source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  35 #include "../librpc/gen_ndr/open_files.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "rpc_server/rpc_ncacn_np.h"
  39 #include "libcli/security/security.h"
  40 #include "libsmb/nmblib.h"
  41 #include "auth.h"
  42 #include "smbprofile.h"
  43 #include "../lib/tsocket/tsocket.h"
  44
  45 /****************************************************************************
  46  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  47  path or anything including wildcards.
  48  We're assuming here that '/' is not the second byte in any multibyte char
  49  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  50  set.
  51 ****************************************************************************/
  52
  53 /* Custom version for processing POSIX paths. */
  54 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  55
  56 static NTSTATUS check_path_syntax_internal(char *path,
  57                                            bool posix_path,
  58                                            bool *p_last_component_contains_wcard)
  59 {
  60         char *d = path;
  61         const char *s = path;
  62         NTSTATUS ret = NT_STATUS_OK;
  63         bool start_of_name_component = True;
  64         bool stream_started = false;
  65
  66         *p_last_component_contains_wcard = False;
  67
  68         while (*s) {
  69                 if (stream_started) {
  70                         switch (*s) {
  71                         case '/':
  72                         case '\\':
  73                                 return NT_STATUS_OBJECT_NAME_INVALID;
  74                         case ':':
  75                                 if (s[1] == '\0') {
  76                                         return NT_STATUS_OBJECT_NAME_INVALID;
  77                                 }
  78                                 if (strchr_m(&s[1], ':')) {
  79                                         return NT_STATUS_OBJECT_NAME_INVALID;
  80                                 }
  81                                 break;
  82                         }
  83                 }
  84
  85                 if ((*s == ':') && !posix_path && !stream_started) {
  86                         if (*p_last_component_contains_wcard) {
  87                                 return NT_STATUS_OBJECT_NAME_INVALID;
  88                         }
  89                         /* Stream names allow more characters than file names.
  90                            We're overloading posix_path here to allow a wider
  91                            range of characters. If stream_started is true this
  92                            is still a Windows path even if posix_path is true.
  93                            JRA.
  94                         */
  95                         stream_started = true;
  96                         start_of_name_component = false;
  97                         posix_path = true;
  98
  99                         if (s[1] == '\0') {
 100                                 return NT_STATUS_OBJECT_NAME_INVALID;
 101                         }
 102                 }
 103
 104                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 105                         /*
 106                          * Safe to assume is not the second part of a mb char
 107                          * as this is handled below.
 108                          */
 109                         /* Eat multiple '/' or '\\' */
 110                         while (IS_PATH_SEP(*s,posix_path)) {
 111                                 s++;
 112                         }
 113                         if ((d != path) && (*s != '\0')) {
 114                                 /* We only care about non-leading or trailing '/' or '\\' */
 115                                 *d++ = '/';
 116                         }
 117
 118                         start_of_name_component = True;
 119                         /* New component. */
 120                         *p_last_component_contains_wcard = False;
 121                         continue;
 122                 }
 123
 124                 if (start_of_name_component) {
 125                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 126                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 127
 128                                 /*
 129                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 130                                  */
 131
 132                                 /* If  we just added a '/' - delete it */
 133                                 if ((d > path) && (*(d-1) == '/')) {
 134                                         *(d-1) = '\0';
 135                                         d--;
 136                                 }
 137
 138                                 /* Are we at the start ? Can't go back further if so. */
 139                                 if (d <= path) {
 140                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 141                                         break;
 142                                 }
 143                                 /* Go back one level... */
 144                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 145                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 146                                 /* Decrement d first as d points to the *next* char to write into. */
 147                                 for (d--; d > path; d--) {
 148                                         if (*d == '/')
 149                                                 break;
 150                                 }
 151                                 s += 2; /* Else go past the .. */
 152                                 /* We're still at the start of a name component, just the previous one. */
 153                                 continue;
 154
 155                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 156                                 if (posix_path) {
 157                                         /* Eat the '.' */
 158                                         s++;
 159                                         continue;
 160                                 }
 161                         }
 162
 163                 }
 164
 165                 if (!(*s & 0x80)) {
 166                         if (!posix_path) {
 167                                 if (*s <= 0x1f || *s == '|') {
 168                                         return NT_STATUS_OBJECT_NAME_INVALID;
 169                                 }
 170                                 switch (*s) {
 171                                         case '*':
 172                                         case '?':
 173                                         case '<':
 174                                         case '>':
 175                                         case '"':
 176                                                 *p_last_component_contains_wcard = True;
 177                                                 break;
 178                                         default:
 179                                                 break;
 180                                 }
 181                         }
 182                         *d++ = *s++;
 183                 } else {
 184                         size_t siz;
 185                         /* Get the size of the next MB character. */
 186                         next_codepoint(s,&siz);
 187                         switch(siz) {
 188                                 case 5:
 189                                         *d++ = *s++;
 190                                         /*fall through*/
 191                                 case 4:
 192                                         *d++ = *s++;
 193                                         /*fall through*/
 194                                 case 3:
 195                                         *d++ = *s++;
 196                                         /*fall through*/
 197                                 case 2:
 198                                         *d++ = *s++;
 199                                         /*fall through*/
 200                                 case 1:
 201                                         *d++ = *s++;
 202                                         break;
 203                                 default:
 204                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 205                                         *d = '\0';
 206                                         return NT_STATUS_INVALID_PARAMETER;
 207                         }
 208                 }
 209                 start_of_name_component = False;
 210         }
 211
 212         *d = '\0';
 213
 214         return ret;
 215 }
 216
 217 /****************************************************************************
 218  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 219  No wildcards allowed.
 220 ****************************************************************************/
 221
 222 NTSTATUS check_path_syntax(char *path)
 223 {
 224         bool ignore;
 225         return check_path_syntax_internal(path, False, &ignore);
 226 }
 227
 228 /****************************************************************************
 229  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 230  Wildcards allowed - p_contains_wcard returns true if the last component contained
 231  a wildcard.
 232 ****************************************************************************/
 233
 234 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 235 {
 236         return check_path_syntax_internal(path, False, p_contains_wcard);
 237 }
 238
 239 /****************************************************************************
 240  Check the path for a POSIX client.
 241  We're assuming here that '/' is not the second byte in any multibyte char
 242  set (a safe assumption).
 243 ****************************************************************************/
 244
 245 NTSTATUS check_path_syntax_posix(char *path)
 246 {
 247         bool ignore;
 248         return check_path_syntax_internal(path, True, &ignore);
 249 }
 250
 251 /****************************************************************************
 252  Pull a string and check the path allowing a wilcard - provide for error return.
 253 ****************************************************************************/
 254
 255 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 256                         const char *base_ptr,
 257                         uint16 smb_flags2,
 258                         char **pp_dest,
 259                         const char *src,
 260                         size_t src_len,
 261                         int flags,
 262                         NTSTATUS *err,
 263                         bool *contains_wcard)
 264 {
 265         size_t ret;
 266
 267         *pp_dest = NULL;
 268
 269         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 270                                  src_len, flags);
 271
 272         if (!*pp_dest) {
 273                 *err = NT_STATUS_INVALID_PARAMETER;
 274                 return ret;
 275         }
 276
 277         *contains_wcard = False;
 278
 279         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 280                 /*
 281                  * For a DFS path the function parse_dfs_path()
 282                  * will do the path processing, just make a copy.
 283                  */
 284                 *err = NT_STATUS_OK;
 285                 return ret;
 286         }
 287
 288         if (lp_posix_pathnames()) {
 289                 *err = check_path_syntax_posix(*pp_dest);
 290         } else {
 291                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 292         }
 293
 294         return ret;
 295 }
 296
 297 /****************************************************************************
 298  Pull a string and check the path - provide for error return.
 299 ****************************************************************************/
 300
 301 size_t srvstr_get_path(TALLOC_CTX *ctx,
 302                         const char *base_ptr,
 303                         uint16 smb_flags2,
 304                         char **pp_dest,
 305                         const char *src,
 306                         size_t src_len,
 307                         int flags,
 308                         NTSTATUS *err)
 309 {
 310         bool ignore;
 311         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 312                                      src_len, flags, err, &ignore);
 313 }
 314
 315 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 316                                  char **pp_dest, const char *src, int flags,
 317                                  NTSTATUS *err, bool *contains_wcard)
 318 {
 319         return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf, req->flags2,
 320                                      pp_dest, src, smbreq_bufrem(req, src),
 321                                      flags, err, contains_wcard);
 322 }
 323
 324 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 325                            char **pp_dest, const char *src, int flags,
 326                            NTSTATUS *err)
 327 {
 328         bool ignore;
 329         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 330                                          flags, err, &ignore);
 331 }
 332
 333 /****************************************************************************
 334  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 335 ****************************************************************************/
 336
 337 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 338                     files_struct *fsp)
 339 {
 340         if ((fsp == NULL) || (conn == NULL)) {
 341                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 342                 return False;
 343         }
 344         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 345                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 346                 return False;
 347         }
 348         return True;
 349 }
 350
 351 /****************************************************************************
 352  Check if we have a correct fsp pointing to a file.
 353 ****************************************************************************/
 354
 355 bool check_fsp(connection_struct *conn, struct smb_request *req,
 356                files_struct *fsp)
 357 {
 358         if (!check_fsp_open(conn, req, fsp)) {
 359                 return False;
 360         }
 361         if (fsp->is_directory) {
 362                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 363                 return False;
 364         }
 365         if (fsp->fh->fd == -1) {
 366                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 367                 return False;
 368         }
 369         fsp->num_smb_operations++;
 370         return True;
 371 }
 372
 373 /****************************************************************************
 374  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 375  the CHECK_NTQUOTA_HANDLE_OK macro.
 376 ****************************************************************************/
 377
 378 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 379                               files_struct *fsp)
 380 {
 381         if (!check_fsp_open(conn, req, fsp)) {
 382                 return false;
 383         }
 384
 385         if (fsp->is_directory) {
 386                 return false;
 387         }
 388
 389         if (fsp->fake_file_handle == NULL) {
 390                 return false;
 391         }
 392
 393         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 394                 return false;
 395         }
 396
 397         if (fsp->fake_file_handle->private_data == NULL) {
 398                 return false;
 399         }
 400
 401         return true;
 402 }
 403
 404 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 405                                      const char *name, int name_type)
 406 {
 407         char *trim_name;
 408         char *trim_name_type;
 409         const char *retarget_parm;
 410         char *retarget;
 411         char *p;
 412         int retarget_type = 0x20;
 413         int retarget_port = 139;
 414         struct sockaddr_storage retarget_addr;
 415         struct sockaddr_in *in_addr;
 416         bool ret = false;
 417         uint8_t outbuf[10];
 418
 419         if (get_socket_port(sconn->sock) != 139) {
 420                 return false;
 421         }
 422
 423         trim_name = talloc_strdup(talloc_tos(), name);
 424         if (trim_name == NULL) {
 425                 goto fail;
 426         }
 427         trim_char(trim_name, ' ', ' ');
 428
 429         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 430                                          name_type);
 431         if (trim_name_type == NULL) {
 432                 goto fail;
 433         }
 434
 435         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 436                                              trim_name_type, NULL);
 437         if (retarget_parm == NULL) {
 438                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 439                                                      trim_name, NULL);
 440         }
 441         if (retarget_parm == NULL) {
 442                 goto fail;
 443         }
 444
 445         retarget = talloc_strdup(trim_name, retarget_parm);
 446         if (retarget == NULL) {
 447                 goto fail;
 448         }
 449
 450         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 451
 452         p = strchr(retarget, ':');
 453         if (p != NULL) {
 454                 *p++ = '\0';
 455                 retarget_port = atoi(p);
 456         }
 457
 458         p = strchr_m(retarget, '#');
 459         if (p != NULL) {
 460                 *p++ = '\0';
 461                 if (sscanf(p, "%x", &retarget_type) != 1) {
 462                         goto fail;
 463                 }
 464         }
 465
 466         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 467         if (!ret) {
 468                 DEBUG(10, ("could not resolve %s\n", retarget));
 469                 goto fail;
 470         }
 471
 472         if (retarget_addr.ss_family != AF_INET) {
 473                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 474                 goto fail;
 475         }
 476
 477         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 478
 479         _smb_setlen(outbuf, 6);
 480         SCVAL(outbuf, 0, 0x84);
 481         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 482         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 483
 484         if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
 485                           NULL)) {
 486                 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
 487                                     "failed.");
 488         }
 489
 490         ret = true;
 491  fail:
 492         TALLOC_FREE(trim_name);
 493         return ret;
 494 }
 495
 496 static void reply_called_name_not_present(char *outbuf)
 497 {
 498         smb_setlen(outbuf, 1);
 499         SCVAL(outbuf, 0, 0x83);
 500         SCVAL(outbuf, 4, 0x82);
 501 }
 502
 503 /****************************************************************************
 504  Reply to a (netbios-level) special message.
 505 ****************************************************************************/
 506
 507 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
 508 {
 509         int msg_type = CVAL(inbuf,0);
 510         int msg_flags = CVAL(inbuf,1);
 511         /*
 512          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 513          * calculation & friends (srv_send_smb uses that) we need the full smb
 514          * header.
 515          */
 516         char outbuf[smb_size];
 517
 518         memset(outbuf, '\0', sizeof(outbuf));
 519
 520         smb_setlen(outbuf,0);
 521
 522         switch (msg_type) {
 523         case NBSSrequest: /* session request */
 524         {
 525                 /* inbuf_size is guarenteed to be at least 4. */
 526                 fstring name1,name2;
 527                 int name_type1, name_type2;
 528                 int name_len1, name_len2;
 529
 530                 *name1 = *name2 = 0;
 531
 532                 if (sconn->nbt.got_session) {
 533                         exit_server_cleanly("multiple session request not permitted");
 534                 }
 535
 536                 SCVAL(outbuf,0,NBSSpositive);
 537                 SCVAL(outbuf,3,0);
 538
 539                 /* inbuf_size is guaranteed to be at least 4. */
 540                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 541                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 542                         DEBUG(0,("Invalid name length in session request\n"));
 543                         reply_called_name_not_present(outbuf);
 544                         break;
 545                 }
 546                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 547                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 548                         DEBUG(0,("Invalid name length in session request\n"));
 549                         reply_called_name_not_present(outbuf);
 550                         break;
 551                 }
 552
 553                 name_type1 = name_extract((unsigned char *)inbuf,
 554                                 inbuf_size,(unsigned int)4,name1);
 555                 name_type2 = name_extract((unsigned char *)inbuf,
 556                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 557
 558                 if (name_type1 == -1 || name_type2 == -1) {
 559                         DEBUG(0,("Invalid name type in session request\n"));
 560                         reply_called_name_not_present(outbuf);
 561                         break;
 562                 }
 563
 564                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 565                          name1, name_type1, name2, name_type2));
 566
 567                 if (netbios_session_retarget(sconn, name1, name_type1)) {
 568                         exit_server_cleanly("retargeted client");
 569                 }
 570
 571                 /*
 572                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 573                  * "*SMBSERV" arrggg!!!
 574                  */
 575                 if (strequal(name1, "*SMBSERVER     ")
 576                     || strequal(name1, "*SMBSERV       "))  {
 577                         char *raddr;
 578
 579                         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
 580                                                                  talloc_tos());
 581                         if (raddr == NULL) {
 582                                 exit_server_cleanly("could not allocate raddr");
 583                         }
 584
 585                         fstrcpy(name1, raddr);
 586                 }
 587
 588                 set_local_machine_name(name1, True);
 589                 set_remote_machine_name(name2, True);
 590
 591                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 592                          get_local_machine_name(), get_remote_machine_name(),
 593                          name_type2));
 594
 595                 if (name_type2 == 'R') {
 596                         /* We are being asked for a pathworks session ---
 597                            no thanks! */
 598                         reply_called_name_not_present(outbuf);
 599                         break;
 600                 }
 601
 602                 /* only add the client's machine name to the list
 603                    of possibly valid usernames if we are operating
 604                    in share mode security */
 605                 if (lp_security() == SEC_SHARE) {
 606                         add_session_user(sconn, get_remote_machine_name());
 607                 }
 608
 609                 reload_services(sconn, conn_snum_used, true);
 610                 reopen_logs();
 611
 612                 sconn->nbt.got_session = true;
 613                 break;
 614         }
 615
 616         case 0x89: /* session keepalive request
 617                       (some old clients produce this?) */
 618                 SCVAL(outbuf,0,NBSSkeepalive);
 619                 SCVAL(outbuf,3,0);
 620                 break;
 621
 622         case NBSSpositive: /* positive session response */
 623         case NBSSnegative: /* negative session response */
 624         case NBSSretarget: /* retarget session response */
 625                 DEBUG(0,("Unexpected session response\n"));
 626                 break;
 627
 628         case NBSSkeepalive: /* session keepalive */
 629         default:
 630                 return;
 631         }
 632
 633         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 634                     msg_type, msg_flags));
 635
 636         srv_send_smb(sconn, outbuf, false, 0, false, NULL);
 637
 638         if (CVAL(outbuf, 0) != 0x82) {
 639                 exit_server_cleanly("invalid netbios session");
 640         }
 641         return;
 642 }
 643
 644 /****************************************************************************
 645  Reply to a tcon.
 646  conn POINTER CAN BE NULL HERE !
 647 ****************************************************************************/
 648
 649 void reply_tcon(struct smb_request *req)
 650 {
 651         connection_struct *conn = req->conn;
 652         const char *service;
 653         char *service_buf = NULL;
 654         char *password = NULL;
 655         char *dev = NULL;
 656         int pwlen=0;
 657         NTSTATUS nt_status;
 658         const char *p;
 659         DATA_BLOB password_blob;
 660         TALLOC_CTX *ctx = talloc_tos();
 661         struct smbd_server_connection *sconn = req->sconn;
 662
 663         START_PROFILE(SMBtcon);
 664
 665         if (req->buflen < 4) {
 666                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 667                 END_PROFILE(SMBtcon);
 668                 return;
 669         }
 670
 671         p = (const char *)req->buf + 1;
 672         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 673         p += 1;
 674         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 675         p += pwlen+1;
 676         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 677         p += 1;
 678
 679         if (service_buf == NULL || password == NULL || dev == NULL) {
 680                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 681                 END_PROFILE(SMBtcon);
 682                 return;
 683         }
 684         p = strrchr_m(service_buf,'\\');
 685         if (p) {
 686                 service = p+1;
 687         } else {
 688                 service = service_buf;
 689         }
 690
 691         password_blob = data_blob(password, pwlen+1);
 692
 693         conn = make_connection(sconn,service,password_blob,dev,
 694                                req->vuid,&nt_status);
 695         req->conn = conn;
 696
 697         data_blob_clear_free(&password_blob);
 698
 699         if (!conn) {
 700                 reply_nterror(req, nt_status);
 701                 END_PROFILE(SMBtcon);
 702                 return;
 703         }
 704
 705         reply_outbuf(req, 2, 0);
 706         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 707         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 708         SSVAL(req->outbuf,smb_tid,conn->cnum);
 709
 710         DEBUG(3,("tcon service=%s cnum=%d\n",
 711                  service, conn->cnum));
 712
 713         END_PROFILE(SMBtcon);
 714         return;
 715 }
 716
 717 /****************************************************************************
 718  Reply to a tcon and X.
 719  conn POINTER CAN BE NULL HERE !
