source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  35 #include "../librpc/gen_ndr/open_files.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "rpc_server/rpc_ncacn_np.h"
  39 #include "libcli/security/security.h"
  40 #include "libsmb/nmblib.h"
  41 #include "auth.h"
  42 #include "smbprofile.h"
  43 #include "../lib/tsocket/tsocket.h"
  44
  45 /****************************************************************************
  46  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  47  path or anything including wildcards.
  48  We're assuming here that '/' is not the second byte in any multibyte char
  49  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  50  set.
  51 ****************************************************************************/
  52
  53 /* Custom version for processing POSIX paths. */
  54 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  55
  56 static NTSTATUS check_path_syntax_internal(char *path,
  57                                            bool posix_path,
  58                                            bool *p_last_component_contains_wcard)
  59 {
  60         char *d = path;
  61         const char *s = path;
  62         NTSTATUS ret = NT_STATUS_OK;
  63         bool start_of_name_component = True;
  64         bool stream_started = false;
  65
  66         *p_last_component_contains_wcard = False;
  67
  68         while (*s) {
  69                 if (stream_started) {
  70                         switch (*s) {
  71                         case '/':
  72                         case '\\':
  73                                 return NT_STATUS_OBJECT_NAME_INVALID;
  74                         case ':':
  75                                 if (s[1] == '\0') {
  76                                         return NT_STATUS_OBJECT_NAME_INVALID;
  77                                 }
  78                                 if (strchr_m(&s[1], ':')) {
  79                                         return NT_STATUS_OBJECT_NAME_INVALID;
  80                                 }
  81                                 break;
  82                         }
  83                 }
  84
  85                 if ((*s == ':') && !posix_path && !stream_started) {
  86                         if (*p_last_component_contains_wcard) {
  87                                 return NT_STATUS_OBJECT_NAME_INVALID;
  88                         }
  89                         /* Stream names allow more characters than file names.
  90                            We're overloading posix_path here to allow a wider
  91                            range of characters. If stream_started is true this
  92                            is still a Windows path even if posix_path is true.
  93                            JRA.
  94                         */
  95                         stream_started = true;
  96                         start_of_name_component = false;
  97                         posix_path = true;
  98
  99                         if (s[1] == '\0') {
 100                                 return NT_STATUS_OBJECT_NAME_INVALID;
 101                         }
 102                 }
 103
 104                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 105                         /*
 106                          * Safe to assume is not the second part of a mb char
 107                          * as this is handled below.
 108                          */
 109                         /* Eat multiple '/' or '\\' */
 110                         while (IS_PATH_SEP(*s,posix_path)) {
 111                                 s++;
 112                         }
 113                         if ((d != path) && (*s != '\0')) {
 114                                 /* We only care about non-leading or trailing '/' or '\\' */
 115                                 *d++ = '/';
 116                         }
 117
 118                         start_of_name_component = True;
 119                         /* New component. */
 120                         *p_last_component_contains_wcard = False;
 121                         continue;
 122                 }
 123
 124                 if (start_of_name_component) {
 125                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 126                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 127
 128                                 /*
 129                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 130                                  */
 131
 132                                 /* If  we just added a '/' - delete it */
 133                                 if ((d > path) && (*(d-1) == '/')) {
 134                                         *(d-1) = '\0';
 135                                         d--;
 136                                 }
 137
 138                                 /* Are we at the start ? Can't go back further if so. */
 139                                 if (d <= path) {
 140                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 141                                         break;
 142                                 }
 143                                 /* Go back one level... */
 144                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 145                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 146                                 /* Decrement d first as d points to the *next* char to write into. */
 147                                 for (d--; d > path; d--) {
 148                                         if (*d == '/')
 149                                                 break;
 150                                 }
 151                                 s += 2; /* Else go past the .. */
 152                                 /* We're still at the start of a name component, just the previous one. */
 153                                 continue;
 154
 155                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 156                                 if (posix_path) {
 157                                         /* Eat the '.' */
 158                                         s++;
 159                                         continue;
 160                                 }
 161                         }
 162
 163                 }
 164
 165                 if (!(*s & 0x80)) {
 166                         if (!posix_path) {
 167                                 if (*s <= 0x1f || *s == '|') {
 168                                         return NT_STATUS_OBJECT_NAME_INVALID;
 169                                 }
 170                                 switch (*s) {
 171                                         case '*':
 172                                         case '?':
 173                                         case '<':
 174                                         case '>':
 175                                         case '"':
 176                                                 *p_last_component_contains_wcard = True;
 177                                                 break;
 178                                         default:
 179                                                 break;
 180                                 }
 181                         }
 182                         *d++ = *s++;
 183                 } else {
 184                         size_t siz;
 185                         /* Get the size of the next MB character. */
 186                         next_codepoint(s,&siz);
 187                         switch(siz) {
 188                                 case 5:
 189                                         *d++ = *s++;
 190                                         /*fall through*/
 191                                 case 4:
 192                                         *d++ = *s++;
 193                                         /*fall through*/
 194                                 case 3:
 195                                         *d++ = *s++;
 196                                         /*fall through*/
 197                                 case 2:
 198                                         *d++ = *s++;
 199                                         /*fall through*/
 200                                 case 1:
 201                                         *d++ = *s++;
 202                                         break;
 203                                 default:
 204                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 205                                         *d = '\0';
 206                                         return NT_STATUS_INVALID_PARAMETER;
 207                         }
 208                 }
 209                 start_of_name_component = False;
 210         }
 211
 212         *d = '\0';
 213
 214         return ret;
 215 }
 216
 217 /****************************************************************************
 218  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 219  No wildcards allowed.
 220 ****************************************************************************/
 221
 222 NTSTATUS check_path_syntax(char *path)
 223 {
 224         bool ignore;
 225         return check_path_syntax_internal(path, False, &ignore);
 226 }
 227
 228 /****************************************************************************
 229  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 230  Wildcards allowed - p_contains_wcard returns true if the last component contained
 231  a wildcard.
 232 ****************************************************************************/
 233
 234 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 235 {
 236         return check_path_syntax_internal(path, False, p_contains_wcard);
 237 }
 238
 239 /****************************************************************************
 240  Check the path for a POSIX client.
 241  We're assuming here that '/' is not the second byte in any multibyte char
 242  set (a safe assumption).
 243 ****************************************************************************/
 244
 245 NTSTATUS check_path_syntax_posix(char *path)
 246 {
 247         bool ignore;
 248         return check_path_syntax_internal(path, True, &ignore);
 249 }
 250
 251 /****************************************************************************
 252  Pull a string and check the path allowing a wilcard - provide for error return.
 253 ****************************************************************************/
 254
 255 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 256                         const char *base_ptr,
 257                         uint16 smb_flags2,
 258                         char **pp_dest,
 259                         const char *src,
 260                         size_t src_len,
 261                         int flags,
 262                         NTSTATUS *err,
 263                         bool *contains_wcard)
 264 {
 265         size_t ret;
 266
 267         *pp_dest = NULL;
 268
 269         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 270                                  src_len, flags);
 271
 272         if (!*pp_dest) {
 273                 *err = NT_STATUS_INVALID_PARAMETER;
 274                 return ret;
 275         }
 276
 277         *contains_wcard = False;
 278
 279         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 280                 /*
 281                  * For a DFS path the function parse_dfs_path()
 282                  * will do the path processing, just make a copy.
 283                  */
 284                 *err = NT_STATUS_OK;
 285                 return ret;
 286         }
 287
 288         if (lp_posix_pathnames()) {
 289                 *err = check_path_syntax_posix(*pp_dest);
 290         } else {
 291                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 292         }
 293
 294         return ret;
 295 }
 296
 297 /****************************************************************************
 298  Pull a string and check the path - provide for error return.
 299 ****************************************************************************/
 300
 301 size_t srvstr_get_path(TALLOC_CTX *ctx,
 302                         const char *base_ptr,
 303                         uint16 smb_flags2,
 304                         char **pp_dest,
 305                         const char *src,
 306                         size_t src_len,
 307                         int flags,
 308                         NTSTATUS *err)
 309 {
 310         bool ignore;
 311         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 312                                      src_len, flags, err, &ignore);
 313 }
 314
 315 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 316                                  char **pp_dest, const char *src, int flags,
 317                                  NTSTATUS *err, bool *contains_wcard)
 318 {
 319         return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf, req->flags2,
 320                                      pp_dest, src, smbreq_bufrem(req, src),
 321                                      flags, err, contains_wcard);
 322 }
 323
 324 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 325                            char **pp_dest, const char *src, int flags,
 326                            NTSTATUS *err)
 327 {
 328         bool ignore;
 329         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 330                                          flags, err, &ignore);
 331 }
 332
 333 /****************************************************************************
 334  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 335 ****************************************************************************/
 336
 337 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 338                     files_struct *fsp)
 339 {
 340         if ((fsp == NULL) || (conn == NULL)) {
 341                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 342                 return False;
 343         }
 344         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 345                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 346                 return False;
 347         }
 348         return True;
 349 }
 350
 351 /****************************************************************************
 352  Check if we have a correct fsp pointing to a file.
 353 ****************************************************************************/
 354
 355 bool check_fsp(connection_struct *conn, struct smb_request *req,
 356                files_struct *fsp)
 357 {
 358         if (!check_fsp_open(conn, req, fsp)) {
 359                 return False;
 360         }
 361         if (fsp->is_directory) {
 362                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 363                 return False;
 364         }
 365         if (fsp->fh->fd == -1) {
 366                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 367                 return False;
 368         }
 369         fsp->num_smb_operations++;
 370         return True;
 371 }
 372
 373 /****************************************************************************
 374  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 375  the CHECK_NTQUOTA_HANDLE_OK macro.
 376 ****************************************************************************/
 377
 378 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 379                               files_struct *fsp)
 380 {
 381         if (!check_fsp_open(conn, req, fsp)) {
 382                 return false;
 383         }
 384
 385         if (fsp->is_directory) {
 386                 return false;
 387         }
 388
 389         if (fsp->fake_file_handle == NULL) {
 390                 return false;
 391         }
 392
 393         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 394                 return false;
 395         }
 396
 397         if (fsp->fake_file_handle->private_data == NULL) {
 398                 return false;
 399         }
 400
 401         return true;
 402 }
 403
 404 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 405                                      const char *name, int name_type)
 406 {
 407         char *trim_name;
 408         char *trim_name_type;
 409         const char *retarget_parm;
 410         char *retarget;
 411         char *p;
 412         int retarget_type = 0x20;
 413         int retarget_port = NBT_SMB_PORT;
 414         struct sockaddr_storage retarget_addr;
 415         struct sockaddr_in *in_addr;
 416         bool ret = false;
 417         uint8_t outbuf[10];
 418
 419         if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
 420                 return false;
 421         }
 422
 423         trim_name = talloc_strdup(talloc_tos(), name);
 424         if (trim_name == NULL) {
 425                 goto fail;
 426         }
 427         trim_char(trim_name, ' ', ' ');
 428
 429         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 430                                          name_type);
 431         if (trim_name_type == NULL) {
 432                 goto fail;
 433         }
 434
 435         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 436                                              trim_name_type, NULL);
 437         if (retarget_parm == NULL) {
 438                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 439                                                      trim_name, NULL);
 440         }
 441         if (retarget_parm == NULL) {
 442                 goto fail;
 443         }
 444
 445         retarget = talloc_strdup(trim_name, retarget_parm);
 446         if (retarget == NULL) {
 447                 goto fail;
 448         }
 449
 450         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 451
 452         p = strchr(retarget, ':');
 453         if (p != NULL) {
 454                 *p++ = '\0';
 455                 retarget_port = atoi(p);
 456         }
 457
 458         p = strchr_m(retarget, '#');
 459         if (p != NULL) {
 460                 *p++ = '\0';
 461                 if (sscanf(p, "%x", &retarget_type) != 1) {
 462                         goto fail;
 463                 }
 464         }
 465
 466         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 467         if (!ret) {
 468                 DEBUG(10, ("could not resolve %s\n", retarget));
 469                 goto fail;
 470         }
 471
 472         if (retarget_addr.ss_family != AF_INET) {
 473                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 474                 goto fail;
 475         }
 476
 477         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 478
 479         _smb_setlen(outbuf, 6);
 480         SCVAL(outbuf, 0, 0x84);
 481         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 482         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 483
 484         if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
 485                           NULL)) {
 486                 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
 487                                     "failed.");
 488         }
 489
 490         ret = true;
 491  fail:
 492         TALLOC_FREE(trim_name);
 493         return ret;
 494 }
 495
 496 static void reply_called_name_not_present(char *outbuf)
 497 {
 498         smb_setlen(outbuf, 1);
 499         SCVAL(outbuf, 0, 0x83);
 500         SCVAL(outbuf, 4, 0x82);
 501 }
 502
 503 /****************************************************************************
 504  Reply to a (netbios-level) special message.
 505 ****************************************************************************/
 506
 507 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
 508 {
 509         int msg_type = CVAL(inbuf,0);
 510         int msg_flags = CVAL(inbuf,1);
 511         /*
 512          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 513          * calculation & friends (srv_send_smb uses that) we need the full smb
 514          * header.
 515          */
 516         char outbuf[smb_size];
 517
 518         memset(outbuf, '\0', sizeof(outbuf));
 519
 520         smb_setlen(outbuf,0);
 521
 522         switch (msg_type) {
 523         case NBSSrequest: /* session request */
 524         {
 525                 /* inbuf_size is guarenteed to be at least 4. */
 526                 fstring name1,name2;
 527                 int name_type1, name_type2;
 528                 int name_len1, name_len2;
 529
 530                 *name1 = *name2 = 0;
 531
 532                 if (sconn->nbt.got_session) {
 533                         exit_server_cleanly("multiple session request not permitted");
 534                 }
 535
 536                 SCVAL(outbuf,0,NBSSpositive);
 537                 SCVAL(outbuf,3,0);
 538
 539                 /* inbuf_size is guaranteed to be at least 4. */
 540                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 541                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 542                         DEBUG(0,("Invalid name length in session request\n"));
 543                         reply_called_name_not_present(outbuf);
 544                         break;
 545                 }
 546                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 547                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 548                         DEBUG(0,("Invalid name length in session request\n"));
 549                         reply_called_name_not_present(outbuf);
 550                         break;
 551                 }
 552
 553                 name_type1 = name_extract((unsigned char *)inbuf,
 554                                 inbuf_size,(unsigned int)4,name1);
 555                 name_type2 = name_extract((unsigned char *)inbuf,
 556                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 557
 558                 if (name_type1 == -1 || name_type2 == -1) {
 559                         DEBUG(0,("Invalid name type in session request\n"));
 560                         reply_called_name_not_present(outbuf);
 561                         break;
 562                 }
 563
 564                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 565                          name1, name_type1, name2, name_type2));
 566
 567                 if (netbios_session_retarget(sconn, name1, name_type1)) {
 568                         exit_server_cleanly("retargeted client");
 569                 }
 570
 571                 /*
 572                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 573                  * "*SMBSERV" arrggg!!!
 574                  */
 575                 if (strequal(name1, "*SMBSERVER     ")
 576                     || strequal(name1, "*SMBSERV       "))  {
 577                         char *raddr;
 578
 579                         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
 580                                                                  talloc_tos());
 581                         if (raddr == NULL) {
 582                                 exit_server_cleanly("could not allocate raddr");
 583                         }
 584
 585                         fstrcpy(name1, raddr);
 586                 }
 587
 588                 set_local_machine_name(name1, True);
 589                 set_remote_machine_name(name2, True);
 590
 591                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 592                          get_local_machine_name(), get_remote_machine_name(),
 593                          name_type2));
 594
 595                 if (name_type2 == 'R') {
 596                         /* We are being asked for a pathworks session ---
 597                            no thanks! */
 598                         reply_called_name_not_present(outbuf);
 599                         break;
 600                 }
 601
 602                 reload_services(sconn, conn_snum_used, true);
 603                 reopen_logs();
 604
 605                 sconn->nbt.got_session = true;
 606                 break;
 607         }
 608
 609         case 0x89: /* session keepalive request
 610                       (some old clients produce this?) */
 611                 SCVAL(outbuf,0,NBSSkeepalive);
 612                 SCVAL(outbuf,3,0);
 613                 break;
 614
 615         case NBSSpositive: /* positive session response */
 616         case NBSSnegative: /* negative session response */
 617         case NBSSretarget: /* retarget session response */
 618                 DEBUG(0,("Unexpected session response\n"));
 619                 break;
 620
 621         case NBSSkeepalive: /* session keepalive */
 622         default:
 623                 return;
 624         }
 625
 626         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 627                     msg_type, msg_flags));
 628
 629         srv_send_smb(sconn, outbuf, false, 0, false, NULL);
 630
 631         if (CVAL(outbuf, 0) != 0x82) {
 632                 exit_server_cleanly("invalid netbios session");
 633         }
 634         return;
 635 }
 636
 637 /****************************************************************************
 638  Reply to a tcon.
 639  conn POINTER CAN BE NULL HERE !
 640 ****************************************************************************/
 641
 642 void reply_tcon(struct smb_request *req)
 643 {
 644         connection_struct *conn = req->conn;
 645         const char *service;
 646         char *service_buf = NULL;
 647         char *password = NULL;
 648         char *dev = NULL;
 649         int pwlen=0;
 650         NTSTATUS nt_status;
 651         const char *p;
 652         TALLOC_CTX *ctx = talloc_tos();
 653         struct smbd_server_connection *sconn = req->sconn;
 654
 655         START_PROFILE(SMBtcon);
 656
 657         if (req->buflen < 4) {
 658                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 659                 END_PROFILE(SMBtcon);
 660                 return;
 661         }
 662
 663         p = (const char *)req->buf + 1;
 664         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 665         p += 1;
 666         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 667         p += pwlen+1;
 668         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 669         p += 1;
 670
 671         if (service_buf == NULL || password == NULL || dev == NULL) {
 672                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 673                 END_PROFILE(SMBtcon);
 674                 return;
 675         }
 676         p = strrchr_m(service_buf,'\\');
 677         if (p) {
 678                 service = p+1;
 679         } else {
 680                 service = service_buf;
 681         }
 682
 683         conn = make_connection(sconn,service,dev,
 684                                req->vuid,&nt_status);
 685         req->conn = conn;
 686
 687         if (!conn) {
 688                 reply_nterror(req, nt_status);
 689                 END_PROFILE(SMBtcon);
 690                 return;
 691         }
 692
 693         reply_outbuf(req, 2, 0);
 694         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 695         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 696         SSVAL(req->outbuf,smb_tid,conn->cnum);
 697
 698         DEBUG(3,("tcon service=%s cnum=%d\n",
 699                  service, conn->cnum));
 700
 701         END_PROFILE(SMBtcon);
 702         return;
 703 }
 704
 705 /****************************************************************************
 706  Reply to a tcon and X.
 707  conn POINTER CAN BE NULL HERE !
 708 ****************************************************************************/
 709
 710 void reply_tcon_and_X(struct smb_request *req)
 711 {
 712         connection_struct *conn = req->conn;
 713         const char *service = NULL;
 714         TALLOC_CTX *ctx = talloc_tos();
 715         /* what the cleint thinks the device is */
 716         char *client_devicetype = NULL;
 717         /* what the server tells the client the share represents */
 718         const char *server_devicetype;
 719         NTSTATUS nt_status;
 720         int passlen;
 721         char *path = NULL;
 722         const char *p, *q;
 723         uint16 tcon_flags;
 724         struct smbd_server_connection *sconn = req->sconn;
 725
 726         START_PROFILE(SMBtconX);
 727
 728         if (req->wct < 4) {
 729                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 730                 END_PROFILE(SMBtconX);
 731                 return;
 732         }
 733
 734         passlen = SVAL(req->vwv+3, 0);
 735         tcon_flags = SVAL(req->vwv+2, 0);
 736
 737         /* we might have to close an old one */
 738         if ((tcon_flags & 0x1) && conn) {
 739                 close_cnum(conn,req->vuid);
 740                 req->conn = NULL;
 741                 conn = NULL;
 742         }
 743
 744         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 745                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 746                 END_PROFILE(SMBtconX);
 747                 return;
 748         }
 749
 750         if (sconn->smb1.negprot.encrypted_passwords) {
 751                 p = (const char *)req->buf + passlen;
 752         } else {
 753                 p = (const char *)req->buf + passlen + 1;
 754         }
 755
 756         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 757
 758         if (path == NULL) {
 759                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 760                 END_PROFILE(SMBtconX);
 761                 return;
 762         }
 763
 764         /*
 765          * the service name can be either: \\server\share
 766          * or share directly like on the DELL PowerVault 705
 767          */
 768         if (*path=='\\') {
 769                 q = strchr_m(path+2,'\\');
 770                 if (!q) {
 771                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 772                         END_PROFILE(SMBtconX);
 773                         return;
 774                 }
 775                 service = q+1;
 776         } else {
 777                 service = path;
 778         }
 779
 780         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 781                                 &client_devicetype, p,
 782                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 783
 784         if (client_devicetype == NULL) {
 785                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 786                 END_PROFILE(SMBtconX);
 787                 return;
 788         }
 789
 790         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 791
 792         conn = make_connection(sconn, service, client_devicetype,
 793                                req->vuid, &nt_status);
 794         req->conn =conn;
 795
 796         if (!conn) {
 797                 reply_nterror(req, nt_status);
 798                 END_PROFILE(SMBtconX);
 799                 return;
 800         }
 801
 802         if ( IS_IPC(conn) )
 803                 server_devicetype = "IPC";
 804         else if ( IS_PRINT(conn) )
 805                 server_devicetype = "LPT1:";
 806         else
 807                 server_devicetype = "A:";
 808
 809         if (get_Protocol() < PROTOCOL_NT1) {
 810                 reply_outbuf(req, 2, 0);
 811                 if (message_push_string(&req->outbuf, server_devicetype,
 812                                         STR_TERMINATE|STR_ASCII) == -1) {
 813                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 814                         END_PROFILE(SMBtconX);
 815                         return;
 816                 }
 817         } else {
 818                 /* NT sets the fstype of IPC$ to the null string */
 819                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 820
 821                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 822                         /* Return permissions. */
 823                         uint32 perm1 = 0;
 824                         uint32 perm2 = 0;
 825
 826                         reply_outbuf(req, 7, 0);
 827
 828                         if (IS_IPC(conn)) {
 829                                 perm1 = FILE_ALL_ACCESS;
 830                                 perm2 = FILE_ALL_ACCESS;
 831                         } else {
 832                                 perm1 = conn->share_access;
 833                         }
 834
 835                         SIVAL(req->outbuf, smb_vwv3, perm1);
 836                         SIVAL(req->outbuf, smb_vwv5, perm2);
 837                 } else {
 838                         reply_outbuf(req, 3, 0);
 839                 }
 840
 841                 if ((message_push_string(&req->outbuf, server_devicetype,
 842                                          STR_TERMINATE|STR_ASCII) == -1)
 843                     || (message_push_string(&req->outbuf, fstype,
 844                                             STR_TERMINATE) == -1)) {
 845                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 846                         END_PROFILE(SMBtconX);
 847                         return;
 848                 }
 849
 850                 /* what does setting this bit do? It is set by NT4 and
 851                    may affect the ability to autorun mounted cdroms */
 852                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 853                       (lp_csc_policy(SNUM(conn)) << 2));
 854
 855                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
 856                         DEBUG(2,("Serving %s as a Dfs root\n",
 857                                  lp_servicename(SNUM(conn)) ));
 858                         SSVAL(req->outbuf, smb_vwv2,
 859                               SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
 860                 }
 861         }
 862
 863
 864         DEBUG(3,("tconX service=%s \n",
 865                  service));
 866
 867         /* set the incoming and outgoing tid to the just created one */
 868         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
 869         SSVAL(req->outbuf,smb_tid,conn->cnum);
 870
 871         END_PROFILE(SMBtconX);
 872
 873         req->tid = conn->cnum;
 874         chain_reply(req);
 875         return;
 876 }
 877
 878 /****************************************************************************
 879  Reply to an unknown type.
 880 ****************************************************************************/
 881
 882 void reply_unknown_new(struct smb_request *req, uint8 type)
 883 {
 884         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 885                   smb_fn_name(type), type, type));
 886         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
 887         return;
 888 }
 889
 890 /****************************************************************************
 891  Reply to an ioctl.
 892  conn POINTER CAN BE NULL HERE !
 893 ****************************************************************************/
 894
 895 void reply_ioctl(struct smb_request *req)
 896 {
 897         connection_struct *conn = req->conn;
 898         uint16 device;
 899         uint16 function;
 900         uint32 ioctl_code;
 901         int replysize;
 902         char *p;
 903
 904         START_PROFILE(SMBioctl);
 905
 906         if (req->wct < 3) {
 907                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 908                 END_PROFILE(SMBioctl);
 909                 return;
 910         }
 911
 912         device     = SVAL(req->vwv+1, 0);
 913         function   = SVAL(req->vwv+2, 0);
 914         ioctl_code = (device << 16) + function;
 915
 916         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 917
 918         switch (ioctl_code) {
 919             case IOCTL_QUERY_JOB_INFO:
 920                     replysize = 32;
 921                     break;
 922             default:
 923                     reply_force_doserror(req, ERRSRV, ERRnosupport);
 924                     END_PROFILE(SMBioctl);
 925                     return;
 926         }
 927
 928         reply_outbuf(req, 8, replysize+1);
 929         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 930         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 931         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 932         p = smb_buf(req->outbuf);
 933         memset(p, '\0', replysize+1); /* valgrind-safe. */
 934         p += 1;          /* Allow for alignment */
 935
 936         switch (ioctl_code) {
 937                 case IOCTL_QUERY_JOB_INFO:
 938                 {
 939                         files_struct *fsp = file_fsp(
 940                                 req, SVAL(req->vwv+0, 0));
 941                         if (!fsp) {
 942                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 943                                 END_PROFILE(SMBioctl);
 944                                 return;
 945                         }
 946                         /* Job number */
 947                         if (fsp->print_file) {
 948                                 SSVAL(p, 0, fsp->print_file->rap_jobid);
 949                         } else {
 950                                 SSVAL(p, 0, 0);
 951                         }
 952                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 953                                     lp_netbios_name(), 15,
 954                                     STR_TERMINATE|STR_ASCII);
 955                         if (conn) {
 956                                 srvstr_push((char *)req->outbuf, req->flags2,
 957                                             p+18, lp_servicename(SNUM(conn)),
 958                                             13, STR_TERMINATE|STR_ASCII);
 959                         } else {
 960                                 memset(p+18, 0, 13);
 961                         }
 962                         break;
 963                 }
 964         }
 965
 966         END_PROFILE(SMBioctl);
 967         return;
 968 }
 969
 970 /****************************************************************************
 971  Strange checkpath NTSTATUS mapping.
 972 ****************************************************************************/
 973
 974 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
 975 {
 976         /* Strange DOS error code semantics only for checkpath... */
 977         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 978                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 979                         /* We need to map to ERRbadpath */
 980                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 981                 }
 982         }
 983         return status;
 984 }
 985
 986 /****************************************************************************
 987  Reply to a checkpath.
 988 ****************************************************************************/
 989
 990 void reply_checkpath(struct smb_request *req)
 991 {
 992         connection_struct *conn = req->conn;
 993         struct smb_filename *smb_fname = NULL;
 994         char *name = NULL;
 995         NTSTATUS status;
 996         TALLOC_CTX *ctx = talloc_tos();
 997
 998         START_PROFILE(SMBcheckpath);
 999
1000         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1001                             STR_TERMINATE, &status);
1002
1003         if (!NT_STATUS_IS_OK(status)) {
1004                 status = map_checkpath_error(req->flags2, status);
1005                 reply_nterror(req, status);
1006                 END_PROFILE(SMBcheckpath);
1007                 return;
1008         }
1009
1010         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1011
1012         status = filename_convert(ctx,
1013                                 conn,
1014                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1015                                 name,
1016                                 0,
1017                                 NULL,
1018                                 &smb_fname);
1019
1020         if (!NT_STATUS_IS_OK(status)) {
1021                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1022                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1023                                         ERRSRV, ERRbadpath);
1024                         END_PROFILE(SMBcheckpath);
1025                         return;
1026                 }
1027                 goto path_err;
1028         }
1029
1030         if (!VALID_STAT(smb_fname->st) &&
1031             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1032                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1033                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1034                 status = map_nt_error_from_unix(errno);
1035                 goto path_err;
1036         }
1037
1038         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1039                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1040                                 ERRDOS, ERRbadpath);
1041                 goto out;
1042         }
1043
1044         reply_outbuf(req, 0, 0);
1045
1046  path_err:
1047         /* We special case this - as when a Windows machine
1048                 is parsing a path is steps through the components
1049                 one at a time - if a component fails it expects
1050                 ERRbadpath, not ERRbadfile.
1051         */
1052         status = map_checkpath_error(req->flags2, status);
1053         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1054                 /*
1055                  * Windows returns different error codes if
1056                  * the parent directory is valid but not the
1057                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1058                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1059                  * if the path is invalid.
