {
5282                         p++;
5283                 }
5284         }
5285
5286         p = ext1;
5287         p2 = ext2;
5288         while (*p2) {
5289                 if (*p2 == '?') {
5290                         /* Hmmm. Should this be mb-aware ? */
5291                         *p2 = *p;
5292                         p2++;
5293                 } else if (*p2 == '*') {
5294                         *p2 = '\0';
5295                         ext2 = talloc_asprintf(ctx, "%s%s",
5296                                                 ext2,
5297                                                 p);
5298                         if (!ext2) {
5299                                 return False;
5300                         }
5301                         break;
5302                 } else {
5303                         p2++;
5304                 }
5305                 if (*p) {
5306                         p++;
5307                 }
5308         }
5309
5310         if (*ext2) {
5311                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5312                                 name2_copy,
5313                                 root2,
5314                                 ext2);
5315         } else {
5316                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5317                                 name2_copy,
5318                                 root2);
5319         }
5320
5321         if (!*pp_newname) {
5322                 return False;
5323         }
5324
5325         return True;
5326 }
5327
5328 /****************************************************************************
5329  Ensure open files have their names updated. Updated to notify other smbd's
5330  asynchronously.
5331 ****************************************************************************/
5332
5333 static void rename_open_files(connection_struct *conn,
5334                               struct share_mode_lock *lck,
5335                               const char *newname)
5336 {
5337         files_struct *fsp;
5338         bool did_rename = False;
5339
5340         for(fsp = file_find_di_first(lck->id); fsp;
5341             fsp = file_find_di_next(fsp)) {
5342                 /* fsp_name is a relative path under the fsp. To change this for other
5343                    sharepaths we need to manipulate relative paths. */
5344                 /* TODO - create the absolute path and manipulate the newname
5345                    relative to the sharepath. */
5346                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5347                         continue;
5348                 }
5349                 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5350                           fsp->fnum, file_id_string_tos(&fsp->file_id),
5351                         fsp->fsp_name, newname ));
5352                 string_set(&fsp->fsp_name, newname);
5353                 did_rename = True;
5354         }
5355
5356         if (!did_rename) {
5357                 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5358                           file_id_string_tos(&lck->id), newname ));
5359         }
5360
5361         /* Send messages to all smbd's (not ourself) that the name has changed. */
5362         rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5363                               newname);
5364 }
5365
5366 /****************************************************************************
5367  We need to check if the source path is a parent directory of the destination
5368  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5369  refuse the rename with a sharing violation. Under UNIX the above call can
5370  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5371  probably need to check that the client is a Windows one before disallowing
5372  this as a UNIX client (one with UNIX extensions) can know the source is a
5373  symlink and make this decision intelligently. Found by an excellent bug
5374  report from <AndyLiebman@aol.com>.
5375 ****************************************************************************/
5376
5377 static bool rename_path_prefix_equal(const char *src, const char *dest)
5378 {
5379         const char *psrc = src;
5380         const char *pdst = dest;
5381         size_t slen;
5382
5383         if (psrc[0] == '.' && psrc[1] == '/') {
5384                 psrc += 2;
5385         }
5386         if (pdst[0] == '.' && pdst[1] == '/') {
5387                 pdst += 2;
5388         }
5389         if ((slen = strlen(psrc)) > strlen(pdst)) {
5390                 return False;
5391         }
5392         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5393 }
5394
5395 /*
5396  * Do the notify calls from a rename
5397  */
5398
5399 static void notify_rename(connection_struct *conn, bool is_dir,
5400                           const char *oldpath, const char *newpath)
5401 {
5402         char *olddir, *newdir;
5403         const char *oldname, *newname;
5404         uint32 mask;
5405
5406         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5407                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5408
5409         if (!parent_dirname_talloc(NULL, oldpath, &olddir, &oldname)
5410             || !parent_dirname_talloc(NULL, newpath, &newdir, &newname)) {
5411                 TALLOC_FREE(olddir);
5412                 return;
5413         }
5414
5415         if (strcmp(olddir, newdir) == 0) {
5416                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5417                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5418         }
5419         else {
5420                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5421                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5422         }
5423         TALLOC_FREE(olddir);
5424         TALLOC_FREE(newdir);
5425
5426         /* this is a strange one. w2k3 gives an additional event for
5427            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5428            files, but not directories */
5429         if (!is_dir) {
5430                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5431                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5432                              |FILE_NOTIFY_CHANGE_CREATION,
5433                              newpath);
5434         }
5435 }
5436
5437 /****************************************************************************
5438  Rename an open file - given an fsp.
5439 ****************************************************************************/
5440
5441 NTSTATUS rename_internals_fsp(connection_struct *conn,
5442                         files_struct *fsp,
5443                         char *newname,
5444                         const char *newname_last_component,
5445                         uint32 attrs,
5446                         bool replace_if_exists)
5447 {
5448         TALLOC_CTX *ctx = talloc_tos();
5449         SMB_STRUCT_STAT sbuf, sbuf1;
5450         NTSTATUS status = NT_STATUS_OK;
5451         struct share_mode_lock *lck = NULL;
5452         bool dst_exists;
5453
5454         ZERO_STRUCT(sbuf);
5455
5456         status = check_name(conn, newname);
5457         if (!NT_STATUS_IS_OK(status)) {
5458                 return status;
5459         }
5460
5461         /* Ensure newname contains a '/' */
5462         if(strrchr_m(newname,'/') == 0) {
5463                 newname = talloc_asprintf(ctx,
5464                                         "./%s",
5465                                         newname);
5466                 if (!newname) {
5467                         return NT_STATUS_NO_MEMORY;
5468                 }
5469         }
5470
5471         /*
5472          * Check for special case with case preserving and not
5473          * case sensitive. If the old last component differs from the original
5474          * last component only by case, then we should allow
5475          * the rename (user is trying to change the case of the
5476          * filename).
5477          */
5478
5479         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5480                         strequal(newname, fsp->fsp_name)) {
5481                 char *p;
5482                 char *newname_modified_last_component = NULL;
5483
5484                 /*
5485                  * Get the last component of the modified name.
5486                  * Note that we guarantee that newname contains a '/'
5487                  * character above.
5488                  */
5489                 p = strrchr_m(newname,'/');
5490                 newname_modified_last_component = talloc_strdup(ctx,
5491                                                 p+1);
5492                 if (!newname_modified_last_component) {
5493                         return NT_STATUS_NO_MEMORY;
5494                 }
5495
5496                 if(strcsequal(newname_modified_last_component,
5497                               newname_last_component) == False) {
5498                         /*
5499                          * Replace the modified last component with
5500                          * the original.
5501                          */
5502                         *p = '\0'; /* Truncate at the '/' */
5503                         newname = talloc_asprintf(ctx,
5504                                         "%s/%s",
5505                                         newname,
5506                                         newname_last_component);
5507                 }
5508         }
5509
5510         /*
5511          * If the src and dest names are identical - including case,
5512          * don't do the rename, just return success.