 720 ****************************************************************************/
 721
 722 void reply_tcon_and_X(struct smb_request *req)
 723 {
 724         connection_struct *conn = req->conn;
 725         const char *service = NULL;
 726         DATA_BLOB password;
 727         TALLOC_CTX *ctx = talloc_tos();
 728         /* what the cleint thinks the device is */
 729         char *client_devicetype = NULL;
 730         /* what the server tells the client the share represents */
 731         const char *server_devicetype;
 732         NTSTATUS nt_status;
 733         int passlen;
 734         char *path = NULL;
 735         const char *p, *q;
 736         uint16 tcon_flags;
 737         struct smbd_server_connection *sconn = req->sconn;
 738
 739         START_PROFILE(SMBtconX);
 740
 741         if (req->wct < 4) {
 742                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 743                 END_PROFILE(SMBtconX);
 744                 return;
 745         }
 746
 747         passlen = SVAL(req->vwv+3, 0);
 748         tcon_flags = SVAL(req->vwv+2, 0);
 749
 750         /* we might have to close an old one */
 751         if ((tcon_flags & 0x1) && conn) {
 752                 close_cnum(conn,req->vuid);
 753                 req->conn = NULL;
 754                 conn = NULL;
 755         }
 756
 757         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 758                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 759                 END_PROFILE(SMBtconX);
 760                 return;
 761         }
 762
 763         if (sconn->smb1.negprot.encrypted_passwords) {
 764                 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
 765                 if (lp_security() == SEC_SHARE) {
 766                         /*
 767                          * Security = share always has a pad byte
 768                          * after the password.
 769                          */
 770                         p = (const char *)req->buf + passlen + 1;
 771                 } else {
 772                         p = (const char *)req->buf + passlen;
 773                 }
 774         } else {
 775                 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
 776                 /* Ensure correct termination */
 777                 password.data[passlen]=0;
 778                 p = (const char *)req->buf + passlen + 1;
 779         }
 780
 781         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 782
 783         if (path == NULL) {
 784                 data_blob_clear_free(&password);
 785                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 786                 END_PROFILE(SMBtconX);
 787                 return;
 788         }
 789
 790         /*
 791          * the service name can be either: \\server\share
 792          * or share directly like on the DELL PowerVault 705
 793          */
 794         if (*path=='\\') {
 795                 q = strchr_m(path+2,'\\');
 796                 if (!q) {
 797                         data_blob_clear_free(&password);
 798                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 799                         END_PROFILE(SMBtconX);
 800                         return;
 801                 }
 802                 service = q+1;
 803         } else {
 804                 service = path;
 805         }
 806
 807         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 808                                 &client_devicetype, p,
 809                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 810
 811         if (client_devicetype == NULL) {
 812                 data_blob_clear_free(&password);
 813                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 814                 END_PROFILE(SMBtconX);
 815                 return;
 816         }
 817
 818         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 819
 820         conn = make_connection(sconn, service, password, client_devicetype,
 821                                req->vuid, &nt_status);
 822         req->conn =conn;
 823
 824         data_blob_clear_free(&password);
 825
 826         if (!conn) {
 827                 reply_nterror(req, nt_status);
 828                 END_PROFILE(SMBtconX);
 829                 return;
 830         }
 831
 832         if ( IS_IPC(conn) )
 833                 server_devicetype = "IPC";
 834         else if ( IS_PRINT(conn) )
 835                 server_devicetype = "LPT1:";
 836         else
 837                 server_devicetype = "A:";
 838
 839         if (get_Protocol() < PROTOCOL_NT1) {
 840                 reply_outbuf(req, 2, 0);
 841                 if (message_push_string(&req->outbuf, server_devicetype,
 842                                         STR_TERMINATE|STR_ASCII) == -1) {
 843                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 844                         END_PROFILE(SMBtconX);
 845                         return;
 846                 }
 847         } else {
 848                 /* NT sets the fstype of IPC$ to the null string */
 849                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 850
 851                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 852                         /* Return permissions. */
 853                         uint32 perm1 = 0;
 854                         uint32 perm2 = 0;
 855
 856                         reply_outbuf(req, 7, 0);
 857
 858                         if (IS_IPC(conn)) {
 859                                 perm1 = FILE_ALL_ACCESS;
 860                                 perm2 = FILE_ALL_ACCESS;
 861                         } else {
 862                                 perm1 = conn->share_access;
 863                         }
 864
 865                         SIVAL(req->outbuf, smb_vwv3, perm1);
 866                         SIVAL(req->outbuf, smb_vwv5, perm2);
 867                 } else {
 868                         reply_outbuf(req, 3, 0);
 869                 }
 870
 871                 if ((message_push_string(&req->outbuf, server_devicetype,
 872                                          STR_TERMINATE|STR_ASCII) == -1)
 873                     || (message_push_string(&req->outbuf, fstype,
 874                                             STR_TERMINATE) == -1)) {
 875                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 876                         END_PROFILE(SMBtconX);
 877                         return;
 878                 }
 879
 880                 /* what does setting this bit do? It is set by NT4 and
 881                    may affect the ability to autorun mounted cdroms */
 882                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 883                       (lp_csc_policy(SNUM(conn)) << 2));
 884
 885                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
 886                         DEBUG(2,("Serving %s as a Dfs root\n",
 887                                  lp_servicename(SNUM(conn)) ));
 888                         SSVAL(req->outbuf, smb_vwv2,
 889                               SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
 890                 }
 891         }
 892
 893
 894         DEBUG(3,("tconX service=%s \n",
 895                  service));
 896
 897         /* set the incoming and outgoing tid to the just created one */
 898         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
 899         SSVAL(req->outbuf,smb_tid,conn->cnum);
 900
 901         END_PROFILE(SMBtconX);
 902
 903         req->tid = conn->cnum;
 904         chain_reply(req);
 905         return;
 906 }
 907
 908 /****************************************************************************
 909  Reply to an unknown type.
 910 ****************************************************************************/
 911
 912 void reply_unknown_new(struct smb_request *req, uint8 type)
 913 {
 914         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 915                   smb_fn_name(type), type, type));
 916         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
 917         return;
 918 }
 919
 920 /****************************************************************************
 921  Reply to an ioctl.
 922  conn POINTER CAN BE NULL HERE !
 923 ****************************************************************************/
 924
 925 void reply_ioctl(struct smb_request *req)
 926 {
 927         connection_struct *conn = req->conn;
 928         uint16 device;
 929         uint16 function;
 930         uint32 ioctl_code;
 931         int replysize;
 932         char *p;
 933
 934         START_PROFILE(SMBioctl);
 935
 936         if (req->wct < 3) {
 937                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 938                 END_PROFILE(SMBioctl);
 939                 return;
 940         }
 941
 942         device     = SVAL(req->vwv+1, 0);
 943         function   = SVAL(req->vwv+2, 0);
 944         ioctl_code = (device << 16) + function;
 945
 946         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 947
 948         switch (ioctl_code) {
 949             case IOCTL_QUERY_JOB_INFO:
 950                     replysize = 32;
 951                     break;
 952             default:
 953                     reply_force_doserror(req, ERRSRV, ERRnosupport);
 954                     END_PROFILE(SMBioctl);
 955                     return;
 956         }
 957
 958         reply_outbuf(req, 8, replysize+1);
 959         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 960         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 961         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 962         p = smb_buf(req->outbuf);
 963         memset(p, '\0', replysize+1); /* valgrind-safe. */
 964         p += 1;          /* Allow for alignment */
 965
 966         switch (ioctl_code) {
 967                 case IOCTL_QUERY_JOB_INFO:
 968                 {
 969                         files_struct *fsp = file_fsp(
 970                                 req, SVAL(req->vwv+0, 0));
 971                         if (!fsp) {
 972                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 973                                 END_PROFILE(SMBioctl);
 974                                 return;
 975                         }
 976                         /* Job number */
 977                         if (fsp->print_file) {
 978                                 SSVAL(p, 0, fsp->print_file->rap_jobid);
 979                         } else {
 980                                 SSVAL(p, 0, 0);
 981                         }
 982                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 983                                     lp_netbios_name(), 15,
 984                                     STR_TERMINATE|STR_ASCII);
 985                         if (conn) {
 986                                 srvstr_push((char *)req->outbuf, req->flags2,
 987                                             p+18, lp_servicename(SNUM(conn)),
 988                                             13, STR_TERMINATE|STR_ASCII);
 989                         } else {
 990                                 memset(p+18, 0, 13);
 991                         }
 992                         break;
 993                 }
 994         }
 995
 996         END_PROFILE(SMBioctl);
 997         return;
 998 }
 999
1000 /****************************************************************************
1001  Strange checkpath NTSTATUS mapping.
1002 ****************************************************************************/
1003
1004 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1005 {
1006         /* Strange DOS error code semantics only for checkpath... */
1007         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1008                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1009                         /* We need to map to ERRbadpath */
1010                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1011                 }
1012         }
1013         return status;
1014 }
1015
1016 /****************************************************************************
1017  Reply to a checkpath.
1018 ****************************************************************************/
1019
1020 void reply_checkpath(struct smb_request *req)
1021 {
1022         connection_struct *conn = req->conn;
1023         struct smb_filename *smb_fname = NULL;
1024         char *name = NULL;
1025         NTSTATUS status;
1026         TALLOC_CTX *ctx = talloc_tos();
1027
1028         START_PROFILE(SMBcheckpath);
1029
1030         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1031                             STR_TERMINATE, &status);
1032
1033         if (!NT_STATUS_IS_OK(status)) {
1034                 status = map_checkpath_error(req->flags2, status);
1035                 reply_nterror(req, status);
1036                 END_PROFILE(SMBcheckpath);
1037                 return;
1038         }
1039
1040         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1041
1042         status = filename_convert(ctx,
1043                                 conn,
1044                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1045                                 name,
1046                                 0,
1047                                 NULL,
1048                                 &smb_fname);
1049
1050         if (!NT_STATUS_IS_OK(status)) {
1051                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1052                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1053                                         ERRSRV, ERRbadpath);
1054                         END_PROFILE(SMBcheckpath);
1055                         return;
1056                 }
1057                 goto path_err;
1058         }
1059
1060         if (!VALID_STAT(smb_fname->st) &&
1061             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1062                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1063                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1064                 status = map_nt_error_from_unix(errno);
1065                 goto path_err;
1066         }
1067
1068         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1069                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1070                                 ERRDOS, ERRbadpath);
1071                 goto out;
1072         }
1073
1074         reply_outbuf(req, 0, 0);
1075
1076  path_err:
1077         /* We special case this - as when a Windows machine
1078                 is parsing a path is steps through the components
1079                 one at a time - if a component fails it expects
1080                 ERRbadpath, not ERRbadfile.
1081         */
1082         status = map_checkpath_error(req->flags2, status);
1083         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1084                 /*
1085                  * Windows returns different error codes if
1086                  * the parent directory is valid but not the
1087                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1088                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1089                  * if the path is invalid.
1090                  */
1091                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1092                                 ERRDOS, ERRbadpath);
1093                 goto out;
1094         }
1095
1096         reply_nterror(req, status);
1097
1098  out:
1099         TALLOC_FREE(smb_fname);
1100         END_PROFILE(SMBcheckpath);
1101         return;
1102 }
1103
1104 /****************************************************************************
1105  Reply to a getatr.
1106 ****************************************************************************/
1107
1108 void reply_getatr(struct smb_request *req)
1109 {
1110         connection_struct *conn = req->conn;
1111         struct smb_filename *smb_fname = NULL;
1112         char *fname = NULL;
1113         int mode=0;
1114         SMB_OFF_T size=0;
1115         time_t mtime=0;
1116         const char *p;
1117         NTSTATUS status;
1118         TALLOC_CTX *ctx = talloc_tos();
1119         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1120
1121         START_PROFILE(SMBgetatr);
1122
1123         p = (const char *)req->buf + 1;
1124         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1125         if (!NT_STATUS_IS_OK(status)) {
1126                 reply_nterror(req, status);
1127                 goto out;
1128         }
1129
1130         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1131                 under WfWg - weird! */
1132         if (*fname == '\0') {
1133                 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1134                 if (!CAN_WRITE(conn)) {
1135                         mode |= FILE_ATTRIBUTE_READONLY;
1136                 }
1137                 size = 0;
1138                 mtime = 0;
1139         } else {
1140                 status = filename_convert(ctx,
1141                                 conn,
1142                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1143                                 fname,
1144                                 0,
1145                                 NULL,
1146                                 &smb_fname);
1147                 if (!NT_STATUS_IS_OK(status)) {
1148                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1149                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1150                                                 ERRSRV, ERRbadpath);
1151                                 goto out;
1152                         }
1153                         reply_nterror(req, status);
1154                         goto out;
1155                 }
1156                 if (!VALID_STAT(smb_fname->st) &&
1157                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1158                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1159                                  smb_fname_str_dbg(smb_fname),
1160                                  strerror(errno)));
1161                         reply_nterror(req,  map_nt_error_from_unix(errno));
1162                         goto out;
1163                 }
1164
1165                 mode = dos_mode(conn, smb_fname);
1166                 size = smb_fname->st.st_ex_size;
1167
1168                 if (ask_sharemode) {
1169                         struct timespec write_time_ts;
1170                         struct file_id fileid;
1171
1172                         ZERO_STRUCT(write_time_ts);
1173                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1174                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1175                         if (!null_timespec(write_time_ts)) {
1176                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1177                         }
1178                 }
1179
1180                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1181                 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1182                         size = 0;
1183                 }
1184         }
1185
1186         reply_outbuf(req, 10, 0);
1187
1188         SSVAL(req->outbuf,smb_vwv0,mode);
1189         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1190                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1191         } else {
1192                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1193         }
1194         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1195
1196         if (get_Protocol() >= PROTOCOL_NT1) {
1197                 SSVAL(req->outbuf, smb_flg2,
1198                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1199         }
1200
1201         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1202                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1203
1204  out:
1205         TALLOC_FREE(smb_fname);
1206         TALLOC_FREE(fname);
1207         END_PROFILE(SMBgetatr);
1208         return;
1209 }
1210
1211 /****************************************************************************
1212  Reply to a setatr.
1213 ****************************************************************************/
1214
1215 void reply_setatr(struct smb_request *req)
1216 {
1217         struct smb_file_time ft;
1218         connection_struct *conn = req->conn;
1219         struct smb_filename *smb_fname = NULL;
1220         char *fname = NULL;
1221         int mode;
1222         time_t mtime;
1223         const char *p;
1224         NTSTATUS status;
1225         TALLOC_CTX *ctx = talloc_tos();
1226
1227         START_PROFILE(SMBsetatr);
1228
1229         ZERO_STRUCT(ft);
1230
1231         if (req->wct < 2) {
1232                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1233                 goto out;
1234         }
1235
1236         p = (const char *)req->buf + 1;
1237         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1238         if (!NT_STATUS_IS_OK(status)) {
1239                 reply_nterror(req, status);
1240                 goto out;
1241         }
1242
1243         status = filename_convert(ctx,
1244                                 conn,
1245                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1246                                 fname,
1247                                 0,
1248                                 NULL,
1249                                 &smb_fname);
1250         if (!NT_STATUS_IS_OK(status)) {
1251                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1252                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1253                                         ERRSRV, ERRbadpath);
1254                         goto out;
1255                 }
1256                 reply_nterror(req, status);
1257                 goto out;
1258         }
1259
1260         if (smb_fname->base_name[0] == '.' &&
1261             smb_fname->base_name[1] == '\0') {
1262                 /*
1263                  * Not sure here is the right place to catch this
1264                  * condition. Might be moved to somewhere else later -- vl
1265                  */
1266                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1267                 goto out;
1268         }
1269
1270         mode = SVAL(req->vwv+0, 0);
1271         mtime = srv_make_unix_date3(req->vwv+1);
1272
1273         if (mode != FILE_ATTRIBUTE_NORMAL) {
1274                 if (VALID_STAT_OF_DIR(smb_fname->st))
1275                         mode |= FILE_ATTRIBUTE_DIRECTORY;
1276                 else
1277                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1278
1279                 status = check_access(conn, NULL, smb_fname,
1280                                         FILE_WRITE_ATTRIBUTES);
1281                 if (!NT_STATUS_IS_OK(status)) {
1282                         reply_nterror(req, status);
1283                         goto out;
1284                 }
1285
1286                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1287                                      false) != 0) {
1288                         reply_nterror(req, map_nt_error_from_unix(errno));
1289                         goto out;
1290                 }
1291         }
1292
1293         ft.mtime = convert_time_t_to_timespec(mtime);
1294         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1295         if (!NT_STATUS_IS_OK(status)) {
1296                 reply_nterror(req, status);
1297                 goto out;
1298         }
1299
1300         reply_outbuf(req, 0, 0);
1301
1302         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1303                  mode));
1304  out:
1305         TALLOC_FREE(smb_fname);
1306         END_PROFILE(SMBsetatr);
1307         return;
1308 }
1309
1310 /****************************************************************************
1311  Reply to a dskattr.
1312 ****************************************************************************/
1313
1314 void reply_dskattr(struct smb_request *req)
1315 {
1316         connection_struct *conn = req->conn;
1317         uint64_t dfree,dsize,bsize;
1318         START_PROFILE(SMBdskattr);
1319
1320         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1321                 reply_nterror(req, map_nt_error_from_unix(errno));
1322                 END_PROFILE(SMBdskattr);
1323                 return;
1324         }
1325
1326         reply_outbuf(req, 5, 0);
1327
1328         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1329                 double total_space, free_space;
1330                 /* we need to scale this to a number that DOS6 can handle. We
1331                    use floating point so we can handle large drives on systems
1332                    that don't have 64 bit integers
1333
1334                    we end up displaying a maximum of 2G to DOS systems
1335                 */
1336                 total_space = dsize * (double)bsize;
1337                 free_space = dfree * (double)bsize;
1338
1339                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1340                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1341
1342                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1343                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1344
1345                 SSVAL(req->outbuf,smb_vwv0,dsize);
1346                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1347                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1348                 SSVAL(req->outbuf,smb_vwv3,dfree);
1349         } else {
1350                 SSVAL(req->outbuf,smb_vwv0,dsize);
1351                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1352                 SSVAL(req->outbuf,smb_vwv2,512);
1353                 SSVAL(req->outbuf,smb_vwv3,dfree);
1354         }
1355
1356         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1357
1358         END_PROFILE(SMBdskattr);
1359         return;
1360 }
1361
1362 /*
1363  * Utility function to split the filename from the directory.