1060                  */
1061                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1062                                 ERRDOS, ERRbadpath);
1063                 goto out;
1064         }
1065
1066         reply_nterror(req, status);
1067
1068  out:
1069         TALLOC_FREE(smb_fname);
1070         END_PROFILE(SMBcheckpath);
1071         return;
1072 }
1073
1074 /****************************************************************************
1075  Reply to a getatr.
1076 ****************************************************************************/
1077
1078 void reply_getatr(struct smb_request *req)
1079 {
1080         connection_struct *conn = req->conn;
1081         struct smb_filename *smb_fname = NULL;
1082         char *fname = NULL;
1083         int mode=0;
1084         SMB_OFF_T size=0;
1085         time_t mtime=0;
1086         const char *p;
1087         NTSTATUS status;
1088         TALLOC_CTX *ctx = talloc_tos();
1089         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1090
1091         START_PROFILE(SMBgetatr);
1092
1093         p = (const char *)req->buf + 1;
1094         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1095         if (!NT_STATUS_IS_OK(status)) {
1096                 reply_nterror(req, status);
1097                 goto out;
1098         }
1099
1100         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1101                 under WfWg - weird! */
1102         if (*fname == '\0') {
1103                 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1104                 if (!CAN_WRITE(conn)) {
1105                         mode |= FILE_ATTRIBUTE_READONLY;
1106                 }
1107                 size = 0;
1108                 mtime = 0;
1109         } else {
1110                 status = filename_convert(ctx,
1111                                 conn,
1112                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1113                                 fname,
1114                                 0,
1115                                 NULL,
1116                                 &smb_fname);
1117                 if (!NT_STATUS_IS_OK(status)) {
1118                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1119                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1120                                                 ERRSRV, ERRbadpath);
1121                                 goto out;
1122                         }
1123                         reply_nterror(req, status);
1124                         goto out;
1125                 }
1126                 if (!VALID_STAT(smb_fname->st) &&
1127                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1128                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1129                                  smb_fname_str_dbg(smb_fname),
1130                                  strerror(errno)));
1131                         reply_nterror(req,  map_nt_error_from_unix(errno));
1132                         goto out;
1133                 }
1134
1135                 mode = dos_mode(conn, smb_fname);
1136                 size = smb_fname->st.st_ex_size;
1137
1138                 if (ask_sharemode) {
1139                         struct timespec write_time_ts;
1140                         struct file_id fileid;
1141
1142                         ZERO_STRUCT(write_time_ts);
1143                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1144                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1145                         if (!null_timespec(write_time_ts)) {
1146                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1147                         }
1148                 }
1149
1150                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1151                 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1152                         size = 0;
1153                 }
1154         }
1155
1156         reply_outbuf(req, 10, 0);
1157
1158         SSVAL(req->outbuf,smb_vwv0,mode);
1159         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1160                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1161         } else {
1162                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1163         }
1164         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1165
1166         if (get_Protocol() >= PROTOCOL_NT1) {
1167                 SSVAL(req->outbuf, smb_flg2,
1168                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1169         }
1170
1171         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1172                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1173
1174  out:
1175         TALLOC_FREE(smb_fname);
1176         TALLOC_FREE(fname);
1177         END_PROFILE(SMBgetatr);
1178         return;
1179 }
1180
1181 /****************************************************************************
1182  Reply to a setatr.
1183 ****************************************************************************/
1184
1185 void reply_setatr(struct smb_request *req)
1186 {
1187         struct smb_file_time ft;
1188         connection_struct *conn = req->conn;
1189         struct smb_filename *smb_fname = NULL;
1190         char *fname = NULL;
1191         int mode;
1192         time_t mtime;
1193         const char *p;
1194         NTSTATUS status;
1195         TALLOC_CTX *ctx = talloc_tos();
1196
1197         START_PROFILE(SMBsetatr);
1198
1199         ZERO_STRUCT(ft);
1200
1201         if (req->wct < 2) {
1202                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1203                 goto out;
1204         }
1205
1206         p = (const char *)req->buf + 1;
1207         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1208         if (!NT_STATUS_IS_OK(status)) {
1209                 reply_nterror(req, status);
1210                 goto out;
1211         }
1212
1213         status = filename_convert(ctx,
1214                                 conn,
1215                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1216                                 fname,
1217                                 0,
1218                                 NULL,
1219                                 &smb_fname);
1220         if (!NT_STATUS_IS_OK(status)) {
1221                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1222                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1223                                         ERRSRV, ERRbadpath);
1224                         goto out;
1225                 }
1226                 reply_nterror(req, status);
1227                 goto out;
1228         }
1229
1230         if (smb_fname->base_name[0] == '.' &&
1231             smb_fname->base_name[1] == '\0') {
1232                 /*
1233                  * Not sure here is the right place to catch this
1234                  * condition. Might be moved to somewhere else later -- vl
1235                  */
1236                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1237                 goto out;
1238         }
1239
1240         mode = SVAL(req->vwv+0, 0);
1241         mtime = srv_make_unix_date3(req->vwv+1);
1242
1243         if (mode != FILE_ATTRIBUTE_NORMAL) {
1244                 if (VALID_STAT_OF_DIR(smb_fname->st))
1245                         mode |= FILE_ATTRIBUTE_DIRECTORY;
1246                 else
1247                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1248
1249                 status = check_access(conn, NULL, smb_fname,
1250                                         FILE_WRITE_ATTRIBUTES);
1251                 if (!NT_STATUS_IS_OK(status)) {
1252                         reply_nterror(req, status);
1253                         goto out;
1254                 }
1255
1256                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1257                                      false) != 0) {
1258                         reply_nterror(req, map_nt_error_from_unix(errno));
1259                         goto out;
1260                 }
1261         }
1262
1263         ft.mtime = convert_time_t_to_timespec(mtime);
1264         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1265         if (!NT_STATUS_IS_OK(status)) {
1266                 reply_nterror(req, status);
1267                 goto out;
1268         }
1269
1270         reply_outbuf(req, 0, 0);
1271
1272         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1273                  mode));
1274  out:
1275         TALLOC_FREE(smb_fname);
1276         END_PROFILE(SMBsetatr);
1277         return;
1278 }
1279
1280 /****************************************************************************
1281  Reply to a dskattr.
1282 ****************************************************************************/
1283
1284 void reply_dskattr(struct smb_request *req)
1285 {
1286         connection_struct *conn = req->conn;
1287         uint64_t dfree,dsize,bsize;
1288         START_PROFILE(SMBdskattr);
1289
1290         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1291                 reply_nterror(req, map_nt_error_from_unix(errno));
1292                 END_PROFILE(SMBdskattr);
1293                 return;
1294         }
1295
1296         reply_outbuf(req, 5, 0);
1297
1298         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1299                 double total_space, free_space;
1300                 /* we need to scale this to a number that DOS6 can handle. We
1301                    use floating point so we can handle large drives on systems
1302                    that don't have 64 bit integers
1303
1304                    we end up displaying a maximum of 2G to DOS systems
1305                 */
1306                 total_space = dsize * (double)bsize;
1307                 free_space = dfree * (double)bsize;
1308
1309                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1310                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1311
1312                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1313                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1314
1315                 SSVAL(req->outbuf,smb_vwv0,dsize);
1316                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1317                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1318                 SSVAL(req->outbuf,smb_vwv3,dfree);
1319         } else {
1320                 SSVAL(req->outbuf,smb_vwv0,dsize);
1321                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1322                 SSVAL(req->outbuf,smb_vwv2,512);
1323                 SSVAL(req->outbuf,smb_vwv3,dfree);
1324         }
1325
1326         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1327
1328         END_PROFILE(SMBdskattr);
1329         return;
1330 }
1331
1332 /*
1333  * Utility function to split the filename from the directory.
1334  */
1335 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1336                                      char **fname_dir_out,
1337                                      char **fname_mask_out)
1338 {
1339         const char *p = NULL;
1340         char *fname_dir = NULL;
1341         char *fname_mask = NULL;
1342
1343         p = strrchr_m(fname_in, '/');
1344         if (!p) {
1345                 fname_dir = talloc_strdup(ctx, ".");
1346                 fname_mask = talloc_strdup(ctx, fname_in);
1347         } else {
1348                 fname_dir = talloc_strndup(ctx, fname_in,
1349                     PTR_DIFF(p, fname_in));
1350                 fname_mask = talloc_strdup(ctx, p+1);
1351         }
1352
1353         if (!fname_dir || !fname_mask) {
1354                 TALLOC_FREE(fname_dir);
1355                 TALLOC_FREE(fname_mask);
1356                 return NT_STATUS_NO_MEMORY;
1357         }
1358
1359         *fname_dir_out = fname_dir;
1360         *fname_mask_out = fname_mask;
1361         return NT_STATUS_OK;
1362 }
1363
1364 /****************************************************************************
1365  Reply to a search.
1366  Can be called from SMBsearch, SMBffirst or SMBfunique.
1367 ****************************************************************************/
1368
1369 void reply_search(struct smb_request *req)
1370 {
1371         connection_struct *conn = req->conn;
1372         char *path = NULL;
1373         const char *mask = NULL;
1374         char *directory = NULL;
1375         struct smb_filename *smb_fname = NULL;
1376         char *fname = NULL;
1377         SMB_OFF_T size;
1378         uint32 mode;
1379         struct timespec date;
1380         uint32 dirtype;
1381         unsigned int numentries = 0;
1382         unsigned int maxentries = 0;
1383         bool finished = False;
1384         const char *p;
1385         int status_len;
1386         char status[21];
1387         int dptr_num= -1;
1388         bool check_descend = False;
1389         bool expect_close = False;
1390         NTSTATUS nt_status;
1391         bool mask_contains_wcard = False;
1392         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1393         TALLOC_CTX *ctx = talloc_tos();
1394         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1395         struct dptr_struct *dirptr = NULL;
1396         struct smbd_server_connection *sconn = req->sconn;
1397
1398         START_PROFILE(SMBsearch);
1399
1400         if (req->wct < 2) {
1401                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1402                 goto out;
1403         }
1404
1405         if (lp_posix_pathnames()) {
1406                 reply_unknown_new(req, req->cmd);
1407                 goto out;
1408         }
1409
1410         /* If we were called as SMBffirst then we must expect close. */
1411         if(req->cmd == SMBffirst) {
1412                 expect_close = True;
1413         }
1414
1415         reply_outbuf(req, 1, 3);
1416         maxentries = SVAL(req->vwv+0, 0);
1417         dirtype = SVAL(req->vwv+1, 0);
1418         p = (const char *)req->buf + 1;
1419         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1420                                        &nt_status, &mask_contains_wcard);
1421         if (!NT_STATUS_IS_OK(nt_status)) {
1422                 reply_nterror(req, nt_status);
1423                 goto out;
1424         }
1425
1426         p++;
1427         status_len = SVAL(p, 0);
1428         p += 2;
1429
1430         /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1431
1432         if (status_len == 0) {
1433                 nt_status = filename_convert(ctx, conn,
1434                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1435                                              path,
1436                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1437                                              &mask_contains_wcard,
1438                                              &smb_fname);
1439                 if (!NT_STATUS_IS_OK(nt_status)) {
1440                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1441                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1442                                                 ERRSRV, ERRbadpath);
1443                                 goto out;
1444                         }
1445                         reply_nterror(req, nt_status);
1446                         goto out;
1447                 }
1448
1449                 directory = smb_fname->base_name;
1450
1451                 p = strrchr_m(directory,'/');
1452                 if ((p != NULL) && (*directory != '/')) {
1453                         mask = p + 1;
1454                         directory = talloc_strndup(ctx, directory,
1455                                                    PTR_DIFF(p, directory));
1456                 } else {
1457                         mask = directory;
1458                         directory = talloc_strdup(ctx,".");
1459                 }
1460
1461                 if (!directory) {
1462                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1463                         goto out;
1464                 }
1465
1466                 memset((char *)status,'\0',21);
1467                 SCVAL(status,0,(dirtype & 0x1F));
1468
1469                 nt_status = dptr_create(conn,
1470                                         NULL, /* req */
1471                                         NULL, /* fsp */
1472                                         directory,
1473                                         True,
1474                                         expect_close,
1475                                         req->smbpid,
1476                                         mask,
1477                                         mask_contains_wcard,
1478                                         dirtype,
1479                                         &dirptr);
1480                 if (!NT_STATUS_IS_OK(nt_status)) {
1481                         reply_nterror(req, nt_status);
1482                         goto out;
1483                 }
1484                 dptr_num = dptr_dnum(dirptr);
1485         } else {
1486                 int status_dirtype;
1487                 const char *dirpath;
1488
1489                 memcpy(status,p,21);
1490                 status_dirtype = CVAL(status,0) & 0x1F;
1491                 if (status_dirtype != (dirtype & 0x1F)) {
1492                         dirtype = status_dirtype;
1493                 }
1494
1495                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1496                 if (!dirptr) {
1497                         goto SearchEmpty;
1498                 }
1499                 dirpath = dptr_path(sconn, dptr_num);
1500                 directory = talloc_strdup(ctx, dirpath);
1501                 if (!directory) {
1502                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1503                         goto out;
1504                 }
1505
1506                 mask = dptr_wcard(sconn, dptr_num);
1507                 if (!mask) {
1508                         goto SearchEmpty;
1509                 }
1510                 /*
1511                  * For a 'continue' search we have no string. So
1512                  * check from the initial saved string.
1513                  */
1514                 mask_contains_wcard = ms_has_wild(mask);
1515                 dirtype = dptr_attr(sconn, dptr_num);
1516         }
1517
1518         DEBUG(4,("dptr_num is %d\n",dptr_num));
1519
1520         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1521         dptr_init_search_op(dirptr);
1522
1523         if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1524                 char buf[DIR_STRUCT_SIZE];
1525                 memcpy(buf,status,21);
1526                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1527                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1528                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1529                         goto out;
1530                 }
1531                 dptr_fill(sconn, buf+12,dptr_num);
1532                 if (dptr_zero(buf+12) && (status_len==0)) {
1533                         numentries = 1;
1534                 } else {
1535                         numentries = 0;
1536                 }
1537                 if (message_push_blob(&req->outbuf,
1538                                       data_blob_const(buf, sizeof(buf)))
1539                     == -1) {
1540                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1541                         goto out;
1542                 }
1543         } else {
1544                 unsigned int i;
1545                 maxentries = MIN(
1546                         maxentries,
1547                         ((BUFFER_SIZE -
1548                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1549                          /DIR_STRUCT_SIZE));
1550
1551                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1552                         directory,lp_dontdescend(SNUM(conn))));
1553                 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1554                         check_descend = True;
1555                 }
1556
1557                 for (i=numentries;(i<maxentries) && !finished;i++) {
1558                         finished = !get_dir_entry(ctx,
1559                                                   dirptr,
1560                                                   mask,
1561                                                   dirtype,
1562                                                   &fname,
1563                                                   &size,
1564                                                   &mode,
1565                                                   &date,
1566                                                   check_descend,
1567                                                   ask_sharemode);
1568                         if (!finished) {
1569                                 char buf[DIR_STRUCT_SIZE];
1570                                 memcpy(buf,status,21);
1571                                 if (!make_dir_struct(ctx,
1572                                                 buf,
1573                                                 mask,
1574                                                 fname,
1575                                                 size,
1576                                                 mode,
1577                                                 convert_timespec_to_time_t(date),
1578                                                 !allow_long_path_components)) {
1579                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1580                                         goto out;
1581                                 }
1582                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1583                                         break;
1584                                 }
1585                                 if (message_push_blob(&req->outbuf,
1586                                                       data_blob_const(buf, sizeof(buf)))
1587                                     == -1) {
1588                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1589                                         goto out;
1590                                 }
1591                                 numentries++;
1592                         }
1593                 }
1594         }
1595
1596   SearchEmpty:
1597
1598         /* If we were called as SMBffirst with smb_search_id == NULL
1599                 and no entries were found then return error and close dirptr
1600                 (X/Open spec) */
1601
1602         if (numentries == 0) {
1603                 dptr_close(sconn, &dptr_num);
1604         } else if(expect_close && status_len == 0) {
1605                 /* Close the dptr - we know it's gone */
1606                 dptr_close(sconn, &dptr_num);
1607         }
1608
1609         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1610         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1611                 dptr_close(sconn, &dptr_num);
1612         }
1613
1614         if ((numentries == 0) && !mask_contains_wcard) {
1615                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1616                 goto out;
1617         }
1618
1619         SSVAL(req->outbuf,smb_vwv0,numentries);
1620         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1621         SCVAL(smb_buf(req->outbuf),0,5);
1622         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1623
1624         /* The replies here are never long name. */
1625         SSVAL(req->outbuf, smb_flg2,
1626               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1627         if (!allow_long_path_components) {
1628                 SSVAL(req->outbuf, smb_flg2,
1629                       SVAL(req->outbuf, smb_flg2)
1630                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1631         }
1632
1633         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1634         SSVAL(req->outbuf, smb_flg2,
1635               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1636
1637         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1638                 smb_fn_name(req->cmd),
1639                 mask,
1640                 directory,
1641                 dirtype,
1642                 numentries,
1643                 maxentries ));
1644  out:
1645         TALLOC_FREE(directory);
1646         TALLOC_FREE(smb_fname);
1647         END_PROFILE(SMBsearch);
1648         return;
1649 }
1650
1651 /****************************************************************************
1652  Reply to a fclose (stop directory search).
1653 ****************************************************************************/
1654
1655 void reply_fclose(struct smb_request *req)
1656 {
1657         int status_len;
1658         char status[21];
1659         int dptr_num= -2;
1660         const char *p;
1661         char *path = NULL;
1662         NTSTATUS err;
1663         bool path_contains_wcard = False;
1664         TALLOC_CTX *ctx = talloc_tos();
1665         struct smbd_server_connection *sconn = req->sconn;
1666
1667         START_PROFILE(SMBfclose);
1668
1669         if (lp_posix_pathnames()) {
1670                 reply_unknown_new(req, req->cmd);
1671                 END_PROFILE(SMBfclose);
1672                 return;
1673         }
1674
1675         p = (const char *)req->buf + 1;
1676         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1677                                        &err, &path_contains_wcard);
1678         if (!NT_STATUS_IS_OK(err)) {
1679                 reply_nterror(req, err);
1680                 END_PROFILE(SMBfclose);
1681                 return;
1682         }
1683         p++;
1684         status_len = SVAL(p,0);
1685         p += 2;
1686
1687         if (status_len == 0) {
1688                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1689                 END_PROFILE(SMBfclose);
1690                 return;
1691         }
1692
1693         memcpy(status,p,21);
1694
1695         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1696                 /*  Close the dptr - we know it's gone */
1697                 dptr_close(sconn, &dptr_num);
1698         }
1699
1700         reply_outbuf(req, 1, 0);
1701         SSVAL(req->outbuf,smb_vwv0,0);
1702
1703         DEBUG(3,("search close\n"));
1704
1705         END_PROFILE(SMBfclose);
1706         return;
1707 }
1708
1709 /****************************************************************************
1710  Reply to an open.
1711 ****************************************************************************/
1712
1713 void reply_open(struct smb_request *req)
1714 {
1715         connection_struct *conn = req->conn;
1716         struct smb_filename *smb_fname = NULL;
1717         char *fname = NULL;
1718         uint32 fattr=0;
1719         SMB_OFF_T size = 0;
1720         time_t mtime=0;
1721         int info;
1722         files_struct *fsp;
1723         int oplock_request;
1724         int deny_mode;
1725         uint32 dos_attr;
1726         uint32 access_mask;
1727         uint32 share_mode;
1728         uint32 create_disposition;
1729         uint32 create_options = 0;
1730         uint32_t private_flags = 0;
1731         NTSTATUS status;
1732         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1733         TALLOC_CTX *ctx = talloc_tos();
1734
1735         START_PROFILE(SMBopen);
1736
1737         if (req->wct < 2) {
1738                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1739                 goto out;
1740         }
1741
1742         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1743         deny_mode = SVAL(req->vwv+0, 0);
1744         dos_attr = SVAL(req->vwv+1, 0);
1745
1746         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1747                             STR_TERMINATE, &status);
1748         if (!NT_STATUS_IS_OK(status)) {
1749                 reply_nterror(req, status);
1750                 goto out;
1751         }
1752
1753         status = filename_convert(ctx,
1754                                 conn,
1755                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1756                                 fname,
1757                                 0,
1758                                 NULL,
1759                                 &smb_fname);
1760         if (!NT_STATUS_IS_OK(status)) {
1761                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1762                         reply_botherror(req,
1763                                         NT_STATUS_PATH_NOT_COVERED,
1764                                         ERRSRV, ERRbadpath);
1765                         goto out;
1766                 }
1767                 reply_nterror(req, status);
1768                 goto out;
1769         }
1770
1771         if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1772                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1773                                          &share_mode, &create_disposition,
1774                                          &create_options, &private_flags)) {
1775                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1776                 goto out;
1777         }
1778
1779         status = SMB_VFS_CREATE_FILE(
1780                 conn,                                   /* conn */
1781                 req,                                    /* req */
1782                 0,                                      /* root_dir_fid */
1783                 smb_fname,                              /* fname */
1784                 access_mask,                            /* access_mask */
1785                 share_mode,                             /* share_access */
1786                 create_disposition,                     /* create_disposition*/
1787                 create_options,                         /* create_options */
1788                 dos_attr,                               /* file_attributes */
1789                 oplock_request,                         /* oplock_request */
1790                 0,                                      /* allocation_size */
1791                 private_flags,
1792                 NULL,                                   /* sd */
1793                 NULL,                                   /* ea_list */
1794                 &fsp,                                   /* result */
1795                 &info);                                 /* pinfo */
1796
1797         if (!NT_STATUS_IS_OK(status)) {
1798                 if (open_was_deferred(req->sconn, req->mid)) {
1799                         /* We have re-scheduled this call. */
1800                         goto out;
1801                 }
1802                 reply_openerror(req, status);
1803                 goto out;
1804         }
1805
1806         size = smb_fname->st.st_ex_size;
1807         fattr = dos_mode(conn, smb_fname);
1808
1809         /* Deal with other possible opens having a modified
1810            write time. JRA. */
1811         if (ask_sharemode) {
1812                 struct timespec write_time_ts;
1813
1814                 ZERO_STRUCT(write_time_ts);
1815                 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1816                 if (!null_timespec(write_time_ts)) {
1817                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1818                 }
1819         }
1820
1821         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1822
1823         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1824                 DEBUG(3,("attempt to open a directory %s\n",
1825                          fsp_str_dbg(fsp)));
1826                 close_file(req, fsp, ERROR_CLOSE);
1827                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1828                         ERRDOS, ERRnoaccess);
1829                 goto out;
1830         }
1831
1832         reply_outbuf(req, 7, 0);
1833         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1834         SSVAL(req->outbuf,smb_vwv1,fattr);
1835         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1836                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1837         } else {
1838                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1839         }
1840         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1841         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1842
1843         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1844                 SCVAL(req->outbuf,smb_flg,
1845                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1846         }
1847
1848         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1849                 SCVAL(req->outbuf,smb_flg,
1850                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1851         }
1852  out:
1853         TALLOC_FREE(smb_fname);
1854         END_PROFILE(SMBopen);
1855         return;
1856 }
1857
1858 /****************************************************************************
1859  Reply to an open and X.
1860 ****************************************************************************/
1861
1862 void reply_open_and_X(struct smb_request *req)
1863 {
1864         connection_struct *conn = req->conn;
1865         struct smb_filename *smb_fname = NULL;
1866         char *fname = NULL;
1867         uint16 open_flags;
1868         int deny_mode;
1869         uint32 smb_attr;
1870         /* Breakout the oplock request bits so we can set the
1871                 reply bits separately. */
1872         int ex_oplock_request;
1873         int core_oplock_request;
1874         int oplock_request;
1875 #if 0
1876         int smb_sattr = SVAL(req->vwv+4, 0);
1877         uint32 smb_time = make_unix_date3(req->vwv+6);
1878 #endif
1879         int smb_ofun;
1880         uint32 fattr=0;
1881         int mtime=0;
1882         int smb_action = 0;
1883         files_struct *fsp;
1884         NTSTATUS status;
1885         uint64_t allocation_size;
1886         ssize_t retval = -1;
1887         uint32 access_mask;
1888         uint32 share_mode;
1889         uint32 create_disposition;
1890         uint32 create_options = 0;
1891         uint32_t private_flags = 0;
1892         TALLOC_CTX *ctx = talloc_tos();
1893
1894         START_PROFILE(SMBopenX);
1895
1896         if (req->wct < 15) {
1897                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1898                 goto out;
1899         }
1900
1901         open_flags = SVAL(req->vwv+2, 0);
1902         deny_mode = SVAL(req->vwv+3, 0);
1903         smb_attr = SVAL(req->vwv+5, 0);
1904         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1905         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1906         oplock_request = ex_oplock_request | core_oplock_request;
1907         smb_ofun = SVAL(req->vwv+8, 0);
1908         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1909
1910         /* If it's an IPC, pass off the pipe handler. */
1911         if (IS_IPC(conn)) {
1912                 if (lp_nt_pipe_support()) {
1913                         reply_open_pipe_and_X(conn, req);
1914                 } else {
1915                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1916                 }
1917                 goto out;
1918         }
1919
1920         /* XXXX we need to handle passed times, sattr and flags */
1921         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1922                         STR_TERMINATE, &status);
1923         if (!NT_STATUS_IS_OK(status)) {
1924                 reply_nterror(req, status);
1925                 goto out;
1926         }
1927
1928         status = filename_convert(ctx,
1929                                 conn,
1930                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1931                                 fname,
1932                                 0,
1933                                 NULL,
1934                                 &smb_fname);
1935         if (!NT_STATUS_IS_OK(status)) {
1936                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1937                         reply_botherror(req,
1938                                         NT_STATUS_PATH_NOT_COVERED,
1939                                         ERRSRV, ERRbadpath);
1940                         goto out;
1941                 }
1942                 reply_nterror(req, status);
1943                 goto out;
1944         }
1945
1946         if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1947                                          smb_ofun,
1948                                          &access_mask, &share_mode,
1949                                          &create_disposition,
1950                                          &create_options,
1951                                          &private_flags)) {
1952                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1953                 goto out;
1954         }
1955
1956         status = SMB_VFS_CREATE_FILE(
1957                 conn,                                   /* conn */
1958                 req,                                    /* req */
1959                 0,                                      /* root_dir_fid */
1960                 smb_fname,                              /* fname */
1961                 access_mask,                            /* access_mask */
1962                 share_mode,                             /* share_access */
1963                 create_disposition,                     /* create_disposition*/
1964                 create_options,                         /* create_options */
1965                 smb_attr,                               /* file_attributes */
1966                 oplock_request,                         /* oplock_request */
1967                 0,                                      /* allocation_size */
1968                 private_flags,
1969                 NULL,                                   /* sd */
1970                 NULL,                                   /* ea_list */
1971                 &fsp,                                   /* result */
1972                 &smb_action);                           /* pinfo */
1973
1974         if (!NT_STATUS_IS_OK(status)) {
1975                 if (open_was_deferred(req->sconn, req->mid)) {
1976                         /* We have re-scheduled this call. */
1977                         goto out;
1978                 }
1979                 reply_openerror(req, status);
1980                 goto out;
1981         }
1982
1983         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1984            if the file is truncated or created. */
1985         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1986                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1987                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1988                         close_file(req, fsp, ERROR_CLOSE);
1989                         reply_nterror(req, NT_STATUS_DISK_FULL);
1990                         goto out;
1991                 }
1992                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1993                 if (retval < 0) {
1994                         close_file(req, fsp, ERROR_CLOSE);
1995                         reply_nterror(req, NT_STATUS_DISK_FULL);
1996                         goto out;
1997                 }
1998                 status = vfs_stat_fsp(fsp);
1999                 if (!NT_STATUS_IS_OK(status)) {
2000                         close_file(req, fsp, ERROR_CLOSE);
2001                         reply_nterror(req, status);
2002                         goto out;
2003                 }
2004         }
2005
2006         fattr = dos_mode(conn, fsp->fsp_name);
2007         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2008         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2009                 close_file(req, fsp, ERROR_CLOSE);
2010                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2011                 goto out;
2012         }
2013
2014         /* If the caller set the extended oplock request bit
2015                 and we granted one (by whatever means) - set the
2016                 correct bit for extended oplock reply.
2017         */
2018
2019         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2020                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2021         }
2022
2023         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2024                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2025         }
2026
2027         /* If the caller set the core oplock request bit
2028                 and we granted one (by whatever means) - set the
2029                 correct bit for core oplock reply.