5513          */
5514
5515         if (strcsequal(fsp->fsp_name, newname)) {
5516                 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5517                         newname));
5518                 return NT_STATUS_OK;
5519         }
5520
5521         /*
5522          * Have vfs_object_exist also fill sbuf1
5523          */
5524         dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5525
5526         if(!replace_if_exists && dst_exists) {
5527                 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5528                         fsp->fsp_name,newname));
5529                 return NT_STATUS_OBJECT_NAME_COLLISION;
5530         }
5531
5532         if (dst_exists) {
5533                 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5534                 files_struct *dst_fsp = file_find_di_first(fileid);
5535                 if (dst_fsp) {
5536                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5537                         return NT_STATUS_ACCESS_DENIED;
5538                 }
5539         }
5540
5541         /* Ensure we have a valid stat struct for the source. */
5542         if (fsp->fh->fd != -1) {
5543                 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5544                         return map_nt_error_from_unix(errno);
5545                 }
5546         } else {
5547                 if (SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf) == -1) {
5548                         return map_nt_error_from_unix(errno);
5549                 }
5550         }
5551
5552         status = can_rename(conn, fsp, attrs, &sbuf);
5553
5554         if (!NT_STATUS_IS_OK(status)) {
5555                 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5556                         nt_errstr(status), fsp->fsp_name,newname));
5557                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5558                         status = NT_STATUS_ACCESS_DENIED;
5559                 return status;
5560         }
5561
5562         if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5563                 return NT_STATUS_ACCESS_DENIED;
5564         }
5565
5566         lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5567                                   NULL);
5568
5569         /*
5570          * We have the file open ourselves, so not being able to get the
5571          * corresponding share mode lock is a fatal error.
5572          */
5573
5574         SMB_ASSERT(lck != NULL);
5575
5576         if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5577                 uint32 create_options = fsp->fh->private_options;
5578
5579                 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5580                         fsp->fsp_name,newname));
5581
5582                 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5583
5584                 rename_open_files(conn, lck, newname);
5585
5586                 /*
5587                  * A rename acts as a new file create w.r.t. allowing an initial delete
5588                  * on close, probably because in Windows there is a new handle to the
5589                  * new file. If initial delete on close was requested but not
5590                  * originally set, we need to set it here. This is probably not 100% correct,
5591                  * but will work for the CIFSFS client which in non-posix mode
5592                  * depends on these semantics. JRA.
5593                  */
5594
5595                 set_allow_initial_delete_on_close(lck, fsp, True);
5596
5597                 if (create_options & FILE_DELETE_ON_CLOSE) {
5598                         status = can_set_delete_on_close(fsp, True, 0);
5599
5600                         if (NT_STATUS_IS_OK(status)) {
5601                                 /* Note that here we set the *inital* delete on close flag,
5602                                  * not the regular one. The magic gets handled in close. */
5603                                 fsp->initial_delete_on_close = True;
5604                         }
5605                 }
5606                 TALLOC_FREE(lck);
5607                 return NT_STATUS_OK;
5608         }
5609
5610         TALLOC_FREE(lck);
5611
5612         if (errno == ENOTDIR || errno == EISDIR) {
5613                 status = NT_STATUS_OBJECT_NAME_COLLISION;
5614         } else {
5615                 status = map_nt_error_from_unix(errno);
5616         }
5617
5618         DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5619                 nt_errstr(status), fsp->fsp_name,newname));
5620
5621         return status;
5622 }
5623
5624 /****************************************************************************
5625  The guts of the rename command, split out so it may be called by the NT SMB
5626  code.
5627 ****************************************************************************/
5628
5629 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5630                         connection_struct *conn,
5631                         struct smb_request *req,
5632                         const char *name_in,
5633                         const char *newname_in,
5634                         uint32 attrs,
5635                         bool replace_if_exists,
5636                         bool src_has_wild,
5637                         bool dest_has_wild,
5638                         uint32_t access_mask)
5639 {
5640         char *directory = NULL;
5641         char *mask = NULL;
5642         char *last_component_src = NULL;
5643         char *last_component_dest = NULL;
5644         char *name = NULL;
5645         char *newname = NULL;
5646         char *p;
5647         int count=0;
5648         NTSTATUS status = NT_STATUS_OK;
5649         SMB_STRUCT_STAT sbuf1, sbuf2;
5650         struct smb_Dir *dir_hnd = NULL;
5651         const char *dname;
5652         long offset = 0;
5653
5654         ZERO_STRUCT(sbuf1);
5655         ZERO_STRUCT(sbuf2);
5656
5657         status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5658                         &last_component_src, &sbuf1);
5659         if (!NT_STATUS_IS_OK(status)) {
5660                 return status;
5661         }
5662
5663         status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5664                         &last_component_dest, &sbuf2);
5665         if (!NT_STATUS_IS_OK(status)) {
5666                 return status;
5667         }
5668
5669         /*
5670          * Split the old name into directory and last component
5671          * strings. Note that unix_convert may have stripped off a
5672          * leading ./ from both name and newname if the rename is
5673          * at the root of the share. We need to make sure either both
5674          * name and newname contain a / character or neither of them do
5675          * as this is checked in resolve_wildcards().
5676          */
5677
5678         p = strrchr_m(name,'/');
5679         if (!p) {
5680                 directory = talloc_strdup(ctx, ".");
5681                 if (!directory) {
5682                         return NT_STATUS_NO_MEMORY;
5683                 }
5684                 mask = name;
5685         } else {
5686                 *p = 0;
5687                 directory = talloc_strdup(ctx, name);
5688                 if (!directory) {
5689                         return NT_STATUS_NO_MEMORY;
5690                 }
5691                 mask = p+1;
5692                 *p = '/'; /* Replace needed for exceptional test below. */
5693         }
5694
5695         /*
5696          * We should only check the mangled cache
5697          * here if unix_convert failed. This means
5698          * that the path in 'mask' doesn't exist
5699          * on the file system and so we need to look
5700          * for a possible mangle. This patch from
5701          * Tine Smukavec <valentin.smukavec@hermes.si>.
5702          */
5703
5704         if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5705                 char *new_mask = NULL;
5706                 mangle_lookup_name_from_8_3(ctx,
5707                                         mask,
5708                                         &new_mask,
5709                                         conn->params );
5710                 if (new_mask) {
5711                         mask = new_mask;
5712                 }
5713         }
5714
5715         if (!src_has_wild) {
5716                 files_struct *fsp;
5717
5718                 /*
5719                  * No wildcards - just process the one file.
5720                  */
5721                 bool is_short_name = mangle_is_8_3(name, True, conn->params);
5722
5723                 /* Add a terminating '/' to the directory name. */
5724                 directory = talloc_asprintf_append(directory,
5725                                 "/%s",
5726                                 mask);
5727                 if (!directory) {
5728                         return NT_STATUS_NO_MEMORY;
5729                 }
5730
5731                 /* Ensure newname contains a '/' also */
5732                 if(strrchr_m(newname,'/') == 0) {
5733                         newname = talloc_asprintf(ctx,
5734                                                 "./%s",
5735                                                 newname);
5736                         if (!newname) {
5737                                 return NT_STATUS_NO_MEMORY;
5738                         }
5739                 }
5740
5741                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5742                           "case_preserve = %d, short case preserve = %d, "
5743                           "directory = %s, newname = %s, "
5744                           "last_component_dest = %s, is_8_3 = %d\n",
5745                           conn->case_sensitive, conn->case_preserve,
5746                           conn->short_case_preserve, directory,
5747                           newname, last_component_dest, is_short_name));
5748
5749                 /* The dest name still may have wildcards. */
5750                 if (dest_has_wild) {
5751                         char *mod_newname = NULL;
5752                         if (!resolve_wildcards(ctx,
5753                                         directory,newname,&mod_newname)) {
5754                                 DEBUG(6, ("rename_internals: resolve_wildcards "
5755                                         "%s %s failed\n",
5756                                         directory,
5757                                         newname));
5758                                 return NT_STATUS_NO_MEMORY;
5759                         }
5760                         newname = mod_newname;
5761                 }
5762
5763                 ZERO_STRUCT(sbuf1);
5764                 SMB_VFS_STAT(conn, directory, &sbuf1);
5765
5766                 status = S_ISDIR(sbuf1.st_mode) ?