1364  */
1365 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1366                                      char **fname_dir_out,
1367                                      char **fname_mask_out)
1368 {
1369         const char *p = NULL;
1370         char *fname_dir = NULL;
1371         char *fname_mask = NULL;
1372
1373         p = strrchr_m(fname_in, '/');
1374         if (!p) {
1375                 fname_dir = talloc_strdup(ctx, ".");
1376                 fname_mask = talloc_strdup(ctx, fname_in);
1377         } else {
1378                 fname_dir = talloc_strndup(ctx, fname_in,
1379                     PTR_DIFF(p, fname_in));
1380                 fname_mask = talloc_strdup(ctx, p+1);
1381         }
1382
1383         if (!fname_dir || !fname_mask) {
1384                 TALLOC_FREE(fname_dir);
1385                 TALLOC_FREE(fname_mask);
1386                 return NT_STATUS_NO_MEMORY;
1387         }
1388
1389         *fname_dir_out = fname_dir;
1390         *fname_mask_out = fname_mask;
1391         return NT_STATUS_OK;
1392 }
1393
1394 /****************************************************************************
1395  Reply to a search.
1396  Can be called from SMBsearch, SMBffirst or SMBfunique.
1397 ****************************************************************************/
1398
1399 void reply_search(struct smb_request *req)
1400 {
1401         connection_struct *conn = req->conn;
1402         char *path = NULL;
1403         const char *mask = NULL;
1404         char *directory = NULL;
1405         struct smb_filename *smb_fname = NULL;
1406         char *fname = NULL;
1407         SMB_OFF_T size;
1408         uint32 mode;
1409         struct timespec date;
1410         uint32 dirtype;
1411         unsigned int numentries = 0;
1412         unsigned int maxentries = 0;
1413         bool finished = False;
1414         const char *p;
1415         int status_len;
1416         char status[21];
1417         int dptr_num= -1;
1418         bool check_descend = False;
1419         bool expect_close = False;
1420         NTSTATUS nt_status;
1421         bool mask_contains_wcard = False;
1422         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1423         TALLOC_CTX *ctx = talloc_tos();
1424         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1425         struct dptr_struct *dirptr = NULL;
1426         struct smbd_server_connection *sconn = req->sconn;
1427
1428         START_PROFILE(SMBsearch);
1429
1430         if (req->wct < 2) {
1431                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1432                 goto out;
1433         }
1434
1435         if (lp_posix_pathnames()) {
1436                 reply_unknown_new(req, req->cmd);
1437                 goto out;
1438         }
1439
1440         /* If we were called as SMBffirst then we must expect close. */
1441         if(req->cmd == SMBffirst) {
1442                 expect_close = True;
1443         }
1444
1445         reply_outbuf(req, 1, 3);
1446         maxentries = SVAL(req->vwv+0, 0);
1447         dirtype = SVAL(req->vwv+1, 0);
1448         p = (const char *)req->buf + 1;
1449         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1450                                        &nt_status, &mask_contains_wcard);
1451         if (!NT_STATUS_IS_OK(nt_status)) {
1452                 reply_nterror(req, nt_status);
1453                 goto out;
1454         }
1455
1456         p++;
1457         status_len = SVAL(p, 0);
1458         p += 2;
1459
1460         /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1461
1462         if (status_len == 0) {
1463                 nt_status = filename_convert(ctx, conn,
1464                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1465                                              path,
1466                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1467                                              &mask_contains_wcard,
1468                                              &smb_fname);
1469                 if (!NT_STATUS_IS_OK(nt_status)) {
1470                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1471                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1472                                                 ERRSRV, ERRbadpath);
1473                                 goto out;
1474                         }
1475                         reply_nterror(req, nt_status);
1476                         goto out;
1477                 }
1478
1479                 directory = smb_fname->base_name;
1480
1481                 p = strrchr_m(directory,'/');
1482                 if ((p != NULL) && (*directory != '/')) {
1483                         mask = p + 1;
1484                         directory = talloc_strndup(ctx, directory,
1485                                                    PTR_DIFF(p, directory));
1486                 } else {
1487                         mask = directory;
1488                         directory = talloc_strdup(ctx,".");
1489                 }
1490
1491                 if (!directory) {
1492                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1493                         goto out;
1494                 }
1495
1496                 memset((char *)status,'\0',21);
1497                 SCVAL(status,0,(dirtype & 0x1F));
1498
1499                 nt_status = dptr_create(conn,
1500                                         NULL, /* fsp */
1501                                         directory,
1502                                         True,
1503                                         expect_close,
1504                                         req->smbpid,
1505                                         mask,
1506                                         mask_contains_wcard,
1507                                         dirtype,
1508                                         &dirptr);
1509                 if (!NT_STATUS_IS_OK(nt_status)) {
1510                         reply_nterror(req, nt_status);
1511                         goto out;
1512                 }
1513                 dptr_num = dptr_dnum(dirptr);
1514         } else {
1515                 int status_dirtype;
1516                 const char *dirpath;
1517
1518                 memcpy(status,p,21);
1519                 status_dirtype = CVAL(status,0) & 0x1F;
1520                 if (status_dirtype != (dirtype & 0x1F)) {
1521                         dirtype = status_dirtype;
1522                 }
1523
1524                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1525                 if (!dirptr) {
1526                         goto SearchEmpty;
1527                 }
1528                 dirpath = dptr_path(sconn, dptr_num);
1529                 directory = talloc_strdup(ctx, dirpath);
1530                 if (!directory) {
1531                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1532                         goto out;
1533                 }
1534
1535                 mask = dptr_wcard(sconn, dptr_num);
1536                 if (!mask) {
1537                         goto SearchEmpty;
1538                 }
1539                 /*
1540                  * For a 'continue' search we have no string. So
1541                  * check from the initial saved string.
1542                  */
1543                 mask_contains_wcard = ms_has_wild(mask);
1544                 dirtype = dptr_attr(sconn, dptr_num);
1545         }
1546
1547         DEBUG(4,("dptr_num is %d\n",dptr_num));
1548
1549         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1550         dptr_init_search_op(dirptr);
1551
1552         if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1553                 char buf[DIR_STRUCT_SIZE];
1554                 memcpy(buf,status,21);
1555                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1556                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1557                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1558                         goto out;
1559                 }
1560                 dptr_fill(sconn, buf+12,dptr_num);
1561                 if (dptr_zero(buf+12) && (status_len==0)) {
1562                         numentries = 1;
1563                 } else {
1564                         numentries = 0;
1565                 }
1566                 if (message_push_blob(&req->outbuf,
1567                                       data_blob_const(buf, sizeof(buf)))
1568                     == -1) {
1569                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1570                         goto out;
1571                 }
1572         } else {
1573                 unsigned int i;
1574                 maxentries = MIN(
1575                         maxentries,
1576                         ((BUFFER_SIZE -
1577                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1578                          /DIR_STRUCT_SIZE));
1579
1580                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1581                         directory,lp_dontdescend(SNUM(conn))));
1582                 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1583                         check_descend = True;
1584                 }
1585
1586                 for (i=numentries;(i<maxentries) && !finished;i++) {
1587                         finished = !get_dir_entry(ctx,
1588                                                   dirptr,
1589                                                   mask,
1590                                                   dirtype,
1591                                                   &fname,
1592                                                   &size,
1593                                                   &mode,
1594                                                   &date,
1595                                                   check_descend,
1596                                                   ask_sharemode);
1597                         if (!finished) {
1598                                 char buf[DIR_STRUCT_SIZE];
1599                                 memcpy(buf,status,21);
1600                                 if (!make_dir_struct(ctx,
1601                                                 buf,
1602                                                 mask,
1603                                                 fname,
1604                                                 size,
1605                                                 mode,
1606                                                 convert_timespec_to_time_t(date),
1607                                                 !allow_long_path_components)) {
1608                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1609                                         goto out;
1610                                 }
1611                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1612                                         break;
1613                                 }
1614                                 if (message_push_blob(&req->outbuf,
1615                                                       data_blob_const(buf, sizeof(buf)))
1616                                     == -1) {
1617                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1618                                         goto out;
1619                                 }
1620                                 numentries++;
1621                         }
1622                 }
1623         }
1624
1625   SearchEmpty:
1626
1627         /* If we were called as SMBffirst with smb_search_id == NULL
1628                 and no entries were found then return error and close dirptr
1629                 (X/Open spec) */
1630
1631         if (numentries == 0) {
1632                 dptr_close(sconn, &dptr_num);
1633         } else if(expect_close && status_len == 0) {
1634                 /* Close the dptr - we know it's gone */
1635                 dptr_close(sconn, &dptr_num);
1636         }
1637
1638         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1639         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1640                 dptr_close(sconn, &dptr_num);
1641         }
1642
1643         if ((numentries == 0) && !mask_contains_wcard) {
1644                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1645                 goto out;
1646         }
1647
1648         SSVAL(req->outbuf,smb_vwv0,numentries);
1649         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1650         SCVAL(smb_buf(req->outbuf),0,5);
1651         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1652
1653         /* The replies here are never long name. */
1654         SSVAL(req->outbuf, smb_flg2,
1655               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1656         if (!allow_long_path_components) {
1657                 SSVAL(req->outbuf, smb_flg2,
1658                       SVAL(req->outbuf, smb_flg2)
1659                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1660         }
1661
1662         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1663         SSVAL(req->outbuf, smb_flg2,
1664               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1665
1666         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1667                 smb_fn_name(req->cmd),
1668                 mask,
1669                 directory,
1670                 dirtype,
1671                 numentries,
1672                 maxentries ));
1673  out:
1674         TALLOC_FREE(directory);
1675         TALLOC_FREE(smb_fname);
1676         END_PROFILE(SMBsearch);
1677         return;
1678 }
1679
1680 /****************************************************************************
1681  Reply to a fclose (stop directory search).
1682 ****************************************************************************/
1683
1684 void reply_fclose(struct smb_request *req)
1685 {
1686         int status_len;
1687         char status[21];
1688         int dptr_num= -2;
1689         const char *p;
1690         char *path = NULL;
1691         NTSTATUS err;
1692         bool path_contains_wcard = False;
1693         TALLOC_CTX *ctx = talloc_tos();
1694         struct smbd_server_connection *sconn = req->sconn;
1695
1696         START_PROFILE(SMBfclose);
1697
1698         if (lp_posix_pathnames()) {
1699                 reply_unknown_new(req, req->cmd);
1700                 END_PROFILE(SMBfclose);
1701                 return;
1702         }
1703
1704         p = (const char *)req->buf + 1;
1705         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1706                                        &err, &path_contains_wcard);
1707         if (!NT_STATUS_IS_OK(err)) {
1708                 reply_nterror(req, err);
1709                 END_PROFILE(SMBfclose);
1710                 return;
1711         }
1712         p++;
1713         status_len = SVAL(p,0);
1714         p += 2;
1715
1716         if (status_len == 0) {
1717                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1718                 END_PROFILE(SMBfclose);
1719                 return;
1720         }
1721
1722         memcpy(status,p,21);
1723
1724         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1725                 /*  Close the dptr - we know it's gone */
1726                 dptr_close(sconn, &dptr_num);
1727         }
1728
1729         reply_outbuf(req, 1, 0);
1730         SSVAL(req->outbuf,smb_vwv0,0);
1731
1732         DEBUG(3,("search close\n"));
1733
1734         END_PROFILE(SMBfclose);
1735         return;
1736 }
1737
1738 /****************************************************************************
1739  Reply to an open.
1740 ****************************************************************************/
1741
1742 void reply_open(struct smb_request *req)
1743 {
1744         connection_struct *conn = req->conn;
1745         struct smb_filename *smb_fname = NULL;
1746         char *fname = NULL;
1747         uint32 fattr=0;
1748         SMB_OFF_T size = 0;
1749         time_t mtime=0;
1750         int info;
1751         files_struct *fsp;
1752         int oplock_request;
1753         int deny_mode;
1754         uint32 dos_attr;
1755         uint32 access_mask;
1756         uint32 share_mode;
1757         uint32 create_disposition;
1758         uint32 create_options = 0;
1759         uint32_t private_flags = 0;
1760         NTSTATUS status;
1761         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1762         TALLOC_CTX *ctx = talloc_tos();
1763
1764         START_PROFILE(SMBopen);
1765
1766         if (req->wct < 2) {
1767                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1768                 goto out;
1769         }
1770
1771         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1772         deny_mode = SVAL(req->vwv+0, 0);
1773         dos_attr = SVAL(req->vwv+1, 0);
1774
1775         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1776                             STR_TERMINATE, &status);
1777         if (!NT_STATUS_IS_OK(status)) {
1778                 reply_nterror(req, status);
1779                 goto out;
1780         }
1781
1782         status = filename_convert(ctx,
1783                                 conn,
1784                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1785                                 fname,
1786                                 0,
1787                                 NULL,
1788                                 &smb_fname);
1789         if (!NT_STATUS_IS_OK(status)) {
1790                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1791                         reply_botherror(req,
1792                                         NT_STATUS_PATH_NOT_COVERED,
1793                                         ERRSRV, ERRbadpath);
1794                         goto out;
1795                 }
1796                 reply_nterror(req, status);
1797                 goto out;
1798         }
1799
1800         if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1801                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1802                                          &share_mode, &create_disposition,
1803                                          &create_options, &private_flags)) {
1804                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1805                 goto out;
1806         }
1807
1808         status = SMB_VFS_CREATE_FILE(
1809                 conn,                                   /* conn */
1810                 req,                                    /* req */
1811                 0,                                      /* root_dir_fid */
1812                 smb_fname,                              /* fname */
1813                 access_mask,                            /* access_mask */
1814                 share_mode,                             /* share_access */
1815                 create_disposition,                     /* create_disposition*/
1816                 create_options,                         /* create_options */
1817                 dos_attr,                               /* file_attributes */
1818                 oplock_request,                         /* oplock_request */
1819                 0,                                      /* allocation_size */
1820                 private_flags,
1821                 NULL,                                   /* sd */
1822                 NULL,                                   /* ea_list */
1823                 &fsp,                                   /* result */
1824                 &info);                                 /* pinfo */
1825
1826         if (!NT_STATUS_IS_OK(status)) {
1827                 if (open_was_deferred(req->sconn, req->mid)) {
1828                         /* We have re-scheduled this call. */
1829                         goto out;
1830                 }
1831                 reply_openerror(req, status);
1832                 goto out;
1833         }
1834
1835         size = smb_fname->st.st_ex_size;
1836         fattr = dos_mode(conn, smb_fname);
1837
1838         /* Deal with other possible opens having a modified
1839            write time. JRA. */
1840         if (ask_sharemode) {
1841                 struct timespec write_time_ts;
1842
1843                 ZERO_STRUCT(write_time_ts);
1844                 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1845                 if (!null_timespec(write_time_ts)) {
1846                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1847                 }
1848         }
1849
1850         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1851
1852         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1853                 DEBUG(3,("attempt to open a directory %s\n",
1854                          fsp_str_dbg(fsp)));
1855                 close_file(req, fsp, ERROR_CLOSE);
1856                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1857                         ERRDOS, ERRnoaccess);
1858                 goto out;
1859         }
1860
1861         reply_outbuf(req, 7, 0);
1862         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1863         SSVAL(req->outbuf,smb_vwv1,fattr);
1864         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1865                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1866         } else {
1867                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1868         }
1869         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1870         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1871
1872         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1873                 SCVAL(req->outbuf,smb_flg,
1874                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1875         }
1876
1877         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1878                 SCVAL(req->outbuf,smb_flg,
1879                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1880         }
1881  out:
1882         TALLOC_FREE(smb_fname);
1883         END_PROFILE(SMBopen);
1884         return;
1885 }
1886
1887 /****************************************************************************
1888  Reply to an open and X.
1889 ****************************************************************************/
1890
1891 void reply_open_and_X(struct smb_request *req)
1892 {
1893         connection_struct *conn = req->conn;
1894         struct smb_filename *smb_fname = NULL;
1895         char *fname = NULL;
1896         uint16 open_flags;
1897         int deny_mode;
1898         uint32 smb_attr;
1899         /* Breakout the oplock request bits so we can set the
1900                 reply bits separately. */
1901         int ex_oplock_request;
1902         int core_oplock_request;
1903         int oplock_request;
1904 #if 0
1905         int smb_sattr = SVAL(req->vwv+4, 0);
1906         uint32 smb_time = make_unix_date3(req->vwv+6);
1907 #endif
1908         int smb_ofun;
1909         uint32 fattr=0;
1910         int mtime=0;
1911         int smb_action = 0;
1912         files_struct *fsp;
1913         NTSTATUS status;
1914         uint64_t allocation_size;
1915         ssize_t retval = -1;
1916         uint32 access_mask;
1917         uint32 share_mode;
1918         uint32 create_disposition;
1919         uint32 create_options = 0;
1920         uint32_t private_flags = 0;
1921         TALLOC_CTX *ctx = talloc_tos();
1922
1923         START_PROFILE(SMBopenX);
1924
1925         if (req->wct < 15) {
1926                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1927                 goto out;
1928         }
1929
1930         open_flags = SVAL(req->vwv+2, 0);
1931         deny_mode = SVAL(req->vwv+3, 0);
1932         smb_attr = SVAL(req->vwv+5, 0);
1933         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1934         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1935         oplock_request = ex_oplock_request | core_oplock_request;
1936         smb_ofun = SVAL(req->vwv+8, 0);
1937         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1938
1939         /* If it's an IPC, pass off the pipe handler. */
1940         if (IS_IPC(conn)) {
1941                 if (lp_nt_pipe_support()) {
1942                         reply_open_pipe_and_X(conn, req);
1943                 } else {
1944                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1945                 }
1946                 goto out;
1947         }
1948
1949         /* XXXX we need to handle passed times, sattr and flags */
1950         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1951                         STR_TERMINATE, &status);
1952         if (!NT_STATUS_IS_OK(status)) {
1953                 reply_nterror(req, status);
1954                 goto out;
1955         }
1956
1957         status = filename_convert(ctx,
1958                                 conn,
1959                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1960                                 fname,
1961                                 0,
1962                                 NULL,
1963                                 &smb_fname);
1964         if (!NT_STATUS_IS_OK(status)) {
1965                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1966                         reply_botherror(req,
1967                                         NT_STATUS_PATH_NOT_COVERED,
1968                                         ERRSRV, ERRbadpath);
1969                         goto out;
1970                 }
1971                 reply_nterror(req, status);
1972                 goto out;
1973         }
1974
1975         if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1976                                          smb_ofun,
1977                                          &access_mask, &share_mode,
1978                                          &create_disposition,
1979                                          &create_options,
1980                                          &private_flags)) {
1981                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1982                 goto out;
1983         }
1984
1985         status = SMB_VFS_CREATE_FILE(
1986                 conn,                                   /* conn */
1987                 req,                                    /* req */
1988                 0,                                      /* root_dir_fid */
1989                 smb_fname,                              /* fname */
1990                 access_mask,                            /* access_mask */
1991                 share_mode,                             /* share_access */
1992                 create_disposition,                     /* create_disposition*/
1993                 create_options,                         /* create_options */
1994                 smb_attr,                               /* file_attributes */
1995                 oplock_request,                         /* oplock_request */
1996                 0,                                      /* allocation_size */
1997                 private_flags,
1998                 NULL,                                   /* sd */
1999                 NULL,                                   /* ea_list */
2000                 &fsp,                                   /* result */
2001                 &smb_action);                           /* pinfo */
2002
2003         if (!NT_STATUS_IS_OK(status)) {
2004                 if (open_was_deferred(req->sconn, req->mid)) {
2005                         /* We have re-scheduled this call. */
2006                         goto out;
2007                 }
2008                 reply_openerror(req, status);
2009                 goto out;
2010         }
2011
2012         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2013            if the file is truncated or created. */
2014         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2015                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2016                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2017                         close_file(req, fsp, ERROR_CLOSE);
2018                         reply_nterror(req, NT_STATUS_DISK_FULL);
2019                         goto out;
2020                 }
2021                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
2022                 if (retval < 0) {
2023                         close_file(req, fsp, ERROR_CLOSE);
2024                         reply_nterror(req, NT_STATUS_DISK_FULL);
2025                         goto out;
2026                 }
2027                 status = vfs_stat_fsp(fsp);
2028                 if (!NT_STATUS_IS_OK(status)) {
2029                         close_file(req, fsp, ERROR_CLOSE);
2030                         reply_nterror(req, status);
2031                         goto out;
2032                 }
2033         }
2034
2035         fattr = dos_mode(conn, fsp->fsp_name);
2036         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2037         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2038                 close_file(req, fsp, ERROR_CLOSE);
2039                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2040                 goto out;
2041         }
2042
2043         /* If the caller set the extended oplock request bit
2044                 and we granted one (by whatever means) - set the
2045                 correct bit for extended oplock reply.