2030         */
2031
2032         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2033                 reply_outbuf(req, 19, 0);
2034         } else {
2035                 reply_outbuf(req, 15, 0);
2036         }
2037
2038         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2039                 SCVAL(req->outbuf, smb_flg,
2040                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2041         }
2042
2043         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2044                 SCVAL(req->outbuf, smb_flg,
2045                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2046         }
2047
2048         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2049         SSVAL(req->outbuf,smb_vwv3,fattr);
2050         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2051                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2052         } else {
2053                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2054         }
2055         SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2056         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2057         SSVAL(req->outbuf,smb_vwv11,smb_action);
2058
2059         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2060                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2061         }
2062
2063         chain_reply(req);
2064  out:
2065         TALLOC_FREE(smb_fname);
2066         END_PROFILE(SMBopenX);
2067         return;
2068 }
2069
2070 /****************************************************************************
2071  Reply to a SMBulogoffX.
2072 ****************************************************************************/
2073
2074 void reply_ulogoffX(struct smb_request *req)
2075 {
2076         struct smbd_server_connection *sconn = req->sconn;
2077         user_struct *vuser;
2078
2079         START_PROFILE(SMBulogoffX);
2080
2081         vuser = get_valid_user_struct(sconn, req->vuid);
2082
2083         if(vuser == NULL) {
2084                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2085                          req->vuid));
2086         }
2087
2088         /* in user level security we are supposed to close any files
2089                 open by this user */
2090         if (vuser != NULL) {
2091                 file_close_user(sconn, req->vuid);
2092         }
2093
2094         invalidate_vuid(sconn, req->vuid);
2095
2096         reply_outbuf(req, 2, 0);
2097
2098         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2099
2100         END_PROFILE(SMBulogoffX);
2101         req->vuid = UID_FIELD_INVALID;
2102         chain_reply(req);
2103 }
2104
2105 /****************************************************************************
2106  Reply to a mknew or a create.
2107 ****************************************************************************/
2108
2109 void reply_mknew(struct smb_request *req)
2110 {
2111         connection_struct *conn = req->conn;
2112         struct smb_filename *smb_fname = NULL;
2113         char *fname = NULL;
2114         uint32 fattr = 0;
2115         struct smb_file_time ft;
2116         files_struct *fsp;
2117         int oplock_request = 0;
2118         NTSTATUS status;
2119         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2120         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2121         uint32 create_disposition;
2122         uint32 create_options = 0;
2123         TALLOC_CTX *ctx = talloc_tos();
2124
2125         START_PROFILE(SMBcreate);
2126         ZERO_STRUCT(ft);
2127
2128         if (req->wct < 3) {
2129                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2130                 goto out;
2131         }
2132
2133         fattr = SVAL(req->vwv+0, 0);
2134         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2135
2136         /* mtime. */
2137         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2138
2139         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2140                             STR_TERMINATE, &status);
2141         if (!NT_STATUS_IS_OK(status)) {
2142                 reply_nterror(req, status);
2143                 goto out;
2144         }
2145
2146         status = filename_convert(ctx,
2147                                 conn,
2148                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2149                                 fname,
2150                                 0,
2151                                 NULL,
2152                                 &smb_fname);
2153         if (!NT_STATUS_IS_OK(status)) {
2154                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2155                         reply_botherror(req,
2156                                         NT_STATUS_PATH_NOT_COVERED,
2157                                         ERRSRV, ERRbadpath);
2158                         goto out;
2159                 }
2160                 reply_nterror(req, status);
2161                 goto out;
2162         }
2163
2164         if (fattr & FILE_ATTRIBUTE_VOLUME) {
2165                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2166                          "please report this\n",
2167                          smb_fname_str_dbg(smb_fname)));
2168         }
2169
2170         if(req->cmd == SMBmknew) {
2171                 /* We should fail if file exists. */
2172                 create_disposition = FILE_CREATE;
2173         } else {
2174                 /* Create if file doesn't exist, truncate if it does. */
2175                 create_disposition = FILE_OVERWRITE_IF;
2176         }
2177
2178         status = SMB_VFS_CREATE_FILE(
2179                 conn,                                   /* conn */
2180                 req,                                    /* req */
2181                 0,                                      /* root_dir_fid */
2182                 smb_fname,                              /* fname */
2183                 access_mask,                            /* access_mask */
2184                 share_mode,                             /* share_access */
2185                 create_disposition,                     /* create_disposition*/
2186                 create_options,                         /* create_options */
2187                 fattr,                                  /* file_attributes */
2188                 oplock_request,                         /* oplock_request */
2189                 0,                                      /* allocation_size */
2190                 0,                                      /* private_flags */
2191                 NULL,                                   /* sd */
2192                 NULL,                                   /* ea_list */
2193                 &fsp,                                   /* result */
2194                 NULL);                                  /* pinfo */
2195
2196         if (!NT_STATUS_IS_OK(status)) {
2197                 if (open_was_deferred(req->sconn, req->mid)) {
2198                         /* We have re-scheduled this call. */
2199                         goto out;
2200                 }
2201                 reply_openerror(req, status);
2202                 goto out;
2203         }
2204
2205         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2206         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2207         if (!NT_STATUS_IS_OK(status)) {
2208                 END_PROFILE(SMBcreate);
2209                 goto out;
2210         }
2211
2212         reply_outbuf(req, 1, 0);
2213         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2214
2215         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2216                 SCVAL(req->outbuf,smb_flg,
2217                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2218         }
2219
2220         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2221                 SCVAL(req->outbuf,smb_flg,
2222                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2223         }
2224
2225         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2226         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2227                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2228                   (unsigned int)fattr));
2229
2230  out:
2231         TALLOC_FREE(smb_fname);
2232         END_PROFILE(SMBcreate);
2233         return;
2234 }
2235
2236 /****************************************************************************
2237  Reply to a create temporary file.
2238 ****************************************************************************/
2239
2240 void reply_ctemp(struct smb_request *req)
2241 {
2242         connection_struct *conn = req->conn;
2243         struct smb_filename *smb_fname = NULL;
2244         char *fname = NULL;
2245         uint32 fattr;
2246         files_struct *fsp;
2247         int oplock_request;
2248         int tmpfd;
2249         char *s;
2250         NTSTATUS status;
2251         TALLOC_CTX *ctx = talloc_tos();
2252
2253         START_PROFILE(SMBctemp);
2254
2255         if (req->wct < 3) {
2256                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2257                 goto out;
2258         }
2259
2260         fattr = SVAL(req->vwv+0, 0);
2261         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2262
2263         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2264                             STR_TERMINATE, &status);
2265         if (!NT_STATUS_IS_OK(status)) {
2266                 reply_nterror(req, status);
2267                 goto out;
2268         }
2269         if (*fname) {
2270                 fname = talloc_asprintf(ctx,
2271                                 "%s/TMXXXXXX",
2272                                 fname);
2273         } else {
2274                 fname = talloc_strdup(ctx, "TMXXXXXX");
2275         }
2276
2277         if (!fname) {
2278                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2279                 goto out;
2280         }
2281
2282         status = filename_convert(ctx, conn,
2283                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2284                                 fname,
2285                                 0,
2286                                 NULL,
2287                                 &smb_fname);
2288         if (!NT_STATUS_IS_OK(status)) {
2289                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2290                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2291                                         ERRSRV, ERRbadpath);
2292                         goto out;
2293                 }
2294                 reply_nterror(req, status);
2295                 goto out;
2296         }
2297
2298         tmpfd = mkstemp(smb_fname->base_name);
2299         if (tmpfd == -1) {
2300                 reply_nterror(req, map_nt_error_from_unix(errno));
2301                 goto out;
2302         }
2303
2304         SMB_VFS_STAT(conn, smb_fname);
2305
2306         /* We should fail if file does not exist. */
2307         status = SMB_VFS_CREATE_FILE(
2308                 conn,                                   /* conn */
2309                 req,                                    /* req */
2310                 0,                                      /* root_dir_fid */
2311                 smb_fname,                              /* fname */
2312                 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2313                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2314                 FILE_OPEN,                              /* create_disposition*/
2315                 0,                                      /* create_options */
2316                 fattr,                                  /* file_attributes */
2317                 oplock_request,                         /* oplock_request */
2318                 0,                                      /* allocation_size */
2319                 0,                                      /* private_flags */
2320                 NULL,                                   /* sd */
2321                 NULL,                                   /* ea_list */
2322                 &fsp,                                   /* result */
2323                 NULL);                                  /* pinfo */
2324
2325         /* close fd from mkstemp() */
2326         close(tmpfd);
2327
2328         if (!NT_STATUS_IS_OK(status)) {
2329                 if (open_was_deferred(req->sconn, req->mid)) {
2330                         /* We have re-scheduled this call. */
2331                         goto out;
2332                 }
2333                 reply_openerror(req, status);
2334                 goto out;
2335         }
2336
2337         reply_outbuf(req, 1, 0);
2338         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2339
2340         /* the returned filename is relative to the directory */
2341         s = strrchr_m(fsp->fsp_name->base_name, '/');
2342         if (!s) {
2343                 s = fsp->fsp_name->base_name;
2344         } else {
2345                 s++;
2346         }
2347
2348 #if 0
2349         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2350            thing in the byte section. JRA */
2351         SSVALS(p, 0, -1); /* what is this? not in spec */
2352 #endif
2353         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2354             == -1) {
2355                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2356                 goto out;
2357         }
2358
2359         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2360                 SCVAL(req->outbuf, smb_flg,
2361                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2362         }
2363
2364         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2365                 SCVAL(req->outbuf, smb_flg,
2366                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2367         }
2368
2369         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2370         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2371                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2372  out:
2373         TALLOC_FREE(smb_fname);
2374         END_PROFILE(SMBctemp);
2375         return;
2376 }
2377
2378 /*******************************************************************
2379  Check if a user is allowed to rename a file.
2380 ********************************************************************/
2381
2382 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2383                         uint16 dirtype)
2384 {
2385         if (!CAN_WRITE(conn)) {
2386                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2387         }
2388
2389         if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2390                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2391                 /* Only bother to read the DOS attribute if we might deny the
2392                    rename on the grounds of attribute missmatch. */
2393                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2394                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2395                         return NT_STATUS_NO_SUCH_FILE;
2396                 }
2397         }
2398
2399         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2400                 if (fsp->posix_open) {
2401                         return NT_STATUS_OK;
2402                 }
2403
2404                 /* If no pathnames are open below this
2405                    directory, allow the rename. */
2406
2407                 if (file_find_subpath(fsp)) {
2408                         return NT_STATUS_ACCESS_DENIED;
2409                 }
2410                 return NT_STATUS_OK;
2411         }
2412
2413         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2414                 return NT_STATUS_OK;
2415         }
2416
2417         return NT_STATUS_ACCESS_DENIED;
2418 }
2419
2420 /*******************************************************************
2421  * unlink a file with all relevant access checks
2422  *******************************************************************/
2423
2424 static NTSTATUS do_unlink(connection_struct *conn,
2425                         struct smb_request *req,
2426                         struct smb_filename *smb_fname,
2427                         uint32 dirtype)
2428 {
2429         uint32 fattr;
2430         files_struct *fsp;
2431         uint32 dirtype_orig = dirtype;
2432         NTSTATUS status;
2433         int ret;
2434         bool posix_paths = lp_posix_pathnames();
2435
2436         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2437                   smb_fname_str_dbg(smb_fname),
2438                   dirtype));
2439
2440         if (!CAN_WRITE(conn)) {
2441                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2442         }
2443
2444         if (posix_paths) {
2445                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2446         } else {
2447                 ret = SMB_VFS_STAT(conn, smb_fname);
2448         }
2449         if (ret != 0) {
2450                 return map_nt_error_from_unix(errno);
2451         }
2452
2453         fattr = dos_mode(conn, smb_fname);
2454
2455         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2456                 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2457         }
2458
2459         dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2460         if (!dirtype) {
2461                 return NT_STATUS_NO_SUCH_FILE;
2462         }
2463
2464         if (!dir_check_ftype(conn, fattr, dirtype)) {
2465                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2466                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2467                 }
2468                 return NT_STATUS_NO_SUCH_FILE;
2469         }
2470
2471         if (dirtype_orig & 0x8000) {
2472                 /* These will never be set for POSIX. */
2473                 return NT_STATUS_NO_SUCH_FILE;
2474         }
2475
2476 #if 0
2477         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2478                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2479         }
2480
2481         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2482                 return NT_STATUS_NO_SUCH_FILE;
2483         }
2484
2485         if (dirtype & 0xFF00) {
2486                 /* These will never be set for POSIX. */
2487                 return NT_STATUS_NO_SUCH_FILE;
2488         }
2489
2490         dirtype &= 0xFF;
2491         if (!dirtype) {
2492                 return NT_STATUS_NO_SUCH_FILE;
2493         }
2494
2495         /* Can't delete a directory. */
2496         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2497                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2498         }
2499 #endif
2500
2501 #if 0 /* JRATEST */
2502         else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2503                 return NT_STATUS_OBJECT_NAME_INVALID;
2504 #endif /* JRATEST */
2505
2506         /* On open checks the open itself will check the share mode, so
2507            don't do it here as we'll get it wrong. */
2508
2509         status = SMB_VFS_CREATE_FILE
2510                 (conn,                  /* conn */
2511                  req,                   /* req */
2512                  0,                     /* root_dir_fid */
2513                  smb_fname,             /* fname */
2514                  DELETE_ACCESS,         /* access_mask */
2515                  FILE_SHARE_NONE,       /* share_access */
2516                  FILE_OPEN,             /* create_disposition*/
2517                  FILE_NON_DIRECTORY_FILE, /* create_options */
2518                                         /* file_attributes */
2519                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2520                                 FILE_ATTRIBUTE_NORMAL,
2521                  0,                     /* oplock_request */
2522                  0,                     /* allocation_size */
2523                  0,                     /* private_flags */
2524                  NULL,                  /* sd */
2525                  NULL,                  /* ea_list */
2526                  &fsp,                  /* result */
2527                  NULL);                 /* pinfo */
2528
2529         if (!NT_STATUS_IS_OK(status)) {
2530                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2531                            nt_errstr(status)));
2532                 return status;
2533         }
2534
2535         status = can_set_delete_on_close(fsp, fattr);
2536         if (!NT_STATUS_IS_OK(status)) {
2537                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2538                         "(%s)\n",
2539                         smb_fname_str_dbg(smb_fname),
2540                         nt_errstr(status)));
2541                 close_file(req, fsp, NORMAL_CLOSE);
2542                 return status;
2543         }
2544
2545         /* The set is across all open files on this dev/inode pair. */
2546         if (!set_delete_on_close(fsp, True, conn->session_info->unix_token)) {
2547                 close_file(req, fsp, NORMAL_CLOSE);
2548                 return NT_STATUS_ACCESS_DENIED;
2549         }
2550
2551         return close_file(req, fsp, NORMAL_CLOSE);
2552 }
2553
2554 /****************************************************************************
2555  The guts of the unlink command, split out so it may be called by the NT SMB
2556  code.
2557 ****************************************************************************/
2558
2559 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2560                           uint32 dirtype, struct smb_filename *smb_fname,
2561                           bool has_wild)
2562 {
2563         char *fname_dir = NULL;
2564         char *fname_mask = NULL;
2565         int count=0;
2566         NTSTATUS status = NT_STATUS_OK;
2567         TALLOC_CTX *ctx = talloc_tos();
2568
2569         /* Split up the directory from the filename/mask. */
2570         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2571                                       &fname_dir, &fname_mask);
2572         if (!NT_STATUS_IS_OK(status)) {
2573                 goto out;
2574         }
2575
2576         /*
2577          * We should only check the mangled cache
2578          * here if unix_convert failed. This means
2579          * that the path in 'mask' doesn't exist
2580          * on the file system and so we need to look
2581          * for a possible mangle. This patch from
2582          * Tine Smukavec <valentin.smukavec@hermes.si>.
2583          */
2584
2585         if (!VALID_STAT(smb_fname->st) &&
2586             mangle_is_mangled(fname_mask, conn->params)) {
2587                 char *new_mask = NULL;
2588                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2589                                             &new_mask, conn->params);
2590                 if (new_mask) {
2591                         TALLOC_FREE(fname_mask);
2592                         fname_mask = new_mask;
2593                 }
2594         }
2595
2596         if (!has_wild) {
2597
2598                 /*
2599                  * Only one file needs to be unlinked. Append the mask back
2600                  * onto the directory.
2601                  */
2602                 TALLOC_FREE(smb_fname->base_name);
2603                 if (ISDOT(fname_dir)) {
2604                         /* Ensure we use canonical names on open. */
2605                         smb_fname->base_name = talloc_asprintf(smb_fname,
2606                                                         "%s",
2607                                                         fname_mask);
2608                 } else {
2609                         smb_fname->base_name = talloc_asprintf(smb_fname,
2610                                                         "%s/%s",
2611                                                         fname_dir,
2612                                                         fname_mask);
2613                 }
2614                 if (!smb_fname->base_name) {
2615                         status = NT_STATUS_NO_MEMORY;
2616                         goto out;
2617                 }
2618                 if (dirtype == 0) {
2619                         dirtype = FILE_ATTRIBUTE_NORMAL;
2620                 }
2621
2622                 status = check_name(conn, smb_fname->base_name);
2623                 if (!NT_STATUS_IS_OK(status)) {
2624                         goto out;
2625                 }
2626
2627                 status = do_unlink(conn, req, smb_fname, dirtype);
2628                 if (!NT_STATUS_IS_OK(status)) {
2629                         goto out;
2630                 }
2631
2632                 count++;
2633         } else {
2634                 struct smb_Dir *dir_hnd = NULL;
2635                 long offset = 0;
2636                 const char *dname = NULL;
2637                 char *talloced = NULL;
2638
2639                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2640                         status = NT_STATUS_OBJECT_NAME_INVALID;
2641                         goto out;
2642                 }
2643
2644                 if (strequal(fname_mask,"????????.???")) {
2645                         TALLOC_FREE(fname_mask);
2646                         fname_mask = talloc_strdup(ctx, "*");
2647                         if (!fname_mask) {
2648                                 status = NT_STATUS_NO_MEMORY;
2649                                 goto out;
2650                         }
2651                 }
2652
2653                 status = check_name(conn, fname_dir);
2654                 if (!NT_STATUS_IS_OK(status)) {
2655                         goto out;
2656                 }
2657
2658                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2659                                   dirtype);
2660                 if (dir_hnd == NULL) {
2661                         status = map_nt_error_from_unix(errno);
2662                         goto out;
2663                 }
2664
2665                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2666                    the pattern matches against the long name, otherwise the short name
2667                    We don't implement this yet XXXX
2668                 */
2669
2670                 status = NT_STATUS_NO_SUCH_FILE;
2671
2672                 while ((dname = ReadDirName(dir_hnd, &offset,
2673                                             &smb_fname->st, &talloced))) {
2674                         TALLOC_CTX *frame = talloc_stackframe();
2675
2676                         if (!is_visible_file(conn, fname_dir, dname,
2677                                              &smb_fname->st, true)) {
2678                                 TALLOC_FREE(frame);
2679                                 TALLOC_FREE(talloced);
2680                                 continue;
2681                         }
2682
2683                         /* Quick check for "." and ".." */
2684                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2685                                 TALLOC_FREE(frame);
2686                                 TALLOC_FREE(talloced);
2687                                 continue;
2688                         }
2689
2690                         if(!mask_match(dname, fname_mask,
2691                                        conn->case_sensitive)) {
2692                                 TALLOC_FREE(frame);
2693                                 TALLOC_FREE(talloced);
2694                                 continue;
2695                         }
2696
2697                         TALLOC_FREE(smb_fname->base_name);
2698                         if (ISDOT(fname_dir)) {
2699                                 /* Ensure we use canonical names on open. */
2700                                 smb_fname->base_name =
2701                                         talloc_asprintf(smb_fname, "%s",
2702                                                 dname);
2703                         } else {
2704                                 smb_fname->base_name =
2705                                         talloc_asprintf(smb_fname, "%s/%s",
2706                                                 fname_dir, dname);
2707                         }
2708
2709                         if (!smb_fname->base_name) {
2710                                 TALLOC_FREE(dir_hnd);
2711                                 status = NT_STATUS_NO_MEMORY;
2712                                 TALLOC_FREE(frame);
2713                                 TALLOC_FREE(talloced);
2714                                 goto out;
2715                         }
2716
2717                         status = check_name(conn, smb_fname->base_name);
2718                         if (!NT_STATUS_IS_OK(status)) {
2719                                 TALLOC_FREE(dir_hnd);
2720                                 TALLOC_FREE(frame);
2721                                 TALLOC_FREE(talloced);
2722                                 goto out;
2723                         }
2724
2725                         status = do_unlink(conn, req, smb_fname, dirtype);
2726                         if (!NT_STATUS_IS_OK(status)) {
2727                                 TALLOC_FREE(frame);
2728                                 TALLOC_FREE(talloced);
2729                                 continue;
2730                         }
2731
2732                         count++;
2733                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2734                                  smb_fname->base_name));
2735
2736                         TALLOC_FREE(frame);
2737                         TALLOC_FREE(talloced);
2738                 }
2739                 TALLOC_FREE(dir_hnd);
2740         }
2741
2742         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2743                 status = map_nt_error_from_unix(errno);
2744         }
2745
2746  out:
2747         TALLOC_FREE(fname_dir);
2748         TALLOC_FREE(fname_mask);
2749         return status;
2750 }
2751
2752 /****************************************************************************
2753  Reply to a unlink
2754 ****************************************************************************/
2755
2756 void reply_unlink(struct smb_request *req)
2757 {
2758         connection_struct *conn = req->conn;
2759         char *name = NULL;
2760         struct smb_filename *smb_fname = NULL;
2761         uint32 dirtype;
2762         NTSTATUS status;
2763         bool path_contains_wcard = False;
2764         TALLOC_CTX *ctx = talloc_tos();
2765
2766         START_PROFILE(SMBunlink);
2767
2768         if (req->wct < 1) {
2769                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2770                 goto out;
2771         }
2772
2773         dirtype = SVAL(req->vwv+0, 0);
2774
2775         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2776                                   STR_TERMINATE, &status,
2777                                   &path_contains_wcard);
2778         if (!NT_STATUS_IS_OK(status)) {
2779                 reply_nterror(req, status);
2780                 goto out;
2781         }
2782
2783         status = filename_convert(ctx, conn,
2784                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2785                                   name,
2786                                   UCF_COND_ALLOW_WCARD_LCOMP,
2787                                   &path_contains_wcard,
2788                                   &smb_fname);
2789         if (!NT_STATUS_IS_OK(status)) {
2790                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2791                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2792                                         ERRSRV, ERRbadpath);
2793                         goto out;
2794                 }
2795                 reply_nterror(req, status);
2796                 goto out;
2797         }
2798
2799         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2800
2801         status = unlink_internals(conn, req, dirtype, smb_fname,
2802                                   path_contains_wcard);
2803         if (!NT_STATUS_IS_OK(status)) {
2804                 if (open_was_deferred(req->sconn, req->mid)) {
2805                         /* We have re-scheduled this call. */
2806                         goto out;
2807                 }
2808                 reply_nterror(req, status);
2809                 goto out;
2810         }
2811
2812         reply_outbuf(req, 0, 0);
2813  out:
2814         TALLOC_FREE(smb_fname);
2815         END_PROFILE(SMBunlink);
2816         return;
2817 }
2818
2819 /****************************************************************************
2820  Fail for readbraw.
2821 ****************************************************************************/
2822
2823 static void fail_readraw(void)
2824 {
2825         const char *errstr = talloc_asprintf(talloc_tos(),
2826                         "FAIL ! reply_readbraw: socket write fail (%s)",
2827                         strerror(errno));
2828         if (!errstr) {
2829                 errstr = "";
2830         }
2831         exit_server_cleanly(errstr);
2832 }
2833
2834 /****************************************************************************
2835  Fake (read/write) sendfile. Returns -1 on read or write fail.
2836 ****************************************************************************/
2837
2838 ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
2839 {
2840         size_t bufsize;
2841         size_t tosend = nread;
2842         char *buf;
2843
2844         if (nread == 0) {
2845                 return 0;
2846         }
2847
2848         bufsize = MIN(nread, 65536);
2849
2850         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2851                 return -1;
2852         }
2853
2854         while (tosend > 0) {
2855                 ssize_t ret;
2856                 size_t cur_read;
2857
2858                 if (tosend > bufsize) {
2859                         cur_read = bufsize;
2860                 } else {
2861                         cur_read = tosend;
2862                 }
2863                 ret = read_file(fsp,buf,startpos,cur_read);
2864                 if (ret == -1) {
2865                         SAFE_FREE(buf);
2866                         return -1;
2867                 }
2868
2869                 /* If we had a short read, fill with zeros. */
2870                 if (ret < cur_read) {
2871                         memset(buf + ret, '\0', cur_read - ret);
2872                 }
2873
2874                 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2875                     != cur_read) {
2876                         char addr[INET6_ADDRSTRLEN];
2877                         /*
2878                          * Try and give an error message saying what
2879                          * client failed.
2880                          */
2881                         DEBUG(0, ("write_data failed for client %s. "
2882                                   "Error %s\n",
2883                                   get_peer_addr(fsp->conn->sconn->sock, addr,
2884                                                 sizeof(addr)),
2885                                   strerror(errno)));
2886                         SAFE_FREE(buf);
2887                         return -1;
2888                 }
2889                 tosend -= cur_read;
2890                 startpos += cur_read;
2891         }
2892
2893         SAFE_FREE(buf);
2894         return (ssize_t)nread;
2895 }
2896
2897 /****************************************************************************
2898  Deal with the case of sendfile reading less bytes from the file than
2899  requested. Fill with zeros (all we can do).
2900 ****************************************************************************/
2901
2902 void sendfile_short_send(files_struct *fsp,
2903                                 ssize_t nread,
2904                                 size_t headersize,
2905                                 size_t smb_maxcnt)
2906 {
2907 #define SHORT_SEND_BUFSIZE 1024
2908         if (nread < headersize) {
2909                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2910                         "header for file %s (%s). Terminating\n",
2911                         fsp_str_dbg(fsp), strerror(errno)));
2912                 exit_server_cleanly("sendfile_short_send failed");
2913         }
2914
2915         nread -= headersize;
2916
2917         if (nread < smb_maxcnt) {
2918                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2919                 if (!buf) {
2920                         exit_server_cleanly("sendfile_short_send: "
2921                                 "malloc failed");
2922                 }
2923
2924                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2925                         "with zeros !\n", fsp_str_dbg(fsp)));
2926
2927                 while (nread < smb_maxcnt) {
2928                         /*
2929                          * We asked for the real file size and told sendfile
2930                          * to not go beyond the end of the file. But it can
2931                          * happen that in between our fstat call and the
2932                          * sendfile call the file was truncated. This is very
2933                          * bad because we have already announced the larger
2934                          * number of bytes to the client.
2935                          *
2936                          * The best we can do now is to send 0-bytes, just as
2937                          * a read from a hole in a sparse file would do.
2938                          *
2939                          * This should happen rarely enough that I don't care
2940                          * about efficiency here :-)
2941                          */
2942                         size_t to_write;
2943
2944                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2945                         if (write_data(fsp->conn->sconn->sock, buf, to_write)
2946                             != to_write) {
2947                                 char addr[INET6_ADDRSTRLEN];
2948                                 /*
2949                                  * Try and give an error message saying what
2950                                  * client failed.
2951                                  */
2952                                 DEBUG(0, ("write_data failed for client %s. "
2953                                           "Error %s\n",
2954                                           get_peer_addr(
2955                                                   fsp->conn->sconn->sock, addr,
2956                                                   sizeof(addr)),
2957                                           strerror(errno)));
2958                                 exit_server_cleanly("sendfile_short_send: "
2959                                                     "write_data failed");
2960                         }
2961                         nread += to_write;
2962                 }
2963                 SAFE_FREE(buf);
2964         }
2965 }
2966
2967 /****************************************************************************
2968  Return a readbraw error (4 bytes of zero).
2969 ****************************************************************************/
2970
2971 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2972 {
2973         char header[4];
2974
2975         SIVAL(header,0,0);
2976
2977         smbd_lock_socket(sconn);
2978         if (write_data(sconn->sock,header,4) != 4) {
2979                 char addr[INET6_ADDRSTRLEN];
2980                 /*
2981                  * Try and give an error message saying what
2982                  * client failed.
2983                  */
2984                 DEBUG(0, ("write_data failed for client %s. "
2985                           "Error %s\n",
2986                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2987                           strerror(errno)));
2988
2989                 fail_readraw();
2990         }
2991         smbd_unlock_socket(sconn);
2992 }
2993
2994 /****************************************************************************
2995  Use sendfile in readbraw.
2996 ****************************************************************************/
2997
2998 static void send_file_readbraw(connection_struct *conn,
2999                                struct smb_request *req,
3000                                files_struct *fsp,
3001                                SMB_OFF_T startpos,
3002                                size_t nread,
3003                                ssize_t mincount)
3004 {
3005         struct smbd_server_connection *sconn = req->sconn;
3006         char *outbuf = NULL;
3007         ssize_t ret=0;
3008
3009         /*
3010          * We can only use sendfile on a non-chained packet
3011          * but we can use on a non-oplocked file. tridge proved this
3012          * on a train in Germany :-). JRA.
3013          * reply_readbraw has already checked the length.
3014          */
3015
3016         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3017             (fsp->wcp == NULL) &&
3018             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3019                 ssize_t sendfile_read = -1;
3020                 char header[4];
3021                 DATA_BLOB header_blob;
3022
3023                 _smb_setlen(header,nread);
3024                 header_blob = data_blob_const(header, 4);
3025
3026                 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3027                                                  &header_blob, startpos,
3028                                                  nread);
3029                 if (sendfile_read == -1) {
3030                         /* Returning ENOSYS means no data at all was sent.
3031                          * Do this as a normal read. */
3032                         if (errno == ENOSYS) {
3033                                 goto normal_readbraw;
3034                         }
3035
3036                         /*
3037                          * Special hack for broken Linux with no working sendfile. If we
3038                          * return EINTR we sent the header but not the rest of the data.
3039                          * Fake this up by doing read/write calls.
3040                          */
3041                         if (errno == EINTR) {
3042                                 /* Ensure we don't do this again. */
3043                                 set_use_sendfile(SNUM(conn), False);
3044                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3045
3046                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
3047                                         DEBUG(0,("send_file_readbraw: "
3048                                                  "fake_sendfile failed for "
3049                                                  "file %s (%s).\n",
3050                                                  fsp_str_dbg(fsp),
3051                                                  strerror(errno)));
3052                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3053                                 }
3054                                 return;
3055                         }
3056
3057                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3058                                  "file %s (%s). Terminating\n",
3059                                  fsp_str_dbg(fsp), strerror(errno)));
3060                         exit_server_cleanly("send_file_readbraw sendfile failed");
3061                 } else if (sendfile_read == 0) {
3062                         /*
3063                          * Some sendfile implementations return 0 to indicate
3064                          * that there was a short read, but nothing was
3065                          * actually written to the socket.  In this case,
3066                          * fallback to the normal read path so the header gets
3067                          * the correct byte count.