5767                         open_directory(conn, req, directory, &sbuf1,
5768                                        access_mask,
5769                                        FILE_SHARE_READ|FILE_SHARE_WRITE,
5770                                        FILE_OPEN, 0, 0, NULL,
5771                                        &fsp)
5772                         : open_file_ntcreate(conn, req, directory, &sbuf1,
5773                                              access_mask,
5774                                              FILE_SHARE_READ|FILE_SHARE_WRITE,
5775                                              FILE_OPEN, 0, 0, 0, NULL,
5776                                              &fsp);
5777
5778                 if (!NT_STATUS_IS_OK(status)) {
5779                         DEBUG(3, ("Could not open rename source %s: %s\n",
5780                                   directory, nt_errstr(status)));
5781                         return status;
5782                 }
5783
5784                 status = rename_internals_fsp(conn, fsp, newname,
5785                                               last_component_dest,
5786                                               attrs, replace_if_exists);
5787
5788                 close_file(fsp, NORMAL_CLOSE);
5789
5790                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
5791                           nt_errstr(status), directory,newname));
5792
5793                 return status;
5794         }
5795
5796         /*
5797          * Wildcards - process each file that matches.
5798          */
5799         if (strequal(mask,"????????.???")) {
5800                 mask[0] = '*';
5801                 mask[1] = '\0';
5802         }
5803
5804         status = check_name(conn, directory);
5805         if (!NT_STATUS_IS_OK(status)) {
5806                 return status;
5807         }
5808
5809         dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
5810         if (dir_hnd == NULL) {
5811                 return map_nt_error_from_unix(errno);
5812         }
5813
5814         status = NT_STATUS_NO_SUCH_FILE;
5815         /*
5816          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
5817          * - gentest fix. JRA
5818          */
5819
5820         while ((dname = ReadDirName(dir_hnd, &offset))) {
5821                 files_struct *fsp = NULL;
5822                 char *fname = NULL;
5823                 char *destname = NULL;
5824                 bool sysdir_entry = False;
5825
5826                 /* Quick check for "." and ".." */
5827                 if (ISDOT(dname) || ISDOTDOT(dname)) {
5828                         if (attrs & aDIR) {
5829                                 sysdir_entry = True;
5830                         } else {
5831                                 continue;
5832                         }
5833                 }
5834
5835                 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
5836                         continue;
5837                 }
5838
5839                 if(!mask_match(dname, mask, conn->case_sensitive)) {
5840                         continue;
5841                 }
5842
5843                 if (sysdir_entry) {
5844                         status = NT_STATUS_OBJECT_NAME_INVALID;
5845                         break;
5846                 }
5847
5848                 fname = talloc_asprintf(ctx,
5849                                 "%s/%s",
5850                                 directory,
5851                                 dname);
5852                 if (!fname) {
5853                         return NT_STATUS_NO_MEMORY;
5854                 }
5855
5856                 if (!resolve_wildcards(ctx,
5857                                 fname,newname,&destname)) {
5858                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
5859                                   fname, destname));
5860                         TALLOC_FREE(fname);
5861                         continue;
5862                 }
5863                 if (!destname) {
5864                         return NT_STATUS_NO_MEMORY;
5865                 }
5866
5867                 ZERO_STRUCT(sbuf1);
5868                 SMB_VFS_STAT(conn, fname, &sbuf1);
5869
5870                 status = S_ISDIR(sbuf1.st_mode) ?
5871                         open_directory(conn, req, fname, &sbuf1,
5872                                        access_mask,
5873                                        FILE_SHARE_READ|FILE_SHARE_WRITE,
5874                                        FILE_OPEN, 0, 0, NULL,
5875                                        &fsp)
5876                         : open_file_ntcreate(conn, req, fname, &sbuf1,
5877                                              access_mask,
5878                                              FILE_SHARE_READ|FILE_SHARE_WRITE,
5879                                              FILE_OPEN, 0, 0, 0, NULL,
5880                                              &fsp);
5881
5882                 if (!NT_STATUS_IS_OK(status)) {
5883                         DEBUG(3,("rename_internals: open_file_ntcreate "
5884                                  "returned %s rename %s -> %s\n",
5885                                  nt_errstr(status), directory, newname));
5886                         break;
5887                 }
5888
5889                 status = rename_internals_fsp(conn, fsp, destname, dname,
5890                                               attrs, replace_if_exists);
5891
5892                 close_file(fsp, NORMAL_CLOSE);
5893
5894                 if (!NT_STATUS_IS_OK(status)) {
5895                         DEBUG(3, ("rename_internals_fsp returned %s for "
5896                                   "rename %s -> %s\n", nt_errstr(status),
5897                                   directory, newname));
5898                         break;
5899                 }
5900
5901                 count++;
5902
5903                 DEBUG(3,("rename_internals: doing rename on %s -> "
5904                          "%s\n",fname,destname));
5905
5906                 TALLOC_FREE(fname);
5907                 TALLOC_FREE(destname);
5908         }
5909         TALLOC_FREE(dir_hnd);
5910
5911         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
5912                 status = map_nt_error_from_unix(errno);
5913         }
5914
5915         return status;
5916 }
5917
5918 /****************************************************************************
5919  Reply to a mv.
5920 ****************************************************************************/
5921
5922 void reply_mv(struct smb_request *req)
5923 {
5924         connection_struct *conn = req->conn;
5925         char *name = NULL;
5926         char *newname = NULL;
5927         char *p;
5928         uint32 attrs;
5929         NTSTATUS status;
5930         bool src_has_wcard = False;
5931         bool dest_has_wcard = False;
5932         TALLOC_CTX *ctx = talloc_tos();
5933
5934         START_PROFILE(SMBmv);
5935
5936         if (req->wct < 1) {
5937                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5938                 END_PROFILE(SMBmv);
5939                 return;
5940         }
5941
5942         attrs = SVAL(req->inbuf,smb_vwv0);
5943
5944         p = smb_buf(req->inbuf) + 1;
5945         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
5946                                    0, STR_TERMINATE, &status,
5947                                    &src_has_wcard);
5948         if (!NT_STATUS_IS_OK(status)) {
5949                 reply_nterror(req, status);
5950                 END_PROFILE(SMBmv);
5951                 return;
5952         }
5953         p++;
5954         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
5955                                    0, STR_TERMINATE, &status,
5956                                    &dest_has_wcard);
5957         if (!NT_STATUS_IS_OK(status)) {
5958                 reply_nterror(req, status);
5959                 END_PROFILE(SMBmv);
5960                 return;
5961         }
5962
5963         status = resolve_dfspath_wcard(ctx, conn,
5964                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
5965                                        name,
5966                                        &name,
5967                                        &src_has_wcard);
5968         if (!NT_STATUS_IS_OK(status)) {
5969                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5970                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5971                                         ERRSRV, ERRbadpath);
5972                         END_PROFILE(SMBmv);
5973                         return;
5974                 }
5975                 reply_nterror(req, status);
5976                 END_PROFILE(SMBmv);
5977                 return;
5978         }
5979
5980         status = resolve_dfspath_wcard(ctx, conn,
5981                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
5982                                        newname,
5983                                        &newname,
5984                                        &dest_has_wcard);
5985         if (!NT_STATUS_IS_OK(status)) {
5986                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5987                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5988                                         ERRSRV, ERRbadpath);
5989                         END_PROFILE(SMBmv);
5990                         return;
5991                 }
5992                 reply_nterror(req, status);
5993                 END_PROFILE(SMBmv);
5994                 return;
5995         }
5996
5997         DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
5998
5999         status = rename_internals(ctx, conn, req, name, newname, attrs, False,
6000                                   src_has_wcard, dest_has_wcard, DELETE_ACCESS);
6001         if (!NT_STATUS_IS_OK(status)) {
6002                 if (open_was_deferred(req->mid)) {
6003                         /* We have re-scheduled this call. */
6004                         END_PROFILE(SMBmv);
6005                         return;
6006                 }
6007                 reply_nterror(req, status);
6008                 END_PROFILE(SMBmv);
6009                 return;
6010         }
6011
6012         reply_outbuf(req, 0, 0);
6013
6014         END_PROFILE(SMBmv);
6015         return;