2046         */
2047
2048         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2049                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2050         }
2051
2052         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2053                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2054         }
2055
2056         /* If the caller set the core oplock request bit
2057                 and we granted one (by whatever means) - set the
2058                 correct bit for core oplock reply.
2059         */
2060
2061         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2062                 reply_outbuf(req, 19, 0);
2063         } else {
2064                 reply_outbuf(req, 15, 0);
2065         }
2066
2067         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2068                 SCVAL(req->outbuf, smb_flg,
2069                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2070         }
2071
2072         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2073                 SCVAL(req->outbuf, smb_flg,
2074                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2075         }
2076
2077         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2078         SSVAL(req->outbuf,smb_vwv3,fattr);
2079         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2080                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2081         } else {
2082                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2083         }
2084         SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2085         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2086         SSVAL(req->outbuf,smb_vwv11,smb_action);
2087
2088         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2089                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2090         }
2091
2092         chain_reply(req);
2093  out:
2094         TALLOC_FREE(smb_fname);
2095         END_PROFILE(SMBopenX);
2096         return;
2097 }
2098
2099 /****************************************************************************
2100  Reply to a SMBulogoffX.
2101 ****************************************************************************/
2102
2103 void reply_ulogoffX(struct smb_request *req)
2104 {
2105         struct smbd_server_connection *sconn = req->sconn;
2106         user_struct *vuser;
2107
2108         START_PROFILE(SMBulogoffX);
2109
2110         vuser = get_valid_user_struct(sconn, req->vuid);
2111
2112         if(vuser == NULL) {
2113                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2114                          req->vuid));
2115         }
2116
2117         /* in user level security we are supposed to close any files
2118                 open by this user */
2119         if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2120                 file_close_user(sconn, req->vuid);
2121         }
2122
2123         invalidate_vuid(sconn, req->vuid);
2124
2125         reply_outbuf(req, 2, 0);
2126
2127         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2128
2129         END_PROFILE(SMBulogoffX);
2130         req->vuid = UID_FIELD_INVALID;
2131         chain_reply(req);
2132 }
2133
2134 /****************************************************************************
2135  Reply to a mknew or a create.
2136 ****************************************************************************/
2137
2138 void reply_mknew(struct smb_request *req)
2139 {
2140         connection_struct *conn = req->conn;
2141         struct smb_filename *smb_fname = NULL;
2142         char *fname = NULL;
2143         uint32 fattr = 0;
2144         struct smb_file_time ft;
2145         files_struct *fsp;
2146         int oplock_request = 0;
2147         NTSTATUS status;
2148         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2149         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2150         uint32 create_disposition;
2151         uint32 create_options = 0;
2152         TALLOC_CTX *ctx = talloc_tos();
2153
2154         START_PROFILE(SMBcreate);
2155         ZERO_STRUCT(ft);
2156
2157         if (req->wct < 3) {
2158                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2159                 goto out;
2160         }
2161
2162         fattr = SVAL(req->vwv+0, 0);
2163         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2164
2165         /* mtime. */
2166         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2167
2168         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2169                             STR_TERMINATE, &status);
2170         if (!NT_STATUS_IS_OK(status)) {
2171                 reply_nterror(req, status);
2172                 goto out;
2173         }
2174
2175         status = filename_convert(ctx,
2176                                 conn,
2177                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2178                                 fname,
2179                                 0,
2180                                 NULL,
2181                                 &smb_fname);
2182         if (!NT_STATUS_IS_OK(status)) {
2183                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2184                         reply_botherror(req,
2185                                         NT_STATUS_PATH_NOT_COVERED,
2186                                         ERRSRV, ERRbadpath);
2187                         goto out;
2188                 }
2189                 reply_nterror(req, status);
2190                 goto out;
2191         }
2192
2193         if (fattr & FILE_ATTRIBUTE_VOLUME) {
2194                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2195                          "please report this\n",
2196                          smb_fname_str_dbg(smb_fname)));
2197         }
2198
2199         if(req->cmd == SMBmknew) {
2200                 /* We should fail if file exists. */
2201                 create_disposition = FILE_CREATE;
2202         } else {
2203                 /* Create if file doesn't exist, truncate if it does. */
2204                 create_disposition = FILE_OVERWRITE_IF;
2205         }
2206
2207         status = SMB_VFS_CREATE_FILE(
2208                 conn,                                   /* conn */
2209                 req,                                    /* req */
2210                 0,                                      /* root_dir_fid */
2211                 smb_fname,                              /* fname */
2212                 access_mask,                            /* access_mask */
2213                 share_mode,                             /* share_access */
2214                 create_disposition,                     /* create_disposition*/
2215                 create_options,                         /* create_options */
2216                 fattr,                                  /* file_attributes */
2217                 oplock_request,                         /* oplock_request */
2218                 0,                                      /* allocation_size */
2219                 0,                                      /* private_flags */
2220                 NULL,                                   /* sd */
2221                 NULL,                                   /* ea_list */
2222                 &fsp,                                   /* result */
2223                 NULL);                                  /* pinfo */
2224
2225         if (!NT_STATUS_IS_OK(status)) {
2226                 if (open_was_deferred(req->sconn, req->mid)) {
2227                         /* We have re-scheduled this call. */
2228                         goto out;
2229                 }
2230                 reply_openerror(req, status);
2231                 goto out;
2232         }
2233
2234         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2235         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2236         if (!NT_STATUS_IS_OK(status)) {
2237                 END_PROFILE(SMBcreate);
2238                 goto out;
2239         }
2240
2241         reply_outbuf(req, 1, 0);
2242         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2243
2244         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2245                 SCVAL(req->outbuf,smb_flg,
2246                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2247         }
2248
2249         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2250                 SCVAL(req->outbuf,smb_flg,
2251                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2252         }
2253
2254         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2255         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2256                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2257                   (unsigned int)fattr));
2258
2259  out:
2260         TALLOC_FREE(smb_fname);
2261         END_PROFILE(SMBcreate);
2262         return;
2263 }
2264
2265 /****************************************************************************
2266  Reply to a create temporary file.
2267 ****************************************************************************/
2268
2269 void reply_ctemp(struct smb_request *req)
2270 {
2271         connection_struct *conn = req->conn;
2272         struct smb_filename *smb_fname = NULL;
2273         char *fname = NULL;
2274         uint32 fattr;
2275         files_struct *fsp;
2276         int oplock_request;
2277         int tmpfd;
2278         char *s;
2279         NTSTATUS status;
2280         TALLOC_CTX *ctx = talloc_tos();
2281
2282         START_PROFILE(SMBctemp);
2283
2284         if (req->wct < 3) {
2285                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2286                 goto out;
2287         }
2288
2289         fattr = SVAL(req->vwv+0, 0);
2290         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2291
2292         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2293                             STR_TERMINATE, &status);
2294         if (!NT_STATUS_IS_OK(status)) {
2295                 reply_nterror(req, status);
2296                 goto out;
2297         }
2298         if (*fname) {
2299                 fname = talloc_asprintf(ctx,
2300                                 "%s/TMXXXXXX",
2301                                 fname);
2302         } else {
2303                 fname = talloc_strdup(ctx, "TMXXXXXX");
2304         }
2305
2306         if (!fname) {
2307                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2308                 goto out;
2309         }
2310
2311         status = filename_convert(ctx, conn,
2312                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2313                                 fname,
2314                                 0,
2315                                 NULL,
2316                                 &smb_fname);
2317         if (!NT_STATUS_IS_OK(status)) {
2318                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2319                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2320                                         ERRSRV, ERRbadpath);
2321                         goto out;
2322                 }
2323                 reply_nterror(req, status);
2324                 goto out;
2325         }
2326
2327         tmpfd = mkstemp(smb_fname->base_name);
2328         if (tmpfd == -1) {
2329                 reply_nterror(req, map_nt_error_from_unix(errno));
2330                 goto out;
2331         }
2332
2333         SMB_VFS_STAT(conn, smb_fname);
2334
2335         /* We should fail if file does not exist. */
2336         status = SMB_VFS_CREATE_FILE(
2337                 conn,                                   /* conn */
2338                 req,                                    /* req */
2339                 0,                                      /* root_dir_fid */
2340                 smb_fname,                              /* fname */
2341                 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2342                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2343                 FILE_OPEN,                              /* create_disposition*/
2344                 0,                                      /* create_options */
2345                 fattr,                                  /* file_attributes */
2346                 oplock_request,                         /* oplock_request */
2347                 0,                                      /* allocation_size */
2348                 0,                                      /* private_flags */
2349                 NULL,                                   /* sd */
2350                 NULL,                                   /* ea_list */
2351                 &fsp,                                   /* result */
2352                 NULL);                                  /* pinfo */
2353
2354         /* close fd from mkstemp() */
2355         close(tmpfd);
2356
2357         if (!NT_STATUS_IS_OK(status)) {
2358                 if (open_was_deferred(req->sconn, req->mid)) {
2359                         /* We have re-scheduled this call. */
2360                         goto out;
2361                 }
2362                 reply_openerror(req, status);
2363                 goto out;
2364         }
2365
2366         reply_outbuf(req, 1, 0);
2367         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2368
2369         /* the returned filename is relative to the directory */
2370         s = strrchr_m(fsp->fsp_name->base_name, '/');
2371         if (!s) {
2372                 s = fsp->fsp_name->base_name;
2373         } else {
2374                 s++;
2375         }
2376
2377 #if 0
2378         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2379            thing in the byte section. JRA */
2380         SSVALS(p, 0, -1); /* what is this? not in spec */
2381 #endif
2382         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2383             == -1) {
2384                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2385                 goto out;
2386         }
2387
2388         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2389                 SCVAL(req->outbuf, smb_flg,
2390                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2391         }
2392
2393         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2394                 SCVAL(req->outbuf, smb_flg,
2395                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2396         }
2397
2398         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2399         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2400                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2401  out:
2402         TALLOC_FREE(smb_fname);
2403         END_PROFILE(SMBctemp);
2404         return;
2405 }
2406
2407 /*******************************************************************
2408  Check if a user is allowed to rename a file.
2409 ********************************************************************/
2410
2411 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2412                         uint16 dirtype)
2413 {
2414         if (!CAN_WRITE(conn)) {
2415                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2416         }
2417
2418         if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2419                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2420                 /* Only bother to read the DOS attribute if we might deny the
2421                    rename on the grounds of attribute missmatch. */
2422                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2423                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2424                         return NT_STATUS_NO_SUCH_FILE;
2425                 }
2426         }
2427
2428         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2429                 if (fsp->posix_open) {
2430                         return NT_STATUS_OK;
2431                 }
2432
2433                 /* If no pathnames are open below this
2434                    directory, allow the rename. */
2435
2436                 if (file_find_subpath(fsp)) {
2437                         return NT_STATUS_ACCESS_DENIED;
2438                 }
2439                 return NT_STATUS_OK;
2440         }
2441
2442         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2443                 return NT_STATUS_OK;
2444         }
2445
2446         return NT_STATUS_ACCESS_DENIED;
2447 }
2448
2449 /*******************************************************************
2450  * unlink a file with all relevant access checks
2451  *******************************************************************/
2452
2453 static NTSTATUS do_unlink(connection_struct *conn,
2454                         struct smb_request *req,
2455                         struct smb_filename *smb_fname,
2456                         uint32 dirtype)
2457 {
2458         uint32 fattr;
2459         files_struct *fsp;
2460         uint32 dirtype_orig = dirtype;
2461         NTSTATUS status;
2462         int ret;
2463         bool posix_paths = lp_posix_pathnames();
2464
2465         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2466                   smb_fname_str_dbg(smb_fname),
2467                   dirtype));
2468
2469         if (!CAN_WRITE(conn)) {
2470                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2471         }
2472
2473         if (posix_paths) {
2474                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2475         } else {
2476                 ret = SMB_VFS_STAT(conn, smb_fname);
2477         }
2478         if (ret != 0) {
2479                 return map_nt_error_from_unix(errno);
2480         }
2481
2482         fattr = dos_mode(conn, smb_fname);
2483
2484         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2485                 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2486         }
2487
2488         dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2489         if (!dirtype) {
2490                 return NT_STATUS_NO_SUCH_FILE;
2491         }
2492
2493         if (!dir_check_ftype(conn, fattr, dirtype)) {
2494                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2495                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2496                 }
2497                 return NT_STATUS_NO_SUCH_FILE;
2498         }
2499
2500         if (dirtype_orig & 0x8000) {
2501                 /* These will never be set for POSIX. */
2502                 return NT_STATUS_NO_SUCH_FILE;
2503         }
2504
2505 #if 0
2506         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2507                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2508         }
2509
2510         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2511                 return NT_STATUS_NO_SUCH_FILE;
2512         }
2513
2514         if (dirtype & 0xFF00) {
2515                 /* These will never be set for POSIX. */
2516                 return NT_STATUS_NO_SUCH_FILE;
2517         }
2518
2519         dirtype &= 0xFF;
2520         if (!dirtype) {
2521                 return NT_STATUS_NO_SUCH_FILE;
2522         }
2523
2524         /* Can't delete a directory. */
2525         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2526                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2527         }
2528 #endif
2529
2530 #if 0 /* JRATEST */
2531         else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2532                 return NT_STATUS_OBJECT_NAME_INVALID;
2533 #endif /* JRATEST */
2534
2535         /* On open checks the open itself will check the share mode, so
2536            don't do it here as we'll get it wrong. */
2537
2538         status = SMB_VFS_CREATE_FILE
2539                 (conn,                  /* conn */
2540                  req,                   /* req */
2541                  0,                     /* root_dir_fid */
2542                  smb_fname,             /* fname */
2543                  DELETE_ACCESS,         /* access_mask */
2544                  FILE_SHARE_NONE,       /* share_access */
2545                  FILE_OPEN,             /* create_disposition*/
2546                  FILE_NON_DIRECTORY_FILE, /* create_options */
2547                                         /* file_attributes */
2548                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2549                                 FILE_ATTRIBUTE_NORMAL,
2550                  0,                     /* oplock_request */
2551                  0,                     /* allocation_size */
2552                  0,                     /* private_flags */
2553                  NULL,                  /* sd */
2554                  NULL,                  /* ea_list */
2555                  &fsp,                  /* result */
2556                  NULL);                 /* pinfo */
2557
2558         if (!NT_STATUS_IS_OK(status)) {
2559                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2560                            nt_errstr(status)));
2561                 return status;
2562         }
2563
2564         status = can_set_delete_on_close(fsp, fattr);
2565         if (!NT_STATUS_IS_OK(status)) {
2566                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2567                         "(%s)\n",
2568                         smb_fname_str_dbg(smb_fname),
2569                         nt_errstr(status)));
2570                 close_file(req, fsp, NORMAL_CLOSE);
2571                 return status;
2572         }
2573
2574         /* The set is across all open files on this dev/inode pair. */
2575         if (!set_delete_on_close(fsp, True, conn->session_info->unix_token)) {
2576                 close_file(req, fsp, NORMAL_CLOSE);
2577                 return NT_STATUS_ACCESS_DENIED;
2578         }
2579
2580         return close_file(req, fsp, NORMAL_CLOSE);
2581 }
2582
2583 /****************************************************************************
2584  The guts of the unlink command, split out so it may be called by the NT SMB
2585  code.
2586 ****************************************************************************/
2587
2588 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2589                           uint32 dirtype, struct smb_filename *smb_fname,
2590                           bool has_wild)
2591 {
2592         char *fname_dir = NULL;
2593         char *fname_mask = NULL;
2594         int count=0;
2595         NTSTATUS status = NT_STATUS_OK;
2596         TALLOC_CTX *ctx = talloc_tos();
2597
2598         /* Split up the directory from the filename/mask. */
2599         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2600                                       &fname_dir, &fname_mask);
2601         if (!NT_STATUS_IS_OK(status)) {
2602                 goto out;
2603         }
2604
2605         /*
2606          * We should only check the mangled cache
2607          * here if unix_convert failed. This means
2608          * that the path in 'mask' doesn't exist
2609          * on the file system and so we need to look
2610          * for a possible mangle. This patch from
2611          * Tine Smukavec <valentin.smukavec@hermes.si>.
2612          */
2613
2614         if (!VALID_STAT(smb_fname->st) &&
2615             mangle_is_mangled(fname_mask, conn->params)) {
2616                 char *new_mask = NULL;
2617                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2618                                             &new_mask, conn->params);
2619                 if (new_mask) {
2620                         TALLOC_FREE(fname_mask);
2621                         fname_mask = new_mask;
2622                 }
2623         }
2624
2625         if (!has_wild) {
2626
2627                 /*
2628                  * Only one file needs to be unlinked. Append the mask back
2629                  * onto the directory.