3068                          */
3069                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3070                                   "bytes falling back to the normal read: "
3071                                   "%s\n", fsp_str_dbg(fsp)));
3072                         goto normal_readbraw;
3073                 }
3074
3075                 /* Deal with possible short send. */
3076                 if (sendfile_read != 4+nread) {
3077                         sendfile_short_send(fsp, sendfile_read, 4, nread);
3078                 }
3079                 return;
3080         }
3081
3082 normal_readbraw:
3083
3084         outbuf = talloc_array(NULL, char, nread+4);
3085         if (!outbuf) {
3086                 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3087                         (unsigned)(nread+4)));
3088                 reply_readbraw_error(sconn);
3089                 return;
3090         }
3091
3092         if (nread > 0) {
3093                 ret = read_file(fsp,outbuf+4,startpos,nread);
3094 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3095                 if (ret < mincount)
3096                         ret = 0;
3097 #else
3098                 if (ret < nread)
3099                         ret = 0;
3100 #endif
3101         }
3102
3103         _smb_setlen(outbuf,ret);
3104         if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3105                 char addr[INET6_ADDRSTRLEN];
3106                 /*
3107                  * Try and give an error message saying what
3108                  * client failed.
3109                  */
3110                 DEBUG(0, ("write_data failed for client %s. "
3111                           "Error %s\n",
3112                           get_peer_addr(fsp->conn->sconn->sock, addr,
3113                                         sizeof(addr)),
3114                           strerror(errno)));
3115
3116                 fail_readraw();
3117         }
3118
3119         TALLOC_FREE(outbuf);
3120 }
3121
3122 /****************************************************************************
3123  Reply to a readbraw (core+ protocol).
3124 ****************************************************************************/
3125
3126 void reply_readbraw(struct smb_request *req)
3127 {
3128         connection_struct *conn = req->conn;
3129         struct smbd_server_connection *sconn = req->sconn;
3130         ssize_t maxcount,mincount;
3131         size_t nread = 0;
3132         SMB_OFF_T startpos;
3133         files_struct *fsp;
3134         struct lock_struct lock;
3135         SMB_OFF_T size = 0;
3136
3137         START_PROFILE(SMBreadbraw);
3138
3139         if (srv_is_signing_active(sconn) ||
3140             is_encrypted_packet(sconn, req->inbuf)) {
3141                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3142                         "raw reads/writes are disallowed.");
3143         }
3144
3145         if (req->wct < 8) {
3146                 reply_readbraw_error(sconn);
3147                 END_PROFILE(SMBreadbraw);
3148                 return;
3149         }
3150
3151         if (sconn->smb1.echo_handler.trusted_fde) {
3152                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3153                          "'async smb echo handler = yes'\n"));
3154                 reply_readbraw_error(sconn);
3155                 END_PROFILE(SMBreadbraw);
3156                 return;
3157         }
3158
3159         /*
3160          * Special check if an oplock break has been issued
3161          * and the readraw request croses on the wire, we must
3162          * return a zero length response here.
3163          */
3164
3165         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3166
3167         /*
3168          * We have to do a check_fsp by hand here, as
3169          * we must always return 4 zero bytes on error,
3170          * not a NTSTATUS.
3171          */
3172
3173         if (!fsp || !conn || conn != fsp->conn ||
3174                         req->vuid != fsp->vuid ||
3175                         fsp->is_directory || fsp->fh->fd == -1) {
3176                 /*
3177                  * fsp could be NULL here so use the value from the packet. JRA.
3178                  */
3179                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3180                         "- cache prime?\n",
3181                         (int)SVAL(req->vwv+0, 0)));
3182                 reply_readbraw_error(sconn);
3183                 END_PROFILE(SMBreadbraw);
3184                 return;
3185         }
3186
3187         /* Do a "by hand" version of CHECK_READ. */
3188         if (!(fsp->can_read ||
3189                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3190                                 (fsp->access_mask & FILE_EXECUTE)))) {
3191                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3192                                 (int)SVAL(req->vwv+0, 0)));
3193                 reply_readbraw_error(sconn);
3194                 END_PROFILE(SMBreadbraw);
3195                 return;
3196         }
3197
3198         flush_write_cache(fsp, READRAW_FLUSH);
3199
3200         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3201         if(req->wct == 10) {
3202                 /*
3203                  * This is a large offset (64 bit) read.
3204                  */
3205 #ifdef LARGE_SMB_OFF_T
3206
3207                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3208
3209 #else /* !LARGE_SMB_OFF_T */
3210
3211                 /*
3212                  * Ensure we haven't been sent a >32 bit offset.
3213                  */
3214
3215                 if(IVAL(req->vwv+8, 0) != 0) {
3216                         DEBUG(0,("reply_readbraw: large offset "
3217                                 "(%x << 32) used and we don't support "
3218                                 "64 bit offsets.\n",
3219                         (unsigned int)IVAL(req->vwv+8, 0) ));
3220                         reply_readbraw_error(sconn);
3221                         END_PROFILE(SMBreadbraw);
3222                         return;
3223                 }
3224
3225 #endif /* LARGE_SMB_OFF_T */
3226
3227                 if(startpos < 0) {
3228                         DEBUG(0,("reply_readbraw: negative 64 bit "
3229                                 "readraw offset (%.0f) !\n",
3230                                 (double)startpos ));
3231                         reply_readbraw_error(sconn);
3232                         END_PROFILE(SMBreadbraw);
3233                         return;
3234                 }
3235         }
3236
3237         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3238         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3239
3240         /* ensure we don't overrun the packet size */
3241         maxcount = MIN(65535,maxcount);
3242
3243         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3244             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3245             &lock);
3246
3247         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3248                 reply_readbraw_error(sconn);
3249                 END_PROFILE(SMBreadbraw);
3250                 return;
3251         }
3252
3253         if (fsp_stat(fsp) == 0) {
3254                 size = fsp->fsp_name->st.st_ex_size;
3255         }
3256
3257         if (startpos >= size) {
3258                 nread = 0;
3259         } else {
3260                 nread = MIN(maxcount,(size - startpos));
3261         }
3262
3263 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3264         if (nread < mincount)
3265                 nread = 0;
3266 #endif
3267
3268         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3269                 "min=%lu nread=%lu\n",
3270                 fsp->fnum, (double)startpos,
3271                 (unsigned long)maxcount,
3272                 (unsigned long)mincount,
3273                 (unsigned long)nread ) );
3274
3275         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3276
3277         DEBUG(5,("reply_readbraw finished\n"));
3278
3279         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3280
3281         END_PROFILE(SMBreadbraw);
3282         return;
3283 }
3284
3285 #undef DBGC_CLASS
3286 #define DBGC_CLASS DBGC_LOCKING
3287
3288 /****************************************************************************
3289  Reply to a lockread (core+ protocol).
3290 ****************************************************************************/
3291
3292 void reply_lockread(struct smb_request *req)
3293 {
3294         connection_struct *conn = req->conn;
3295         ssize_t nread = -1;
3296         char *data;
3297         SMB_OFF_T startpos;
3298         size_t numtoread;
3299         NTSTATUS status;
3300         files_struct *fsp;
3301         struct byte_range_lock *br_lck = NULL;
3302         char *p = NULL;
3303         struct smbd_server_connection *sconn = req->sconn;
3304
3305         START_PROFILE(SMBlockread);
3306
3307         if (req->wct < 5) {
3308                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3309                 END_PROFILE(SMBlockread);
3310                 return;
3311         }
3312
3313         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3314
3315         if (!check_fsp(conn, req, fsp)) {
3316                 END_PROFILE(SMBlockread);
3317                 return;
3318         }
3319
3320         if (!CHECK_READ(fsp,req)) {
3321                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3322                 END_PROFILE(SMBlockread);
3323                 return;
3324         }
3325
3326         numtoread = SVAL(req->vwv+1, 0);
3327         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3328
3329         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3330
3331         reply_outbuf(req, 5, numtoread + 3);
3332
3333         data = smb_buf(req->outbuf) + 3;
3334
3335         /*
3336          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3337          * protocol request that predates the read/write lock concept.
3338          * Thus instead of asking for a read lock here we need to ask
3339          * for a write lock. JRA.
3340          * Note that the requested lock size is unaffected by max_recv.
3341          */
3342
3343         br_lck = do_lock(req->sconn->msg_ctx,
3344                         fsp,
3345                         (uint64_t)req->smbpid,
3346                         (uint64_t)numtoread,
3347                         (uint64_t)startpos,
3348                         WRITE_LOCK,
3349                         WINDOWS_LOCK,
3350                         False, /* Non-blocking lock. */
3351                         &status,
3352                         NULL,
3353                         NULL);
3354         TALLOC_FREE(br_lck);
3355
3356         if (NT_STATUS_V(status)) {
3357                 reply_nterror(req, status);
3358                 END_PROFILE(SMBlockread);
3359                 return;
3360         }
3361
3362         /*
3363          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3364          */
3365
3366         if (numtoread > sconn->smb1.negprot.max_recv) {
3367                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3368 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3369                         (unsigned int)numtoread,
3370                         (unsigned int)sconn->smb1.negprot.max_recv));
3371                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3372         }
3373         nread = read_file(fsp,data,startpos,numtoread);
3374
3375         if (nread < 0) {
3376                 reply_nterror(req, map_nt_error_from_unix(errno));
3377                 END_PROFILE(SMBlockread);
3378                 return;
3379         }
3380
3381         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3382
3383         SSVAL(req->outbuf,smb_vwv0,nread);
3384         SSVAL(req->outbuf,smb_vwv5,nread+3);
3385         p = smb_buf(req->outbuf);
3386         SCVAL(p,0,0); /* pad byte. */
3387         SSVAL(p,1,nread);
3388
3389         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3390                  fsp->fnum, (int)numtoread, (int)nread));
3391
3392         END_PROFILE(SMBlockread);
3393         return;
3394 }
3395
3396 #undef DBGC_CLASS
3397 #define DBGC_CLASS DBGC_ALL
3398
3399 /****************************************************************************
3400  Reply to a read.
3401 ****************************************************************************/
3402
3403 void reply_read(struct smb_request *req)
3404 {
3405         connection_struct *conn = req->conn;
3406         size_t numtoread;
3407         ssize_t nread = 0;
3408         char *data;
3409         SMB_OFF_T startpos;
3410         int outsize = 0;
3411         files_struct *fsp;
3412         struct lock_struct lock;
3413         struct smbd_server_connection *sconn = req->sconn;
3414
3415         START_PROFILE(SMBread);
3416
3417         if (req->wct < 3) {
3418                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3419                 END_PROFILE(SMBread);
3420                 return;
3421         }
3422
3423         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3424
3425         if (!check_fsp(conn, req, fsp)) {
3426                 END_PROFILE(SMBread);
3427                 return;
3428         }
3429
3430         if (!CHECK_READ(fsp,req)) {
3431                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3432                 END_PROFILE(SMBread);
3433                 return;
3434         }
3435
3436         numtoread = SVAL(req->vwv+1, 0);
3437         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3438
3439         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3440
3441         /*
3442          * The requested read size cannot be greater than max_recv. JRA.
3443          */
3444         if (numtoread > sconn->smb1.negprot.max_recv) {
3445                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3446 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3447                         (unsigned int)numtoread,
3448                         (unsigned int)sconn->smb1.negprot.max_recv));
3449                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3450         }
3451
3452         reply_outbuf(req, 5, numtoread+3);
3453
3454         data = smb_buf(req->outbuf) + 3;
3455
3456         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3457             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3458             &lock);
3459
3460         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3461                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3462                 END_PROFILE(SMBread);
3463                 return;
3464         }
3465
3466         if (numtoread > 0)
3467                 nread = read_file(fsp,data,startpos,numtoread);
3468
3469         if (nread < 0) {
3470                 reply_nterror(req, map_nt_error_from_unix(errno));
3471                 goto strict_unlock;
3472         }
3473
3474         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3475
3476         SSVAL(req->outbuf,smb_vwv0,nread);
3477         SSVAL(req->outbuf,smb_vwv5,nread+3);
3478         SCVAL(smb_buf(req->outbuf),0,1);
3479         SSVAL(smb_buf(req->outbuf),1,nread);
3480
3481         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3482                 fsp->fnum, (int)numtoread, (int)nread ) );
3483
3484 strict_unlock:
3485         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3486
3487         END_PROFILE(SMBread);
3488         return;
3489 }
3490
3491 /****************************************************************************
3492  Setup readX header.
3493 ****************************************************************************/
3494
3495 static int setup_readX_header(struct smb_request *req, char *outbuf,
3496                               size_t smb_maxcnt)
3497 {
3498         int outsize;
3499
3500         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3501
3502         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3503
3504         SCVAL(outbuf,smb_vwv0,0xFF);
3505         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3506         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3507         SSVAL(outbuf,smb_vwv6,
3508               req_wct_ofs(req)
3509               + 1               /* the wct field */
3510               + 12 * sizeof(uint16_t) /* vwv */
3511               + 2);             /* the buflen field */
3512         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3513         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3514         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3515         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3516         return outsize;
3517 }
3518
3519 /****************************************************************************
3520  Reply to a read and X - possibly using sendfile.
3521 ****************************************************************************/
3522
3523 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3524                             files_struct *fsp, SMB_OFF_T startpos,
3525                             size_t smb_maxcnt)
3526 {
3527         ssize_t nread = -1;
3528         struct lock_struct lock;
3529         int saved_errno = 0;
3530
3531         if(fsp_stat(fsp) == -1) {
3532                 reply_nterror(req, map_nt_error_from_unix(errno));
3533                 return;
3534         }
3535
3536         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3537             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3538             &lock);
3539
3540         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3541                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3542                 return;
3543         }
3544
3545         if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3546                         (startpos > fsp->fsp_name->st.st_ex_size)
3547                         || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3548                 /*
3549                  * We already know that we would do a short read, so don't
3550                  * try the sendfile() path.
3551                  */
3552                 goto nosendfile_read;
3553         }
3554
3555         /*
3556          * We can only use sendfile on a non-chained packet
3557          * but we can use on a non-oplocked file. tridge proved this
3558          * on a train in Germany :-). JRA.
3559          */
3560
3561         if (!req_is_in_chain(req) &&
3562             !is_encrypted_packet(req->sconn, req->inbuf) &&
3563             (fsp->base_fsp == NULL) &&
3564             (fsp->wcp == NULL) &&
3565             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3566                 uint8 headerbuf[smb_size + 12 * 2];
3567                 DATA_BLOB header;
3568
3569                 /*
3570                  * Set up the packet header before send. We
3571                  * assume here the sendfile will work (get the
3572                  * correct amount of data).
3573                  */
3574
3575                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3576
3577                 construct_reply_common_req(req, (char *)headerbuf);
3578                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3579
3580                 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3581                                          startpos, smb_maxcnt);
3582                 if (nread == -1) {
3583                         /* Returning ENOSYS means no data at all was sent.
3584                            Do this as a normal read. */
3585                         if (errno == ENOSYS) {
3586                                 goto normal_read;
3587                         }
3588
3589                         /*
3590                          * Special hack for broken Linux with no working sendfile. If we
3591                          * return EINTR we sent the header but not the rest of the data.
3592                          * Fake this up by doing read/write calls.
3593                          */
3594
3595                         if (errno == EINTR) {
3596                                 /* Ensure we don't do this again. */
3597                                 set_use_sendfile(SNUM(conn), False);
3598                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3599                                 nread = fake_sendfile(fsp, startpos,
3600                                                       smb_maxcnt);
3601                                 if (nread == -1) {
3602                                         DEBUG(0,("send_file_readX: "
3603                                                  "fake_sendfile failed for "
3604                                                  "file %s (%s).\n",
3605                                                  fsp_str_dbg(fsp),
3606                                                  strerror(errno)));
3607                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3608                                 }
3609                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3610                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3611                                 /* No outbuf here means successful sendfile. */
3612                                 goto strict_unlock;
3613                         }
3614
3615                         DEBUG(0,("send_file_readX: sendfile failed for file "
3616                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3617                                  strerror(errno)));
3618                         exit_server_cleanly("send_file_readX sendfile failed");
3619                 } else if (nread == 0) {
3620                         /*
3621                          * Some sendfile implementations return 0 to indicate
3622                          * that there was a short read, but nothing was
3623                          * actually written to the socket.  In this case,
3624                          * fallback to the normal read path so the header gets
3625                          * the correct byte count.
3626                          */
3627                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3628                                   "falling back to the normal read: %s\n",
3629                                   fsp_str_dbg(fsp)));
3630                         goto normal_read;
3631                 }
3632
3633                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3634                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3635
3636                 /* Deal with possible short send. */
3637                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3638                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3639                 }
3640                 /* No outbuf here means successful sendfile. */
3641                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3642                 SMB_PERFCOUNT_END(&req->pcd);
3643                 goto strict_unlock;
3644         }
3645
3646 normal_read:
3647
3648         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3649                 uint8 headerbuf[smb_size + 2*12];
3650
3651                 construct_reply_common_req(req, (char *)headerbuf);
3652                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3653
3654                 /* Send out the header. */
3655                 if (write_data(req->sconn->sock, (char *)headerbuf,
3656                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3657
3658                         char addr[INET6_ADDRSTRLEN];
3659                         /*
3660                          * Try and give an error message saying what
3661                          * client failed.
3662                          */
3663                         DEBUG(0, ("write_data failed for client %s. "
3664                                   "Error %s\n",
3665                                   get_peer_addr(req->sconn->sock, addr,
3666                                                 sizeof(addr)),
3667                                   strerror(errno)));
3668
3669                         DEBUG(0,("send_file_readX: write_data failed for file "
3670                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3671                                  strerror(errno)));
3672                         exit_server_cleanly("send_file_readX sendfile failed");
3673                 }
3674                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3675                 if (nread == -1) {
3676                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3677                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3678                                  strerror(errno)));
3679                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3680                 }
3681                 goto strict_unlock;
3682         }
3683
3684 nosendfile_read:
3685
3686         reply_outbuf(req, 12, smb_maxcnt);
3687
3688         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3689         saved_errno = errno;
3690
3691         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3692
3693         if (nread < 0) {
3694                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3695                 return;
3696         }
3697
3698         setup_readX_header(req, (char *)req->outbuf, nread);
3699
3700         DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3701                     fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3702
3703         chain_reply(req);
3704         return;
3705
3706  strict_unlock:
3707         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3708         TALLOC_FREE(req->outbuf);
3709         return;
3710 }
3711
3712 /****************************************************************************
3713  Reply to a read and X.
3714 ****************************************************************************/
3715
3716 void reply_read_and_X(struct smb_request *req)
3717 {
3718         struct smbd_server_connection *sconn = req->sconn;
3719         connection_struct *conn = req->conn;
3720         files_struct *fsp;
3721         SMB_OFF_T startpos;
3722         size_t smb_maxcnt;
3723         bool big_readX = False;
3724 #if 0
3725         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3726 #endif
3727
3728         START_PROFILE(SMBreadX);
3729
3730         if ((req->wct != 10) && (req->wct != 12)) {
3731                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3732                 return;
3733         }
3734
3735         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3736         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3737         smb_maxcnt = SVAL(req->vwv+5, 0);
3738
3739         /* If it's an IPC, pass off the pipe handler. */
3740         if (IS_IPC(conn)) {
3741                 reply_pipe_read_and_X(req);
3742                 END_PROFILE(SMBreadX);
3743                 return;
3744         }
3745
3746         if (!check_fsp(conn, req, fsp)) {
3747                 END_PROFILE(SMBreadX);
3748                 return;
3749         }
3750
3751         if (!CHECK_READ(fsp,req)) {
3752                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3753                 END_PROFILE(SMBreadX);
3754                 return;
3755         }
3756
3757         if ((sconn->smb1.unix_info.client_cap_low & CIFS_UNIX_LARGE_READ_CAP) ||
3758             (get_remote_arch() == RA_SAMBA)) {
3759                 /*
3760                  * This is Samba only behavior (up to Samba 3.6)!
3761                  *
3762                  * Windows 2008 R2 ignores the upper_size,
3763                  * so we do unless unix extentions are active
3764                  * or "smbclient" is talking to us.
3765                  */
3766                 size_t upper_size = SVAL(req->vwv+7, 0);
3767                 smb_maxcnt |= (upper_size<<16);
3768                 if (upper_size > 1) {
3769                         /* Can't do this on a chained packet. */
3770                         if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3771                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3772                                 END_PROFILE(SMBreadX);
3773                                 return;
3774                         }
3775                         /* We currently don't do this on signed or sealed data. */
3776                         if (srv_is_signing_active(req->sconn) ||
3777                             is_encrypted_packet(req->sconn, req->inbuf)) {
3778                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3779                                 END_PROFILE(SMBreadX);
3780                                 return;
3781                         }
3782                         /* Is there room in the reply for this data ? */
3783                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3784                                 reply_nterror(req,
3785                                               NT_STATUS_INVALID_PARAMETER);
3786                                 END_PROFILE(SMBreadX);
3787                                 return;
3788                         }
3789                         big_readX = True;
3790                 }
3791         }
3792
3793         if (req->wct == 12) {
3794 #ifdef LARGE_SMB_OFF_T
3795                 /*
3796                  * This is a large offset (64 bit) read.
3797                  */
3798                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3799
3800 #else /* !LARGE_SMB_OFF_T */
3801
3802                 /*
3803                  * Ensure we haven't been sent a >32 bit offset.
3804                  */
3805
3806                 if(IVAL(req->vwv+10, 0) != 0) {
3807                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3808                                  "used and we don't support 64 bit offsets.\n",
3809                                  (unsigned int)IVAL(req->vwv+10, 0) ));
3810                         END_PROFILE(SMBreadX);
3811                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3812                         return;
3813                 }
3814
3815 #endif /* LARGE_SMB_OFF_T */
3816
3817         }
3818
3819         if (!big_readX) {
3820                 NTSTATUS status = schedule_aio_read_and_X(conn,
3821                                         req,
3822                                         fsp,
3823                                         startpos,
3824                                         smb_maxcnt);
3825                 if (NT_STATUS_IS_OK(status)) {
3826                         /* Read scheduled - we're done. */
3827                         goto out;
3828                 }
3829                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3830                         /* Real error - report to client. */
3831                         END_PROFILE(SMBreadX);
3832                         reply_nterror(req, status);
3833                         return;
3834                 }
3835                 /* NT_STATUS_RETRY - fall back to sync read. */
3836         }
3837
3838         smbd_lock_socket(req->sconn);
3839         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3840         smbd_unlock_socket(req->sconn);
3841
3842  out:
3843         END_PROFILE(SMBreadX);
3844         return;
3845 }
3846
3847 /****************************************************************************
3848  Error replies to writebraw must have smb_wct == 1. Fix this up.
3849 ****************************************************************************/
3850
3851 void error_to_writebrawerr(struct smb_request *req)
3852 {
3853         uint8 *old_outbuf = req->outbuf;
3854
3855         reply_outbuf(req, 1, 0);
3856
3857         memcpy(req->outbuf, old_outbuf, smb_size);
3858         TALLOC_FREE(old_outbuf);
3859 }
3860
3861 /****************************************************************************
3862  Read 4 bytes of a smb packet and return the smb length of the packet.
3863  Store the result in the buffer. This version of the function will
3864  never return a session keepalive (length of zero).
3865  Timeout is in milliseconds.
3866 ****************************************************************************/
3867
3868 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3869                                 size_t *len)
3870 {
3871         uint8_t msgtype = NBSSkeepalive;
3872
3873         while (msgtype == NBSSkeepalive) {
3874                 NTSTATUS status;
3875
3876                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3877                                                           len);
3878                 if (!NT_STATUS_IS_OK(status)) {
3879                         char addr[INET6_ADDRSTRLEN];
3880                         /* Try and give an error message
3881                          * saying what client failed. */
3882                         DEBUG(0, ("read_fd_with_timeout failed for "
3883                                   "client %s read error = %s.\n",
3884                                   get_peer_addr(fd,addr,sizeof(addr)),
3885                                   nt_errstr(status)));
3886                         return status;
3887                 }
3888
3889                 msgtype = CVAL(inbuf, 0);
3890         }
3891
3892         DEBUG(10,("read_smb_length: got smb length of %lu\n",
3893                   (unsigned long)len));
3894
3895         return NT_STATUS_OK;
3896 }
3897
3898 /****************************************************************************
3899  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3900 ****************************************************************************/
3901
3902 void reply_writebraw(struct smb_request *req)
3903 {
3904         connection_struct *conn = req->conn;
3905         char *buf = NULL;
3906         ssize_t nwritten=0;
3907         ssize_t total_written=0;
3908         size_t numtowrite=0;
3909         size_t tcount;
3910         SMB_OFF_T startpos;
3911         const char *data=NULL;
3912         bool write_through;
3913         files_struct *fsp;
3914         struct lock_struct lock;
3915         NTSTATUS status;
3916
3917         START_PROFILE(SMBwritebraw);
3918
3919         /*
3920          * If we ever reply with an error, it must have the SMB command
3921          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3922          * we're finished.
3923          */
3924         SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
3925
3926         if (srv_is_signing_active(req->sconn)) {
3927                 END_PROFILE(SMBwritebraw);
3928                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3929                                 "raw reads/writes are disallowed.");
3930         }
3931
3932         if (req->wct < 12) {
3933                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3934                 error_to_writebrawerr(req);
3935                 END_PROFILE(SMBwritebraw);
3936                 return;
3937         }
3938
3939         if (req->sconn->smb1.echo_handler.trusted_fde) {
3940                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3941                          "'async smb echo handler = yes'\n"));
3942                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3943                 error_to_writebrawerr(req);
3944                 END_PROFILE(SMBwritebraw);
3945                 return;
3946         }
3947
3948         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3949         if (!check_fsp(conn, req, fsp)) {
3950                 error_to_writebrawerr(req);
3951                 END_PROFILE(SMBwritebraw);
3952                 return;
3953         }
3954
3955         if (!CHECK_WRITE(fsp)) {
3956                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3957                 error_to_writebrawerr(req);
3958                 END_PROFILE(SMBwritebraw);
3959                 return;
3960         }
3961
3962         tcount = IVAL(req->vwv+1, 0);
3963         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3964         write_through = BITSETW(req->vwv+7,0);
3965
3966         /* We have to deal with slightly different formats depending
3967                 on whether we are using the core+ or lanman1.0 protocol */
3968
3969         if(get_Protocol() <= PROTOCOL_COREPLUS) {
3970                 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
3971                 data = smb_buf_const(req->inbuf);
3972         } else {
3973                 numtowrite = SVAL(req->vwv+10, 0);
3974                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3975         }
3976
3977         /* Ensure we don't write bytes past the end of this packet. */
3978         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3979                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3980                 error_to_writebrawerr(req);
3981                 END_PROFILE(SMBwritebraw);
3982                 return;
3983         }
3984
3985         if (!fsp->print_file) {
3986                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3987                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3988                     &lock);
3989
3990                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3991                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3992                         error_to_writebrawerr(req);
3993                         END_PROFILE(SMBwritebraw);
3994                         return;
3995                 }
3996         }
3997
3998         if (numtowrite>0) {
3999                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4000         }
4001
4002         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
4003                         "wrote=%d sync=%d\n",
4004                 fsp->fnum, (double)startpos, (int)numtowrite,
4005                 (int)nwritten, (int)write_through));
4006
4007         if (nwritten < (ssize_t)numtowrite)  {
4008                 reply_nterror(req, NT_STATUS_DISK_FULL);
4009                 error_to_writebrawerr(req);
4010                 goto strict_unlock;
4011         }
4012
4013         total_written = nwritten;
4014
4015         /* Allocate a buffer of 64k + length. */
4016         buf = talloc_array(NULL, char, 65540);
4017         if (!buf) {
4018                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4019                 error_to_writebrawerr(req);
4020                 goto strict_unlock;
4021         }
4022
4023         /* Return a SMBwritebraw message to the redirector to tell
4024          * it to send more bytes */
4025
4026         memcpy(buf, req->inbuf, smb_size);
4027         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4028         SCVAL(buf,smb_com,SMBwritebraw);
4029         SSVALS(buf,smb_vwv0,0xFFFF);
4030         show_msg(buf);
4031         if (!srv_send_smb(req->sconn,
4032                           buf,
4033                           false, 0, /* no signing */
4034                           IS_CONN_ENCRYPTED(conn),
4035                           &req->pcd)) {
4036                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4037                         "failed.");
4038         }
4039
4040         /* Now read the raw data into the buffer and write it */
4041         status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4042                                  &numtowrite);
4043         if (!NT_STATUS_IS_OK(status)) {
4044                 exit_server_cleanly("secondary writebraw failed");
4045         }
4046
4047         /* Set up outbuf to return the correct size */
4048         reply_outbuf(req, 1, 0);
4049
4050         if (numtowrite != 0) {
4051
4052                 if (numtowrite > 0xFFFF) {
4053                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4054                                 "raw requested (%u). Terminating\n",
4055                                 (unsigned int)numtowrite ));
4056                         exit_server_cleanly("secondary writebraw failed");
4057                 }
4058
4059                 if (tcount > nwritten+numtowrite) {
4060                         DEBUG(3,("reply_writebraw: Client overestimated the "
4061                                 "write %d %d %d\n",
4062                                 (int)tcount,(int)nwritten,(int)numtowrite));
4063                 }
4064
4065                 status = read_data(req->sconn->sock, buf+4, numtowrite);
4066
4067                 if (!NT_STATUS_IS_OK(status)) {
4068                         char addr[INET6_ADDRSTRLEN];
4069                         /* Try and give an error message
4070                          * saying what client failed. */
4071                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4072                                   "raw read failed (%s) for client %s. "
4073                                   "Terminating\n", nt_errstr(status),
4074                                   get_peer_addr(req->sconn->sock, addr,
4075                                                 sizeof(addr))));
4076                         exit_server_cleanly("secondary writebraw failed");
4077                 }
4078
4079                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4080                 if (nwritten == -1) {
4081                         TALLOC_FREE(buf);
4082                         reply_nterror(req, map_nt_error_from_unix(errno));
4083                         error_to_writebrawerr(req);
4084                         goto strict_unlock;
4085                 }
4086
4087                 if (nwritten < (ssize_t)numtowrite) {
4088                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4089                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4090                 }
4091
4092                 if (nwritten > 0) {
4093                         total_written += nwritten;
4094                 }
4095         }
4096
4097         TALLOC_FREE(buf);
4098         SSVAL(req->outbuf,smb_vwv0,total_written);
4099
4100         status = sync_file(conn, fsp, write_through);
4101         if (!NT_STATUS_IS_OK(status)) {
4102                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4103                          fsp_str_dbg(fsp), nt_errstr(status)));
4104                 reply_nterror(req, status);
4105                 error_to_writebrawerr(req);
4106                 goto strict_unlock;
4107         }
4108
4109         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4110                 "wrote=%d\n",
4111                 fsp->fnum, (double)startpos, (int)numtowrite,
4112                 (int)total_written));
4113
4114         if (!fsp->print_file) {
4115                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4116         }
4117
4118         /* We won't return a status if write through is not selected - this
4119          * follows what WfWg does */
4120         END_PROFILE(SMBwritebraw);
4121
4122         if (!write_through && total_written==tcount) {
4123
4124 #if RABBIT_PELLET_FIX
4125                 /*
4126                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4127                  * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4128                  * JRA.