6016 }
6017
6018 /*******************************************************************
6019  Copy a file as part of a reply_copy.
6020 ******************************************************************/
6021
6022 /*
6023  * TODO: check error codes on all callers
6024  */
6025
6026 NTSTATUS copy_file(TALLOC_CTX *ctx,
6027                         connection_struct *conn,
6028                         const char *src,
6029                         const char *dest1,
6030                         int ofun,
6031                         int count,
6032                         bool target_is_directory)
6033 {
6034         SMB_STRUCT_STAT src_sbuf, sbuf2;
6035         SMB_OFF_T ret=-1;
6036         files_struct *fsp1,*fsp2;
6037         char *dest = NULL;
6038         uint32 dosattrs;
6039         uint32 new_create_disposition;
6040         NTSTATUS status;
6041
6042         dest = talloc_strdup(ctx, dest1);
6043         if (!dest) {
6044                 return NT_STATUS_NO_MEMORY;
6045         }
6046         if (target_is_directory) {
6047                 const char *p = strrchr_m(src,'/');
6048                 if (p) {
6049                         p++;
6050                 } else {
6051                         p = src;
6052                 }
6053                 dest = talloc_asprintf_append(dest,
6054                                 "/%s",
6055                                 p);
6056                 if (!dest) {
6057                         return NT_STATUS_NO_MEMORY;
6058                 }
6059         }
6060
6061         if (!vfs_file_exist(conn,src,&src_sbuf)) {
6062                 TALLOC_FREE(dest);
6063                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6064         }
6065
6066         if (!target_is_directory && count) {
6067                 new_create_disposition = FILE_OPEN;
6068         } else {
6069                 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6070                                 NULL, NULL, &new_create_disposition, NULL)) {
6071                         TALLOC_FREE(dest);
6072                         return NT_STATUS_INVALID_PARAMETER;
6073                 }
6074         }
6075
6076         status = open_file_ntcreate(conn, NULL, src, &src_sbuf,
6077                         FILE_GENERIC_READ,
6078                         FILE_SHARE_READ|FILE_SHARE_WRITE,
6079                         FILE_OPEN,
6080                         0,
6081                         FILE_ATTRIBUTE_NORMAL,
6082                         INTERNAL_OPEN_ONLY,
6083                         NULL, &fsp1);
6084
6085         if (!NT_STATUS_IS_OK(status)) {
6086                 TALLOC_FREE(dest);
6087                 return status;
6088         }
6089
6090         dosattrs = dos_mode(conn, src, &src_sbuf);
6091         if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6092                 ZERO_STRUCTP(&sbuf2);
6093         }
6094
6095         status = open_file_ntcreate(conn, NULL, dest, &sbuf2,
6096                         FILE_GENERIC_WRITE,
6097                         FILE_SHARE_READ|FILE_SHARE_WRITE,
6098                         new_create_disposition,
6099                         0,
6100                         dosattrs,
6101                         INTERNAL_OPEN_ONLY,
6102                         NULL, &fsp2);
6103
6104         TALLOC_FREE(dest);
6105
6106         if (!NT_STATUS_IS_OK(status)) {
6107                 close_file(fsp1,ERROR_CLOSE);
6108                 return status;
6109         }
6110
6111         if ((ofun&3) == 1) {
6112                 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6113                         DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6114                         /*
6115                          * Stop the copy from occurring.
6116                          */
6117                         ret = -1;
6118                         src_sbuf.st_size = 0;
6119                 }
6120         }
6121
6122         if (src_sbuf.st_size) {
6123                 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6124         }
6125
6126         close_file(fsp1,NORMAL_CLOSE);
6127
6128         /* Ensure the modtime is set correctly on the destination file. */
6129         set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6130
6131         /*
6132          * As we are opening fsp1 read-only we only expect
6133          * an error on close on fsp2 if we are out of space.
6134          * Thus we don't look at the error return from the
6135          * close of fsp1.
6136          */
6137         status = close_file(fsp2,NORMAL_CLOSE);
6138
6139         if (!NT_STATUS_IS_OK(status)) {
6140                 return status;
6141         }
6142
6143         if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6144                 return NT_STATUS_DISK_FULL;
6145         }
6146
6147         return NT_STATUS_OK;
6148 }
6149
6150 /****************************************************************************
6151  Reply to a file copy.
6152 ****************************************************************************/
6153
6154 void reply_copy(struct smb_request *req)
6155 {
6156         connection_struct *conn = req->conn;
6157         char *name = NULL;
6158         char *newname = NULL;
6159         char *directory = NULL;
6160         char *mask = NULL;
6161         char *p;
6162         int count=0;
6163         int error = ERRnoaccess;
6164         int err = 0;
6165         int tid2;
6166         int ofun;
6167         int flags;
6168         bool target_is_directory=False;
6169         bool source_has_wild = False;
6170         bool dest_has_wild = False;
6171         SMB_STRUCT_STAT sbuf1, sbuf2;
6172         NTSTATUS status;
6173         TALLOC_CTX *ctx = talloc_tos();
6174
6175         START_PROFILE(SMBcopy);
6176
6177         if (req->wct < 3) {
6178                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6179                 END_PROFILE(SMBcopy);
6180                 return;
6181         }
6182
6183         tid2 = SVAL(req->inbuf,smb_vwv0);
6184         ofun = SVAL(req->inbuf,smb_vwv1);
6185         flags = SVAL(req->inbuf,smb_vwv2);
6186
6187         p = smb_buf(req->inbuf);
6188         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
6189                                    0, STR_TERMINATE, &status,
6190                                    &source_has_wild);
6191         if (!NT_STATUS_IS_OK(status)) {
6192                 reply_nterror(req, status);
6193                 END_PROFILE(SMBcopy);
6194                 return;
6195         }
6196         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
6197                                    0, STR_TERMINATE, &status,
6198                                    &dest_has_wild);
6199         if (!NT_STATUS_IS_OK(status)) {
6200                 reply_nterror(req, status);
6201                 END_PROFILE(SMBcopy);
6202                 return;
6203         }
6204
6205         DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6206
6207         if (tid2 != conn->cnum) {
6208                 /* can't currently handle inter share copies XXXX */
6209                 DEBUG(3,("Rejecting inter-share copy\n"));
6210                 reply_doserror(req, ERRSRV, ERRinvdevice);
6211                 END_PROFILE(SMBcopy);
6212                 return;
6213         }
6214
6215         status = resolve_dfspath_wcard(ctx, conn,
6216                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
6217                                        name,
6218                                        &name,
6219                                        &source_has_wild);
6220         if (!NT_STATUS_IS_OK(status)) {
6221                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6222                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6223                                         ERRSRV, ERRbadpath);
6224                         END_PROFILE(SMBcopy);
6225                         return;
6226                 }
6227                 reply_nterror(req, status);
6228                 END_PROFILE(SMBcopy);
6229                 return;
6230         }
6231
6232         status = resolve_dfspath_wcard(ctx, conn,
6233                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
6234                                        newname,
6235                                        &newname,
6236                                        &dest_has_wild);
6237         if (!NT_STATUS_IS_OK(status)) {
6238                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6239                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6240                                         ERRSRV, ERRbadpath);
6241                         END_PROFILE(SMBcopy);
6242                         return;
6243                 }
6244                 reply_nterror(req, status);
6245                 END_PROFILE(SMBcopy);
6246                 return;
6247         }
6248
6249         status = unix_convert(ctx, conn, name, source_has_wild,
6250                         &name, NULL, &sbuf1);
6251         if (!NT_STATUS_IS_OK(status)) {
6252                 reply_nterror(req, status);
6253                 END_PROFILE(SMBcopy);
6254                 return;
6255         }
6256
6257         status = unix_convert(ctx, conn, newname, dest_has_wild,