2630                  */
2631                 TALLOC_FREE(smb_fname->base_name);
2632                 if (ISDOT(fname_dir)) {
2633                         /* Ensure we use canonical names on open. */
2634                         smb_fname->base_name = talloc_asprintf(smb_fname,
2635                                                         "%s",
2636                                                         fname_mask);
2637                 } else {
2638                         smb_fname->base_name = talloc_asprintf(smb_fname,
2639                                                         "%s/%s",
2640                                                         fname_dir,
2641                                                         fname_mask);
2642                 }
2643                 if (!smb_fname->base_name) {
2644                         status = NT_STATUS_NO_MEMORY;
2645                         goto out;
2646                 }
2647                 if (dirtype == 0) {
2648                         dirtype = FILE_ATTRIBUTE_NORMAL;
2649                 }
2650
2651                 status = check_name(conn, smb_fname->base_name);
2652                 if (!NT_STATUS_IS_OK(status)) {
2653                         goto out;
2654                 }
2655
2656                 status = do_unlink(conn, req, smb_fname, dirtype);
2657                 if (!NT_STATUS_IS_OK(status)) {
2658                         goto out;
2659                 }
2660
2661                 count++;
2662         } else {
2663                 struct smb_Dir *dir_hnd = NULL;
2664                 long offset = 0;
2665                 const char *dname = NULL;
2666                 char *talloced = NULL;
2667
2668                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2669                         status = NT_STATUS_OBJECT_NAME_INVALID;
2670                         goto out;
2671                 }
2672
2673                 if (strequal(fname_mask,"????????.???")) {
2674                         TALLOC_FREE(fname_mask);
2675                         fname_mask = talloc_strdup(ctx, "*");
2676                         if (!fname_mask) {
2677                                 status = NT_STATUS_NO_MEMORY;
2678                                 goto out;
2679                         }
2680                 }
2681
2682                 status = check_name(conn, fname_dir);
2683                 if (!NT_STATUS_IS_OK(status)) {
2684                         goto out;
2685                 }
2686
2687                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2688                                   dirtype);
2689                 if (dir_hnd == NULL) {
2690                         status = map_nt_error_from_unix(errno);
2691                         goto out;
2692                 }
2693
2694                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2695                    the pattern matches against the long name, otherwise the short name
2696                    We don't implement this yet XXXX
2697                 */
2698
2699                 status = NT_STATUS_NO_SUCH_FILE;
2700
2701                 while ((dname = ReadDirName(dir_hnd, &offset,
2702                                             &smb_fname->st, &talloced))) {
2703                         TALLOC_CTX *frame = talloc_stackframe();
2704
2705                         if (!is_visible_file(conn, fname_dir, dname,
2706                                              &smb_fname->st, true)) {
2707                                 TALLOC_FREE(frame);
2708                                 TALLOC_FREE(talloced);
2709                                 continue;
2710                         }
2711
2712                         /* Quick check for "." and ".." */
2713                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2714                                 TALLOC_FREE(frame);
2715                                 TALLOC_FREE(talloced);
2716                                 continue;
2717                         }
2718
2719                         if(!mask_match(dname, fname_mask,
2720                                        conn->case_sensitive)) {
2721                                 TALLOC_FREE(frame);
2722                                 TALLOC_FREE(talloced);
2723                                 continue;
2724                         }
2725
2726                         TALLOC_FREE(smb_fname->base_name);
2727                         if (ISDOT(fname_dir)) {
2728                                 /* Ensure we use canonical names on open. */
2729                                 smb_fname->base_name =
2730                                         talloc_asprintf(smb_fname, "%s",
2731                                                 dname);
2732                         } else {
2733                                 smb_fname->base_name =
2734                                         talloc_asprintf(smb_fname, "%s/%s",
2735                                                 fname_dir, dname);
2736                         }
2737
2738                         if (!smb_fname->base_name) {
2739                                 TALLOC_FREE(dir_hnd);
2740                                 status = NT_STATUS_NO_MEMORY;
2741                                 TALLOC_FREE(frame);
2742                                 TALLOC_FREE(talloced);
2743                                 goto out;
2744                         }
2745
2746                         status = check_name(conn, smb_fname->base_name);
2747                         if (!NT_STATUS_IS_OK(status)) {
2748                                 TALLOC_FREE(dir_hnd);
2749                                 TALLOC_FREE(frame);
2750                                 TALLOC_FREE(talloced);
2751                                 goto out;
2752                         }
2753
2754                         status = do_unlink(conn, req, smb_fname, dirtype);
2755                         if (!NT_STATUS_IS_OK(status)) {
2756                                 TALLOC_FREE(frame);
2757                                 TALLOC_FREE(talloced);
2758                                 continue;
2759                         }
2760
2761                         count++;
2762                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2763                                  smb_fname->base_name));
2764
2765                         TALLOC_FREE(frame);
2766                         TALLOC_FREE(talloced);
2767                 }
2768                 TALLOC_FREE(dir_hnd);
2769         }
2770
2771         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2772                 status = map_nt_error_from_unix(errno);
2773         }
2774
2775  out:
2776         TALLOC_FREE(fname_dir);
2777         TALLOC_FREE(fname_mask);
2778         return status;
2779 }
2780
2781 /****************************************************************************
2782  Reply to a unlink
2783 ****************************************************************************/
2784
2785 void reply_unlink(struct smb_request *req)
2786 {
2787         connection_struct *conn = req->conn;
2788         char *name = NULL;
2789         struct smb_filename *smb_fname = NULL;
2790         uint32 dirtype;
2791         NTSTATUS status;
2792         bool path_contains_wcard = False;
2793         TALLOC_CTX *ctx = talloc_tos();
2794
2795         START_PROFILE(SMBunlink);
2796
2797         if (req->wct < 1) {
2798                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2799                 goto out;
2800         }
2801
2802         dirtype = SVAL(req->vwv+0, 0);
2803
2804         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2805                                   STR_TERMINATE, &status,
2806                                   &path_contains_wcard);
2807         if (!NT_STATUS_IS_OK(status)) {
2808                 reply_nterror(req, status);
2809                 goto out;
2810         }
2811
2812         status = filename_convert(ctx, conn,
2813                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2814                                   name,
2815                                   UCF_COND_ALLOW_WCARD_LCOMP,
2816                                   &path_contains_wcard,
2817                                   &smb_fname);
2818         if (!NT_STATUS_IS_OK(status)) {
2819                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2820                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2821                                         ERRSRV, ERRbadpath);
2822                         goto out;
2823                 }
2824                 reply_nterror(req, status);
2825                 goto out;
2826         }
2827
2828         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2829
2830         status = unlink_internals(conn, req, dirtype, smb_fname,
2831                                   path_contains_wcard);
2832         if (!NT_STATUS_IS_OK(status)) {
2833                 if (open_was_deferred(req->sconn, req->mid)) {
2834                         /* We have re-scheduled this call. */
2835                         goto out;
2836                 }
2837                 reply_nterror(req, status);
2838                 goto out;
2839         }
2840
2841         reply_outbuf(req, 0, 0);
2842  out:
2843         TALLOC_FREE(smb_fname);
2844         END_PROFILE(SMBunlink);
2845         return;
2846 }
2847
2848 /****************************************************************************
2849  Fail for readbraw.
2850 ****************************************************************************/
2851
2852 static void fail_readraw(void)
2853 {
2854         const char *errstr = talloc_asprintf(talloc_tos(),
2855                         "FAIL ! reply_readbraw: socket write fail (%s)",
2856                         strerror(errno));
2857         if (!errstr) {
2858                 errstr = "";
2859         }
2860         exit_server_cleanly(errstr);
2861 }
2862
2863 /****************************************************************************
2864  Fake (read/write) sendfile. Returns -1 on read or write fail.
2865 ****************************************************************************/
2866
2867 ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
2868 {
2869         size_t bufsize;
2870         size_t tosend = nread;
2871         char *buf;
2872
2873         if (nread == 0) {
2874                 return 0;
2875         }
2876
2877         bufsize = MIN(nread, 65536);
2878
2879         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2880                 return -1;
2881         }
2882
2883         while (tosend > 0) {
2884                 ssize_t ret;
2885                 size_t cur_read;
2886
2887                 if (tosend > bufsize) {
2888                         cur_read = bufsize;
2889                 } else {
2890                         cur_read = tosend;
2891                 }
2892                 ret = read_file(fsp,buf,startpos,cur_read);
2893                 if (ret == -1) {
2894                         SAFE_FREE(buf);
2895                         return -1;
2896                 }
2897
2898                 /* If we had a short read, fill with zeros. */
2899                 if (ret < cur_read) {
2900                         memset(buf + ret, '\0', cur_read - ret);
2901                 }
2902
2903                 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2904                     != cur_read) {
2905                         char addr[INET6_ADDRSTRLEN];
2906                         /*
2907                          * Try and give an error message saying what
2908                          * client failed.
2909                          */
2910                         DEBUG(0, ("write_data failed for client %s. "
2911                                   "Error %s\n",
2912                                   get_peer_addr(fsp->conn->sconn->sock, addr,
2913                                                 sizeof(addr)),
2914                                   strerror(errno)));
2915                         SAFE_FREE(buf);
2916                         return -1;
2917                 }
2918                 tosend -= cur_read;
2919                 startpos += cur_read;
2920         }
2921
2922         SAFE_FREE(buf);
2923         return (ssize_t)nread;
2924 }
2925
2926 /****************************************************************************
2927  Deal with the case of sendfile reading less bytes from the file than
2928  requested. Fill with zeros (all we can do).
2929 ****************************************************************************/
2930
2931 void sendfile_short_send(files_struct *fsp,
2932                                 ssize_t nread,
2933                                 size_t headersize,
2934                                 size_t smb_maxcnt)
2935 {
2936 #define SHORT_SEND_BUFSIZE 1024
2937         if (nread < headersize) {
2938                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2939                         "header for file %s (%s). Terminating\n",
2940                         fsp_str_dbg(fsp), strerror(errno)));
2941                 exit_server_cleanly("sendfile_short_send failed");
2942         }
2943
2944         nread -= headersize;
2945
2946         if (nread < smb_maxcnt) {
2947                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2948                 if (!buf) {
2949                         exit_server_cleanly("sendfile_short_send: "
2950                                 "malloc failed");
2951                 }
2952
2953                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2954                         "with zeros !\n", fsp_str_dbg(fsp)));
2955
2956                 while (nread < smb_maxcnt) {
2957                         /*
2958                          * We asked for the real file size and told sendfile
2959                          * to not go beyond the end of the file. But it can
2960                          * happen that in between our fstat call and the
2961                          * sendfile call the file was truncated. This is very
2962                          * bad because we have already announced the larger
2963                          * number of bytes to the client.
2964                          *
2965                          * The best we can do now is to send 0-bytes, just as
2966                          * a read from a hole in a sparse file would do.
2967                          *
2968                          * This should happen rarely enough that I don't care
2969                          * about efficiency here :-)
2970                          */
2971                         size_t to_write;
2972
2973                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2974                         if (write_data(fsp->conn->sconn->sock, buf, to_write)
2975                             != to_write) {
2976                                 char addr[INET6_ADDRSTRLEN];
2977                                 /*
2978                                  * Try and give an error message saying what
2979                                  * client failed.
2980                                  */
2981                                 DEBUG(0, ("write_data failed for client %s. "
2982                                           "Error %s\n",
2983                                           get_peer_addr(
2984                                                   fsp->conn->sconn->sock, addr,
2985                                                   sizeof(addr)),
2986                                           strerror(errno)));
2987                                 exit_server_cleanly("sendfile_short_send: "
2988                                                     "write_data failed");
2989                         }
2990                         nread += to_write;
2991                 }
2992                 SAFE_FREE(buf);
2993         }
2994 }
2995
2996 /****************************************************************************
2997  Return a readbraw error (4 bytes of zero).
2998 ****************************************************************************/
2999
3000 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3001 {
3002         char header[4];
3003
3004         SIVAL(header,0,0);
3005
3006         smbd_lock_socket(sconn);
3007         if (write_data(sconn->sock,header,4) != 4) {
3008                 char addr[INET6_ADDRSTRLEN];
3009                 /*
3010                  * Try and give an error message saying what
3011                  * client failed.
3012                  */
3013                 DEBUG(0, ("write_data failed for client %s. "
3014                           "Error %s\n",
3015                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
3016                           strerror(errno)));
3017
3018                 fail_readraw();
3019         }
3020         smbd_unlock_socket(sconn);
3021 }
3022
3023 /****************************************************************************
3024  Use sendfile in readbraw.
3025 ****************************************************************************/
3026
3027 static void send_file_readbraw(connection_struct *conn,
3028                                struct smb_request *req,
3029                                files_struct *fsp,
3030                                SMB_OFF_T startpos,
3031                                size_t nread,
3032                                ssize_t mincount)
3033 {
3034         struct smbd_server_connection *sconn = req->sconn;
3035         char *outbuf = NULL;
3036         ssize_t ret=0;
3037
3038         /*
3039          * We can only use sendfile on a non-chained packet
3040          * but we can use on a non-oplocked file. tridge proved this
3041          * on a train in Germany :-). JRA.
3042          * reply_readbraw has already checked the length.
3043          */
3044
3045         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3046             (fsp->wcp == NULL) &&
3047             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3048                 ssize_t sendfile_read = -1;
3049                 char header[4];
3050                 DATA_BLOB header_blob;
3051
3052                 _smb_setlen(header,nread);
3053                 header_blob = data_blob_const(header, 4);
3054
3055                 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3056                                                  &header_blob, startpos,
3057                                                  nread);
3058                 if (sendfile_read == -1) {
3059                         /* Returning ENOSYS means no data at all was sent.
3060                          * Do this as a normal read. */
3061                         if (errno == ENOSYS) {
3062                                 goto normal_readbraw;
3063                         }
3064
3065                         /*
3066                          * Special hack for broken Linux with no working sendfile. If we
3067                          * return EINTR we sent the header but not the rest of the data.
3068                          * Fake this up by doing read/write calls.
3069                          */
3070                         if (errno == EINTR) {
3071                                 /* Ensure we don't do this again. */
3072                                 set_use_sendfile(SNUM(conn), False);
3073                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3074
3075                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
3076                                         DEBUG(0,("send_file_readbraw: "
3077                                                  "fake_sendfile failed for "
3078                                                  "file %s (%s).\n",
3079                                                  fsp_str_dbg(fsp),
3080                                                  strerror(errno)));
3081                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3082                                 }
3083                                 return;
3084                         }
3085
3086                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3087                                  "file %s (%s). Terminating\n",
3088                                  fsp_str_dbg(fsp), strerror(errno)));
3089                         exit_server_cleanly("send_file_readbraw sendfile failed");
3090                 } else if (sendfile_read == 0) {
3091                         /*
3092                          * Some sendfile implementations return 0 to indicate
3093                          * that there was a short read, but nothing was
3094                          * actually written to the socket.  In this case,
3095                          * fallback to the normal read path so the header gets
3096                          * the correct byte count.
3097                          */
3098                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3099                                   "bytes falling back to the normal read: "
3100                                   "%s\n", fsp_str_dbg(fsp)));
3101                         goto normal_readbraw;
3102                 }
3103
3104                 /* Deal with possible short send. */
3105                 if (sendfile_read != 4+nread) {
3106                         sendfile_short_send(fsp, sendfile_read, 4, nread);
3107                 }
3108                 return;
3109         }
3110
3111 normal_readbraw:
3112
3113         outbuf = talloc_array(NULL, char, nread+4);
3114         if (!outbuf) {
3115                 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3116                         (unsigned)(nread+4)));
3117                 reply_readbraw_error(sconn);
3118                 return;
3119         }
3120
3121         if (nread > 0) {
3122                 ret = read_file(fsp,outbuf+4,startpos,nread);
3123 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3124                 if (ret < mincount)
3125                         ret = 0;
3126 #else
3127                 if (ret < nread)
3128                         ret = 0;
3129 #endif
3130         }
3131
3132         _smb_setlen(outbuf,ret);
3133         if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3134                 char addr[INET6_ADDRSTRLEN];
3135                 /*
3136                  * Try and give an error message saying what
3137                  * client failed.
3138                  */
3139                 DEBUG(0, ("write_data failed for client %s. "
3140                           "Error %s\n",
3141                           get_peer_addr(fsp->conn->sconn->sock, addr,
3142                                         sizeof(addr)),
3143                           strerror(errno)));
3144
3145                 fail_readraw();
3146         }
3147
3148         TALLOC_FREE(outbuf);
3149 }
3150
3151 /****************************************************************************
3152  Reply to a readbraw (core+ protocol).
3153 ****************************************************************************/
3154
3155 void reply_readbraw(struct smb_request *req)
3156 {
3157         connection_struct *conn = req->conn;
3158         struct smbd_server_connection *sconn = req->sconn;
3159         ssize_t maxcount,mincount;
3160         size_t nread = 0;
3161         SMB_OFF_T startpos;
3162         files_struct *fsp;
3163         struct lock_struct lock;
3164         SMB_OFF_T size = 0;
3165
3166         START_PROFILE(SMBreadbraw);
3167
3168         if (srv_is_signing_active(sconn) ||
3169             is_encrypted_packet(sconn, req->inbuf)) {
3170                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3171                         "raw reads/writes are disallowed.");
3172         }
3173
3174         if (req->wct < 8) {
3175                 reply_readbraw_error(sconn);
3176                 END_PROFILE(SMBreadbraw);
3177                 return;
3178         }
3179
3180         if (sconn->smb1.echo_handler.trusted_fde) {
3181                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3182                          "'async smb echo handler = yes'\n"));
3183                 reply_readbraw_error(sconn);
3184                 END_PROFILE(SMBreadbraw);
3185                 return;
3186         }
3187
3188         /*
3189          * Special check if an oplock break has been issued
3190          * and the readraw request croses on the wire, we must
3191          * return a zero length response here.
3192          */
3193
3194         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3195
3196         /*
3197          * We have to do a check_fsp by hand here, as
3198          * we must always return 4 zero bytes on error,
3199          * not a NTSTATUS.
3200          */
3201
3202         if (!fsp || !conn || conn != fsp->conn ||
3203                         req->vuid != fsp->vuid ||
3204                         fsp->is_directory || fsp->fh->fd == -1) {
3205                 /*
3206                  * fsp could be NULL here so use the value from the packet. JRA.
3207                  */
3208                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3209                         "- cache prime?\n",
3210                         (int)SVAL(req->vwv+0, 0)));
3211                 reply_readbraw_error(sconn);
3212                 END_PROFILE(SMBreadbraw);
3213                 return;
3214         }
3215
3216         /* Do a "by hand" version of CHECK_READ. */
3217         if (!(fsp->can_read ||
3218                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3219                                 (fsp->access_mask & FILE_EXECUTE)))) {
3220                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3221                                 (int)SVAL(req->vwv+0, 0)));
3222                 reply_readbraw_error(sconn);
3223                 END_PROFILE(SMBreadbraw);
3224                 return;
3225         }
3226
3227         flush_write_cache(fsp, READRAW_FLUSH);
3228
3229         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3230         if(req->wct == 10) {
3231                 /*
3232                  * This is a large offset (64 bit) read.
3233                  */
3234 #ifdef LARGE_SMB_OFF_T
3235
3236                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3237
3238 #else /* !LARGE_SMB_OFF_T */
3239
3240                 /*
3241                  * Ensure we haven't been sent a >32 bit offset.