4129                  */
4130                 if (!send_keepalive(req->sconn->sock)) {
4131                         exit_server_cleanly("reply_writebraw: send of "
4132                                 "keepalive failed");
4133                 }
4134 #endif
4135                 TALLOC_FREE(req->outbuf);
4136         }
4137         return;
4138
4139 strict_unlock:
4140         if (!fsp->print_file) {
4141                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4142         }
4143
4144         END_PROFILE(SMBwritebraw);
4145         return;
4146 }
4147
4148 #undef DBGC_CLASS
4149 #define DBGC_CLASS DBGC_LOCKING
4150
4151 /****************************************************************************
4152  Reply to a writeunlock (core+).
4153 ****************************************************************************/
4154
4155 void reply_writeunlock(struct smb_request *req)
4156 {
4157         connection_struct *conn = req->conn;
4158         ssize_t nwritten = -1;
4159         size_t numtowrite;
4160         SMB_OFF_T startpos;
4161         const char *data;
4162         NTSTATUS status = NT_STATUS_OK;
4163         files_struct *fsp;
4164         struct lock_struct lock;
4165         int saved_errno = 0;
4166
4167         START_PROFILE(SMBwriteunlock);
4168
4169         if (req->wct < 5) {
4170                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4171                 END_PROFILE(SMBwriteunlock);
4172                 return;
4173         }
4174
4175         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4176
4177         if (!check_fsp(conn, req, fsp)) {
4178                 END_PROFILE(SMBwriteunlock);
4179                 return;
4180         }
4181
4182         if (!CHECK_WRITE(fsp)) {
4183                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4184                 END_PROFILE(SMBwriteunlock);
4185                 return;
4186         }
4187
4188         numtowrite = SVAL(req->vwv+1, 0);
4189         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4190         data = (const char *)req->buf + 3;
4191
4192         if (!fsp->print_file && numtowrite > 0) {
4193                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4194                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4195                     &lock);
4196
4197                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4198                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4199                         END_PROFILE(SMBwriteunlock);
4200                         return;
4201                 }
4202         }
4203
4204         /* The special X/Open SMB protocol handling of
4205            zero length writes is *NOT* done for
4206            this call */
4207         if(numtowrite == 0) {
4208                 nwritten = 0;
4209         } else {
4210                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4211                 saved_errno = errno;
4212         }
4213
4214         status = sync_file(conn, fsp, False /* write through */);
4215         if (!NT_STATUS_IS_OK(status)) {
4216                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4217                          fsp_str_dbg(fsp), nt_errstr(status)));
4218                 reply_nterror(req, status);
4219                 goto strict_unlock;
4220         }
4221
4222         if(nwritten < 0) {
4223                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4224                 goto strict_unlock;
4225         }
4226
4227         if((nwritten < numtowrite) && (numtowrite != 0)) {
4228                 reply_nterror(req, NT_STATUS_DISK_FULL);
4229                 goto strict_unlock;
4230         }
4231
4232         if (numtowrite && !fsp->print_file) {
4233                 status = do_unlock(req->sconn->msg_ctx,
4234                                 fsp,
4235                                 (uint64_t)req->smbpid,
4236                                 (uint64_t)numtowrite,
4237                                 (uint64_t)startpos,
4238                                 WINDOWS_LOCK);
4239
4240                 if (NT_STATUS_V(status)) {
4241                         reply_nterror(req, status);
4242                         goto strict_unlock;
4243                 }
4244         }
4245
4246         reply_outbuf(req, 1, 0);
4247
4248         SSVAL(req->outbuf,smb_vwv0,nwritten);
4249
4250         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4251                  fsp->fnum, (int)numtowrite, (int)nwritten));
4252
4253 strict_unlock:
4254         if (numtowrite && !fsp->print_file) {
4255                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4256         }
4257
4258         END_PROFILE(SMBwriteunlock);
4259         return;
4260 }
4261
4262 #undef DBGC_CLASS
4263 #define DBGC_CLASS DBGC_ALL
4264
4265 /****************************************************************************
4266  Reply to a write.
4267 ****************************************************************************/
4268
4269 void reply_write(struct smb_request *req)
4270 {
4271         connection_struct *conn = req->conn;
4272         size_t numtowrite;
4273         ssize_t nwritten = -1;
4274         SMB_OFF_T startpos;
4275         const char *data;
4276         files_struct *fsp;
4277         struct lock_struct lock;
4278         NTSTATUS status;
4279         int saved_errno = 0;
4280
4281         START_PROFILE(SMBwrite);
4282
4283         if (req->wct < 5) {
4284                 END_PROFILE(SMBwrite);
4285                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4286                 return;
4287         }
4288
4289         /* If it's an IPC, pass off the pipe handler. */
4290         if (IS_IPC(conn)) {
4291                 reply_pipe_write(req);
4292                 END_PROFILE(SMBwrite);
4293                 return;
4294         }
4295
4296         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4297
4298         if (!check_fsp(conn, req, fsp)) {
4299                 END_PROFILE(SMBwrite);
4300                 return;
4301         }
4302
4303         if (!CHECK_WRITE(fsp)) {
4304                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4305                 END_PROFILE(SMBwrite);
4306                 return;
4307         }
4308
4309         numtowrite = SVAL(req->vwv+1, 0);
4310         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4311         data = (const char *)req->buf + 3;
4312
4313         if (!fsp->print_file) {
4314                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4315                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4316                         &lock);
4317
4318                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4319                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4320                         END_PROFILE(SMBwrite);
4321                         return;
4322                 }
4323         }
4324
4325         /*
4326          * X/Open SMB protocol says that if smb_vwv1 is
4327          * zero then the file size should be extended or
4328          * truncated to the size given in smb_vwv[2-3].
4329          */
4330
4331         if(numtowrite == 0) {
4332                 /*
4333                  * This is actually an allocate call, and set EOF. JRA.
4334                  */
4335                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4336                 if (nwritten < 0) {
4337                         reply_nterror(req, NT_STATUS_DISK_FULL);
4338                         goto strict_unlock;
4339                 }
4340                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4341                 if (nwritten < 0) {
4342                         reply_nterror(req, NT_STATUS_DISK_FULL);
4343                         goto strict_unlock;
4344                 }
4345                 trigger_write_time_update_immediate(fsp);
4346         } else {
4347                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4348         }
4349
4350         status = sync_file(conn, fsp, False);
4351         if (!NT_STATUS_IS_OK(status)) {
4352                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4353                          fsp_str_dbg(fsp), nt_errstr(status)));
4354                 reply_nterror(req, status);
4355                 goto strict_unlock;
4356         }
4357
4358         if(nwritten < 0) {
4359                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4360                 goto strict_unlock;
4361         }
4362
4363         if((nwritten == 0) && (numtowrite != 0)) {
4364                 reply_nterror(req, NT_STATUS_DISK_FULL);
4365                 goto strict_unlock;
4366         }
4367
4368         reply_outbuf(req, 1, 0);
4369
4370         SSVAL(req->outbuf,smb_vwv0,nwritten);
4371
4372         if (nwritten < (ssize_t)numtowrite) {
4373                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4374                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4375         }
4376
4377         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4378
4379 strict_unlock:
4380         if (!fsp->print_file) {
4381                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4382         }
4383
4384         END_PROFILE(SMBwrite);
4385         return;
4386 }
4387
4388 /****************************************************************************
4389  Ensure a buffer is a valid writeX for recvfile purposes.
4390 ****************************************************************************/
4391
4392 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4393                                                 (2*14) + /* word count (including bcc) */ \
4394                                                 1 /* pad byte */)
4395
4396 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4397                             const uint8_t *inbuf)
4398 {
4399         size_t numtowrite;
4400         connection_struct *conn = NULL;
4401         unsigned int doff = 0;
4402         size_t len = smb_len_large(inbuf);
4403
4404         if (is_encrypted_packet(sconn, inbuf)) {
4405                 /* Can't do this on encrypted
4406                  * connections. */
4407                 return false;
4408         }
4409
4410         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4411                 return false;
4412         }
4413
4414         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4415                         CVAL(inbuf,smb_wct) != 14) {
4416                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4417                         "invalid word length.\n"));
4418                 return false;
4419         }
4420
4421         conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4422         if (conn == NULL) {
4423                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4424                 return false;
4425         }
4426         if (IS_IPC(conn)) {
4427                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4428                 return false;
4429         }
4430         if (IS_PRINT(conn)) {
4431                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4432                 return false;
4433         }
4434         doff = SVAL(inbuf,smb_vwv11);
4435
4436         numtowrite = SVAL(inbuf,smb_vwv10);
4437
4438         if (len > doff && len - doff > 0xFFFF) {
4439                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4440         }
4441
4442         if (numtowrite == 0) {
4443                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4444                 return false;
4445         }
4446
4447         /* Ensure the sizes match up. */
4448         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4449                 /* no pad byte...old smbclient :-( */
4450                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4451                         (unsigned int)doff,
4452                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4453                 return false;
4454         }
4455
4456         if (len - doff != numtowrite) {
4457                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4458                         "len = %u, doff = %u, numtowrite = %u\n",
4459                         (unsigned int)len,
4460                         (unsigned int)doff,
4461                         (unsigned int)numtowrite ));
4462                 return false;
4463         }
4464
4465         DEBUG(10,("is_valid_writeX_buffer: true "
4466                 "len = %u, doff = %u, numtowrite = %u\n",
4467                 (unsigned int)len,
4468                 (unsigned int)doff,
4469                 (unsigned int)numtowrite ));
4470
4471         return true;
4472 }
4473
4474 /****************************************************************************
4475  Reply to a write and X.
4476 ****************************************************************************/
4477
4478 void reply_write_and_X(struct smb_request *req)
4479 {
4480         connection_struct *conn = req->conn;
4481         files_struct *fsp;
4482         struct lock_struct lock;
4483         SMB_OFF_T startpos;
4484         size_t numtowrite;
4485         bool write_through;
4486         ssize_t nwritten;
4487         unsigned int smb_doff;
4488         unsigned int smblen;
4489         const char *data;
4490         NTSTATUS status;
4491         int saved_errno = 0;
4492
4493         START_PROFILE(SMBwriteX);
4494
4495         if ((req->wct != 12) && (req->wct != 14)) {
4496                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4497                 goto out;
4498         }
4499
4500         numtowrite = SVAL(req->vwv+10, 0);
4501         smb_doff = SVAL(req->vwv+11, 0);
4502         smblen = smb_len(req->inbuf);
4503
4504         if (req->unread_bytes > 0xFFFF ||
4505                         (smblen > smb_doff &&
4506                                 smblen - smb_doff > 0xFFFF)) {
4507                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4508         }
4509
4510         if (req->unread_bytes) {
4511                 /* Can't do a recvfile write on IPC$ */
4512                 if (IS_IPC(conn)) {
4513                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4514                         goto out;
4515                 }
4516                 if (numtowrite != req->unread_bytes) {
4517                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4518                         goto out;
4519                 }
4520         } else {
4521                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4522                                 smb_doff + numtowrite > smblen) {
4523                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4524                         goto out;
4525                 }
4526         }
4527
4528         /* If it's an IPC, pass off the pipe handler. */
4529         if (IS_IPC(conn)) {
4530                 if (req->unread_bytes) {
4531                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4532                         goto out;
4533                 }
4534                 reply_pipe_write_and_X(req);
4535                 goto out;
4536         }
4537
4538         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4539         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4540         write_through = BITSETW(req->vwv+7,0);
4541
4542         if (!check_fsp(conn, req, fsp)) {
4543                 goto out;
4544         }
4545
4546         if (!CHECK_WRITE(fsp)) {
4547                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4548                 goto out;
4549         }
4550
4551         data = smb_base(req->inbuf) + smb_doff;
4552
4553         if(req->wct == 14) {
4554 #ifdef LARGE_SMB_OFF_T
4555                 /*
4556                  * This is a large offset (64 bit) write.
4557                  */
4558                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4559
4560 #else /* !LARGE_SMB_OFF_T */
4561
4562                 /*
4563                  * Ensure we haven't been sent a >32 bit offset.
4564                  */
4565
4566                 if(IVAL(req->vwv+12, 0) != 0) {
4567                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4568                                  "used and we don't support 64 bit offsets.\n",
4569                                  (unsigned int)IVAL(req->vwv+12, 0) ));
4570                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4571                         goto out;
4572                 }
4573
4574 #endif /* LARGE_SMB_OFF_T */
4575         }
4576
4577         /* X/Open SMB protocol says that, unlike SMBwrite
4578         if the length is zero then NO truncation is
4579         done, just a write of zero. To truncate a file,
4580         use SMBwrite. */
4581
4582         if(numtowrite == 0) {
4583                 nwritten = 0;
4584         } else {
4585                 if (req->unread_bytes == 0) {
4586                         status = schedule_aio_write_and_X(conn,
4587                                                 req,
4588                                                 fsp,
4589                                                 data,
4590                                                 startpos,
4591                                                 numtowrite);
4592
4593                         if (NT_STATUS_IS_OK(status)) {
4594                                 /* write scheduled - we're done. */
4595                                 goto out;
4596                         }
4597                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4598                                 /* Real error - report to client. */
4599                                 reply_nterror(req, status);
4600                                 goto out;
4601                         }
4602                         /* NT_STATUS_RETRY - fall through to sync write. */
4603                 }
4604
4605                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4606                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4607                     &lock);
4608
4609                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4610                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4611                         goto out;
4612                 }
4613
4614                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4615                 saved_errno = errno;
4616
4617                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4618         }
4619
4620         if(nwritten < 0) {
4621                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4622                 goto out;
4623         }
4624
4625         if((nwritten == 0) && (numtowrite != 0)) {
4626                 reply_nterror(req, NT_STATUS_DISK_FULL);
4627                 goto out;
4628         }
4629
4630         reply_outbuf(req, 6, 0);
4631         SSVAL(req->outbuf,smb_vwv2,nwritten);
4632         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4633
4634         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4635                 fsp->fnum, (int)numtowrite, (int)nwritten));
4636
4637         status = sync_file(conn, fsp, write_through);
4638         if (!NT_STATUS_IS_OK(status)) {
4639                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4640                          fsp_str_dbg(fsp), nt_errstr(status)));
4641                 reply_nterror(req, status);
4642                 goto out;
4643         }
4644
4645         END_PROFILE(SMBwriteX);
4646         chain_reply(req);
4647         return;
4648
4649 out:
4650         END_PROFILE(SMBwriteX);
4651         return;
4652 }
4653
4654 /****************************************************************************
4655  Reply to a lseek.
4656 ****************************************************************************/
4657
4658 void reply_lseek(struct smb_request *req)
4659 {
4660         connection_struct *conn = req->conn;
4661         SMB_OFF_T startpos;
4662         SMB_OFF_T res= -1;
4663         int mode,umode;
4664         files_struct *fsp;
4665
4666         START_PROFILE(SMBlseek);
4667
4668         if (req->wct < 4) {
4669                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4670                 END_PROFILE(SMBlseek);
4671                 return;
4672         }
4673
4674         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4675
4676         if (!check_fsp(conn, req, fsp)) {
4677                 return;
4678         }
4679
4680         flush_write_cache(fsp, SEEK_FLUSH);
4681
4682         mode = SVAL(req->vwv+1, 0) & 3;
4683         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4684         startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4685
4686         switch (mode) {
4687                 case 0:
4688                         umode = SEEK_SET;
4689                         res = startpos;
4690                         break;
4691                 case 1:
4692                         umode = SEEK_CUR;
4693                         res = fsp->fh->pos + startpos;
4694                         break;
4695                 case 2:
4696                         umode = SEEK_END;
4697                         break;
4698                 default:
4699                         umode = SEEK_SET;
4700                         res = startpos;
4701                         break;
4702         }
4703
4704         if (umode == SEEK_END) {
4705                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4706                         if(errno == EINVAL) {
4707                                 SMB_OFF_T current_pos = startpos;
4708
4709                                 if(fsp_stat(fsp) == -1) {
4710                                         reply_nterror(req,
4711                                                 map_nt_error_from_unix(errno));
4712                                         END_PROFILE(SMBlseek);
4713                                         return;
4714                                 }
4715
4716                                 current_pos += fsp->fsp_name->st.st_ex_size;
4717                                 if(current_pos < 0)
4718                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4719                         }
4720                 }
4721
4722                 if(res == -1) {
4723                         reply_nterror(req, map_nt_error_from_unix(errno));
4724                         END_PROFILE(SMBlseek);
4725                         return;
4726                 }
4727         }
4728
4729         fsp->fh->pos = res;
4730
4731         reply_outbuf(req, 2, 0);
4732         SIVAL(req->outbuf,smb_vwv0,res);
4733
4734         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4735                 fsp->fnum, (double)startpos, (double)res, mode));
4736
4737         END_PROFILE(SMBlseek);
4738         return;
4739 }
4740
4741 /****************************************************************************
4742  Reply to a flush.
4743 ****************************************************************************/
4744
4745 void reply_flush(struct smb_request *req)
4746 {
4747         connection_struct *conn = req->conn;
4748         uint16 fnum;
4749         files_struct *fsp;
4750
4751         START_PROFILE(SMBflush);
4752
4753         if (req->wct < 1) {
4754                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4755                 return;
4756         }
4757
4758         fnum = SVAL(req->vwv+0, 0);
4759         fsp = file_fsp(req, fnum);
4760
4761         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4762                 return;
4763         }
4764
4765         if (!fsp) {
4766                 file_sync_all(conn);
4767         } else {
4768                 NTSTATUS status = sync_file(conn, fsp, True);
4769                 if (!NT_STATUS_IS_OK(status)) {
4770                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4771                                 fsp_str_dbg(fsp), nt_errstr(status)));
4772                         reply_nterror(req, status);
4773                         END_PROFILE(SMBflush);
4774                         return;
4775                 }
4776         }
4777
4778         reply_outbuf(req, 0, 0);
4779
4780         DEBUG(3,("flush\n"));
4781         END_PROFILE(SMBflush);
4782         return;
4783 }
4784
4785 /****************************************************************************
4786  Reply to a exit.
4787  conn POINTER CAN BE NULL HERE !
4788 ****************************************************************************/
4789
4790 void reply_exit(struct smb_request *req)
4791 {
4792         START_PROFILE(SMBexit);
4793
4794         file_close_pid(req->sconn, req->smbpid, req->vuid);
4795
4796         reply_outbuf(req, 0, 0);
4797
4798         DEBUG(3,("exit\n"));
4799
4800         END_PROFILE(SMBexit);
4801         return;
4802 }
4803
4804 /****************************************************************************
4805  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4806 ****************************************************************************/
4807
4808 void reply_close(struct smb_request *req)
4809 {
4810         connection_struct *conn = req->conn;
4811         NTSTATUS status = NT_STATUS_OK;
4812         files_struct *fsp = NULL;
4813         START_PROFILE(SMBclose);
4814
4815         if (req->wct < 3) {
4816                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4817                 END_PROFILE(SMBclose);
4818                 return;
4819         }
4820
4821         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4822
4823         /*
4824          * We can only use check_fsp if we know it's not a directory.
4825          */
4826
4827         if (!check_fsp_open(conn, req, fsp)) {
4828                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4829                 END_PROFILE(SMBclose);
4830                 return;
4831         }
4832
4833         if(fsp->is_directory) {
4834                 /*
4835                  * Special case - close NT SMB directory handle.
4836                  */
4837                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4838                 status = close_file(req, fsp, NORMAL_CLOSE);
4839         } else {
4840                 time_t t;
4841                 /*
4842                  * Close ordinary file.
4843                  */
4844
4845                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4846                          fsp->fh->fd, fsp->fnum,
4847                          conn->num_files_open));
4848
4849                 /*
4850                  * Take care of any time sent in the close.
4851                  */
4852
4853                 t = srv_make_unix_date3(req->vwv+1);
4854                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4855
4856                 /*
4857                  * close_file() returns the unix errno if an error
4858                  * was detected on close - normally this is due to
4859                  * a disk full error. If not then it was probably an I/O error.
4860                  */
4861
4862                 status = close_file(req, fsp, NORMAL_CLOSE);
4863         }
4864
4865         if (!NT_STATUS_IS_OK(status)) {
4866                 reply_nterror(req, status);
4867                 END_PROFILE(SMBclose);
4868                 return;
4869         }
4870
4871         reply_outbuf(req, 0, 0);
4872         END_PROFILE(SMBclose);
4873         return;
4874 }
4875
4876 /****************************************************************************
4877  Reply to a writeclose (Core+ protocol).
4878 ****************************************************************************/
4879
4880 void reply_writeclose(struct smb_request *req)
4881 {
4882         connection_struct *conn = req->conn;
4883         size_t numtowrite;
4884         ssize_t nwritten = -1;
4885         NTSTATUS close_status = NT_STATUS_OK;
4886         SMB_OFF_T startpos;
4887         const char *data;
4888         struct timespec mtime;
4889         files_struct *fsp;
4890         struct lock_struct lock;
4891
4892         START_PROFILE(SMBwriteclose);
4893
4894         if (req->wct < 6) {
4895                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4896                 END_PROFILE(SMBwriteclose);
4897                 return;
4898         }
4899
4900         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4901
4902         if (!check_fsp(conn, req, fsp)) {
4903                 END_PROFILE(SMBwriteclose);
4904                 return;
4905         }
4906         if (!CHECK_WRITE(fsp)) {
4907                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4908                 END_PROFILE(SMBwriteclose);
4909                 return;
4910         }
4911
4912         numtowrite = SVAL(req->vwv+1, 0);
4913         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4914         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4915         data = (const char *)req->buf + 1;
4916
4917         if (!fsp->print_file) {
4918                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4919                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4920                     &lock);
4921
4922                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4923                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4924                         END_PROFILE(SMBwriteclose);
4925                         return;
4926                 }
4927         }
4928
4929         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4930
4931         set_close_write_time(fsp, mtime);
4932
4933         /*
4934          * More insanity. W2K only closes the file if writelen > 0.
4935          * JRA.
4936          */
4937
4938         if (numtowrite) {
4939                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4940                          "file %s\n", fsp_str_dbg(fsp)));
4941                 close_status = close_file(req, fsp, NORMAL_CLOSE);
4942         }
4943
4944         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4945                  fsp->fnum, (int)numtowrite, (int)nwritten,
4946                  conn->num_files_open));
4947
4948         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4949                 reply_nterror(req, NT_STATUS_DISK_FULL);
4950                 goto strict_unlock;
4951         }
4952
4953         if(!NT_STATUS_IS_OK(close_status)) {
4954                 reply_nterror(req, close_status);
4955                 goto strict_unlock;
4956         }
4957
4958         reply_outbuf(req, 1, 0);
4959
4960         SSVAL(req->outbuf,smb_vwv0,nwritten);
4961
4962 strict_unlock:
4963         if (numtowrite && !fsp->print_file) {
4964                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4965         }
4966
4967         END_PROFILE(SMBwriteclose);
4968         return;
4969 }
4970
4971 #undef DBGC_CLASS
4972 #define DBGC_CLASS DBGC_LOCKING
4973
4974 /****************************************************************************
4975  Reply to a lock.
4976 ****************************************************************************/
4977
4978 void reply_lock(struct smb_request *req)
4979 {
4980         connection_struct *conn = req->conn;
4981         uint64_t count,offset;
4982         NTSTATUS status;
4983         files_struct *fsp;
4984         struct byte_range_lock *br_lck = NULL;
4985
4986         START_PROFILE(SMBlock);
4987
4988         if (req->wct < 5) {
4989                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4990                 END_PROFILE(SMBlock);
4991                 return;
4992         }
4993
4994         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4995
4996         if (!check_fsp(conn, req, fsp)) {
4997                 END_PROFILE(SMBlock);
4998                 return;
4999         }
5000
5001         count = (uint64_t)IVAL(req->vwv+1, 0);
5002         offset = (uint64_t)IVAL(req->vwv+3, 0);
5003
5004         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5005                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
5006
5007         br_lck = do_lock(req->sconn->msg_ctx,
5008                         fsp,
5009                         (uint64_t)req->smbpid,
5010                         count,
5011                         offset,
5012                         WRITE_LOCK,
5013                         WINDOWS_LOCK,
5014                         False, /* Non-blocking lock. */
5015                         &status,
5016                         NULL,
5017                         NULL);
5018
5019         TALLOC_FREE(br_lck);
5020
5021         if (NT_STATUS_V(status)) {
5022                 reply_nterror(req, status);
5023                 END_PROFILE(SMBlock);
5024                 return;
5025         }
5026
5027         reply_outbuf(req, 0, 0);
5028
5029         END_PROFILE(SMBlock);
5030         return;
5031 }
5032
5033 /****************************************************************************
5034  Reply to a unlock.
5035 ****************************************************************************/
5036
5037 void reply_unlock(struct smb_request *req)
5038 {
5039         connection_struct *conn = req->conn;
5040         uint64_t count,offset;
5041         NTSTATUS status;
5042         files_struct *fsp;
5043
5044         START_PROFILE(SMBunlock);
5045
5046         if (req->wct < 5) {
5047                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5048                 END_PROFILE(SMBunlock);
5049                 return;
5050         }
5051
5052         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5053
5054         if (!check_fsp(conn, req, fsp)) {
5055                 END_PROFILE(SMBunlock);
5056                 return;
5057         }
5058
5059         count = (uint64_t)IVAL(req->vwv+1, 0);
5060         offset = (uint64_t)IVAL(req->vwv+3, 0);
5061
5062         status = do_unlock(req->sconn->msg_ctx,
5063                         fsp,
5064                         (uint64_t)req->smbpid,
5065                         count,
5066                         offset,
5067                         WINDOWS_LOCK);
5068
5069         if (NT_STATUS_V(status)) {
5070                 reply_nterror(req, status);
5071                 END_PROFILE(SMBunlock);
5072                 return;
5073         }
5074
5075         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5076                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5077
5078         reply_outbuf(req, 0, 0);
5079
5080         END_PROFILE(SMBunlock);
5081         return;
5082 }
5083
5084 #undef DBGC_CLASS
5085 #define DBGC_CLASS DBGC_ALL
5086
5087 /****************************************************************************
5088  Reply to a tdis.
5089  conn POINTER CAN BE NULL HERE !
5090 ****************************************************************************/
5091
5092 void reply_tdis(struct smb_request *req)
5093 {
5094         connection_struct *conn = req->conn;
5095         START_PROFILE(SMBtdis);
5096
5097         if (!conn) {
5098                 DEBUG(4,("Invalid connection in tdis\n"));
5099                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5100                 END_PROFILE(SMBtdis);
5101                 return;
5102         }
5103
5104         conn->used = False;
5105
5106         close_cnum(conn,req->vuid);
5107         req->conn = NULL;
5108
5109         reply_outbuf(req, 0, 0);
5110         END_PROFILE(SMBtdis);
5111         return;
5112 }
5113
5114 /****************************************************************************
5115  Reply to a echo.
5116  conn POINTER CAN BE NULL HERE !