6258                         &newname, NULL, &sbuf2);
6259         if (!NT_STATUS_IS_OK(status)) {
6260                 reply_nterror(req, status);
6261                 END_PROFILE(SMBcopy);
6262                 return;
6263         }
6264
6265         target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6266
6267         if ((flags&1) && target_is_directory) {
6268                 reply_doserror(req, ERRDOS, ERRbadfile);
6269                 END_PROFILE(SMBcopy);
6270                 return;
6271         }
6272
6273         if ((flags&2) && !target_is_directory) {
6274                 reply_doserror(req, ERRDOS, ERRbadpath);
6275                 END_PROFILE(SMBcopy);
6276                 return;
6277         }
6278
6279         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6280                 /* wants a tree copy! XXXX */
6281                 DEBUG(3,("Rejecting tree copy\n"));
6282                 reply_doserror(req, ERRSRV, ERRerror);
6283                 END_PROFILE(SMBcopy);
6284                 return;
6285         }
6286
6287         p = strrchr_m(name,'/');
6288         if (!p) {
6289                 directory = talloc_strdup(ctx, "./");
6290                 if (!directory) {
6291                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6292                         END_PROFILE(SMBcopy);
6293                         return;
6294                 }
6295                 mask = name;
6296         } else {
6297                 *p = 0;
6298                 directory = talloc_strdup(ctx, name);
6299                 if (!directory) {
6300                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6301                         END_PROFILE(SMBcopy);
6302                         return;
6303                 }
6304                 mask = p+1;
6305         }
6306
6307         /*
6308          * We should only check the mangled cache
6309          * here if unix_convert failed. This means
6310          * that the path in 'mask' doesn't exist
6311          * on the file system and so we need to look
6312          * for a possible mangle. This patch from
6313          * Tine Smukavec <valentin.smukavec@hermes.si>.
6314          */
6315
6316         if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6317                 char *new_mask = NULL;
6318                 mangle_lookup_name_from_8_3(ctx,
6319                                         mask,
6320                                         &new_mask,
6321                                         conn->params );
6322                 if (new_mask) {
6323                         mask = new_mask;
6324                 }
6325         }
6326
6327         if (!source_has_wild) {
6328                 directory = talloc_asprintf_append(directory,
6329                                 "/%s",
6330                                 mask);
6331                 if (dest_has_wild) {
6332                         char *mod_newname = NULL;
6333                         if (!resolve_wildcards(ctx,
6334                                         directory,newname,&mod_newname)) {
6335                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6336                                 END_PROFILE(SMBcopy);
6337                                 return;
6338                         }
6339                         newname = mod_newname;
6340                 }
6341
6342                 status = check_name(conn, directory);
6343                 if (!NT_STATUS_IS_OK(status)) {
6344                         reply_nterror(req, status);
6345                         END_PROFILE(SMBcopy);
6346                         return;
6347                 }
6348
6349                 status = check_name(conn, newname);
6350                 if (!NT_STATUS_IS_OK(status)) {
6351                         reply_nterror(req, status);
6352                         END_PROFILE(SMBcopy);
6353                         return;
6354                 }
6355
6356                 status = copy_file(ctx,conn,directory,newname,ofun,
6357                                 count,target_is_directory);
6358
6359                 if(!NT_STATUS_IS_OK(status)) {
6360                         reply_nterror(req, status);
6361                         END_PROFILE(SMBcopy);
6362                         return;
6363                 } else {
6364                         count++;
6365                 }
6366         } else {
6367                 struct smb_Dir *dir_hnd = NULL;
6368                 const char *dname = NULL;
6369                 long offset = 0;
6370
6371                 if (strequal(mask,"????????.???")) {
6372                         mask[0] = '*';
6373                         mask[1] = '\0';
6374                 }
6375
6376                 status = check_name(conn, directory);
6377                 if (!NT_STATUS_IS_OK(status)) {
6378                         reply_nterror(req, status);
6379                         END_PROFILE(SMBcopy);
6380                         return;
6381                 }
6382
6383                 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6384                 if (dir_hnd == NULL) {
6385                         status = map_nt_error_from_unix(errno);
6386                         reply_nterror(req, status);
6387                         END_PROFILE(SMBcopy);
6388                         return;
6389                 }
6390
6391                 error = ERRbadfile;
6392
6393                 while ((dname = ReadDirName(dir_hnd, &offset))) {
6394                         char *destname = NULL;
6395                         char *fname = NULL;
6396
6397                         if (ISDOT(dname) || ISDOTDOT(dname)) {
6398                                 continue;
6399                         }
6400
6401                         if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6402                                 continue;
6403                         }
6404
6405                         if(!mask_match(dname, mask, conn->case_sensitive)) {
6406                                 continue;
6407                         }
6408
6409                         error = ERRnoaccess;
6410                         fname = talloc_asprintf(ctx,
6411                                         "%s/%s",
6412                                         directory,
6413                                         dname);
6414                         if (!fname) {
6415                                 TALLOC_FREE(dir_hnd);
6416                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6417                                 END_PROFILE(SMBcopy);
6418                                 return;
6419                         }
6420
6421                         if (!resolve_wildcards(ctx,
6422                                         fname,newname,&destname)) {
6423                                 continue;
6424                         }
6425                         if (!destname) {
6426                                 TALLOC_FREE(dir_hnd);
6427                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6428                                 END_PROFILE(SMBcopy);
6429                                 return;
6430                         }
6431
6432                         status = check_name(conn, fname);
6433                         if (!NT_STATUS_IS_OK(status)) {
6434                                 TALLOC_FREE(dir_hnd);
6435                                 reply_nterror(req, status);
6436                                 END_PROFILE(SMBcopy);
6437                                 return;
6438                         }
6439
6440                         status = check_name(conn, destname);
6441                         if (!NT_STATUS_IS_OK(status)) {
6442                                 TALLOC_FREE(dir_hnd);
6443                                 reply_nterror(req, status);
6444                                 END_PROFILE(SMBcopy);
6445                                 return;
6446                         }
6447
6448                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6449
6450                         status = copy_file(ctx,conn,fname,destname,ofun,
6451                                         count,target_is_directory);
6452                         if (NT_STATUS_IS_OK(status)) {
6453                                 count++;
6454                         }
6455                         TALLOC_FREE(fname);
6456                         TALLOC_FREE(destname);
6457                 }
6458                 TALLOC_FREE(dir_hnd);
6459         }
6460
6461         if (count == 0) {
6462                 if(err) {
6463                         /* Error on close... */
6464                         errno = err;
6465                         reply_unixerror(req, ERRHRD, ERRgeneral);
6466                         END_PROFILE(SMBcopy);
6467                         return;
6468                 }
6469
6470                 reply_doserror(req, ERRDOS, error);
6471                 END_PROFILE(SMBcopy);
6472                 return;
6473         }
6474
6475         reply_outbuf(req, 1, 0);
6476         SSVAL(req->outbuf,smb_vwv0,count);
6477
6478         END_PROFILE(SMBcopy);
6479         return;
6480 }
6481
6482 #undef DBGC_CLASS
6483 #define DBGC_CLASS DBGC_LOCKING
6484
6485 /****************************************************************************