3242                  */
3243
3244                 if(IVAL(req->vwv+8, 0) != 0) {
3245                         DEBUG(0,("reply_readbraw: large offset "
3246                                 "(%x << 32) used and we don't support "
3247                                 "64 bit offsets.\n",
3248                         (unsigned int)IVAL(req->vwv+8, 0) ));
3249                         reply_readbraw_error(sconn);
3250                         END_PROFILE(SMBreadbraw);
3251                         return;
3252                 }
3253
3254 #endif /* LARGE_SMB_OFF_T */
3255
3256                 if(startpos < 0) {
3257                         DEBUG(0,("reply_readbraw: negative 64 bit "
3258                                 "readraw offset (%.0f) !\n",
3259                                 (double)startpos ));
3260                         reply_readbraw_error(sconn);
3261                         END_PROFILE(SMBreadbraw);
3262                         return;
3263                 }
3264         }
3265
3266         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3267         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3268
3269         /* ensure we don't overrun the packet size */
3270         maxcount = MIN(65535,maxcount);
3271
3272         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3273             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3274             &lock);
3275
3276         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3277                 reply_readbraw_error(sconn);
3278                 END_PROFILE(SMBreadbraw);
3279                 return;
3280         }
3281
3282         if (fsp_stat(fsp) == 0) {
3283                 size = fsp->fsp_name->st.st_ex_size;
3284         }
3285
3286         if (startpos >= size) {
3287                 nread = 0;
3288         } else {
3289                 nread = MIN(maxcount,(size - startpos));
3290         }
3291
3292 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3293         if (nread < mincount)
3294                 nread = 0;
3295 #endif
3296
3297         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3298                 "min=%lu nread=%lu\n",
3299                 fsp->fnum, (double)startpos,
3300                 (unsigned long)maxcount,
3301                 (unsigned long)mincount,
3302                 (unsigned long)nread ) );
3303
3304         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3305
3306         DEBUG(5,("reply_readbraw finished\n"));
3307
3308         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3309
3310         END_PROFILE(SMBreadbraw);
3311         return;
3312 }
3313
3314 #undef DBGC_CLASS
3315 #define DBGC_CLASS DBGC_LOCKING
3316
3317 /****************************************************************************
3318  Reply to a lockread (core+ protocol).
3319 ****************************************************************************/
3320
3321 void reply_lockread(struct smb_request *req)
3322 {
3323         connection_struct *conn = req->conn;
3324         ssize_t nread = -1;
3325         char *data;
3326         SMB_OFF_T startpos;
3327         size_t numtoread;
3328         NTSTATUS status;
3329         files_struct *fsp;
3330         struct byte_range_lock *br_lck = NULL;
3331         char *p = NULL;
3332         struct smbd_server_connection *sconn = req->sconn;
3333
3334         START_PROFILE(SMBlockread);
3335
3336         if (req->wct < 5) {
3337                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3338                 END_PROFILE(SMBlockread);
3339                 return;
3340         }
3341
3342         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3343
3344         if (!check_fsp(conn, req, fsp)) {
3345                 END_PROFILE(SMBlockread);
3346                 return;
3347         }
3348
3349         if (!CHECK_READ(fsp,req)) {
3350                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3351                 END_PROFILE(SMBlockread);
3352                 return;
3353         }
3354
3355         numtoread = SVAL(req->vwv+1, 0);
3356         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3357
3358         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3359
3360         reply_outbuf(req, 5, numtoread + 3);
3361
3362         data = smb_buf(req->outbuf) + 3;
3363
3364         /*
3365          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3366          * protocol request that predates the read/write lock concept.
3367          * Thus instead of asking for a read lock here we need to ask
3368          * for a write lock. JRA.
3369          * Note that the requested lock size is unaffected by max_recv.
3370          */
3371
3372         br_lck = do_lock(req->sconn->msg_ctx,
3373                         fsp,
3374                         (uint64_t)req->smbpid,
3375                         (uint64_t)numtoread,
3376                         (uint64_t)startpos,
3377                         WRITE_LOCK,
3378                         WINDOWS_LOCK,
3379                         False, /* Non-blocking lock. */
3380                         &status,
3381                         NULL,
3382                         NULL);
3383         TALLOC_FREE(br_lck);
3384
3385         if (NT_STATUS_V(status)) {
3386                 reply_nterror(req, status);
3387                 END_PROFILE(SMBlockread);
3388                 return;
3389         }
3390
3391         /*
3392          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3393          */
3394
3395         if (numtoread > sconn->smb1.negprot.max_recv) {
3396                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3397 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3398                         (unsigned int)numtoread,
3399                         (unsigned int)sconn->smb1.negprot.max_recv));
3400                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3401         }
3402         nread = read_file(fsp,data,startpos,numtoread);
3403
3404         if (nread < 0) {
3405                 reply_nterror(req, map_nt_error_from_unix(errno));
3406                 END_PROFILE(SMBlockread);
3407                 return;
3408         }
3409
3410         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3411
3412         SSVAL(req->outbuf,smb_vwv0,nread);
3413         SSVAL(req->outbuf,smb_vwv5,nread+3);
3414         p = smb_buf(req->outbuf);
3415         SCVAL(p,0,0); /* pad byte. */
3416         SSVAL(p,1,nread);
3417
3418         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3419                  fsp->fnum, (int)numtoread, (int)nread));
3420
3421         END_PROFILE(SMBlockread);
3422         return;
3423 }
3424
3425 #undef DBGC_CLASS
3426 #define DBGC_CLASS DBGC_ALL
3427
3428 /****************************************************************************
3429  Reply to a read.
3430 ****************************************************************************/
3431
3432 void reply_read(struct smb_request *req)
3433 {
3434         connection_struct *conn = req->conn;
3435         size_t numtoread;
3436         ssize_t nread = 0;
3437         char *data;
3438         SMB_OFF_T startpos;
3439         int outsize = 0;
3440         files_struct *fsp;
3441         struct lock_struct lock;
3442         struct smbd_server_connection *sconn = req->sconn;
3443
3444         START_PROFILE(SMBread);
3445
3446         if (req->wct < 3) {
3447                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3448                 END_PROFILE(SMBread);
3449                 return;
3450         }
3451
3452         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3453
3454         if (!check_fsp(conn, req, fsp)) {
3455                 END_PROFILE(SMBread);
3456                 return;
3457         }
3458
3459         if (!CHECK_READ(fsp,req)) {
3460                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3461                 END_PROFILE(SMBread);
3462                 return;
3463         }
3464
3465         numtoread = SVAL(req->vwv+1, 0);
3466         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3467
3468         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3469
3470         /*
3471          * The requested read size cannot be greater than max_recv. JRA.
3472          */
3473         if (numtoread > sconn->smb1.negprot.max_recv) {
3474                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3475 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3476                         (unsigned int)numtoread,
3477                         (unsigned int)sconn->smb1.negprot.max_recv));
3478                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3479         }
3480
3481         reply_outbuf(req, 5, numtoread+3);
3482
3483         data = smb_buf(req->outbuf) + 3;
3484
3485         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3486             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3487             &lock);
3488
3489         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3490                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3491                 END_PROFILE(SMBread);
3492                 return;
3493         }
3494
3495         if (numtoread > 0)
3496                 nread = read_file(fsp,data,startpos,numtoread);
3497
3498         if (nread < 0) {
3499                 reply_nterror(req, map_nt_error_from_unix(errno));
3500                 goto strict_unlock;
3501         }
3502
3503         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3504
3505         SSVAL(req->outbuf,smb_vwv0,nread);
3506         SSVAL(req->outbuf,smb_vwv5,nread+3);
3507         SCVAL(smb_buf(req->outbuf),0,1);
3508         SSVAL(smb_buf(req->outbuf),1,nread);
3509
3510         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3511                 fsp->fnum, (int)numtoread, (int)nread ) );
3512
3513 strict_unlock:
3514         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3515
3516         END_PROFILE(SMBread);
3517         return;
3518 }
3519
3520 /****************************************************************************
3521  Setup readX header.
3522 ****************************************************************************/
3523
3524 static int setup_readX_header(struct smb_request *req, char *outbuf,
3525                               size_t smb_maxcnt)
3526 {
3527         int outsize;
3528         char *data;
3529
3530         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3531         data = smb_buf(outbuf);
3532
3533         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3534
3535         SCVAL(outbuf,smb_vwv0,0xFF);
3536         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3537         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3538         SSVAL(outbuf,smb_vwv6,
3539               req_wct_ofs(req)
3540               + 1               /* the wct field */
3541               + 12 * sizeof(uint16_t) /* vwv */
3542               + 2);             /* the buflen field */
3543         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3544         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3545         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3546         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3547         return outsize;
3548 }
3549
3550 /****************************************************************************
3551  Reply to a read and X - possibly using sendfile.
3552 ****************************************************************************/
3553
3554 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3555                             files_struct *fsp, SMB_OFF_T startpos,
3556                             size_t smb_maxcnt)
3557 {
3558         ssize_t nread = -1;
3559         struct lock_struct lock;
3560         int saved_errno = 0;
3561
3562         if(fsp_stat(fsp) == -1) {
3563                 reply_nterror(req, map_nt_error_from_unix(errno));
3564                 return;
3565         }
3566
3567         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3568             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3569             &lock);
3570
3571         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3572                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3573                 return;
3574         }
3575
3576         if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3577                         (startpos > fsp->fsp_name->st.st_ex_size)
3578                         || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3579                 /*
3580                  * We already know that we would do a short read, so don't
3581                  * try the sendfile() path.
3582                  */
3583                 goto nosendfile_read;
3584         }
3585
3586         /*
3587          * We can only use sendfile on a non-chained packet
3588          * but we can use on a non-oplocked file. tridge proved this
3589          * on a train in Germany :-). JRA.
3590          */
3591
3592         if (!req_is_in_chain(req) &&
3593             !is_encrypted_packet(req->sconn, req->inbuf) &&
3594             (fsp->base_fsp == NULL) &&
3595             (fsp->wcp == NULL) &&
3596             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3597                 uint8 headerbuf[smb_size + 12 * 2];
3598                 DATA_BLOB header;
3599
3600                 /*
3601                  * Set up the packet header before send. We
3602                  * assume here the sendfile will work (get the
3603                  * correct amount of data).
3604                  */
3605
3606                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3607
3608                 construct_reply_common_req(req, (char *)headerbuf);
3609                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3610
3611                 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3612                                          startpos, smb_maxcnt);
3613                 if (nread == -1) {
3614                         /* Returning ENOSYS means no data at all was sent.
3615                            Do this as a normal read. */
3616                         if (errno == ENOSYS) {
3617                                 goto normal_read;
3618                         }
3619
3620                         /*
3621                          * Special hack for broken Linux with no working sendfile. If we
3622                          * return EINTR we sent the header but not the rest of the data.
3623                          * Fake this up by doing read/write calls.
3624                          */
3625
3626                         if (errno == EINTR) {
3627                                 /* Ensure we don't do this again. */
3628                                 set_use_sendfile(SNUM(conn), False);
3629                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3630                                 nread = fake_sendfile(fsp, startpos,
3631                                                       smb_maxcnt);
3632                                 if (nread == -1) {
3633                                         DEBUG(0,("send_file_readX: "
3634                                                  "fake_sendfile failed for "
3635                                                  "file %s (%s).\n",
3636                                                  fsp_str_dbg(fsp),
3637                                                  strerror(errno)));
3638                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3639                                 }
3640                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3641                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3642                                 /* No outbuf here means successful sendfile. */
3643                                 goto strict_unlock;
3644                         }
3645
3646                         DEBUG(0,("send_file_readX: sendfile failed for file "
3647                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3648                                  strerror(errno)));
3649                         exit_server_cleanly("send_file_readX sendfile failed");
3650                 } else if (nread == 0) {
3651                         /*
3652                          * Some sendfile implementations return 0 to indicate
3653                          * that there was a short read, but nothing was
3654                          * actually written to the socket.  In this case,
3655                          * fallback to the normal read path so the header gets
3656                          * the correct byte count.
3657                          */
3658                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3659                                   "falling back to the normal read: %s\n",
3660                                   fsp_str_dbg(fsp)));
3661                         goto normal_read;
3662                 }
3663
3664                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3665                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3666
3667                 /* Deal with possible short send. */
3668                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3669                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3670                 }
3671                 /* No outbuf here means successful sendfile. */
3672                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3673                 SMB_PERFCOUNT_END(&req->pcd);
3674                 goto strict_unlock;
3675         }
3676
3677 normal_read:
3678
3679         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3680                 uint8 headerbuf[smb_size + 2*12];
3681
3682                 construct_reply_common_req(req, (char *)headerbuf);
3683                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3684
3685                 /* Send out the header. */
3686                 if (write_data(req->sconn->sock, (char *)headerbuf,
3687                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3688
3689                         char addr[INET6_ADDRSTRLEN];
3690                         /*
3691                          * Try and give an error message saying what
3692                          * client failed.
3693                          */
3694                         DEBUG(0, ("write_data failed for client %s. "
3695                                   "Error %s\n",
3696                                   get_peer_addr(req->sconn->sock, addr,
3697                                                 sizeof(addr)),
3698                                   strerror(errno)));
3699
3700                         DEBUG(0,("send_file_readX: write_data failed for file "
3701                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3702                                  strerror(errno)));
3703                         exit_server_cleanly("send_file_readX sendfile failed");
3704                 }
3705                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3706                 if (nread == -1) {
3707                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3708                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3709                                  strerror(errno)));
3710                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3711                 }
3712                 goto strict_unlock;
3713         }
3714
3715 nosendfile_read:
3716
3717         reply_outbuf(req, 12, smb_maxcnt);
3718
3719         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3720         saved_errno = errno;
3721
3722         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3723
3724         if (nread < 0) {
3725                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3726                 return;
3727         }
3728
3729         setup_readX_header(req, (char *)req->outbuf, nread);
3730
3731         DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3732                     fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3733
3734         chain_reply(req);
3735         return;
3736
3737  strict_unlock:
3738         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3739         TALLOC_FREE(req->outbuf);
3740         return;
3741 }
3742
3743 /****************************************************************************
3744  Reply to a read and X.
3745 ****************************************************************************/
3746
3747 void reply_read_and_X(struct smb_request *req)
3748 {
3749         struct smbd_server_connection *sconn = req->sconn;
3750         connection_struct *conn = req->conn;
3751         files_struct *fsp;
3752         SMB_OFF_T startpos;
3753         size_t smb_maxcnt;
3754         bool big_readX = False;
3755 #if 0
3756         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3757 #endif
3758
3759         START_PROFILE(SMBreadX);
3760
3761         if ((req->wct != 10) && (req->wct != 12)) {
3762                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3763                 return;
3764         }
3765
3766         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3767         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3768         smb_maxcnt = SVAL(req->vwv+5, 0);
3769
3770         /* If it's an IPC, pass off the pipe handler. */
3771         if (IS_IPC(conn)) {
3772                 reply_pipe_read_and_X(req);
3773                 END_PROFILE(SMBreadX);
3774                 return;
3775         }
3776
3777         if (!check_fsp(conn, req, fsp)) {
3778                 END_PROFILE(SMBreadX);
3779                 return;
3780         }
3781
3782         if (!CHECK_READ(fsp,req)) {
3783                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3784                 END_PROFILE(SMBreadX);
3785                 return;
3786         }
3787
3788         if ((sconn->smb1.unix_info.client_cap_low & CIFS_UNIX_LARGE_READ_CAP) ||
3789             (get_remote_arch() == RA_SAMBA)) {
3790                 /*
3791                  * This is Samba only behavior (up to Samba 3.6)!
3792                  *
3793                  * Windows 2008 R2 ignores the upper_size,
3794                  * so we do unless unix extentions are active
3795                  * or "smbclient" is talking to us.
3796                  */
3797                 size_t upper_size = SVAL(req->vwv+7, 0);
3798                 smb_maxcnt |= (upper_size<<16);
3799                 if (upper_size > 1) {
3800                         /* Can't do this on a chained packet. */
3801                         if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3802                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3803                                 END_PROFILE(SMBreadX);
3804                                 return;
3805                         }
3806                         /* We currently don't do this on signed or sealed data. */
3807                         if (srv_is_signing_active(req->sconn) ||
3808                             is_encrypted_packet(req->sconn, req->inbuf)) {
3809                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3810                                 END_PROFILE(SMBreadX);
3811                                 return;
3812                         }
3813                         /* Is there room in the reply for this data ? */
3814                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3815                                 reply_nterror(req,
3816                                               NT_STATUS_INVALID_PARAMETER);
3817                                 END_PROFILE(SMBreadX);
3818                                 return;
3819                         }
3820                         big_readX = True;
3821                 }
3822         }
3823
3824         if (req->wct == 12) {
3825 #ifdef LARGE_SMB_OFF_T
3826                 /*
3827                  * This is a large offset (64 bit) read.
3828                  */
3829                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3830
3831 #else /* !LARGE_SMB_OFF_T */
3832
3833                 /*
3834                  * Ensure we haven't been sent a >32 bit offset.
3835                  */
3836
3837                 if(IVAL(req->vwv+10, 0) != 0) {
3838                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3839                                  "used and we don't support 64 bit offsets.\n",
3840                                  (unsigned int)IVAL(req->vwv+10, 0) ));
3841                         END_PROFILE(SMBreadX);
3842                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3843                         return;
3844                 }
3845
3846 #endif /* LARGE_SMB_OFF_T */
3847
3848         }
3849
3850         if (!big_readX) {
3851                 NTSTATUS status = schedule_aio_read_and_X(conn,
3852                                         req,
3853                                         fsp,
3854                                         startpos,
3855                                         smb_maxcnt);
3856                 if (NT_STATUS_IS_OK(status)) {
3857                         /* Read scheduled - we're done. */
3858                         goto out;
3859                 }
3860                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3861                         /* Real error - report to client. */
3862                         END_PROFILE(SMBreadX);
3863                         reply_nterror(req, status);
3864                         return;
3865                 }
3866                 /* NT_STATUS_RETRY - fall back to sync read. */
3867         }
3868
3869         smbd_lock_socket(req->sconn);
3870         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3871         smbd_unlock_socket(req->sconn);
3872
3873  out:
3874         END_PROFILE(SMBreadX);
3875         return;
3876 }
3877
3878 /****************************************************************************
3879  Error replies to writebraw must have smb_wct == 1. Fix this up.
3880 ****************************************************************************/
3881
3882 void error_to_writebrawerr(struct smb_request *req)
3883 {
3884         uint8 *old_outbuf = req->outbuf;
3885
3886         reply_outbuf(req, 1, 0);
3887
3888         memcpy(req->outbuf, old_outbuf, smb_size);
3889         TALLOC_FREE(old_outbuf);
3890 }
3891
3892 /****************************************************************************
3893  Read 4 bytes of a smb packet and return the smb length of the packet.
3894  Store the result in the buffer. This version of the function will
3895  never return a session keepalive (length of zero).
3896  Timeout is in milliseconds.
3897 ****************************************************************************/
3898
3899 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3900                                 size_t *len)
3901 {
3902         uint8_t msgtype = NBSSkeepalive;
3903
3904         while (msgtype == NBSSkeepalive) {
3905                 NTSTATUS status;
3906
3907                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3908                                                           len);
3909                 if (!NT_STATUS_IS_OK(status)) {
3910                         char addr[INET6_ADDRSTRLEN];
3911                         /* Try and give an error message
3912                          * saying what client failed. */
3913                         DEBUG(0, ("read_fd_with_timeout failed for "
3914                                   "client %s read error = %s.\n",
3915                                   get_peer_addr(fd,addr,sizeof(addr)),
3916                                   nt_errstr(status)));
3917                         return status;
3918                 }
3919
3920                 msgtype = CVAL(inbuf, 0);
3921         }
3922
3923         DEBUG(10,("read_smb_length: got smb length of %lu\n",
3924                   (unsigned long)len));
3925
3926         return NT_STATUS_OK;
3927 }
3928
3929 /****************************************************************************
3930  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3931 ****************************************************************************/
3932
3933 void reply_writebraw(struct smb_request *req)
3934 {
3935         connection_struct *conn = req->conn;
3936         char *buf = NULL;
3937         ssize_t nwritten=0;
3938         ssize_t total_written=0;
3939         size_t numtowrite=0;
3940         size_t tcount;
3941         SMB_OFF_T startpos;
3942         const char *data=NULL;
3943         bool write_through;
3944         files_struct *fsp;
3945         struct lock_struct lock;
3946         NTSTATUS status;
3947
3948         START_PROFILE(SMBwritebraw);
3949
3950         /*
3951          * If we ever reply with an error, it must have the SMB command
3952          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3953          * we're finished.