5117 ****************************************************************************/
5118
5119 void reply_echo(struct smb_request *req)
5120 {
5121         connection_struct *conn = req->conn;
5122         struct smb_perfcount_data local_pcd;
5123         struct smb_perfcount_data *cur_pcd;
5124         int smb_reverb;
5125         int seq_num;
5126
5127         START_PROFILE(SMBecho);
5128
5129         smb_init_perfcount_data(&local_pcd);
5130
5131         if (req->wct < 1) {
5132                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5133                 END_PROFILE(SMBecho);
5134                 return;
5135         }
5136
5137         smb_reverb = SVAL(req->vwv+0, 0);
5138
5139         reply_outbuf(req, 1, req->buflen);
5140
5141         /* copy any incoming data back out */
5142         if (req->buflen > 0) {
5143                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5144         }
5145
5146         if (smb_reverb > 100) {
5147                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5148                 smb_reverb = 100;
5149         }
5150
5151         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5152
5153                 /* this makes sure we catch the request pcd */
5154                 if (seq_num == smb_reverb) {
5155                         cur_pcd = &req->pcd;
5156                 } else {
5157                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5158                         cur_pcd = &local_pcd;
5159                 }
5160
5161                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5162
5163                 show_msg((char *)req->outbuf);
5164                 if (!srv_send_smb(req->sconn,
5165                                 (char *)req->outbuf,
5166                                 true, req->seqnum+1,
5167                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5168                                 cur_pcd))
5169                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5170         }
5171
5172         DEBUG(3,("echo %d times\n", smb_reverb));
5173
5174         TALLOC_FREE(req->outbuf);
5175
5176         END_PROFILE(SMBecho);
5177         return;
5178 }
5179
5180 /****************************************************************************
5181  Reply to a printopen.
5182 ****************************************************************************/
5183
5184 void reply_printopen(struct smb_request *req)
5185 {
5186         connection_struct *conn = req->conn;
5187         files_struct *fsp;
5188         NTSTATUS status;
5189
5190         START_PROFILE(SMBsplopen);
5191
5192         if (req->wct < 2) {
5193                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5194                 END_PROFILE(SMBsplopen);
5195                 return;
5196         }
5197
5198         if (!CAN_PRINT(conn)) {
5199                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5200                 END_PROFILE(SMBsplopen);
5201                 return;
5202         }
5203
5204         status = file_new(req, conn, &fsp);
5205         if(!NT_STATUS_IS_OK(status)) {
5206                 reply_nterror(req, status);
5207                 END_PROFILE(SMBsplopen);
5208                 return;
5209         }
5210
5211         /* Open for exclusive use, write only. */
5212         status = print_spool_open(fsp, NULL, req->vuid);
5213
5214         if (!NT_STATUS_IS_OK(status)) {
5215                 file_free(req, fsp);
5216                 reply_nterror(req, status);
5217                 END_PROFILE(SMBsplopen);
5218                 return;
5219         }
5220
5221         reply_outbuf(req, 1, 0);
5222         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5223
5224         DEBUG(3,("openprint fd=%d fnum=%d\n",
5225                  fsp->fh->fd, fsp->fnum));
5226
5227         END_PROFILE(SMBsplopen);
5228         return;
5229 }
5230
5231 /****************************************************************************
5232  Reply to a printclose.
5233 ****************************************************************************/
5234
5235 void reply_printclose(struct smb_request *req)
5236 {
5237         connection_struct *conn = req->conn;
5238         files_struct *fsp;
5239         NTSTATUS status;
5240
5241         START_PROFILE(SMBsplclose);
5242
5243         if (req->wct < 1) {
5244                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5245                 END_PROFILE(SMBsplclose);
5246                 return;
5247         }
5248
5249         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5250
5251         if (!check_fsp(conn, req, fsp)) {
5252                 END_PROFILE(SMBsplclose);
5253                 return;
5254         }
5255
5256         if (!CAN_PRINT(conn)) {
5257                 reply_force_doserror(req, ERRSRV, ERRerror);
5258                 END_PROFILE(SMBsplclose);
5259                 return;
5260         }
5261
5262         DEBUG(3,("printclose fd=%d fnum=%d\n",
5263                  fsp->fh->fd,fsp->fnum));
5264
5265         status = close_file(req, fsp, NORMAL_CLOSE);
5266
5267         if(!NT_STATUS_IS_OK(status)) {
5268                 reply_nterror(req, status);
5269                 END_PROFILE(SMBsplclose);
5270                 return;
5271         }
5272
5273         reply_outbuf(req, 0, 0);
5274
5275         END_PROFILE(SMBsplclose);
5276         return;
5277 }
5278
5279 /****************************************************************************
5280  Reply to a printqueue.
5281 ****************************************************************************/
5282
5283 void reply_printqueue(struct smb_request *req)
5284 {
5285         connection_struct *conn = req->conn;
5286         int max_count;
5287         int start_index;
5288
5289         START_PROFILE(SMBsplretq);
5290
5291         if (req->wct < 2) {
5292                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5293                 END_PROFILE(SMBsplretq);
5294                 return;
5295         }
5296
5297         max_count = SVAL(req->vwv+0, 0);
5298         start_index = SVAL(req->vwv+1, 0);
5299
5300         /* we used to allow the client to get the cnum wrong, but that
5301            is really quite gross and only worked when there was only
5302            one printer - I think we should now only accept it if they
5303            get it right (tridge) */
5304         if (!CAN_PRINT(conn)) {
5305                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5306                 END_PROFILE(SMBsplretq);
5307                 return;
5308         }
5309
5310         reply_outbuf(req, 2, 3);
5311         SSVAL(req->outbuf,smb_vwv0,0);
5312         SSVAL(req->outbuf,smb_vwv1,0);
5313         SCVAL(smb_buf(req->outbuf),0,1);
5314         SSVAL(smb_buf(req->outbuf),1,0);
5315
5316         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5317                  start_index, max_count));
5318
5319         {
5320                 TALLOC_CTX *mem_ctx = talloc_tos();
5321                 NTSTATUS status;
5322                 WERROR werr;
5323                 const char *sharename = lp_servicename(SNUM(conn));
5324                 struct rpc_pipe_client *cli = NULL;
5325                 struct dcerpc_binding_handle *b = NULL;
5326                 struct policy_handle handle;
5327                 struct spoolss_DevmodeContainer devmode_ctr;
5328                 union spoolss_JobInfo *info;
5329                 uint32_t count;
5330                 uint32_t num_to_get;
5331                 uint32_t first;
5332                 uint32_t i;
5333
5334                 ZERO_STRUCT(handle);
5335
5336                 status = rpc_pipe_open_interface(conn,
5337                                                  &ndr_table_spoolss.syntax_id,
5338                                                  conn->session_info,
5339                                                  conn->sconn->remote_address,
5340                                                  conn->sconn->msg_ctx,
5341                                                  &cli);
5342                 if (!NT_STATUS_IS_OK(status)) {
5343                         DEBUG(0, ("reply_printqueue: "
5344                                   "could not connect to spoolss: %s\n",
5345                                   nt_errstr(status)));
5346                         reply_nterror(req, status);
5347                         goto out;
5348                 }
5349                 b = cli->binding_handle;
5350
5351                 ZERO_STRUCT(devmode_ctr);
5352
5353                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5354                                                 sharename,
5355                                                 NULL, devmode_ctr,
5356                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5357                                                 &handle,
5358                                                 &werr);
5359                 if (!NT_STATUS_IS_OK(status)) {
5360                         reply_nterror(req, status);
5361                         goto out;
5362                 }
5363                 if (!W_ERROR_IS_OK(werr)) {
5364                         reply_nterror(req, werror_to_ntstatus(werr));
5365                         goto out;
5366                 }
5367
5368                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5369                                                &handle,
5370                                                0, /* firstjob */
5371                                                0xff, /* numjobs */
5372                                                2, /* level */
5373                                                0, /* offered */
5374                                                &count,
5375                                                &info);
5376                 if (!W_ERROR_IS_OK(werr)) {
5377                         reply_nterror(req, werror_to_ntstatus(werr));
5378                         goto out;
5379                 }
5380
5381                 if (max_count > 0) {
5382                         first = start_index;
5383                 } else {
5384                         first = start_index + max_count + 1;
5385                 }
5386
5387                 if (first >= count) {
5388                         num_to_get = first;
5389                 } else {
5390                         num_to_get = first + MIN(ABS(max_count), count - first);
5391                 }
5392
5393                 for (i = first; i < num_to_get; i++) {
5394                         char blob[28];
5395                         char *p = blob;
5396                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5397                         int qstatus;
5398                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5399                                                         info[i].info2.job_id);
5400
5401                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5402                                 qstatus = 2;
5403                         } else {
5404                                 qstatus = 3;
5405                         }
5406
5407                         srv_put_dos_date2(p, 0, qtime);
5408                         SCVAL(p, 4, qstatus);
5409                         SSVAL(p, 5, qrapjobid);
5410                         SIVAL(p, 7, info[i].info2.size);
5411                         SCVAL(p, 11, 0);
5412                         srvstr_push(blob, req->flags2, p+12,
5413                                     info[i].info2.notify_name, 16, STR_ASCII);
5414
5415                         if (message_push_blob(
5416                                     &req->outbuf,
5417                                     data_blob_const(
5418                                             blob, sizeof(blob))) == -1) {
5419                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5420                                 goto out;
5421                         }
5422                 }
5423
5424                 if (count > 0) {
5425                         SSVAL(req->outbuf,smb_vwv0,count);
5426                         SSVAL(req->outbuf,smb_vwv1,
5427                               (max_count>0?first+count:first-1));
5428                         SCVAL(smb_buf(req->outbuf),0,1);
5429                         SSVAL(smb_buf(req->outbuf),1,28*count);
5430                 }
5431
5432
5433                 DEBUG(3, ("%u entries returned in queue\n",
5434                           (unsigned)count));
5435
5436 out:
5437                 if (b && is_valid_policy_hnd(&handle)) {
5438                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5439                 }
5440
5441         }
5442
5443         END_PROFILE(SMBsplretq);
5444         return;
5445 }
5446
5447 /****************************************************************************
5448  Reply to a printwrite.
5449 ****************************************************************************/
5450
5451 void reply_printwrite(struct smb_request *req)
5452 {
5453         connection_struct *conn = req->conn;
5454         int numtowrite;
5455         const char *data;
5456         files_struct *fsp;
5457
5458         START_PROFILE(SMBsplwr);
5459
5460         if (req->wct < 1) {
5461                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5462                 END_PROFILE(SMBsplwr);
5463                 return;
5464         }
5465
5466         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5467
5468         if (!check_fsp(conn, req, fsp)) {
5469                 END_PROFILE(SMBsplwr);
5470                 return;
5471         }
5472
5473         if (!fsp->print_file) {
5474                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5475                 END_PROFILE(SMBsplwr);
5476                 return;
5477         }
5478
5479         if (!CHECK_WRITE(fsp)) {
5480                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5481                 END_PROFILE(SMBsplwr);
5482                 return;
5483         }
5484
5485         numtowrite = SVAL(req->buf, 1);
5486
5487         if (req->buflen < numtowrite + 3) {
5488                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5489                 END_PROFILE(SMBsplwr);
5490                 return;
5491         }
5492
5493         data = (const char *)req->buf + 3;
5494
5495         if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5496                 reply_nterror(req, map_nt_error_from_unix(errno));
5497                 END_PROFILE(SMBsplwr);
5498                 return;
5499         }
5500
5501         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5502
5503         END_PROFILE(SMBsplwr);
5504         return;
5505 }
5506
5507 /****************************************************************************
5508  Reply to a mkdir.
5509 ****************************************************************************/
5510
5511 void reply_mkdir(struct smb_request *req)
5512 {
5513         connection_struct *conn = req->conn;
5514         struct smb_filename *smb_dname = NULL;
5515         char *directory = NULL;
5516         NTSTATUS status;
5517         TALLOC_CTX *ctx = talloc_tos();
5518
5519         START_PROFILE(SMBmkdir);
5520
5521         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5522                             STR_TERMINATE, &status);
5523         if (!NT_STATUS_IS_OK(status)) {
5524                 reply_nterror(req, status);
5525                 goto out;
5526         }
5527
5528         status = filename_convert(ctx, conn,
5529                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5530                                  directory,
5531                                  0,
5532                                  NULL,
5533                                  &smb_dname);
5534         if (!NT_STATUS_IS_OK(status)) {
5535                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5536                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5537                                         ERRSRV, ERRbadpath);
5538                         goto out;
5539                 }
5540                 reply_nterror(req, status);
5541                 goto out;
5542         }
5543
5544         status = create_directory(conn, req, smb_dname);
5545
5546         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5547
5548         if (!NT_STATUS_IS_OK(status)) {
5549
5550                 if (!use_nt_status()
5551                     && NT_STATUS_EQUAL(status,
5552                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5553                         /*
5554                          * Yes, in the DOS error code case we get a
5555                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5556                          * samba4 torture test.
5557                          */
5558                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5559                 }
5560
5561                 reply_nterror(req, status);
5562                 goto out;
5563         }
5564
5565         reply_outbuf(req, 0, 0);
5566
5567         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5568  out:
5569         TALLOC_FREE(smb_dname);
5570         END_PROFILE(SMBmkdir);
5571         return;
5572 }
5573
5574 /****************************************************************************
5575  Reply to a rmdir.
5576 ****************************************************************************/
5577
5578 void reply_rmdir(struct smb_request *req)
5579 {
5580         connection_struct *conn = req->conn;
5581         struct smb_filename *smb_dname = NULL;
5582         char *directory = NULL;
5583         NTSTATUS status;
5584         TALLOC_CTX *ctx = talloc_tos();
5585         files_struct *fsp = NULL;
5586         int info = 0;
5587         struct smbd_server_connection *sconn = req->sconn;
5588
5589         START_PROFILE(SMBrmdir);
5590
5591         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5592                             STR_TERMINATE, &status);
5593         if (!NT_STATUS_IS_OK(status)) {
5594                 reply_nterror(req, status);
5595                 goto out;
5596         }
5597
5598         status = filename_convert(ctx, conn,
5599                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5600                                  directory,
5601                                  0,
5602                                  NULL,
5603                                  &smb_dname);
5604         if (!NT_STATUS_IS_OK(status)) {
5605                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5606                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5607                                         ERRSRV, ERRbadpath);
5608                         goto out;
5609                 }
5610                 reply_nterror(req, status);
5611                 goto out;
5612         }
5613
5614         if (is_ntfs_stream_smb_fname(smb_dname)) {
5615                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5616                 goto out;
5617         }
5618
5619         status = SMB_VFS_CREATE_FILE(
5620                 conn,                                   /* conn */
5621                 req,                                    /* req */
5622                 0,                                      /* root_dir_fid */
5623                 smb_dname,                              /* fname */
5624                 DELETE_ACCESS,                          /* access_mask */
5625                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5626                         FILE_SHARE_DELETE),
5627                 FILE_OPEN,                              /* create_disposition*/
5628                 FILE_DIRECTORY_FILE,                    /* create_options */
5629                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5630                 0,                                      /* oplock_request */
5631                 0,                                      /* allocation_size */
5632                 0,                                      /* private_flags */
5633                 NULL,                                   /* sd */
5634                 NULL,                                   /* ea_list */
5635                 &fsp,                                   /* result */
5636                 &info);                                 /* pinfo */
5637
5638         if (!NT_STATUS_IS_OK(status)) {
5639                 if (open_was_deferred(req->sconn, req->mid)) {
5640                         /* We have re-scheduled this call. */
5641                         goto out;
5642                 }
5643                 reply_nterror(req, status);
5644                 goto out;
5645         }
5646
5647         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5648         if (!NT_STATUS_IS_OK(status)) {
5649                 close_file(req, fsp, ERROR_CLOSE);
5650                 reply_nterror(req, status);
5651                 goto out;
5652         }
5653
5654         if (!set_delete_on_close(fsp, true, conn->session_info->unix_token)) {
5655                 close_file(req, fsp, ERROR_CLOSE);
5656                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5657                 goto out;
5658         }
5659
5660         status = close_file(req, fsp, NORMAL_CLOSE);
5661         if (!NT_STATUS_IS_OK(status)) {
5662                 reply_nterror(req, status);
5663         } else {
5664                 reply_outbuf(req, 0, 0);
5665         }
5666
5667         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5668
5669         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5670  out:
5671         TALLOC_FREE(smb_dname);
5672         END_PROFILE(SMBrmdir);
5673         return;
5674 }
5675
5676 /*******************************************************************
5677  Resolve wildcards in a filename rename.
5678 ********************************************************************/
5679
5680 static bool resolve_wildcards(TALLOC_CTX *ctx,
5681                                 const char *name1,
5682                                 const char *name2,
5683                                 char **pp_newname)
5684 {
5685         char *name2_copy = NULL;
5686         char *root1 = NULL;
5687         char *root2 = NULL;
5688         char *ext1 = NULL;
5689         char *ext2 = NULL;
5690         char *p,*p2, *pname1, *pname2;
5691
5692         name2_copy = talloc_strdup(ctx, name2);
5693         if (!name2_copy) {
5694                 return False;
5695         }
5696
5697         pname1 = strrchr_m(name1,'/');
5698         pname2 = strrchr_m(name2_copy,'/');
5699
5700         if (!pname1 || !pname2) {
5701                 return False;
5702         }
5703
5704         /* Truncate the copy of name2 at the last '/' */
5705         *pname2 = '\0';
5706
5707         /* Now go past the '/' */
5708         pname1++;
5709         pname2++;
5710
5711         root1 = talloc_strdup(ctx, pname1);
5712         root2 = talloc_strdup(ctx, pname2);
5713
5714         if (!root1 || !root2) {
5715                 return False;
5716         }
5717
5718         p = strrchr_m(root1,'.');
5719         if (p) {
5720                 *p = 0;
5721                 ext1 = talloc_strdup(ctx, p+1);
5722         } else {
5723                 ext1 = talloc_strdup(ctx, "");
5724         }
5725         p = strrchr_m(root2,'.');
5726         if (p) {
5727                 *p = 0;
5728                 ext2 = talloc_strdup(ctx, p+1);
5729         } else {
5730                 ext2 = talloc_strdup(ctx, "");
5731         }
5732
5733         if (!ext1 || !ext2) {
5734                 return False;
5735         }
5736
5737         p = root1;
5738         p2 = root2;
5739         while (*p2) {
5740                 if (*p2 == '?') {
5741                         /* Hmmm. Should this be mb-aware ? */
5742                         *p2 = *p;
5743                         p2++;
5744                 } else if (*p2 == '*') {
5745                         *p2 = '\0';
5746                         root2 = talloc_asprintf(ctx, "%s%s",
5747                                                 root2,
5748                                                 p);
5749                         if (!root2) {
5750                                 return False;
5751                         }
5752                         break;
5753                 } else {
5754                         p2++;
5755                 }
5756                 if (*p) {
5757                         p++;
5758                 }
5759         }
5760
5761         p = ext1;
5762         p2 = ext2;
5763         while (*p2) {
5764                 if (*p2 == '?') {
5765                         /* Hmmm. Should this be mb-aware ? */
5766                         *p2 = *p;
5767                         p2++;
5768                 } else if (*p2 == '*') {
5769                         *p2 = '\0';
5770                         ext2 = talloc_asprintf(ctx, "%s%s",
5771                                                 ext2,
5772                                                 p);
5773                         if (!ext2) {
5774                                 return False;
5775                         }
5776                         break;
5777                 } else {
5778                         p2++;
5779                 }
5780                 if (*p) {
5781                         p++;
5782                 }
5783         }
5784
5785         if (*ext2) {
5786                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5787                                 name2_copy,
5788                                 root2,
5789                                 ext2);
5790         } else {
5791                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5792                                 name2_copy,
5793                                 root2);
5794         }
5795
5796         if (!*pp_newname) {
5797                 return False;
5798         }
5799
5800         return True;
5801 }
5802
5803 /****************************************************************************
5804  Ensure open files have their names updated. Updated to notify other smbd's
5805  asynchronously.
5806 ****************************************************************************/
5807
5808 static void rename_open_files(connection_struct *conn,
5809                               struct share_mode_lock *lck,
5810                               uint32_t orig_name_hash,
5811                               const struct smb_filename *smb_fname_dst)
5812 {
5813         files_struct *fsp;
5814         bool did_rename = False;
5815         NTSTATUS status;
5816         uint32_t new_name_hash = 0;
5817
5818         for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
5819             fsp = file_find_di_next(fsp)) {
5820                 /* fsp_name is a relative path under the fsp. To change this for other
5821                    sharepaths we need to manipulate relative paths. */
5822                 /* TODO - create the absolute path and manipulate the newname
5823                    relative to the sharepath. */
5824                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5825                         continue;
5826                 }
5827                 if (fsp->name_hash != orig_name_hash) {
5828                         continue;
5829                 }
5830                 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5831                            "(file_id %s) from %s -> %s\n", fsp->fnum,
5832                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5833                            smb_fname_str_dbg(smb_fname_dst)));
5834
5835                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5836                 if (NT_STATUS_IS_OK(status)) {
5837                         did_rename = True;
5838                         new_name_hash = fsp->name_hash;
5839                 }
5840         }
5841
5842         if (!did_rename) {
5843                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5844                            "for %s\n", file_id_string_tos(&lck->data->id),
5845                            smb_fname_str_dbg(smb_fname_dst)));
5846         }
5847
5848         /* Send messages to all smbd's (not ourself) that the name has changed. */
5849         rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5850                               orig_name_hash, new_name_hash,
5851                               smb_fname_dst);
5852
5853 }
5854
5855 /****************************************************************************
5856  We need to check if the source path is a parent directory of the destination
5857  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5858  refuse the rename with a sharing violation. Under UNIX the above call can
5859  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5860  probably need to check that the client is a Windows one before disallowing
5861  this as a UNIX client (one with UNIX extensions) can know the source is a
5862  symlink and make this decision intelligently. Found by an excellent bug
5863  report from <AndyLiebman@aol.com>.
5864 ****************************************************************************/
5865
5866 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5867                                      const struct smb_filename *smb_fname_dst)
5868 {
5869         const char *psrc = smb_fname_src->base_name;
5870         const char *pdst = smb_fname_dst->base_name;
5871         size_t slen;
5872
5873         if (psrc[0] == '.' && psrc[1] == '/') {
5874                 psrc += 2;
5875         }
5876         if (pdst[0] == '.' && pdst[1] == '/') {
5877                 pdst += 2;
5878         }
5879         if ((slen = strlen(psrc)) > strlen(pdst)) {
5880                 return False;
5881         }
5882         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5883 }
5884
5885 /*
5886  * Do the notify calls from a rename
5887  */
5888
5889 static void notify_rename(connection_struct *conn, bool is_dir,
5890                           const struct smb_filename *smb_fname_src,
5891                           const struct smb_filename *smb_fname_dst)
5892 {
5893         char *parent_dir_src = NULL;
5894         char *parent_dir_dst = NULL;
5895         uint32 mask;
5896
5897         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5898                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5899
5900         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5901                             &parent_dir_src, NULL) ||
5902             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5903                             &parent_dir_dst, NULL)) {
5904                 goto out;
5905         }
5906
5907         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5908                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5909                              smb_fname_src->base_name);
5910                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5911                              smb_fname_dst->base_name);
5912         }
5913         else {
5914                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5915                              smb_fname_src->base_name);
5916                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5917                              smb_fname_dst->base_name);
5918         }
5919
5920         /* this is a strange one. w2k3 gives an additional event for
5921            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5922            files, but not directories */
5923         if (!is_dir) {
5924                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5925                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5926                              |FILE_NOTIFY_CHANGE_CREATION,
5927                              smb_fname_dst->base_name);
5928         }
5929  out:
5930         TALLOC_FREE(parent_dir_src);
5931         TALLOC_FREE(parent_dir_dst);
5932 }
5933
5934 /****************************************************************************
5935  Returns an error if the parent directory for a filename is open in an
5936  incompatible way.
5937 ****************************************************************************/
5938
5939 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
5940                                         const struct smb_filename *smb_fname_dst_in)
5941 {
5942         char *parent_dir = NULL;
5943         struct smb_filename smb_fname_parent;
5944         struct file_id id;
5945         files_struct *fsp = NULL;
5946         int ret;
5947
5948         if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
5949                         &parent_dir, NULL)) {
5950                 return NT_STATUS_NO_MEMORY;
5951         }
5952         ZERO_STRUCT(smb_fname_parent);
5953         smb_fname_parent.base_name = parent_dir;
5954
5955         ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
5956         if (ret == -1) {
5957                 return map_nt_error_from_unix(errno);
5958         }
5959
5960         /*
5961          * We're only checking on this smbd here, mostly good
5962          * enough.. and will pass tests.
5963          */
5964
5965         id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
5966         for (fsp = file_find_di_first(conn->sconn, id); fsp;
5967                         fsp = file_find_di_next(fsp)) {
5968                 if (fsp->access_mask & DELETE_ACCESS) {
5969                         return NT_STATUS_SHARING_VIOLATION;
5970                 }
5971         }
5972         return NT_STATUS_OK;
5973 }
5974
5975 /****************************************************************************
5976  Rename an open file - given an fsp.
5977 ****************************************************************************/
5978
5979 NTSTATUS rename_internals_fsp(connection_struct *conn,
5980                         files_struct *fsp,
5981                         const struct smb_filename *smb_fname_dst_in,
5982                         uint32 attrs,
5983                         bool replace_if_exists)
5984 {
5985         TALLOC_CTX *ctx = talloc_tos();
5986         struct smb_filename *smb_fname_dst = NULL;
5987         NTSTATUS status = NT_STATUS_OK;
5988         struct share_mode_lock *lck = NULL;
5989         bool dst_exists, old_is_stream, new_is_stream;
5990
5991         status = check_name(conn, smb_fname_dst_in->base_name);
5992         if (!NT_STATUS_IS_OK(status)) {
5993                 return status;
5994         }
5995
5996         status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
5997         if (!NT_STATUS_IS_OK(status)) {
5998                 return status;
5999         }
6000
6001         /* Make a copy of the dst smb_fname structs */
6002
6003         status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
6004         if (!NT_STATUS_IS_OK(status)) {
6005                 goto out;
6006         }
6007
6008         /*
6009          * Check for special case with case preserving and not
6010          * case sensitive. If the old last component differs from the original
6011          * last component only by case, then we should allow
6012          * the rename (user is trying to change the case of the
6013          * filename).
6014          */
6015         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6016             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6017             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6018                 char *last_slash;
6019                 char *fname_dst_lcomp_base_mod = NULL;
6020                 struct smb_filename *smb_fname_orig_lcomp = NULL;
6021
6022                 /*
6023                  * Get the last component of the destination name.
6024                  */
6025                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6026                 if (last_slash) {
6027                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6028                 } else {
6029                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6030                 }
6031                 if (!fname_dst_lcomp_base_mod) {
6032                         status = NT_STATUS_NO_MEMORY;
6033                         goto out;
6034                 }
6035
6036                 /*
6037                  * Create an smb_filename struct using the original last
6038                  * component of the destination.
6039                  */
6040                 status = create_synthetic_smb_fname_split(ctx,
6041                     smb_fname_dst->original_lcomp, NULL,
6042                     &smb_fname_orig_lcomp);
6043                 if (!NT_STATUS_IS_OK(status)) {
6044                         TALLOC_FREE(fname_dst_lcomp_base_mod);
6045                         goto out;
6046                 }
6047
6048                 /* If the base names only differ by case, use original. */
6049                 if(!strcsequal(fname_dst_lcomp_base_mod,
6050                                smb_fname_orig_lcomp->base_name)) {
6051                         char *tmp;
6052                         /*
6053                          * Replace the modified last component with the
6054                          * original.
6055                          */
6056                         if (last_slash) {
6057                                 *last_slash = '\0'; /* Truncate at the '/' */
6058                                 tmp = talloc_asprintf(smb_fname_dst,
6059                                         "%s/%s",
6060                                         smb_fname_dst->base_name,
6061                                         smb_fname_orig_lcomp->base_name);
6062                         } else {
6063                                 tmp = talloc_asprintf(smb_fname_dst,
6064                                         "%s",
6065                                         smb_fname_orig_lcomp->base_name);
6066                         }
6067                         if (tmp == NULL) {
6068                                 status = NT_STATUS_NO_MEMORY;
6069                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6070                                 TALLOC_FREE(smb_fname_orig_lcomp);
6071                                 goto out;
6072                         }
6073                         TALLOC_FREE(smb_fname_dst->base_name);
6074                         smb_fname_dst->base_name = tmp;
6075                 }
6076
6077                 /* If the stream_names only differ by case, use original. */
6078                 if(!strcsequal(smb_fname_dst->stream_name,
6079                                smb_fname_orig_lcomp->stream_name)) {
6080                         char *tmp = NULL;
6081                         /* Use the original stream. */
6082                         tmp = talloc_strdup(smb_fname_dst,
6083                                             smb_fname_orig_lcomp->stream_name);
6084                         if (tmp == NULL) {
6085                                 status = NT_STATUS_NO_MEMORY;
6086                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6087                                 TALLOC_FREE(smb_fname_orig_lcomp);
6088                                 goto out;
6089                         }
6090                         TALLOC_FREE(smb_fname_dst->stream_name);
6091                         smb_fname_dst->stream_name = tmp;
6092                 }
6093                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6094                 TALLOC_FREE(smb_fname_orig_lcomp);
6095         }
6096
6097         /*
6098          * If the src and dest names are identical - including case,
6099          * don't do the rename, just return success.