6486  Get a lock pid, dealing with large count requests.
6487 ****************************************************************************/
6488
6489 uint32 get_lock_pid( char *data, int data_offset, bool large_file_format)
6490 {
6491         if(!large_file_format)
6492                 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6493         else
6494                 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6495 }
6496
6497 /****************************************************************************
6498  Get a lock count, dealing with large count requests.
6499 ****************************************************************************/
6500
6501 SMB_BIG_UINT get_lock_count( char *data, int data_offset, bool large_file_format)
6502 {
6503         SMB_BIG_UINT count = 0;
6504
6505         if(!large_file_format) {
6506                 count = (SMB_BIG_UINT)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6507         } else {
6508
6509 #if defined(HAVE_LONGLONG)
6510                 count = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6511                         ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6512 #else /* HAVE_LONGLONG */
6513
6514                 /*
6515                  * NT4.x seems to be broken in that it sends large file (64 bit)
6516                  * lockingX calls even if the CAP_LARGE_FILES was *not*
6517                  * negotiated. For boxes without large unsigned ints truncate the
6518                  * lock count by dropping the top 32 bits.
6519                  */
6520
6521                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6522                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6523                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6524                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6525                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6526                 }
6527
6528                 count = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6529 #endif /* HAVE_LONGLONG */
6530         }
6531
6532         return count;
6533 }
6534
6535 #if !defined(HAVE_LONGLONG)
6536 /****************************************************************************
6537  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6538 ****************************************************************************/
6539
6540 static uint32 map_lock_offset(uint32 high, uint32 low)
6541 {
6542         unsigned int i;
6543         uint32 mask = 0;
6544         uint32 highcopy = high;
6545
6546         /*
6547          * Try and find out how many significant bits there are in high.
6548          */
6549
6550         for(i = 0; highcopy; i++)
6551                 highcopy >>= 1;
6552
6553         /*
6554          * We use 31 bits not 32 here as POSIX
6555          * lock offsets may not be negative.
6556          */
6557
6558         mask = (~0) << (31 - i);
6559
6560         if(low & mask)
6561                 return 0; /* Fail. */
6562
6563         high <<= (31 - i);
6564
6565         return (high|low);
6566 }
6567 #endif /* !defined(HAVE_LONGLONG) */
6568
6569 /****************************************************************************
6570  Get a lock offset, dealing with large offset requests.
6571 ****************************************************************************/
6572
6573 SMB_BIG_UINT get_lock_offset( char *data, int data_offset, bool large_file_format, bool *err)
6574 {
6575         SMB_BIG_UINT offset = 0;
6576
6577         *err = False;
6578
6579         if(!large_file_format) {
6580                 offset = (SMB_BIG_UINT)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6581         } else {
6582
6583 #if defined(HAVE_LONGLONG)
6584                 offset = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6585                                 ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6586 #else /* HAVE_LONGLONG */
6587
6588                 /*
6589                  * NT4.x seems to be broken in that it sends large file (64 bit)
6590                  * lockingX calls even if the CAP_LARGE_FILES was *not*
6591                  * negotiated. For boxes without large unsigned ints mangle the
6592                  * lock offset by mapping the top 32 bits onto the lower 32.
6593                  */
6594
6595                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6596                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6597                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6598                         uint32 new_low = 0;
6599
6600                         if((new_low = map_lock_offset(high, low)) == 0) {
6601                                 *err = True;
6602                                 return (SMB_BIG_UINT)-1;
6603                         }
6604
6605                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6606                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6607                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6608                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6609                 }
6610
6611                 offset = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6612 #endif /* HAVE_LONGLONG */
6613         }
6614
6615         return offset;
6616 }
6617
6618 /****************************************************************************
6619  Reply to a lockingX request.
6620 ****************************************************************************/
6621
6622 void reply_lockingX(struct smb_request *req)
6623 {
6624         connection_struct *conn = req->conn;
6625         files_struct *fsp;
6626         unsigned char locktype;
6627         unsigned char oplocklevel;
6628         uint16 num_ulocks;
6629         uint16 num_locks;
6630         SMB_BIG_UINT count = 0, offset = 0;
6631         uint32 lock_pid;
6632         int32 lock_timeout;
6633         int i;
6634         char *data;
6635         bool large_file_format;
6636         bool err;
6637         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6638
6639         START_PROFILE(SMBlockingX);
6640
6641         if (req->wct < 8) {
6642                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6643                 END_PROFILE(SMBlockingX);
6644                 return;
6645         }
6646
6647         fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
6648         locktype = CVAL(req->inbuf,smb_vwv3);
6649         oplocklevel = CVAL(req->inbuf,smb_vwv3+1);
6650         num_ulocks = SVAL(req->inbuf,smb_vwv6);
6651         num_locks = SVAL(req->inbuf,smb_vwv7);
6652         lock_timeout = IVAL(req->inbuf,smb_vwv4);
6653         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6654
6655         if (!check_fsp(conn, req, fsp)) {
6656                 END_PROFILE(SMBlockingX);
6657                 return;
6658         }
6659
6660         data = smb_buf(req->inbuf);
6661
6662         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6663                 /* we don't support these - and CANCEL_LOCK makes w2k
6664                    and XP reboot so I don't really want to be
6665                    compatible! (tridge) */
6666                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6667                 END_PROFILE(SMBlockingX);
6668                 return;
6669         }
6670
6671         /* Check if this is an oplock break on a file
6672            we have granted an oplock on.
6673         */
6674         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6675                 /* Client can insist on breaking to none. */
6676                 bool break_to_none = (oplocklevel == 0);
6677                 bool result;
6678
6679                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6680                          "for fnum = %d\n", (unsigned int)oplocklevel,
6681                          fsp->fnum ));
6682
6683                 /*
6684                  * Make sure we have granted an exclusive or batch oplock on
6685                  * this file.
6686                  */
6687
6688                 if (fsp->oplock_type == 0) {
6689
6690                         /* The Samba4 nbench simulator doesn't understand
6691                            the difference between break to level2 and break
6692                            to none from level2 - it sends oplock break
6693                            replies in both cases. Don't keep logging an error
6694                            message here - just ignore it. JRA. */
6695
6696                         DEBUG(5,("reply_lockingX: Error : oplock break from "
6697                                  "client for fnum = %d (oplock=%d) and no "
6698                                  "oplock granted on this file (%s).\n",
6699                                  fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6700
6701                         /* if this is a pure oplock break request then don't
6702                          * send a reply */
6703                         if (num_locks == 0 && num_ulocks == 0) {
6704                                 END_PROFILE(SMBlockingX);
6705                                 return;
6706                         } else {
6707                                 END_PROFILE(SMBlockingX);
6708                                 reply_doserror(req, ERRDOS, ERRlock);
6709                                 return;
6710                         }
6711                 }
6712
6713                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
6714                     (break_to_none)) {
6715                         result = remove_oplock(fsp);
6716                 } else {
6717                         result = downgrade_oplock(fsp);
6718                 }
6719
6720                 if (!result) {
6721                         DEBUG(0, ("reply_lockingX: error in removing "
6722                                   "oplock on file %s\n", fsp->fsp_name));
6723                         /* Hmmm. Is this panic justified? */
6724                         smb_panic("internal tdb error");
6725                 }
6726
6727                 reply_to_oplock_break_requests(fsp);
6728
6729                 /* if this is a pure oplock break request then don't send a
6730                  * reply */
6731                 if (num_locks == 0 && num_ulocks == 0) {
6732                         /* Sanity check - ensure a pure oplock break is not a
6733                            chained request. */
6734                         if(CVAL(req->inbuf,smb_vwv0) != 0xff)
6735                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
6736                                          "break is a chained %d request !\n",
6737                                          (unsigned int)CVAL(req->inbuf,
6738                                                             smb_vwv0) ));
6739                         END_PROFILE(SMBlockingX);
6740                         return;
6741                 }
6742         }
6743
6744         /*
6745          * We do this check *after* we have checked this is not a oplock break
6746          * response message. JRA.