3954          */
3955         SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
3956
3957         if (srv_is_signing_active(req->sconn)) {
3958                 END_PROFILE(SMBwritebraw);
3959                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3960                                 "raw reads/writes are disallowed.");
3961         }
3962
3963         if (req->wct < 12) {
3964                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3965                 error_to_writebrawerr(req);
3966                 END_PROFILE(SMBwritebraw);
3967                 return;
3968         }
3969
3970         if (req->sconn->smb1.echo_handler.trusted_fde) {
3971                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3972                          "'async smb echo handler = yes'\n"));
3973                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3974                 error_to_writebrawerr(req);
3975                 END_PROFILE(SMBwritebraw);
3976                 return;
3977         }
3978
3979         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3980         if (!check_fsp(conn, req, fsp)) {
3981                 error_to_writebrawerr(req);
3982                 END_PROFILE(SMBwritebraw);
3983                 return;
3984         }
3985
3986         if (!CHECK_WRITE(fsp)) {
3987                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3988                 error_to_writebrawerr(req);
3989                 END_PROFILE(SMBwritebraw);
3990                 return;
3991         }
3992
3993         tcount = IVAL(req->vwv+1, 0);
3994         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3995         write_through = BITSETW(req->vwv+7,0);
3996
3997         /* We have to deal with slightly different formats depending
3998                 on whether we are using the core+ or lanman1.0 protocol */
3999
4000         if(get_Protocol() <= PROTOCOL_COREPLUS) {
4001                 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4002                 data = smb_buf_const(req->inbuf);
4003         } else {
4004                 numtowrite = SVAL(req->vwv+10, 0);
4005                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4006         }
4007
4008         /* Ensure we don't write bytes past the end of this packet. */
4009         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4010                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4011                 error_to_writebrawerr(req);
4012                 END_PROFILE(SMBwritebraw);
4013                 return;
4014         }
4015
4016         if (!fsp->print_file) {
4017                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4018                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4019                     &lock);
4020
4021                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4022                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4023                         error_to_writebrawerr(req);
4024                         END_PROFILE(SMBwritebraw);
4025                         return;
4026                 }
4027         }
4028
4029         if (numtowrite>0) {
4030                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4031         }
4032
4033         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
4034                         "wrote=%d sync=%d\n",
4035                 fsp->fnum, (double)startpos, (int)numtowrite,
4036                 (int)nwritten, (int)write_through));
4037
4038         if (nwritten < (ssize_t)numtowrite)  {
4039                 reply_nterror(req, NT_STATUS_DISK_FULL);
4040                 error_to_writebrawerr(req);
4041                 goto strict_unlock;
4042         }
4043
4044         total_written = nwritten;
4045
4046         /* Allocate a buffer of 64k + length. */
4047         buf = talloc_array(NULL, char, 65540);
4048         if (!buf) {
4049                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4050                 error_to_writebrawerr(req);
4051                 goto strict_unlock;
4052         }
4053
4054         /* Return a SMBwritebraw message to the redirector to tell
4055          * it to send more bytes */
4056
4057         memcpy(buf, req->inbuf, smb_size);
4058         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4059         SCVAL(buf,smb_com,SMBwritebraw);
4060         SSVALS(buf,smb_vwv0,0xFFFF);
4061         show_msg(buf);
4062         if (!srv_send_smb(req->sconn,
4063                           buf,
4064                           false, 0, /* no signing */
4065                           IS_CONN_ENCRYPTED(conn),
4066                           &req->pcd)) {
4067                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4068                         "failed.");
4069         }
4070
4071         /* Now read the raw data into the buffer and write it */
4072         status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4073                                  &numtowrite);
4074         if (!NT_STATUS_IS_OK(status)) {
4075                 exit_server_cleanly("secondary writebraw failed");
4076         }
4077
4078         /* Set up outbuf to return the correct size */
4079         reply_outbuf(req, 1, 0);
4080
4081         if (numtowrite != 0) {
4082
4083                 if (numtowrite > 0xFFFF) {
4084                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4085                                 "raw requested (%u). Terminating\n",
4086                                 (unsigned int)numtowrite ));
4087                         exit_server_cleanly("secondary writebraw failed");
4088                 }
4089
4090                 if (tcount > nwritten+numtowrite) {
4091                         DEBUG(3,("reply_writebraw: Client overestimated the "
4092                                 "write %d %d %d\n",
4093                                 (int)tcount,(int)nwritten,(int)numtowrite));
4094                 }
4095
4096                 status = read_data(req->sconn->sock, buf+4, numtowrite);
4097
4098                 if (!NT_STATUS_IS_OK(status)) {
4099                         char addr[INET6_ADDRSTRLEN];
4100                         /* Try and give an error message
4101                          * saying what client failed. */
4102                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4103                                   "raw read failed (%s) for client %s. "
4104                                   "Terminating\n", nt_errstr(status),
4105                                   get_peer_addr(req->sconn->sock, addr,
4106                                                 sizeof(addr))));
4107                         exit_server_cleanly("secondary writebraw failed");
4108                 }
4109
4110                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4111                 if (nwritten == -1) {
4112                         TALLOC_FREE(buf);
4113                         reply_nterror(req, map_nt_error_from_unix(errno));
4114                         error_to_writebrawerr(req);
4115                         goto strict_unlock;
4116                 }
4117
4118                 if (nwritten < (ssize_t)numtowrite) {
4119                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4120                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4121                 }
4122
4123                 if (nwritten > 0) {
4124                         total_written += nwritten;
4125                 }
4126         }
4127
4128         TALLOC_FREE(buf);
4129         SSVAL(req->outbuf,smb_vwv0,total_written);
4130
4131         status = sync_file(conn, fsp, write_through);
4132         if (!NT_STATUS_IS_OK(status)) {
4133                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4134                          fsp_str_dbg(fsp), nt_errstr(status)));
4135                 reply_nterror(req, status);
4136                 error_to_writebrawerr(req);
4137                 goto strict_unlock;
4138         }
4139
4140         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4141                 "wrote=%d\n",
4142                 fsp->fnum, (double)startpos, (int)numtowrite,
4143                 (int)total_written));
4144
4145         if (!fsp->print_file) {
4146                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4147         }
4148
4149         /* We won't return a status if write through is not selected - this
4150          * follows what WfWg does */
4151         END_PROFILE(SMBwritebraw);
4152
4153         if (!write_through && total_written==tcount) {
4154
4155 #if RABBIT_PELLET_FIX
4156                 /*
4157                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4158                  * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4159                  * JRA.
4160                  */
4161                 if (!send_keepalive(req->sconn->sock)) {
4162                         exit_server_cleanly("reply_writebraw: send of "
4163                                 "keepalive failed");
4164                 }
4165 #endif
4166                 TALLOC_FREE(req->outbuf);
4167         }
4168         return;
4169
4170 strict_unlock:
4171         if (!fsp->print_file) {
4172                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4173         }
4174
4175         END_PROFILE(SMBwritebraw);
4176         return;
4177 }
4178
4179 #undef DBGC_CLASS
4180 #define DBGC_CLASS DBGC_LOCKING
4181
4182 /****************************************************************************
4183  Reply to a writeunlock (core+).
4184 ****************************************************************************/
4185
4186 void reply_writeunlock(struct smb_request *req)
4187 {
4188         connection_struct *conn = req->conn;
4189         ssize_t nwritten = -1;
4190         size_t numtowrite;
4191         SMB_OFF_T startpos;
4192         const char *data;
4193         NTSTATUS status = NT_STATUS_OK;
4194         files_struct *fsp;
4195         struct lock_struct lock;
4196         int saved_errno = 0;
4197
4198         START_PROFILE(SMBwriteunlock);
4199
4200         if (req->wct < 5) {
4201                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4202                 END_PROFILE(SMBwriteunlock);
4203                 return;
4204         }
4205
4206         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4207
4208         if (!check_fsp(conn, req, fsp)) {
4209                 END_PROFILE(SMBwriteunlock);
4210                 return;
4211         }
4212
4213         if (!CHECK_WRITE(fsp)) {
4214                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4215                 END_PROFILE(SMBwriteunlock);
4216                 return;
4217         }
4218
4219         numtowrite = SVAL(req->vwv+1, 0);
4220         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4221         data = (const char *)req->buf + 3;
4222
4223         if (!fsp->print_file && numtowrite > 0) {
4224                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4225                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4226                     &lock);
4227
4228                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4229                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4230                         END_PROFILE(SMBwriteunlock);
4231                         return;
4232                 }
4233         }
4234
4235         /* The special X/Open SMB protocol handling of
4236            zero length writes is *NOT* done for
4237            this call */
4238         if(numtowrite == 0) {
4239                 nwritten = 0;
4240         } else {
4241                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4242                 saved_errno = errno;
4243         }
4244
4245         status = sync_file(conn, fsp, False /* write through */);
4246         if (!NT_STATUS_IS_OK(status)) {
4247                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4248                          fsp_str_dbg(fsp), nt_errstr(status)));
4249                 reply_nterror(req, status);
4250                 goto strict_unlock;
4251         }
4252
4253         if(nwritten < 0) {
4254                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4255                 goto strict_unlock;
4256         }
4257
4258         if((nwritten < numtowrite) && (numtowrite != 0)) {
4259                 reply_nterror(req, NT_STATUS_DISK_FULL);
4260                 goto strict_unlock;
4261         }
4262
4263         if (numtowrite && !fsp->print_file) {
4264                 status = do_unlock(req->sconn->msg_ctx,
4265                                 fsp,
4266                                 (uint64_t)req->smbpid,
4267                                 (uint64_t)numtowrite,
4268                                 (uint64_t)startpos,
4269                                 WINDOWS_LOCK);
4270
4271                 if (NT_STATUS_V(status)) {
4272                         reply_nterror(req, status);
4273                         goto strict_unlock;
4274                 }
4275         }
4276
4277         reply_outbuf(req, 1, 0);
4278
4279         SSVAL(req->outbuf,smb_vwv0,nwritten);
4280
4281         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4282                  fsp->fnum, (int)numtowrite, (int)nwritten));
4283
4284 strict_unlock:
4285         if (numtowrite && !fsp->print_file) {
4286                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4287         }
4288
4289         END_PROFILE(SMBwriteunlock);
4290         return;
4291 }
4292
4293 #undef DBGC_CLASS
4294 #define DBGC_CLASS DBGC_ALL
4295
4296 /****************************************************************************
4297  Reply to a write.
4298 ****************************************************************************/
4299
4300 void reply_write(struct smb_request *req)
4301 {
4302         connection_struct *conn = req->conn;
4303         size_t numtowrite;
4304         ssize_t nwritten = -1;
4305         SMB_OFF_T startpos;
4306         const char *data;
4307         files_struct *fsp;
4308         struct lock_struct lock;
4309         NTSTATUS status;
4310         int saved_errno = 0;
4311
4312         START_PROFILE(SMBwrite);
4313
4314         if (req->wct < 5) {
4315                 END_PROFILE(SMBwrite);
4316                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4317                 return;
4318         }
4319
4320         /* If it's an IPC, pass off the pipe handler. */
4321         if (IS_IPC(conn)) {
4322                 reply_pipe_write(req);
4323                 END_PROFILE(SMBwrite);
4324                 return;
4325         }
4326
4327         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4328
4329         if (!check_fsp(conn, req, fsp)) {
4330                 END_PROFILE(SMBwrite);
4331                 return;
4332         }
4333
4334         if (!CHECK_WRITE(fsp)) {
4335                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4336                 END_PROFILE(SMBwrite);
4337                 return;
4338         }
4339
4340         numtowrite = SVAL(req->vwv+1, 0);
4341         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4342         data = (const char *)req->buf + 3;
4343
4344         if (!fsp->print_file) {
4345                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4346                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4347                         &lock);
4348
4349                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4350                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4351                         END_PROFILE(SMBwrite);
4352                         return;
4353                 }
4354         }
4355
4356         /*
4357          * X/Open SMB protocol says that if smb_vwv1 is
4358          * zero then the file size should be extended or
4359          * truncated to the size given in smb_vwv[2-3].
4360          */
4361
4362         if(numtowrite == 0) {
4363                 /*
4364                  * This is actually an allocate call, and set EOF. JRA.
4365                  */
4366                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4367                 if (nwritten < 0) {
4368                         reply_nterror(req, NT_STATUS_DISK_FULL);
4369                         goto strict_unlock;
4370                 }
4371                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4372                 if (nwritten < 0) {
4373                         reply_nterror(req, NT_STATUS_DISK_FULL);
4374                         goto strict_unlock;
4375                 }
4376                 trigger_write_time_update_immediate(fsp);
4377         } else {
4378                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4379         }
4380
4381         status = sync_file(conn, fsp, False);
4382         if (!NT_STATUS_IS_OK(status)) {
4383                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4384                          fsp_str_dbg(fsp), nt_errstr(status)));
4385                 reply_nterror(req, status);
4386                 goto strict_unlock;
4387         }
4388
4389         if(nwritten < 0) {
4390                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4391                 goto strict_unlock;
4392         }
4393
4394         if((nwritten == 0) && (numtowrite != 0)) {
4395                 reply_nterror(req, NT_STATUS_DISK_FULL);
4396                 goto strict_unlock;
4397         }
4398
4399         reply_outbuf(req, 1, 0);
4400
4401         SSVAL(req->outbuf,smb_vwv0,nwritten);
4402
4403         if (nwritten < (ssize_t)numtowrite) {
4404                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4405                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4406         }
4407
4408         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4409
4410 strict_unlock:
4411         if (!fsp->print_file) {
4412                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4413         }
4414
4415         END_PROFILE(SMBwrite);
4416         return;
4417 }
4418
4419 /****************************************************************************
4420  Ensure a buffer is a valid writeX for recvfile purposes.
4421 ****************************************************************************/
4422
4423 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4424                                                 (2*14) + /* word count (including bcc) */ \
4425                                                 1 /* pad byte */)
4426
4427 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4428                             const uint8_t *inbuf)
4429 {
4430         size_t numtowrite;
4431         connection_struct *conn = NULL;
4432         unsigned int doff = 0;
4433         size_t len = smb_len_large(inbuf);
4434
4435         if (is_encrypted_packet(sconn, inbuf)) {
4436                 /* Can't do this on encrypted
4437                  * connections. */
4438                 return false;
4439         }
4440
4441         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4442                 return false;
4443         }
4444
4445         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4446                         CVAL(inbuf,smb_wct) != 14) {
4447                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4448                         "invalid word length.\n"));
4449                 return false;
4450         }
4451
4452         conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4453         if (conn == NULL) {
4454                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4455                 return false;
4456         }
4457         if (IS_IPC(conn)) {
4458                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4459                 return false;
4460         }
4461         if (IS_PRINT(conn)) {
4462                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4463                 return false;
4464         }
4465         doff = SVAL(inbuf,smb_vwv11);
4466
4467         numtowrite = SVAL(inbuf,smb_vwv10);
4468
4469         if (len > doff && len - doff > 0xFFFF) {
4470                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4471         }
4472
4473         if (numtowrite == 0) {
4474                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4475                 return false;
4476         }
4477
4478         /* Ensure the sizes match up. */
4479         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4480                 /* no pad byte...old smbclient :-( */
4481                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4482                         (unsigned int)doff,
4483                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4484                 return false;
4485         }
4486
4487         if (len - doff != numtowrite) {
4488                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4489                         "len = %u, doff = %u, numtowrite = %u\n",
4490                         (unsigned int)len,
4491                         (unsigned int)doff,
4492                         (unsigned int)numtowrite ));
4493                 return false;
4494         }
4495
4496         DEBUG(10,("is_valid_writeX_buffer: true "
4497                 "len = %u, doff = %u, numtowrite = %u\n",
4498                 (unsigned int)len,
4499                 (unsigned int)doff,
4500                 (unsigned int)numtowrite ));
4501
4502         return true;
4503 }
4504
4505 /****************************************************************************
4506  Reply to a write and X.
4507 ****************************************************************************/
4508
4509 void reply_write_and_X(struct smb_request *req)
4510 {
4511         connection_struct *conn = req->conn;
4512         files_struct *fsp;
4513         struct lock_struct lock;
4514         SMB_OFF_T startpos;
4515         size_t numtowrite;
4516         bool write_through;
4517         ssize_t nwritten;
4518         unsigned int smb_doff;
4519         unsigned int smblen;
4520         const char *data;
4521         NTSTATUS status;
4522         int saved_errno = 0;
4523
4524         START_PROFILE(SMBwriteX);
4525
4526         if ((req->wct != 12) && (req->wct != 14)) {
4527                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4528                 END_PROFILE(SMBwriteX);
4529                 return;
4530         }
4531
4532         numtowrite = SVAL(req->vwv+10, 0);
4533         smb_doff = SVAL(req->vwv+11, 0);
4534         smblen = smb_len(req->inbuf);
4535
4536         if (req->unread_bytes > 0xFFFF ||
4537                         (smblen > smb_doff &&
4538                                 smblen - smb_doff > 0xFFFF)) {
4539                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4540         }
4541
4542         if (req->unread_bytes) {
4543                 /* Can't do a recvfile write on IPC$ */
4544                 if (IS_IPC(conn)) {
4545                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4546                         END_PROFILE(SMBwriteX);
4547                         return;
4548                 }
4549                 if (numtowrite != req->unread_bytes) {
4550                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4551                         END_PROFILE(SMBwriteX);
4552                         return;
4553                 }
4554         } else {
4555                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4556                                 smb_doff + numtowrite > smblen) {
4557                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4558                         END_PROFILE(SMBwriteX);
4559                         return;
4560                 }
4561         }
4562
4563         /* If it's an IPC, pass off the pipe handler. */
4564         if (IS_IPC(conn)) {
4565                 if (req->unread_bytes) {
4566                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4567                         END_PROFILE(SMBwriteX);
4568                         return;
4569                 }
4570                 reply_pipe_write_and_X(req);
4571                 END_PROFILE(SMBwriteX);
4572                 return;
4573         }
4574
4575         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4576         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4577         write_through = BITSETW(req->vwv+7,0);
4578
4579         if (!check_fsp(conn, req, fsp)) {
4580                 END_PROFILE(SMBwriteX);
4581                 return;
4582         }
4583
4584         if (!CHECK_WRITE(fsp)) {
4585                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4586                 END_PROFILE(SMBwriteX);
4587                 return;
4588         }
4589
4590         data = smb_base(req->inbuf) + smb_doff;
4591
4592         if(req->wct == 14) {
4593 #ifdef LARGE_SMB_OFF_T
4594                 /*
4595                  * This is a large offset (64 bit) write.