6100          */
6101
6102         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6103             strcsequal(fsp->fsp_name->stream_name,
6104                        smb_fname_dst->stream_name)) {
6105                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6106                           "- returning success\n",
6107                           smb_fname_str_dbg(smb_fname_dst)));
6108                 status = NT_STATUS_OK;
6109                 goto out;
6110         }
6111
6112         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6113         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6114
6115         /* Return the correct error code if both names aren't streams. */
6116         if (!old_is_stream && new_is_stream) {
6117                 status = NT_STATUS_OBJECT_NAME_INVALID;
6118                 goto out;
6119         }
6120
6121         if (old_is_stream && !new_is_stream) {
6122                 status = NT_STATUS_INVALID_PARAMETER;
6123                 goto out;
6124         }
6125
6126         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6127
6128         if(!replace_if_exists && dst_exists) {
6129                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6130                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6131                           smb_fname_str_dbg(smb_fname_dst)));
6132                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6133                 goto out;
6134         }
6135
6136         if (dst_exists) {
6137                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6138                     &smb_fname_dst->st);
6139                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6140                                                            fileid);
6141                 /* The file can be open when renaming a stream */
6142                 if (dst_fsp && !new_is_stream) {
6143                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6144                         status = NT_STATUS_ACCESS_DENIED;
6145                         goto out;
6146                 }
6147         }
6148
6149         /* Ensure we have a valid stat struct for the source. */
6150         status = vfs_stat_fsp(fsp);
6151         if (!NT_STATUS_IS_OK(status)) {
6152                 goto out;
6153         }
6154
6155         status = can_rename(conn, fsp, attrs);
6156
6157         if (!NT_STATUS_IS_OK(status)) {
6158                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6159                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6160                           smb_fname_str_dbg(smb_fname_dst)));
6161                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6162                         status = NT_STATUS_ACCESS_DENIED;
6163                 goto out;
6164         }
6165
6166         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6167                 status = NT_STATUS_ACCESS_DENIED;
6168         }
6169
6170         lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6171
6172         /*
6173          * We have the file open ourselves, so not being able to get the
6174          * corresponding share mode lock is a fatal error.
6175          */
6176
6177         SMB_ASSERT(lck != NULL);
6178
6179         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6180                 uint32 create_options = fsp->fh->private_options;
6181
6182                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6183                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6184                           smb_fname_str_dbg(smb_fname_dst)));
6185
6186                 if (!lp_posix_pathnames() &&
6187                     (lp_map_archive(SNUM(conn)) ||
6188                     lp_store_dos_attributes(SNUM(conn)))) {
6189                         /* We must set the archive bit on the newly
6190                            renamed file. */
6191                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6192                                 uint32_t old_dosmode = dos_mode(conn,
6193                                                         smb_fname_dst);
6194                                 file_set_dosmode(conn,
6195                                         smb_fname_dst,
6196                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6197                                         NULL,
6198                                         true);
6199                         }
6200                 }
6201
6202                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6203                               smb_fname_dst);
6204
6205                 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6206
6207                 /*
6208                  * A rename acts as a new file create w.r.t. allowing an initial delete
6209                  * on close, probably because in Windows there is a new handle to the
6210                  * new file. If initial delete on close was requested but not
6211                  * originally set, we need to set it here. This is probably not 100% correct,
6212                  * but will work for the CIFSFS client which in non-posix mode
6213                  * depends on these semantics. JRA.
6214                  */
6215
6216                 if (create_options & FILE_DELETE_ON_CLOSE) {
6217                         status = can_set_delete_on_close(fsp, 0);
6218
6219                         if (NT_STATUS_IS_OK(status)) {
6220                                 /* Note that here we set the *inital* delete on close flag,
6221                                  * not the regular one. The magic gets handled in close. */
6222                                 fsp->initial_delete_on_close = True;
6223                         }
6224                 }
6225                 TALLOC_FREE(lck);
6226                 status = NT_STATUS_OK;
6227                 goto out;
6228         }
6229
6230         TALLOC_FREE(lck);
6231
6232         if (errno == ENOTDIR || errno == EISDIR) {
6233                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6234         } else {
6235                 status = map_nt_error_from_unix(errno);
6236         }
6237
6238         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6239                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6240                   smb_fname_str_dbg(smb_fname_dst)));
6241
6242  out:
6243         TALLOC_FREE(smb_fname_dst);
6244
6245         return status;
6246 }
6247
6248 /****************************************************************************
6249  The guts of the rename command, split out so it may be called by the NT SMB
6250  code.
6251 ****************************************************************************/
6252
6253 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6254                         connection_struct *conn,
6255                         struct smb_request *req,
6256                         struct smb_filename *smb_fname_src,
6257                         struct smb_filename *smb_fname_dst,
6258                         uint32 attrs,
6259                         bool replace_if_exists,
6260                         bool src_has_wild,
6261                         bool dest_has_wild,
6262                         uint32_t access_mask)
6263 {
6264         char *fname_src_dir = NULL;
6265         char *fname_src_mask = NULL;
6266         int count=0;
6267         NTSTATUS status = NT_STATUS_OK;
6268         struct smb_Dir *dir_hnd = NULL;
6269         const char *dname = NULL;
6270         char *talloced = NULL;
6271         long offset = 0;
6272         int create_options = 0;
6273         bool posix_pathnames = lp_posix_pathnames();
6274
6275         /*
6276          * Split the old name into directory and last component
6277          * strings. Note that unix_convert may have stripped off a
6278          * leading ./ from both name and newname if the rename is
6279          * at the root of the share. We need to make sure either both
6280          * name and newname contain a / character or neither of them do
6281          * as this is checked in resolve_wildcards().
6282          */
6283
6284         /* Split up the directory from the filename/mask. */
6285         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6286                                       &fname_src_dir, &fname_src_mask);
6287         if (!NT_STATUS_IS_OK(status)) {
6288                 status = NT_STATUS_NO_MEMORY;
6289                 goto out;
6290         }
6291
6292         /*
6293          * We should only check the mangled cache
6294          * here if unix_convert failed. This means
6295          * that the path in 'mask' doesn't exist
6296          * on the file system and so we need to look
6297          * for a possible mangle. This patch from
6298          * Tine Smukavec <valentin.smukavec@hermes.si>.
6299          */
6300
6301         if (!VALID_STAT(smb_fname_src->st) &&
6302             mangle_is_mangled(fname_src_mask, conn->params)) {
6303                 char *new_mask = NULL;
6304                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6305                                             conn->params);
6306                 if (new_mask) {
6307                         TALLOC_FREE(fname_src_mask);
6308                         fname_src_mask = new_mask;
6309                 }
6310         }
6311
6312         if (!src_has_wild) {
6313                 files_struct *fsp;
6314
6315                 /*
6316                  * Only one file needs to be renamed. Append the mask back
6317                  * onto the directory.
6318                  */
6319                 TALLOC_FREE(smb_fname_src->base_name);
6320                 if (ISDOT(fname_src_dir)) {
6321                         /* Ensure we use canonical names on open. */
6322                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6323                                                         "%s",
6324                                                         fname_src_mask);
6325                 } else {
6326                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6327                                                         "%s/%s",
6328                                                         fname_src_dir,
6329                                                         fname_src_mask);
6330                 }
6331                 if (!smb_fname_src->base_name) {
6332                         status = NT_STATUS_NO_MEMORY;
6333                         goto out;
6334                 }
6335
6336                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6337                           "case_preserve = %d, short case preserve = %d, "
6338                           "directory = %s, newname = %s, "
6339                           "last_component_dest = %s\n",
6340                           conn->case_sensitive, conn->case_preserve,
6341                           conn->short_case_preserve,
6342                           smb_fname_str_dbg(smb_fname_src),
6343                           smb_fname_str_dbg(smb_fname_dst),
6344                           smb_fname_dst->original_lcomp));
6345
6346                 /* The dest name still may have wildcards. */
6347                 if (dest_has_wild) {
6348                         char *fname_dst_mod = NULL;
6349                         if (!resolve_wildcards(smb_fname_dst,
6350                                                smb_fname_src->base_name,
6351                                                smb_fname_dst->base_name,
6352                                                &fname_dst_mod)) {
6353                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6354                                           "%s %s failed\n",
6355                                           smb_fname_src->base_name,
6356                                           smb_fname_dst->base_name));
6357                                 status = NT_STATUS_NO_MEMORY;
6358                                 goto out;
6359                         }
6360                         TALLOC_FREE(smb_fname_dst->base_name);
6361                         smb_fname_dst->base_name = fname_dst_mod;
6362                 }
6363
6364                 ZERO_STRUCT(smb_fname_src->st);
6365                 if (posix_pathnames) {
6366                         SMB_VFS_LSTAT(conn, smb_fname_src);
6367                 } else {
6368                         SMB_VFS_STAT(conn, smb_fname_src);
6369                 }
6370
6371                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6372                         create_options |= FILE_DIRECTORY_FILE;
6373                 }
6374
6375                 status = SMB_VFS_CREATE_FILE(
6376                         conn,                           /* conn */
6377                         req,                            /* req */
6378                         0,                              /* root_dir_fid */
6379                         smb_fname_src,                  /* fname */
6380                         access_mask,                    /* access_mask */
6381                         (FILE_SHARE_READ |              /* share_access */
6382                             FILE_SHARE_WRITE),
6383                         FILE_OPEN,                      /* create_disposition*/
6384                         create_options,                 /* create_options */
6385                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6386                         0,                              /* oplock_request */
6387                         0,                              /* allocation_size */
6388                         0,                              /* private_flags */
6389                         NULL,                           /* sd */
6390                         NULL,                           /* ea_list */
6391                         &fsp,                           /* result */
6392                         NULL);                          /* pinfo */
6393
6394                 if (!NT_STATUS_IS_OK(status)) {
6395                         DEBUG(3, ("Could not open rename source %s: %s\n",
6396                                   smb_fname_str_dbg(smb_fname_src),
6397                                   nt_errstr(status)));
6398                         goto out;
6399                 }
6400
6401                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6402                                               attrs, replace_if_exists);
6403
6404                 close_file(req, fsp, NORMAL_CLOSE);
6405
6406                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6407                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6408                           smb_fname_str_dbg(smb_fname_dst)));
6409
6410                 goto out;
6411         }
6412
6413         /*
6414          * Wildcards - process each file that matches.
6415          */
6416         if (strequal(fname_src_mask, "????????.???")) {
6417                 TALLOC_FREE(fname_src_mask);
6418                 fname_src_mask = talloc_strdup(ctx, "*");
6419                 if (!fname_src_mask) {
6420                         status = NT_STATUS_NO_MEMORY;
6421                         goto out;
6422                 }
6423         }
6424
6425         status = check_name(conn, fname_src_dir);
6426         if (!NT_STATUS_IS_OK(status)) {
6427                 goto out;
6428         }
6429
6430         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6431                           attrs);
6432         if (dir_hnd == NULL) {
6433                 status = map_nt_error_from_unix(errno);
6434                 goto out;
6435         }
6436
6437         status = NT_STATUS_NO_SUCH_FILE;
6438         /*
6439          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6440          * - gentest fix. JRA
6441          */
6442
6443         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6444                                     &talloced))) {
6445                 files_struct *fsp = NULL;
6446                 char *destname = NULL;
6447                 bool sysdir_entry = False;
6448
6449                 /* Quick check for "." and ".." */
6450                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6451                         if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6452                                 sysdir_entry = True;
6453                         } else {
6454                                 TALLOC_FREE(talloced);
6455                                 continue;
6456                         }
6457                 }
6458
6459                 if (!is_visible_file(conn, fname_src_dir, dname,
6460                                      &smb_fname_src->st, false)) {
6461                         TALLOC_FREE(talloced);
6462                         continue;
6463                 }
6464
6465                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6466                         TALLOC_FREE(talloced);
6467                         continue;
6468                 }
6469
6470                 if (sysdir_entry) {
6471                         status = NT_STATUS_OBJECT_NAME_INVALID;
6472                         break;
6473                 }
6474
6475                 TALLOC_FREE(smb_fname_src->base_name);
6476                 if (ISDOT(fname_src_dir)) {
6477                         /* Ensure we use canonical names on open. */
6478                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6479                                                         "%s",
6480                                                         dname);
6481                 } else {
6482                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6483                                                         "%s/%s",
6484                                                         fname_src_dir,
6485                                                         dname);
6486                 }
6487                 if (!smb_fname_src->base_name) {
6488                         status = NT_STATUS_NO_MEMORY;
6489                         goto out;
6490                 }
6491
6492                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6493                                        smb_fname_dst->base_name,
6494                                        &destname)) {
6495                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6496                                   smb_fname_src->base_name, destname));
6497                         TALLOC_FREE(talloced);
6498                         continue;
6499                 }
6500                 if (!destname) {
6501                         status = NT_STATUS_NO_MEMORY;
6502                         goto out;
6503                 }
6504
6505                 TALLOC_FREE(smb_fname_dst->base_name);
6506                 smb_fname_dst->base_name = destname;
6507
6508                 ZERO_STRUCT(smb_fname_src->st);
6509                 if (posix_pathnames) {
6510                         SMB_VFS_LSTAT(conn, smb_fname_src);
6511                 } else {
6512                         SMB_VFS_STAT(conn, smb_fname_src);
6513                 }
6514
6515                 create_options = 0;
6516
6517                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6518                         create_options |= FILE_DIRECTORY_FILE;
6519                 }
6520
6521                 status = SMB_VFS_CREATE_FILE(
6522                         conn,                           /* conn */
6523                         req,                            /* req */
6524                         0,                              /* root_dir_fid */
6525                         smb_fname_src,                  /* fname */
6526                         access_mask,                    /* access_mask */
6527                         (FILE_SHARE_READ |              /* share_access */
6528                             FILE_SHARE_WRITE),
6529                         FILE_OPEN,                      /* create_disposition*/
6530                         create_options,                 /* create_options */
6531                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6532                         0,                              /* oplock_request */
6533                         0,                              /* allocation_size */
6534                         0,                              /* private_flags */
6535                         NULL,                           /* sd */
6536                         NULL,                           /* ea_list */
6537                         &fsp,                           /* result */
6538                         NULL);                          /* pinfo */
6539
6540                 if (!NT_STATUS_IS_OK(status)) {
6541                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6542                                  "returned %s rename %s -> %s\n",
6543                                  nt_errstr(status),
6544                                  smb_fname_str_dbg(smb_fname_src),
6545                                  smb_fname_str_dbg(smb_fname_dst)));
6546                         break;
6547                 }
6548
6549                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6550                                                               dname);
6551                 if (!smb_fname_dst->original_lcomp) {
6552                         status = NT_STATUS_NO_MEMORY;
6553                         goto out;
6554                 }
6555
6556                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6557                                               attrs, replace_if_exists);
6558
6559                 close_file(req, fsp, NORMAL_CLOSE);
6560
6561                 if (!NT_STATUS_IS_OK(status)) {
6562                         DEBUG(3, ("rename_internals_fsp returned %s for "
6563                                   "rename %s -> %s\n", nt_errstr(status),
6564                                   smb_fname_str_dbg(smb_fname_src),
6565                                   smb_fname_str_dbg(smb_fname_dst)));
6566                         break;
6567                 }
6568
6569                 count++;
6570
6571                 DEBUG(3,("rename_internals: doing rename on %s -> "
6572                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6573                          smb_fname_str_dbg(smb_fname_src)));
6574                 TALLOC_FREE(talloced);
6575         }
6576         TALLOC_FREE(dir_hnd);
6577
6578         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6579                 status = map_nt_error_from_unix(errno);
6580         }
6581
6582  out:
6583         TALLOC_FREE(talloced);
6584         TALLOC_FREE(fname_src_dir);
6585         TALLOC_FREE(fname_src_mask);
6586         return status;
6587 }
6588
6589 /****************************************************************************
6590  Reply to a mv.
6591 ****************************************************************************/
6592
6593 void reply_mv(struct smb_request *req)
6594 {
6595         connection_struct *conn = req->conn;
6596         char *name = NULL;
6597         char *newname = NULL;
6598         const char *p;
6599         uint32 attrs;
6600         NTSTATUS status;
6601         bool src_has_wcard = False;
6602         bool dest_has_wcard = False;
6603         TALLOC_CTX *ctx = talloc_tos();
6604         struct smb_filename *smb_fname_src = NULL;
6605         struct smb_filename *smb_fname_dst = NULL;
6606         uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6607         uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6608         bool stream_rename = false;
6609
6610         START_PROFILE(SMBmv);
6611
6612         if (req->wct < 1) {
6613                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6614                 goto out;
6615         }
6616
6617         attrs = SVAL(req->vwv+0, 0);
6618
6619         p = (const char *)req->buf + 1;
6620         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6621                                        &status, &src_has_wcard);
6622         if (!NT_STATUS_IS_OK(status)) {
6623                 reply_nterror(req, status);
6624                 goto out;
6625         }
6626         p++;
6627         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6628                                        &status, &dest_has_wcard);
6629         if (!NT_STATUS_IS_OK(status)) {
6630                 reply_nterror(req, status);
6631                 goto out;
6632         }
6633
6634         if (!lp_posix_pathnames()) {
6635                 /* The newname must begin with a ':' if the
6636                    name contains a ':'. */
6637                 if (strchr_m(name, ':')) {
6638                         if (newname[0] != ':') {
6639                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6640                                 goto out;
6641                         }
6642                         stream_rename = true;
6643                 }
6644         }
6645
6646         status = filename_convert(ctx,
6647                                   conn,
6648                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6649                                   name,
6650                                   src_ucf_flags,
6651                                   &src_has_wcard,
6652                                   &smb_fname_src);
6653
6654         if (!NT_STATUS_IS_OK(status)) {
6655                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6656                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6657                                         ERRSRV, ERRbadpath);
6658                         goto out;
6659                 }
6660                 reply_nterror(req, status);
6661                 goto out;
6662         }
6663
6664         status = filename_convert(ctx,
6665                                   conn,
6666                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6667                                   newname,
6668                                   dst_ucf_flags,
6669                                   &dest_has_wcard,
6670                                   &smb_fname_dst);
6671
6672         if (!NT_STATUS_IS_OK(status)) {
6673                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6674                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6675                                         ERRSRV, ERRbadpath);
6676                         goto out;
6677                 }
6678                 reply_nterror(req, status);
6679                 goto out;
6680         }
6681
6682         if (stream_rename) {
6683                 /* smb_fname_dst->base_name must be the same as
6684                    smb_fname_src->base_name. */
6685                 TALLOC_FREE(smb_fname_dst->base_name);
6686                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6687                                                 smb_fname_src->base_name);
6688                 if (!smb_fname_dst->base_name) {
6689                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6690                         goto out;
6691                 }
6692         }
6693
6694         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6695                  smb_fname_str_dbg(smb_fname_dst)));
6696
6697         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6698                                   attrs, False, src_has_wcard, dest_has_wcard,
6699                                   DELETE_ACCESS);
6700         if (!NT_STATUS_IS_OK(status)) {
6701                 if (open_was_deferred(req->sconn, req->mid)) {
6702                         /* We have re-scheduled this call. */
6703                         goto out;
6704                 }
6705                 reply_nterror(req, status);
6706                 goto out;
6707         }
6708
6709         reply_outbuf(req, 0, 0);
6710  out:
6711         TALLOC_FREE(smb_fname_src);
6712         TALLOC_FREE(smb_fname_dst);
6713         END_PROFILE(SMBmv);
6714         return;
6715 }
6716
6717 /*******************************************************************
6718  Copy a file as part of a reply_copy.
6719 ******************************************************************/
6720
6721 /*
6722  * TODO: check error codes on all callers
6723  */
6724
6725 NTSTATUS copy_file(TALLOC_CTX *ctx,
6726                         connection_struct *conn,
6727                         struct smb_filename *smb_fname_src,
6728                         struct smb_filename *smb_fname_dst,
6729                         int ofun,
6730                         int count,
6731                         bool target_is_directory)
6732 {
6733         struct smb_filename *smb_fname_dst_tmp = NULL;
6734         SMB_OFF_T ret=-1;
6735         files_struct *fsp1,*fsp2;
6736         uint32 dosattrs;
6737         uint32 new_create_disposition;
6738         NTSTATUS status;
6739
6740
6741         status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6742         if (!NT_STATUS_IS_OK(status)) {
6743                 return status;
6744         }
6745
6746         /*
6747          * If the target is a directory, extract the last component from the
6748          * src filename and append it to the dst filename
6749          */
6750         if (target_is_directory) {
6751                 const char *p;
6752
6753                 /* dest/target can't be a stream if it's a directory. */
6754                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6755
6756                 p = strrchr_m(smb_fname_src->base_name,'/');
6757                 if (p) {
6758                         p++;
6759                 } else {
6760                         p = smb_fname_src->base_name;
6761                 }
6762                 smb_fname_dst_tmp->base_name =
6763                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6764                                            p);
6765                 if (!smb_fname_dst_tmp->base_name) {
6766                         status = NT_STATUS_NO_MEMORY;
6767                         goto out;
6768                 }
6769         }
6770
6771         status = vfs_file_exist(conn, smb_fname_src);
6772         if (!NT_STATUS_IS_OK(status)) {
6773                 goto out;
6774         }
6775
6776         if (!target_is_directory && count) {
6777                 new_create_disposition = FILE_OPEN;
6778         } else {
6779                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6780                                                  0, ofun,
6781                                                  NULL, NULL,
6782                                                  &new_create_disposition,
6783                                                  NULL,
6784                                                  NULL)) {
6785                         status = NT_STATUS_INVALID_PARAMETER;
6786                         goto out;
6787                 }
6788         }
6789
6790         /* Open the src file for reading. */
6791         status = SMB_VFS_CREATE_FILE(
6792                 conn,                                   /* conn */
6793                 NULL,                                   /* req */
6794                 0,                                      /* root_dir_fid */
6795                 smb_fname_src,                          /* fname */
6796                 FILE_GENERIC_READ,                      /* access_mask */
6797                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6798                 FILE_OPEN,                              /* create_disposition*/
6799                 0,                                      /* create_options */
6800                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
6801                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6802                 0,                                      /* allocation_size */
6803                 0,                                      /* private_flags */
6804                 NULL,                                   /* sd */
6805                 NULL,                                   /* ea_list */
6806                 &fsp1,                                  /* result */
6807                 NULL);                                  /* psbuf */
6808
6809         if (!NT_STATUS_IS_OK(status)) {
6810                 goto out;
6811         }
6812
6813         dosattrs = dos_mode(conn, smb_fname_src);
6814
6815         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6816                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6817         }
6818
6819         /* Open the dst file for writing. */
6820         status = SMB_VFS_CREATE_FILE(
6821                 conn,                                   /* conn */
6822                 NULL,                                   /* req */
6823                 0,                                      /* root_dir_fid */
6824                 smb_fname_dst,                          /* fname */
6825                 FILE_GENERIC_WRITE,                     /* access_mask */
6826                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6827                 new_create_disposition,                 /* create_disposition*/
6828                 0,                                      /* create_options */
6829                 dosattrs,                               /* file_attributes */
6830                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6831                 0,                                      /* allocation_size */
6832                 0,                                      /* private_flags */
6833                 NULL,                                   /* sd */
6834                 NULL,                                   /* ea_list */
6835                 &fsp2,                                  /* result */
6836                 NULL);                                  /* psbuf */
6837
6838         if (!NT_STATUS_IS_OK(status)) {
6839                 close_file(NULL, fsp1, ERROR_CLOSE);
6840                 goto out;
6841         }
6842
6843         if (ofun & OPENX_FILE_EXISTS_OPEN) {
6844                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6845                 if (ret == -1) {
6846                         DEBUG(0, ("error - vfs lseek returned error %s\n",
6847                                 strerror(errno)));
6848                         status = map_nt_error_from_unix(errno);
6849                         close_file(NULL, fsp1, ERROR_CLOSE);
6850                         close_file(NULL, fsp2, ERROR_CLOSE);
6851                         goto out;
6852                 }
6853         }
6854
6855         /* Do the actual copy. */
6856         if (smb_fname_src->st.st_ex_size) {
6857                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6858         } else {
6859                 ret = 0;
6860         }
6861
6862         close_file(NULL, fsp1, NORMAL_CLOSE);
6863
6864         /* Ensure the modtime is set correctly on the destination file. */
6865         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6866
6867         /*
6868          * As we are opening fsp1 read-only we only expect
6869          * an error on close on fsp2 if we are out of space.
6870          * Thus we don't look at the error return from the
6871          * close of fsp1.
6872          */
6873         status = close_file(NULL, fsp2, NORMAL_CLOSE);
6874
6875         if (!NT_STATUS_IS_OK(status)) {
6876                 goto out;
6877         }
6878
6879         if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6880                 status = NT_STATUS_DISK_FULL;
6881                 goto out;
6882         }
6883
6884         status = NT_STATUS_OK;
6885
6886  out:
6887         TALLOC_FREE(smb_fname_dst_tmp);
6888         return status;
6889 }
6890
6891 /****************************************************************************
6892  Reply to a file copy.
6893 ****************************************************************************/
6894
6895 void reply_copy(struct smb_request *req)
6896 {
6897         connection_struct *conn = req->conn;
6898         struct smb_filename *smb_fname_src = NULL;
6899         struct smb_filename *smb_fname_dst = NULL;
6900         char *fname_src = NULL;
6901         char *fname_dst = NULL;
6902         char *fname_src_mask = NULL;
6903         char *fname_src_dir = NULL;
6904         const char *p;
6905         int count=0;
6906         int error = ERRnoaccess;
6907         int tid2;
6908         int ofun;
6909         int flags;
6910         bool target_is_directory=False;
6911         bool source_has_wild = False;
6912         bool dest_has_wild = False;
6913         NTSTATUS status;
6914         TALLOC_CTX *ctx = talloc_tos();
6915
6916         START_PROFILE(SMBcopy);
6917
6918         if (req->wct < 3) {
6919                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6920                 goto out;
6921         }
6922
6923         tid2 = SVAL(req->vwv+0, 0);
6924         ofun = SVAL(req->vwv+1, 0);
6925         flags = SVAL(req->vwv+2, 0);
6926
6927         p = (const char *)req->buf;
6928         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6929                                        &status, &source_has_wild);
6930         if (!NT_STATUS_IS_OK(status)) {
6931                 reply_nterror(req, status);
6932                 goto out;
6933         }
6934         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6935                                        &status, &dest_has_wild);
6936         if (!NT_STATUS_IS_OK(status)) {
6937                 reply_nterror(req, status);
6938                 goto out;
6939         }
6940
6941         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6942
6943         if (tid2 != conn->cnum) {
6944                 /* can't currently handle inter share copies XXXX */
6945                 DEBUG(3,("Rejecting inter-share copy\n"));
6946                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6947                 goto out;
6948         }
6949
6950         status = filename_convert(ctx, conn,
6951                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6952                                   fname_src,
6953                                   UCF_COND_ALLOW_WCARD_LCOMP,
6954                                   &source_has_wild,
6955                                   &smb_fname_src);
6956         if (!NT_STATUS_IS_OK(status)) {
6957                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6958                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6959                                         ERRSRV, ERRbadpath);
6960                         goto out;
6961                 }
6962                 reply_nterror(req, status);
6963                 goto out;
6964         }
6965
6966         status = filename_convert(ctx, conn,
6967                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6968                                   fname_dst,
6969                                   UCF_COND_ALLOW_WCARD_LCOMP,
6970                                   &dest_has_wild,
6971                                   &smb_fname_dst);
6972         if (!NT_STATUS_IS_OK(status)) {
6973                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6974                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6975                                         ERRSRV, ERRbadpath);
6976                         goto out;
6977                 }
6978                 reply_nterror(req, status);
6979                 goto out;
6980         }
6981
6982         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6983
6984         if ((flags&1) && target_is_directory) {
6985                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6986                 goto out;
6987         }
6988
6989         if ((flags&2) && !target_is_directory) {
6990                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6991                 goto out;
6992         }
6993
6994         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6995                 /* wants a tree copy! XXXX */
6996                 DEBUG(3,("Rejecting tree copy\n"));
6997                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6998                 goto out;
6999         }
7000
7001         /* Split up the directory from the filename/mask. */
7002         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7003                                       &fname_src_dir, &fname_src_mask);
7004         if (!NT_STATUS_IS_OK(status)) {
7005                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7006                 goto out;
7007         }
7008
7009         /*
7010          * We should only check the mangled cache
7011          * here if unix_convert failed. This means
7012          * that the path in 'mask' doesn't exist
7013          * on the file system and so we need to look
7014          * for a possible mangle. This patch from
7015          * Tine Smukavec <valentin.smukavec@hermes.si>.
7016          */
7017         if (!VALID_STAT(smb_fname_src->st) &&
7018             mangle_is_mangled(fname_src_mask, conn->params)) {
7019                 char *new_mask = NULL;
7020                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7021                                             &new_mask, conn->params);
7022
7023                 /* Use demangled name if one was successfully found. */
7024                 if (new_mask) {
7025                         TALLOC_FREE(fname_src_mask);
7026                         fname_src_mask = new_mask;
7027                 }
7028         }
7029
7030         if (!source_has_wild) {
7031
7032                 /*
7033                  * Only one file needs to be copied. Append the mask back onto
7034                  * the directory.