6747          */
6748
6749         release_level_2_oplocks_on_change(fsp);
6750
6751         if (smb_buflen(req->inbuf) <
6752             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
6753                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6754                 END_PROFILE(SMBlockingX);
6755                 return;
6756         }
6757
6758         /* Data now points at the beginning of the list
6759            of smb_unlkrng structs */
6760         for(i = 0; i < (int)num_ulocks; i++) {
6761                 lock_pid = get_lock_pid( data, i, large_file_format);
6762                 count = get_lock_count( data, i, large_file_format);
6763                 offset = get_lock_offset( data, i, large_file_format, &err);
6764
6765                 /*
6766                  * There is no error code marked "stupid client bug".... :-).
6767                  */
6768                 if(err) {
6769                         END_PROFILE(SMBlockingX);
6770                         reply_doserror(req, ERRDOS, ERRnoaccess);
6771                         return;
6772                 }
6773
6774                 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
6775                           "pid %u, file %s\n", (double)offset, (double)count,
6776                           (unsigned int)lock_pid, fsp->fsp_name ));
6777
6778                 status = do_unlock(smbd_messaging_context(),
6779                                 fsp,
6780                                 lock_pid,
6781                                 count,
6782                                 offset,
6783                                 WINDOWS_LOCK);
6784
6785                 if (NT_STATUS_V(status)) {
6786                         END_PROFILE(SMBlockingX);
6787                         reply_nterror(req, status);
6788                         return;
6789                 }
6790         }
6791
6792         /* Setup the timeout in seconds. */
6793
6794         if (!lp_blocking_locks(SNUM(conn))) {
6795                 lock_timeout = 0;
6796         }
6797
6798         /* Now do any requested locks */
6799         data += ((large_file_format ? 20 : 10)*num_ulocks);
6800
6801         /* Data now points at the beginning of the list
6802            of smb_lkrng structs */
6803
6804         for(i = 0; i < (int)num_locks; i++) {
6805                 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
6806                                 READ_LOCK:WRITE_LOCK);
6807                 lock_pid = get_lock_pid( data, i, large_file_format);
6808                 count = get_lock_count( data, i, large_file_format);
6809                 offset = get_lock_offset( data, i, large_file_format, &err);
6810
6811                 /*
6812                  * There is no error code marked "stupid client bug".... :-).
6813                  */
6814                 if(err) {
6815                         END_PROFILE(SMBlockingX);
6816                         reply_doserror(req, ERRDOS, ERRnoaccess);
6817                         return;
6818                 }
6819
6820                 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
6821                           "%u, file %s timeout = %d\n", (double)offset,
6822                           (double)count, (unsigned int)lock_pid,
6823                           fsp->fsp_name, (int)lock_timeout ));
6824
6825                 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
6826                         if (lp_blocking_locks(SNUM(conn))) {
6827
6828                                 /* Schedule a message to ourselves to
6829                                    remove the blocking lock record and
6830                                    return the right error. */
6831
6832                                 if (!blocking_lock_cancel(fsp,
6833                                                 lock_pid,
6834                                                 offset,
6835                                                 count,
6836                                                 WINDOWS_LOCK,
6837                                                 locktype,
6838                                                 NT_STATUS_FILE_LOCK_CONFLICT)) {
6839                                         END_PROFILE(SMBlockingX);
6840                                         reply_nterror(
6841                                                 req,
6842                                                 NT_STATUS_DOS(
6843                                                         ERRDOS,
6844                                                         ERRcancelviolation));
6845                                         return;
6846                                 }
6847                         }
6848                         /* Remove a matching pending lock. */
6849                         status = do_lock_cancel(fsp,
6850                                                 lock_pid,
6851                                                 count,
6852                                                 offset,
6853                                                 WINDOWS_LOCK);
6854                 } else {
6855                         bool blocking_lock = lock_timeout ? True : False;
6856                         bool defer_lock = False;
6857                         struct byte_range_lock *br_lck;
6858                         uint32 block_smbpid;
6859
6860                         br_lck = do_lock(smbd_messaging_context(),
6861                                         fsp,
6862                                         lock_pid,
6863                                         count,
6864                                         offset,
6865                                         lock_type,
6866                                         WINDOWS_LOCK,
6867                                         blocking_lock,
6868                                         &status,
6869                                         &block_smbpid);
6870
6871                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
6872                                 /* Windows internal resolution for blocking locks seems
6873                                    to be about 200ms... Don't wait for less than that. JRA. */
6874                                 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
6875                                         lock_timeout = lp_lock_spin_time();
6876                                 }
6877                                 defer_lock = True;
6878                         }
6879
6880                         /* This heuristic seems to match W2K3 very well. If a
6881                            lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
6882                            it pretends we asked for a timeout of between 150 - 300 milliseconds as
6883                            far as I can tell. Replacement for do_lock_spin(). JRA. */
6884
6885                         if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
6886                                         NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
6887                                 defer_lock = True;
6888                                 lock_timeout = lp_lock_spin_time();
6889                         }
6890
6891                         if (br_lck && defer_lock) {
6892                                 /*
6893                                  * A blocking lock was requested. Package up
6894                                  * this smb into a queued request and push it
6895                                  * onto the blocking lock queue.
6896                                  */
6897                                 if(push_blocking_lock_request(br_lck,
6898                                                         req,
6899                                                         fsp,
6900                                                         lock_timeout,
6901                                                         i,
6902                                                         lock_pid,
6903                                                         lock_type,
6904                                                         WINDOWS_LOCK,
6905                                                         offset,
6906                                                         count,
6907                                                         block_smbpid)) {
6908                                         TALLOC_FREE(br_lck);
6909                                         END_PROFILE(SMBlockingX);
6910                                         return;
6911                                 }
6912                         }
6913
6914                         TALLOC_FREE(br_lck);
6915                 }
6916
6917                 if (NT_STATUS_V(status)) {
6918                         END_PROFILE(SMBlockingX);
6919                         reply_nterror(req, status);
6920                         return;
6921                 }
6922         }
6923
6924         /* If any of the above locks failed, then we must unlock
6925            all of the previous locks (X/Open spec). */
6926
6927         if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
6928                         (i != num_locks) &&
6929                         (num_locks != 0)) {
6930                 /*
6931                  * Ensure we don't do a remove on the lock that just failed,
6932                  * as under POSIX rules, if we have a lock already there, we
6933                  * will delete it (and we shouldn't) .....
6934                  */
6935                 for(i--; i >= 0; i--) {
6936                         lock_pid = get_lock_pid( data, i, large_file_format);
6937                         count = get_lock_count( data, i, large_file_format);
6938                         offset = get_lock_offset( data, i, large_file_format,
6939                                                   &err);
6940
6941                         /*
6942                          * There is no error code marked "stupid client
6943                          * bug".... :-).