7035                  */
7036                 TALLOC_FREE(smb_fname_src->base_name);
7037                 if (ISDOT(fname_src_dir)) {
7038                         /* Ensure we use canonical names on open. */
7039                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7040                                                         "%s",
7041                                                         fname_src_mask);
7042                 } else {
7043                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7044                                                         "%s/%s",
7045                                                         fname_src_dir,
7046                                                         fname_src_mask);
7047                 }
7048                 if (!smb_fname_src->base_name) {
7049                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7050                         goto out;
7051                 }
7052
7053                 if (dest_has_wild) {
7054                         char *fname_dst_mod = NULL;
7055                         if (!resolve_wildcards(smb_fname_dst,
7056                                                smb_fname_src->base_name,
7057                                                smb_fname_dst->base_name,
7058                                                &fname_dst_mod)) {
7059                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7060                                 goto out;
7061                         }
7062                         TALLOC_FREE(smb_fname_dst->base_name);
7063                         smb_fname_dst->base_name = fname_dst_mod;
7064                 }
7065
7066                 status = check_name(conn, smb_fname_src->base_name);
7067                 if (!NT_STATUS_IS_OK(status)) {
7068                         reply_nterror(req, status);
7069                         goto out;
7070                 }
7071
7072                 status = check_name(conn, smb_fname_dst->base_name);
7073                 if (!NT_STATUS_IS_OK(status)) {
7074                         reply_nterror(req, status);
7075                         goto out;
7076                 }
7077
7078                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7079                                    ofun, count, target_is_directory);
7080
7081                 if(!NT_STATUS_IS_OK(status)) {
7082                         reply_nterror(req, status);
7083                         goto out;
7084                 } else {
7085                         count++;
7086                 }
7087         } else {
7088                 struct smb_Dir *dir_hnd = NULL;
7089                 const char *dname = NULL;
7090                 char *talloced = NULL;
7091                 long offset = 0;
7092
7093                 /*
7094                  * There is a wildcard that requires us to actually read the
7095                  * src dir and copy each file matching the mask to the dst.
7096                  * Right now streams won't be copied, but this could
7097                  * presumably be added with a nested loop for reach dir entry.
7098                  */
7099                 SMB_ASSERT(!smb_fname_src->stream_name);
7100                 SMB_ASSERT(!smb_fname_dst->stream_name);
7101
7102                 smb_fname_src->stream_name = NULL;
7103                 smb_fname_dst->stream_name = NULL;
7104
7105                 if (strequal(fname_src_mask,"????????.???")) {
7106                         TALLOC_FREE(fname_src_mask);
7107                         fname_src_mask = talloc_strdup(ctx, "*");
7108                         if (!fname_src_mask) {
7109                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7110                                 goto out;
7111                         }
7112                 }
7113
7114                 status = check_name(conn, fname_src_dir);
7115                 if (!NT_STATUS_IS_OK(status)) {
7116                         reply_nterror(req, status);
7117                         goto out;
7118                 }
7119
7120                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7121                 if (dir_hnd == NULL) {
7122                         status = map_nt_error_from_unix(errno);
7123                         reply_nterror(req, status);
7124                         goto out;
7125                 }
7126
7127                 error = ERRbadfile;
7128
7129                 /* Iterate over the src dir copying each entry to the dst. */
7130                 while ((dname = ReadDirName(dir_hnd, &offset,
7131                                             &smb_fname_src->st, &talloced))) {
7132                         char *destname = NULL;
7133
7134                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7135                                 TALLOC_FREE(talloced);
7136                                 continue;
7137                         }
7138
7139                         if (!is_visible_file(conn, fname_src_dir, dname,
7140                                              &smb_fname_src->st, false)) {
7141                                 TALLOC_FREE(talloced);
7142                                 continue;
7143                         }
7144
7145                         if(!mask_match(dname, fname_src_mask,
7146                                        conn->case_sensitive)) {
7147                                 TALLOC_FREE(talloced);
7148                                 continue;
7149                         }
7150
7151                         error = ERRnoaccess;
7152
7153                         /* Get the src smb_fname struct setup. */
7154                         TALLOC_FREE(smb_fname_src->base_name);
7155                         if (ISDOT(fname_src_dir)) {
7156                                 /* Ensure we use canonical names on open. */
7157                                 smb_fname_src->base_name =
7158                                         talloc_asprintf(smb_fname_src, "%s",
7159                                                 dname);
7160                         } else {
7161                                 smb_fname_src->base_name =
7162                                         talloc_asprintf(smb_fname_src, "%s/%s",
7163                                                 fname_src_dir, dname);
7164                         }
7165
7166                         if (!smb_fname_src->base_name) {
7167                                 TALLOC_FREE(dir_hnd);
7168                                 TALLOC_FREE(talloced);
7169                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7170                                 goto out;
7171                         }
7172
7173                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7174                                                smb_fname_dst->base_name,
7175                                                &destname)) {
7176                                 TALLOC_FREE(talloced);
7177                                 continue;
7178                         }
7179                         if (!destname) {
7180                                 TALLOC_FREE(dir_hnd);
7181                                 TALLOC_FREE(talloced);
7182                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7183                                 goto out;
7184                         }
7185
7186                         TALLOC_FREE(smb_fname_dst->base_name);
7187                         smb_fname_dst->base_name = destname;
7188
7189                         status = check_name(conn, smb_fname_src->base_name);
7190                         if (!NT_STATUS_IS_OK(status)) {
7191                                 TALLOC_FREE(dir_hnd);
7192                                 TALLOC_FREE(talloced);
7193                                 reply_nterror(req, status);
7194                                 goto out;
7195                         }
7196
7197                         status = check_name(conn, smb_fname_dst->base_name);
7198                         if (!NT_STATUS_IS_OK(status)) {
7199                                 TALLOC_FREE(dir_hnd);
7200                                 TALLOC_FREE(talloced);
7201                                 reply_nterror(req, status);
7202                                 goto out;
7203                         }
7204
7205                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7206                                 smb_fname_src->base_name,
7207                                 smb_fname_dst->base_name));
7208
7209                         status = copy_file(ctx, conn, smb_fname_src,
7210                                            smb_fname_dst, ofun, count,
7211                                            target_is_directory);
7212                         if (NT_STATUS_IS_OK(status)) {
7213                                 count++;
7214                         }
7215
7216                         TALLOC_FREE(talloced);
7217                 }
7218                 TALLOC_FREE(dir_hnd);
7219         }
7220
7221         if (count == 0) {
7222                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7223                 goto out;
7224         }
7225
7226         reply_outbuf(req, 1, 0);
7227         SSVAL(req->outbuf,smb_vwv0,count);
7228  out:
7229         TALLOC_FREE(smb_fname_src);
7230         TALLOC_FREE(smb_fname_dst);
7231         TALLOC_FREE(fname_src);
7232         TALLOC_FREE(fname_dst);
7233         TALLOC_FREE(fname_src_mask);
7234         TALLOC_FREE(fname_src_dir);
7235
7236         END_PROFILE(SMBcopy);
7237         return;
7238 }
7239
7240 #undef DBGC_CLASS
7241 #define DBGC_CLASS DBGC_LOCKING
7242
7243 /****************************************************************************
7244  Get a lock pid, dealing with large count requests.
7245 ****************************************************************************/
7246
7247 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7248                     bool large_file_format)
7249 {
7250         if(!large_file_format)
7251                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7252         else
7253                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7254 }
7255
7256 /****************************************************************************
7257  Get a lock count, dealing with large count requests.
7258 ****************************************************************************/
7259
7260 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7261                         bool large_file_format)
7262 {
7263         uint64_t count = 0;
7264
7265         if(!large_file_format) {
7266                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7267         } else {
7268
7269 #if defined(HAVE_LONGLONG)
7270                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7271                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7272 #else /* HAVE_LONGLONG */
7273
7274                 /*
7275                  * NT4.x seems to be broken in that it sends large file (64 bit)
7276                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7277                  * negotiated. For boxes without large unsigned ints truncate the
7278                  * lock count by dropping the top 32 bits.
7279                  */
7280
7281                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7282                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7283                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7284                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7285                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7286                 }
7287
7288                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7289 #endif /* HAVE_LONGLONG */
7290         }
7291
7292         return count;
7293 }
7294
7295 #if !defined(HAVE_LONGLONG)
7296 /****************************************************************************
7297  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7298 ****************************************************************************/
7299
7300 static uint32 map_lock_offset(uint32 high, uint32 low)
7301 {
7302         unsigned int i;
7303         uint32 mask = 0;
7304         uint32 highcopy = high;
7305
7306         /*
7307          * Try and find out how many significant bits there are in high.
7308          */
7309
7310         for(i = 0; highcopy; i++)
7311                 highcopy >>= 1;
7312
7313         /*
7314          * We use 31 bits not 32 here as POSIX
7315          * lock offsets may not be negative.
7316          */
7317
7318         mask = (~0) << (31 - i);
7319
7320         if(low & mask)
7321                 return 0; /* Fail. */
7322
7323         high <<= (31 - i);
7324
7325         return (high|low);
7326 }
7327 #endif /* !defined(HAVE_LONGLONG) */
7328
7329 /****************************************************************************
7330  Get a lock offset, dealing with large offset requests.
7331 ****************************************************************************/
7332
7333 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7334                          bool large_file_format, bool *err)
7335 {
7336         uint64_t offset = 0;
7337
7338         *err = False;
7339
7340         if(!large_file_format) {
7341                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7342         } else {
7343
7344 #if defined(HAVE_LONGLONG)
7345                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7346                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7347 #else /* HAVE_LONGLONG */
7348
7349                 /*
7350                  * NT4.x seems to be broken in that it sends large file (64 bit)
7351                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7352                  * negotiated. For boxes without large unsigned ints mangle the
7353                  * lock offset by mapping the top 32 bits onto the lower 32.
7354                  */
7355
7356                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7357                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7358                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7359                         uint32 new_low = 0;
7360
7361                         if((new_low = map_lock_offset(high, low)) == 0) {
7362                                 *err = True;
7363                                 return (uint64_t)-1;
7364                         }
7365
7366                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7367                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7368                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7369                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7370                 }
7371
7372                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7373 #endif /* HAVE_LONGLONG */
7374         }
7375
7376         return offset;
7377 }
7378
7379 NTSTATUS smbd_do_locking(struct smb_request *req,
7380                          files_struct *fsp,
7381                          uint8_t type,
7382                          int32_t timeout,
7383                          uint16_t num_ulocks,
7384                          struct smbd_lock_element *ulocks,
7385                          uint16_t num_locks,
7386                          struct smbd_lock_element *locks,
7387                          bool *async)
7388 {
7389         connection_struct *conn = req->conn;
7390         int i;
7391         NTSTATUS status = NT_STATUS_OK;
7392
7393         *async = false;
7394
7395         /* Data now points at the beginning of the list
7396            of smb_unlkrng structs */
7397         for(i = 0; i < (int)num_ulocks; i++) {
7398                 struct smbd_lock_element *e = &ulocks[i];
7399
7400                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7401                           "pid %u, file %s\n",
7402                           (double)e->offset,
7403                           (double)e->count,
7404                           (unsigned int)e->smblctx,
7405                           fsp_str_dbg(fsp)));
7406
7407                 if (e->brltype != UNLOCK_LOCK) {
7408                         /* this can only happen with SMB2 */
7409                         return NT_STATUS_INVALID_PARAMETER;
7410                 }
7411
7412                 status = do_unlock(req->sconn->msg_ctx,
7413                                 fsp,
7414                                 e->smblctx,
7415                                 e->count,
7416                                 e->offset,
7417                                 WINDOWS_LOCK);
7418
7419                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7420                     nt_errstr(status)));
7421
7422                 if (!NT_STATUS_IS_OK(status)) {
7423                         return status;
7424                 }
7425         }
7426
7427         /* Setup the timeout in seconds. */
7428
7429         if (!lp_blocking_locks(SNUM(conn))) {
7430                 timeout = 0;
7431         }
7432
7433         /* Data now points at the beginning of the list
7434            of smb_lkrng structs */
7435
7436         for(i = 0; i < (int)num_locks; i++) {
7437                 struct smbd_lock_element *e = &locks[i];
7438
7439                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7440                           "%llu, file %s timeout = %d\n",
7441                           (double)e->offset,
7442                           (double)e->count,
7443                           (unsigned long long)e->smblctx,
7444                           fsp_str_dbg(fsp),
7445                           (int)timeout));
7446
7447                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7448                         struct blocking_lock_record *blr = NULL;
7449
7450                         if (num_locks > 1) {
7451                                 /*
7452                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7453                                  * if the lock vector contains one entry. When given mutliple cancel
7454                                  * requests in a single PDU we expect the server to return an
7455                                  * error. Windows servers seem to accept the request but only
7456                                  * cancel the first lock.
7457                                  * JRA - Do what Windows does (tm) :-).
7458                                  */
7459
7460 #if 0
7461                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7462                                 return NT_STATUS_DOS(ERRDOS,
7463                                                 ERRcancelviolation);
7464 #else
7465                                 /* Windows behavior. */
7466                                 if (i != 0) {
7467                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7468                                                 "cancel request\n"));
7469                                         continue;
7470                                 }
7471 #endif
7472                         }
7473
7474                         if (lp_blocking_locks(SNUM(conn))) {
7475
7476                                 /* Schedule a message to ourselves to
7477                                    remove the blocking lock record and
7478                                    return the right error. */
7479
7480                                 blr = blocking_lock_cancel_smb1(fsp,
7481                                                 e->smblctx,
7482                                                 e->offset,
7483                                                 e->count,
7484                                                 WINDOWS_LOCK,
7485                                                 type,
7486                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7487                                 if (blr == NULL) {
7488                                         return NT_STATUS_DOS(
7489                                                         ERRDOS,
7490                                                         ERRcancelviolation);
7491                                 }
7492                         }
7493                         /* Remove a matching pending lock. */
7494                         status = do_lock_cancel(fsp,
7495                                                 e->smblctx,
7496                                                 e->count,
7497                                                 e->offset,
7498                                                 WINDOWS_LOCK,
7499                                                 blr);
7500                 } else {
7501                         bool blocking_lock = timeout ? true : false;
7502                         bool defer_lock = false;
7503                         struct byte_range_lock *br_lck;
7504                         uint64_t block_smblctx;
7505
7506                         br_lck = do_lock(req->sconn->msg_ctx,
7507                                         fsp,
7508                                         e->smblctx,
7509                                         e->count,
7510                                         e->offset,
7511                                         e->brltype,
7512                                         WINDOWS_LOCK,
7513                                         blocking_lock,
7514                                         &status,
7515                                         &block_smblctx,
7516                                         NULL);
7517
7518                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7519                                 /* Windows internal resolution for blocking locks seems
7520                                    to be about 200ms... Don't wait for less than that. JRA. */
7521                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7522                                         timeout = lp_lock_spin_time();
7523                                 }
7524                                 defer_lock = true;
7525                         }
7526
7527                         /* If a lock sent with timeout of zero would fail, and
7528                          * this lock has been requested multiple times,
7529                          * according to brl_lock_failed() we convert this
7530                          * request to a blocking lock with a timeout of between
7531                          * 150 - 300 milliseconds.
7532                          *
7533                          * If lp_lock_spin_time() has been set to 0, we skip
7534                          * this blocking retry and fail immediately.
7535                          *
7536                          * Replacement for do_lock_spin(). JRA. */
7537
7538                         if (!req->sconn->using_smb2 &&
7539                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7540                             lp_lock_spin_time() && !blocking_lock &&
7541                             NT_STATUS_EQUAL((status),
7542                                 NT_STATUS_FILE_LOCK_CONFLICT))
7543                         {
7544                                 defer_lock = true;
7545                                 timeout = lp_lock_spin_time();
7546                         }
7547
7548                         if (br_lck && defer_lock) {
7549                                 /*
7550                                  * A blocking lock was requested. Package up
7551                                  * this smb into a queued request and push it
7552                                  * onto the blocking lock queue.
7553                                  */
7554                                 if(push_blocking_lock_request(br_lck,
7555                                                         req,
7556                                                         fsp,
7557                                                         timeout,
7558                                                         i,
7559                                                         e->smblctx,
7560                                                         e->brltype,
7561                                                         WINDOWS_LOCK,
7562                                                         e->offset,
7563                                                         e->count,
7564                                                         block_smblctx)) {
7565                                         TALLOC_FREE(br_lck);
7566                                         *async = true;
7567                                         return NT_STATUS_OK;
7568                                 }
7569                         }
7570
7571                         TALLOC_FREE(br_lck);
7572                 }
7573
7574                 if (!NT_STATUS_IS_OK(status)) {
7575                         break;
7576                 }
7577         }
7578
7579         /* If any of the above locks failed, then we must unlock
7580            all of the previous locks (X/Open spec). */
7581
7582         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7583
7584                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7585                         i = -1; /* we want to skip the for loop */
7586                 }
7587
7588                 /*
7589                  * Ensure we don't do a remove on the lock that just failed,
7590                  * as under POSIX rules, if we have a lock already there, we
7591                  * will delete it (and we shouldn't) .....
7592                  */
7593                 for(i--; i >= 0; i--) {
7594                         struct smbd_lock_element *e = &locks[i];
7595
7596                         do_unlock(req->sconn->msg_ctx,
7597                                 fsp,
7598                                 e->smblctx,
7599                                 e->count,
7600                                 e->offset,
7601                                 WINDOWS_LOCK);
7602                 }
7603                 return status;
7604         }
7605
7606         DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7607                   fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7608
7609         return NT_STATUS_OK;
7610 }
7611
7612 /****************************************************************************
7613  Reply to a lockingX request.
7614 ****************************************************************************/
7615
7616 void reply_lockingX(struct smb_request *req)
7617 {
7618         connection_struct *conn = req->conn;
7619         files_struct *fsp;
7620         unsigned char locktype;
7621         unsigned char oplocklevel;
7622         uint16 num_ulocks;
7623         uint16 num_locks;
7624         int32 lock_timeout;
7625         int i;
7626         const uint8_t *data;
7627         bool large_file_format;
7628         bool err;
7629         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7630         struct smbd_lock_element *ulocks;
7631         struct smbd_lock_element *locks;
7632         bool async = false;
7633
7634         START_PROFILE(SMBlockingX);
7635
7636         if (req->wct < 8) {
7637                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7638                 END_PROFILE(SMBlockingX);
7639                 return;
7640         }
7641
7642         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7643         locktype = CVAL(req->vwv+3, 0);
7644         oplocklevel = CVAL(req->vwv+3, 1);
7645         num_ulocks = SVAL(req->vwv+6, 0);
7646         num_locks = SVAL(req->vwv+7, 0);
7647         lock_timeout = IVAL(req->vwv+4, 0);
7648         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7649
7650         if (!check_fsp(conn, req, fsp)) {
7651                 END_PROFILE(SMBlockingX);
7652                 return;
7653         }
7654
7655         data = req->buf;
7656
7657         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7658                 /* we don't support these - and CANCEL_LOCK makes w2k
7659                    and XP reboot so I don't really want to be
7660                    compatible! (tridge) */
7661                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7662                 END_PROFILE(SMBlockingX);
7663                 return;
7664         }
7665
7666         /* Check if this is an oplock break on a file
7667            we have granted an oplock on.
7668         */
7669         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7670                 /* Client can insist on breaking to none. */
7671                 bool break_to_none = (oplocklevel == 0);
7672                 bool result;
7673
7674                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7675                          "for fnum = %d\n", (unsigned int)oplocklevel,
7676                          fsp->fnum ));
7677
7678                 /*
7679                  * Make sure we have granted an exclusive or batch oplock on
7680                  * this file.
7681                  */
7682
7683                 if (fsp->oplock_type == 0) {
7684
7685                         /* The Samba4 nbench simulator doesn't understand
7686                            the difference between break to level2 and break
7687                            to none from level2 - it sends oplock break
7688                            replies in both cases. Don't keep logging an error
7689                            message here - just ignore it. JRA. */
7690
7691                         DEBUG(5,("reply_lockingX: Error : oplock break from "
7692                                  "client for fnum = %d (oplock=%d) and no "
7693                                  "oplock granted on this file (%s).\n",
7694                                  fsp->fnum, fsp->oplock_type,
7695                                  fsp_str_dbg(fsp)));
7696
7697                         /* if this is a pure oplock break request then don't
7698                          * send a reply */
7699                         if (num_locks == 0 && num_ulocks == 0) {
7700                                 END_PROFILE(SMBlockingX);
7701                                 return;
7702                         } else {
7703                                 END_PROFILE(SMBlockingX);
7704                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7705                                 return;
7706                         }
7707                 }
7708
7709                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7710                     (break_to_none)) {
7711                         result = remove_oplock(fsp);
7712                 } else {
7713                         result = downgrade_oplock(fsp);
7714                 }
7715
7716                 if (!result) {
7717                         DEBUG(0, ("reply_lockingX: error in removing "
7718                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
7719                         /* Hmmm. Is this panic justified? */
7720                         smb_panic("internal tdb error");
7721                 }
7722
7723                 reply_to_oplock_break_requests(fsp);
7724
7725                 /* if this is a pure oplock break request then don't send a
7726                  * reply */
7727                 if (num_locks == 0 && num_ulocks == 0) {
7728                         /* Sanity check - ensure a pure oplock break is not a
7729                            chained request. */
7730                         if(CVAL(req->vwv+0, 0) != 0xff)
7731                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
7732                                          "break is a chained %d request !\n",
7733                                          (unsigned int)CVAL(req->vwv+0, 0)));
7734                         END_PROFILE(SMBlockingX);
7735                         return;
7736                 }
7737         }
7738
7739         if (req->buflen <
7740             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7741                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7742                 END_PROFILE(SMBlockingX);
7743                 return;
7744         }
7745
7746         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7747         if (ulocks == NULL) {
7748                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7749                 END_PROFILE(SMBlockingX);
7750                 return;
7751         }
7752
7753         locks = talloc_array(req, struct smbd_lock_element, num_locks);
7754         if (locks == NULL) {
7755                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7756                 END_PROFILE(SMBlockingX);
7757                 return;
7758         }
7759
7760         /* Data now points at the beginning of the list
7761            of smb_unlkrng structs */
7762         for(i = 0; i < (int)num_ulocks; i++) {
7763                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7764                 ulocks[i].count = get_lock_count(data, i, large_file_format);
7765                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7766                 ulocks[i].brltype = UNLOCK_LOCK;
7767
7768                 /*
7769                  * There is no error code marked "stupid client bug".... :-).
7770                  */
7771                 if(err) {
7772                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7773                         END_PROFILE(SMBlockingX);
7774                         return;
7775                 }
7776         }
7777
7778         /* Now do any requested locks */
7779         data += ((large_file_format ? 20 : 10)*num_ulocks);
7780
7781         /* Data now points at the beginning of the list
7782            of smb_lkrng structs */
7783
7784         for(i = 0; i < (int)num_locks; i++) {
7785                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7786                 locks[i].count = get_lock_count(data, i, large_file_format);
7787                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7788
7789                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7790                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7791                                 locks[i].brltype = PENDING_READ_LOCK;
7792                         } else {
7793                                 locks[i].brltype = READ_LOCK;
7794                         }
7795                 } else {
7796                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7797                                 locks[i].brltype = PENDING_WRITE_LOCK;
7798                         } else {
7799                                 locks[i].brltype = WRITE_LOCK;
7800                         }
7801                 }
7802
7803                 /*
7804                  * There is no error code marked "stupid client bug".... :-).
7805                  */
7806                 if(err) {
7807                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7808                         END_PROFILE(SMBlockingX);
7809                         return;
7810                 }
7811         }
7812
7813         status = smbd_do_locking(req, fsp,
7814                                  locktype, lock_timeout,
7815                                  num_ulocks, ulocks,
7816                                  num_locks, locks,
7817                                  &async);
7818         if (!NT_STATUS_IS_OK(status)) {
7819                 END_PROFILE(SMBlockingX);
7820                 reply_nterror(req, status);
7821                 return;
7822         }
7823         if (async) {
7824                 END_PROFILE(SMBlockingX);
7825                 return;
7826         }
7827
7828         reply_outbuf(req, 2, 0);
7829
7830         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7831                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7832
7833         END_PROFILE(SMBlockingX);
7834         chain_reply(req);
7835 }
7836
7837 #undef DBGC_CLASS
7838 #define DBGC_CLASS DBGC_ALL
7839
7840 /****************************************************************************
7841  Reply to a SMBreadbmpx (read block multiplex) request.
7842  Always reply with an error, if someone has a platform really needs this,
7843  please contact vl@samba.org
7844 ****************************************************************************/
7845
7846 void reply_readbmpx(struct smb_request *req)
7847 {
7848         START_PROFILE(SMBreadBmpx);
7849         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7850         END_PROFILE(SMBreadBmpx);
7851         return;
7852 }
7853
7854 /****************************************************************************
7855  Reply to a SMBreadbs (read block multiplex secondary) request.
7856  Always reply with an error, if someone has a platform really needs this,
7857  please contact vl@samba.org
7858 ****************************************************************************/
7859
7860 void reply_readbs(struct smb_request *req)
7861 {
7862         START_PROFILE(SMBreadBs);
7863         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7864         END_PROFILE(SMBreadBs);
7865         return;
7866 }
7867
7868 /****************************************************************************
7869  Reply to a SMBsetattrE.
7870 ****************************************************************************/
7871
7872 void reply_setattrE(struct smb_request *req)
7873 {
7874         connection_struct *conn = req->conn;
7875         struct smb_file_time ft;
7876         files_struct *fsp;
7877         NTSTATUS status;
7878
7879         START_PROFILE(SMBsetattrE);
7880         ZERO_STRUCT(ft);
7881
7882         if (req->wct < 7) {
7883                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7884                 goto out;
7885         }
7886
7887         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7888
7889         if(!fsp || (fsp->conn != conn)) {
7890                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7891                 goto out;
7892         }
7893
7894         /*
7895          * Convert the DOS times into unix times.
7896          */
7897
7898         ft.atime = convert_time_t_to_timespec(
7899             srv_make_unix_date2(req->vwv+3));
7900         ft.mtime = convert_time_t_to_timespec(
7901             srv_make_unix_date2(req->vwv+5));
7902         ft.create_time = convert_time_t_to_timespec(
7903             srv_make_unix_date2(req->vwv+1));
7904
7905         reply_outbuf(req, 0, 0);
7906
7907         /*
7908          * Patch from Ray Frush <frush@engr.colostate.edu>
7909          * Sometimes times are sent as zero - ignore them.
7910          */
7911
7912         /* Ensure we have a valid stat struct for the source. */
7913         status = vfs_stat_fsp(fsp);
7914         if (!NT_STATUS_IS_OK(status)) {
7915                 reply_nterror(req, status);
7916                 goto out;
7917         }
7918
7919         if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
7920                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7921                 goto out;
7922         }
7923
7924         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7925         if (!NT_STATUS_IS_OK(status)) {
7926                 reply_nterror(req, status);
7927                 goto out;
7928         }
7929
7930         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7931                " createtime=%u\n",
7932                 fsp->fnum,
7933                 (unsigned int)ft.atime.tv_sec,
7934                 (unsigned int)ft.mtime.tv_sec,
7935                 (unsigned int)ft.create_time.tv_sec
7936                 ));
7937  out:
7938         END_PROFILE(SMBsetattrE);
7939         return;
7940 }
7941
7942
7943 /* Back from the dead for OS/2..... JRA. */
7944
7945 /****************************************************************************
7946  Reply to a SMBwritebmpx (write block multiplex primary) request.
7947  Always reply with an error, if someone has a platform really needs this,
7948  please contact vl@samba.org
7949 ****************************************************************************/
7950
7951 void reply_writebmpx(struct smb_request *req)
7952 {
7953         START_PROFILE(SMBwriteBmpx);
7954         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7955         END_PROFILE(SMBwriteBmpx);
7956         return;
7957 }
7958
7959 /****************************************************************************
7960  Reply to a SMBwritebs (write block multiplex secondary) request.
7961  Always reply with an error, if someone has a platform really needs this,
7962  please contact vl@samba.org
7963 ****************************************************************************/
7964
7965 void reply_writebs(struct smb_request *req)
7966 {
7967         START_PROFILE(SMBwriteBs);
7968         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7969         END_PROFILE(SMBwriteBs);
7970         return;
7971 }
7972
7973 /****************************************************************************
7974  Reply to a SMBgetattrE.
7975 ****************************************************************************/
7976
7977 void reply_getattrE(struct smb_request *req)
7978 {
7979         connection_struct *conn = req->conn;
7980         int mode;
7981         files_struct *fsp;
7982         struct timespec create_ts;
7983
7984         START_PROFILE(SMBgetattrE);
7985
7986         if (req->wct < 1) {
7987                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7988                 END_PROFILE(SMBgetattrE);
7989                 return;
7990         }
7991
7992         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7993
7994         if(!fsp || (fsp->conn != conn)) {
7995                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7996                 END_PROFILE(SMBgetattrE);
7997                 return;
7998         }
7999
8000         /* Do an fstat on this file */
8001         if(fsp_stat(fsp)) {
8002                 reply_nterror(req, map_nt_error_from_unix(errno));
8003                 END_PROFILE(SMBgetattrE);
8004                 return;
8005         }
8006
8007         mode = dos_mode(conn, fsp->fsp_name);
8008
8009         /*
8010          * Convert the times into dos times. Set create
8011          * date to be last modify date as UNIX doesn't save
8012          * this.
8013          */
8014
8015         reply_outbuf(req, 11, 0);
8016
8017         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8018         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8019         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8020                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8021         /* Should we check pending modtime here ? JRA */
8022         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8023                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8024
8025         if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8026                 SIVAL(req->outbuf, smb_vwv6, 0);
8027                 SIVAL(req->outbuf, smb_vwv8, 0);
8028         } else {
8029                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8030                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8031                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8032         }
8033         SSVAL(req->outbuf,smb_vwv10, mode);
8034
8035         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
8036
8037         END_PROFILE(SMBgetattrE);
8038         return;
8039 }