6944                          */
6945                         if(err) {
6946                                 END_PROFILE(SMBlockingX);
6947                                 reply_doserror(req, ERRDOS, ERRnoaccess);
6948                                 return;
6949                         }
6950
6951                         do_unlock(smbd_messaging_context(),
6952                                 fsp,
6953                                 lock_pid,
6954                                 count,
6955                                 offset,
6956                                 WINDOWS_LOCK);
6957                 }
6958                 END_PROFILE(SMBlockingX);
6959                 reply_nterror(req, status);
6960                 return;
6961         }
6962
6963         reply_outbuf(req, 2, 0);
6964
6965         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
6966                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
6967
6968         END_PROFILE(SMBlockingX);
6969         chain_reply(req);
6970 }
6971
6972 #undef DBGC_CLASS
6973 #define DBGC_CLASS DBGC_ALL
6974
6975 /****************************************************************************
6976  Reply to a SMBreadbmpx (read block multiplex) request.
6977  Always reply with an error, if someone has a platform really needs this,
6978  please contact vl@samba.org
6979 ****************************************************************************/
6980
6981 void reply_readbmpx(struct smb_request *req)
6982 {
6983         START_PROFILE(SMBreadBmpx);
6984         reply_doserror(req, ERRSRV, ERRuseSTD);
6985         END_PROFILE(SMBreadBmpx);
6986         return;
6987 }
6988
6989 /****************************************************************************
6990  Reply to a SMBreadbs (read block multiplex secondary) request.
6991  Always reply with an error, if someone has a platform really needs this,
6992  please contact vl@samba.org
6993 ****************************************************************************/
6994
6995 void reply_readbs(struct smb_request *req)
6996 {
6997         START_PROFILE(SMBreadBs);
6998         reply_doserror(req, ERRSRV, ERRuseSTD);
6999         END_PROFILE(SMBreadBs);
7000         return;
7001 }
7002
7003 /****************************************************************************
7004  Reply to a SMBsetattrE.
7005 ****************************************************************************/
7006
7007 void reply_setattrE(struct smb_request *req)
7008 {
7009         connection_struct *conn = req->conn;
7010         struct timespec ts[2];
7011         files_struct *fsp;
7012         SMB_STRUCT_STAT sbuf;
7013         NTSTATUS status;
7014
7015         START_PROFILE(SMBsetattrE);
7016
7017         if (req->wct < 7) {
7018                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7019                 END_PROFILE(SMBsetattrE);
7020                 return;
7021         }
7022
7023         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
7024
7025         if(!fsp || (fsp->conn != conn)) {
7026                 reply_doserror(req, ERRDOS, ERRbadfid);
7027                 END_PROFILE(SMBsetattrE);
7028                 return;
7029         }
7030
7031
7032         /*
7033          * Convert the DOS times into unix times. Ignore create
7034          * time as UNIX can't set this.
7035          */
7036
7037         ts[0] = convert_time_t_to_timespec(
7038                 srv_make_unix_date2(req->inbuf+smb_vwv3)); /* atime. */
7039         ts[1] = convert_time_t_to_timespec(
7040                 srv_make_unix_date2(req->inbuf+smb_vwv5)); /* mtime. */
7041
7042         reply_outbuf(req, 0, 0);
7043
7044         /*
7045          * Patch from Ray Frush <frush@engr.colostate.edu>
7046          * Sometimes times are sent as zero - ignore them.
7047          */
7048
7049         /* Ensure we have a valid stat struct for the source. */
7050         if (fsp->fh->fd != -1) {
7051                 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7052                         status = map_nt_error_from_unix(errno);
7053                         reply_nterror(req, status);
7054                         END_PROFILE(SMBsetattrE);
7055                         return;
7056                 }
7057         } else {
7058                 if (SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf) == -1) {
7059                         status = map_nt_error_from_unix(errno);
7060                         reply_nterror(req, status);
7061                         END_PROFILE(SMBsetattrE);
7062                         return;
7063                 }
7064         }
7065
7066         status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7067                                    &sbuf, ts, true);
7068         if (!NT_STATUS_IS_OK(status)) {
7069                 reply_doserror(req, ERRDOS, ERRnoaccess);
7070                 END_PROFILE(SMBsetattrE);
7071                 return;
7072         }
7073
7074         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u\n",
7075                 fsp->fnum,
7076                 (unsigned int)ts[0].tv_sec,
7077                 (unsigned int)ts[1].tv_sec));
7078
7079         END_PROFILE(SMBsetattrE);
7080         return;
7081 }
7082
7083
7084 /* Back from the dead for OS/2..... JRA. */
7085
7086 /****************************************************************************
7087  Reply to a SMBwritebmpx (write block multiplex primary) request.
7088  Always reply with an error, if someone has a platform really needs this,
7089  please contact vl@samba.org
7090 ****************************************************************************/
7091
7092 void reply_writebmpx(struct smb_request *req)
7093 {
7094         START_PROFILE(SMBwriteBmpx);
7095         reply_doserror(req, ERRSRV, ERRuseSTD);
7096         END_PROFILE(SMBwriteBmpx);
7097         return;
7098 }
7099
7100 /****************************************************************************
7101  Reply to a SMBwritebs (write block multiplex secondary) request.
7102  Always reply with an error, if someone has a platform really needs this,
7103  please contact vl@samba.org
7104 ****************************************************************************/
7105
7106 void reply_writebs(struct smb_request *req)
7107 {
7108         START_PROFILE(SMBwriteBs);
7109         reply_doserror(req, ERRSRV, ERRuseSTD);
7110         END_PROFILE(SMBwriteBs);
7111         return;
7112 }
7113
7114 /****************************************************************************
7115  Reply to a SMBgetattrE.
7116 ****************************************************************************/
7117
7118 void reply_getattrE(struct smb_request *req)
7119 {
7120         connection_struct *conn = req->conn;
7121         SMB_STRUCT_STAT sbuf;
7122         int mode;
7123         files_struct *fsp;
7124         struct timespec create_ts;
7125
7126         START_PROFILE(SMBgetattrE);
7127
7128         if (req->wct < 1) {
7129                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7130                 END_PROFILE(SMBgetattrE);
7131                 return;
7132         }
7133
7134         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
7135
7136         if(!fsp || (fsp->conn != conn)) {
7137                 reply_doserror(req, ERRDOS, ERRbadfid);
7138                 END_PROFILE(SMBgetattrE);
7139                 return;
7140         }
7141
7142         /* Do an fstat on this file */
7143         if(fsp_stat(fsp, &sbuf)) {
7144                 reply_unixerror(req, ERRDOS, ERRnoaccess);
7145                 END_PROFILE(SMBgetattrE);
7146                 return;
7147         }
7148
7149         mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7150
7151         /*
7152          * Convert the times into dos times. Set create
7153          * date to be last modify date as UNIX doesn't save
7154          * this.
7155          */
7156
7157         reply_outbuf(req, 11, 0);
7158
7159         create_ts = get_create_timespec(&sbuf,
7160                                   lp_fake_dir_create_times(SNUM(conn)));
7161         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7162         srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7163         /* Should we check pending modtime here ? JRA */
7164         srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7165
7166         if (mode & aDIR) {
7167                 SIVAL(req->outbuf, smb_vwv6, 0);
7168                 SIVAL(req->outbuf, smb_vwv8, 0);
7169         } else {
7170                 uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
7171                 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7172                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7173         }
7174         SSVAL(req->outbuf,smb_vwv10, mode);
7175
7176         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7177
7178         END_PROFILE(SMBgetattrE);
7179         return;
7180 }