4596                  */
4597                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4598
4599 #else /* !LARGE_SMB_OFF_T */
4600
4601                 /*
4602                  * Ensure we haven't been sent a >32 bit offset.
4603                  */
4604
4605                 if(IVAL(req->vwv+12, 0) != 0) {
4606                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4607                                  "used and we don't support 64 bit offsets.\n",
4608                                  (unsigned int)IVAL(req->vwv+12, 0) ));
4609                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4610                         END_PROFILE(SMBwriteX);
4611                         return;
4612                 }
4613
4614 #endif /* LARGE_SMB_OFF_T */
4615         }
4616
4617         /* X/Open SMB protocol says that, unlike SMBwrite
4618         if the length is zero then NO truncation is
4619         done, just a write of zero. To truncate a file,
4620         use SMBwrite. */
4621
4622         if(numtowrite == 0) {
4623                 nwritten = 0;
4624         } else {
4625                 if (req->unread_bytes == 0) {
4626                         status = schedule_aio_write_and_X(conn,
4627                                                 req,
4628                                                 fsp,
4629                                                 data,
4630                                                 startpos,
4631                                                 numtowrite);
4632
4633                         if (NT_STATUS_IS_OK(status)) {
4634                                 /* write scheduled - we're done. */
4635                                 goto out;
4636                         }
4637                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4638                                 /* Real error - report to client. */
4639                                 reply_nterror(req, status);
4640                                 goto out;
4641                         }
4642                         /* NT_STATUS_RETRY - fall through to sync write. */
4643                 }
4644
4645                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4646                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4647                     &lock);
4648
4649                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4650                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4651                         goto out;
4652                 }
4653
4654                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4655                 saved_errno = errno;
4656
4657                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4658         }
4659
4660         if(nwritten < 0) {
4661                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4662                 goto out;
4663         }
4664
4665         if((nwritten == 0) && (numtowrite != 0)) {
4666                 reply_nterror(req, NT_STATUS_DISK_FULL);
4667                 goto out;
4668         }
4669
4670         reply_outbuf(req, 6, 0);
4671         SSVAL(req->outbuf,smb_vwv2,nwritten);
4672         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4673
4674         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4675                 fsp->fnum, (int)numtowrite, (int)nwritten));
4676
4677         status = sync_file(conn, fsp, write_through);
4678         if (!NT_STATUS_IS_OK(status)) {
4679                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4680                          fsp_str_dbg(fsp), nt_errstr(status)));
4681                 reply_nterror(req, status);
4682                 goto out;
4683         }
4684
4685         END_PROFILE(SMBwriteX);
4686         chain_reply(req);
4687         return;
4688
4689 out:
4690         END_PROFILE(SMBwriteX);
4691         return;
4692 }
4693
4694 /****************************************************************************
4695  Reply to a lseek.
4696 ****************************************************************************/
4697
4698 void reply_lseek(struct smb_request *req)
4699 {
4700         connection_struct *conn = req->conn;
4701         SMB_OFF_T startpos;
4702         SMB_OFF_T res= -1;
4703         int mode,umode;
4704         files_struct *fsp;
4705
4706         START_PROFILE(SMBlseek);
4707
4708         if (req->wct < 4) {
4709                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4710                 END_PROFILE(SMBlseek);
4711                 return;
4712         }
4713
4714         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4715
4716         if (!check_fsp(conn, req, fsp)) {
4717                 return;
4718         }
4719
4720         flush_write_cache(fsp, SEEK_FLUSH);
4721
4722         mode = SVAL(req->vwv+1, 0) & 3;
4723         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4724         startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4725
4726         switch (mode) {
4727                 case 0:
4728                         umode = SEEK_SET;
4729                         res = startpos;
4730                         break;
4731                 case 1:
4732                         umode = SEEK_CUR;
4733                         res = fsp->fh->pos + startpos;
4734                         break;
4735                 case 2:
4736                         umode = SEEK_END;
4737                         break;
4738                 default:
4739                         umode = SEEK_SET;
4740                         res = startpos;
4741                         break;
4742         }
4743
4744         if (umode == SEEK_END) {
4745                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4746                         if(errno == EINVAL) {
4747                                 SMB_OFF_T current_pos = startpos;
4748
4749                                 if(fsp_stat(fsp) == -1) {
4750                                         reply_nterror(req,
4751                                                 map_nt_error_from_unix(errno));
4752                                         END_PROFILE(SMBlseek);
4753                                         return;
4754                                 }
4755
4756                                 current_pos += fsp->fsp_name->st.st_ex_size;
4757                                 if(current_pos < 0)
4758                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4759                         }
4760                 }
4761
4762                 if(res == -1) {
4763                         reply_nterror(req, map_nt_error_from_unix(errno));
4764                         END_PROFILE(SMBlseek);
4765                         return;
4766                 }
4767         }
4768
4769         fsp->fh->pos = res;
4770
4771         reply_outbuf(req, 2, 0);
4772         SIVAL(req->outbuf,smb_vwv0,res);
4773
4774         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4775                 fsp->fnum, (double)startpos, (double)res, mode));
4776
4777         END_PROFILE(SMBlseek);
4778         return;
4779 }
4780
4781 /****************************************************************************
4782  Reply to a flush.
4783 ****************************************************************************/
4784
4785 void reply_flush(struct smb_request *req)
4786 {
4787         connection_struct *conn = req->conn;
4788         uint16 fnum;
4789         files_struct *fsp;
4790
4791         START_PROFILE(SMBflush);
4792
4793         if (req->wct < 1) {
4794                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4795                 return;
4796         }
4797
4798         fnum = SVAL(req->vwv+0, 0);
4799         fsp = file_fsp(req, fnum);
4800
4801         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4802                 return;
4803         }
4804
4805         if (!fsp) {
4806                 file_sync_all(conn);
4807         } else {
4808                 NTSTATUS status = sync_file(conn, fsp, True);
4809                 if (!NT_STATUS_IS_OK(status)) {
4810                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4811                                 fsp_str_dbg(fsp), nt_errstr(status)));
4812                         reply_nterror(req, status);
4813                         END_PROFILE(SMBflush);
4814                         return;
4815                 }
4816         }
4817
4818         reply_outbuf(req, 0, 0);
4819
4820         DEBUG(3,("flush\n"));
4821         END_PROFILE(SMBflush);
4822         return;
4823 }
4824
4825 /****************************************************************************
4826  Reply to a exit.
4827  conn POINTER CAN BE NULL HERE !
4828 ****************************************************************************/
4829
4830 void reply_exit(struct smb_request *req)
4831 {
4832         START_PROFILE(SMBexit);
4833
4834         file_close_pid(req->sconn, req->smbpid, req->vuid);
4835
4836         reply_outbuf(req, 0, 0);
4837
4838         DEBUG(3,("exit\n"));
4839
4840         END_PROFILE(SMBexit);
4841         return;
4842 }
4843
4844 /****************************************************************************
4845  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4846 ****************************************************************************/
4847
4848 void reply_close(struct smb_request *req)
4849 {
4850         connection_struct *conn = req->conn;
4851         NTSTATUS status = NT_STATUS_OK;
4852         files_struct *fsp = NULL;
4853         START_PROFILE(SMBclose);
4854
4855         if (req->wct < 3) {
4856                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4857                 END_PROFILE(SMBclose);
4858                 return;
4859         }
4860
4861         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4862
4863         /*
4864          * We can only use check_fsp if we know it's not a directory.
4865          */
4866
4867         if (!check_fsp_open(conn, req, fsp)) {
4868                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4869                 END_PROFILE(SMBclose);
4870                 return;
4871         }
4872
4873         if(fsp->is_directory) {
4874                 /*
4875                  * Special case - close NT SMB directory handle.
4876                  */
4877                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4878                 status = close_file(req, fsp, NORMAL_CLOSE);
4879         } else {
4880                 time_t t;
4881                 /*
4882                  * Close ordinary file.
4883                  */
4884
4885                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4886                          fsp->fh->fd, fsp->fnum,
4887                          conn->num_files_open));
4888
4889                 /*
4890                  * Take care of any time sent in the close.
4891                  */
4892
4893                 t = srv_make_unix_date3(req->vwv+1);
4894                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4895
4896                 /*
4897                  * close_file() returns the unix errno if an error
4898                  * was detected on close - normally this is due to
4899                  * a disk full error. If not then it was probably an I/O error.
4900                  */
4901
4902                 status = close_file(req, fsp, NORMAL_CLOSE);
4903         }
4904
4905         if (!NT_STATUS_IS_OK(status)) {
4906                 reply_nterror(req, status);
4907                 END_PROFILE(SMBclose);
4908                 return;
4909         }
4910
4911         reply_outbuf(req, 0, 0);
4912         END_PROFILE(SMBclose);
4913         return;
4914 }
4915
4916 /****************************************************************************
4917  Reply to a writeclose (Core+ protocol).
4918 ****************************************************************************/
4919
4920 void reply_writeclose(struct smb_request *req)
4921 {
4922         connection_struct *conn = req->conn;
4923         size_t numtowrite;
4924         ssize_t nwritten = -1;
4925         NTSTATUS close_status = NT_STATUS_OK;
4926         SMB_OFF_T startpos;
4927         const char *data;
4928         struct timespec mtime;
4929         files_struct *fsp;
4930         struct lock_struct lock;
4931
4932         START_PROFILE(SMBwriteclose);
4933
4934         if (req->wct < 6) {
4935                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4936                 END_PROFILE(SMBwriteclose);
4937                 return;
4938         }
4939
4940         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4941
4942         if (!check_fsp(conn, req, fsp)) {
4943                 END_PROFILE(SMBwriteclose);
4944                 return;
4945         }
4946         if (!CHECK_WRITE(fsp)) {
4947                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4948                 END_PROFILE(SMBwriteclose);
4949                 return;
4950         }
4951
4952         numtowrite = SVAL(req->vwv+1, 0);
4953         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4954         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4955         data = (const char *)req->buf + 1;
4956
4957         if (!fsp->print_file) {
4958                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4959                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4960                     &lock);
4961
4962                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4963                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4964                         END_PROFILE(SMBwriteclose);
4965                         return;
4966                 }
4967         }
4968
4969         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4970
4971         set_close_write_time(fsp, mtime);
4972
4973         /*
4974          * More insanity. W2K only closes the file if writelen > 0.
4975          * JRA.
4976          */
4977
4978         if (numtowrite) {
4979                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4980                          "file %s\n", fsp_str_dbg(fsp)));
4981                 close_status = close_file(req, fsp, NORMAL_CLOSE);
4982         }
4983
4984         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4985                  fsp->fnum, (int)numtowrite, (int)nwritten,
4986                  conn->num_files_open));
4987
4988         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4989                 reply_nterror(req, NT_STATUS_DISK_FULL);
4990                 goto strict_unlock;
4991         }
4992
4993         if(!NT_STATUS_IS_OK(close_status)) {
4994                 reply_nterror(req, close_status);
4995                 goto strict_unlock;
4996         }
4997
4998         reply_outbuf(req, 1, 0);
4999
5000         SSVAL(req->outbuf,smb_vwv0,nwritten);
5001
5002 strict_unlock:
5003         if (numtowrite && !fsp->print_file) {
5004                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5005         }
5006
5007         END_PROFILE(SMBwriteclose);
5008         return;
5009 }
5010
5011 #undef DBGC_CLASS
5012 #define DBGC_CLASS DBGC_LOCKING
5013
5014 /****************************************************************************
5015  Reply to a lock.
5016 ****************************************************************************/
5017
5018 void reply_lock(struct smb_request *req)
5019 {
5020         connection_struct *conn = req->conn;
5021         uint64_t count,offset;
5022         NTSTATUS status;
5023         files_struct *fsp;
5024         struct byte_range_lock *br_lck = NULL;
5025
5026         START_PROFILE(SMBlock);
5027
5028         if (req->wct < 5) {
5029                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5030                 END_PROFILE(SMBlock);
5031                 return;
5032         }
5033
5034         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5035
5036         if (!check_fsp(conn, req, fsp)) {
5037                 END_PROFILE(SMBlock);
5038                 return;
5039         }
5040
5041         count = (uint64_t)IVAL(req->vwv+1, 0);
5042         offset = (uint64_t)IVAL(req->vwv+3, 0);
5043
5044         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5045                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
5046
5047         br_lck = do_lock(req->sconn->msg_ctx,
5048                         fsp,
5049                         (uint64_t)req->smbpid,
5050                         count,
5051                         offset,
5052                         WRITE_LOCK,
5053                         WINDOWS_LOCK,
5054                         False, /* Non-blocking lock. */
5055                         &status,
5056                         NULL,
5057                         NULL);
5058
5059         TALLOC_FREE(br_lck);
5060
5061         if (NT_STATUS_V(status)) {
5062                 reply_nterror(req, status);
5063                 END_PROFILE(SMBlock);
5064                 return;
5065         }
5066
5067         reply_outbuf(req, 0, 0);
5068
5069         END_PROFILE(SMBlock);
5070         return;
5071 }
5072
5073 /****************************************************************************
5074  Reply to a unlock.
5075 ****************************************************************************/
5076
5077 void reply_unlock(struct smb_request *req)
5078 {
5079         connection_struct *conn = req->conn;
5080         uint64_t count,offset;
5081         NTSTATUS status;
5082         files_struct *fsp;
5083
5084         START_PROFILE(SMBunlock);
5085
5086         if (req->wct < 5) {
5087                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5088                 END_PROFILE(SMBunlock);
5089                 return;
5090         }
5091
5092         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5093
5094         if (!check_fsp(conn, req, fsp)) {
5095                 END_PROFILE(SMBunlock);
5096                 return;
5097         }
5098
5099         count = (uint64_t)IVAL(req->vwv+1, 0);
5100         offset = (uint64_t)IVAL(req->vwv+3, 0);
5101
5102         status = do_unlock(req->sconn->msg_ctx,
5103                         fsp,
5104                         (uint64_t)req->smbpid,
5105                         count,
5106                         offset,
5107                         WINDOWS_LOCK);
5108
5109         if (NT_STATUS_V(status)) {
5110                 reply_nterror(req, status);
5111                 END_PROFILE(SMBunlock);
5112                 return;
5113         }
5114
5115         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5116                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5117
5118         reply_outbuf(req, 0, 0);
5119
5120         END_PROFILE(SMBunlock);
5121         return;
5122 }
5123
5124 #undef DBGC_CLASS
5125 #define DBGC_CLASS DBGC_ALL
5126
5127 /****************************************************************************
5128  Reply to a tdis.
5129  conn POINTER CAN BE NULL HERE !
5130 ****************************************************************************/
5131
5132 void reply_tdis(struct smb_request *req)
5133 {
5134         connection_struct *conn = req->conn;
5135         START_PROFILE(SMBtdis);
5136
5137         if (!conn) {
5138                 DEBUG(4,("Invalid connection in tdis\n"));
5139                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5140                 END_PROFILE(SMBtdis);
5141                 return;
5142         }
5143
5144         conn->used = False;
5145
5146         close_cnum(conn,req->vuid);
5147         req->conn = NULL;
5148
5149         reply_outbuf(req, 0, 0);
5150         END_PROFILE(SMBtdis);
5151         return;
5152 }
5153
5154 /****************************************************************************
5155  Reply to a echo.
5156  conn POINTER CAN BE NULL HERE !
5157 ****************************************************************************/
5158
5159 void reply_echo(struct smb_request *req)
5160 {
5161         connection_struct *conn = req->conn;
5162         struct smb_perfcount_data local_pcd;
5163         struct smb_perfcount_data *cur_pcd;
5164         int smb_reverb;
5165         int seq_num;
5166
5167         START_PROFILE(SMBecho);
5168
5169         smb_init_perfcount_data(&local_pcd);
5170
5171         if (req->wct < 1) {
5172                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5173                 END_PROFILE(SMBecho);
5174                 return;
5175         }
5176
5177         smb_reverb = SVAL(req->vwv+0, 0);
5178
5179         reply_outbuf(req, 1, req->buflen);
5180
5181         /* copy any incoming data back out */
5182         if (req->buflen > 0) {
5183                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5184         }
5185
5186         if (smb_reverb > 100) {
5187                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5188                 smb_reverb = 100;
5189         }
5190
5191         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5192
5193                 /* this makes sure we catch the request pcd */
5194                 if (seq_num == smb_reverb) {
5195                         cur_pcd = &req->pcd;
5196                 } else {
5197                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5198                         cur_pcd = &local_pcd;
5199                 }
5200
5201                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5202
5203                 show_msg((char *)req->outbuf);
5204                 if (!srv_send_smb(req->sconn,
5205                                 (char *)req->outbuf,
5206                                 true, req->seqnum+1,
5207                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5208                                 cur_pcd))
5209                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5210         }
5211
5212         DEBUG(3,("echo %d times\n", smb_reverb));
5213
5214         TALLOC_FREE(req->outbuf);
5215
5216         END_PROFILE(SMBecho);
5217         return;
5218 }
5219
5220 /****************************************************************************
5221  Reply to a printopen.
5222 ****************************************************************************/
5223
5224 void reply_printopen(struct smb_request *req)
5225 {
5226         connection_struct *conn = req->conn;
5227         files_struct *fsp;
5228         NTSTATUS status;
5229
5230         START_PROFILE(SMBsplopen);
5231
5232         if (req->wct < 2) {
5233                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5234                 END_PROFILE(SMBsplopen);
5235                 return;
5236         }
5237
5238         if (!CAN_PRINT(conn)) {
5239                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5240                 END_PROFILE(SMBsplopen);
5241                 return;
5242         }
5243
5244         status = file_new(req, conn, &fsp);
5245         if(!NT_STATUS_IS_OK(status)) {
5246                 reply_nterror(req, status);
5247                 END_PROFILE(SMBsplopen);
5248                 return;
5249         }
5250
5251         /* Open for exclusive use, write only. */
5252         status = print_spool_open(fsp, NULL, req->vuid);
5253
5254         if (!NT_STATUS_IS_OK(status)) {
5255                 file_free(req, fsp);
5256                 reply_nterror(req, status);
5257                 END_PROFILE(SMBsplopen);
5258                 return;
5259         }
5260
5261         reply_outbuf(req, 1, 0);
5262         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5263
5264         DEBUG(3,("openprint fd=%d fnum=%d\n",
5265                  fsp->fh->fd, fsp->fnum));
5266
5267         END_PROFILE(SMBsplopen);
5268         return;
5269 }
5270
5271 /****************************************************************************
5272  Reply to a printclose.
5273 ****************************************************************************/
5274
5275 void reply_printclose(struct smb_request *req)
5276 {
5277         connection_struct *conn = req->conn;
5278         files_struct *fsp;
5279         NTSTATUS status;
5280
5281         START_PROFILE(SMBsplclose);
5282
5283         if (req->wct < 1) {
5284                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5285                 END_PROFILE(SMBsplclose);
5286                 return;
5287         }
5288
5289         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5290
5291         if (!check_fsp(conn, req, fsp)) {
5292                 END_PROFILE(SMBsplclose);
5293                 return;
5294         }
5295
5296         if (!CAN_PRINT(conn)) {
5297                 reply_force_doserror(req, ERRSRV, ERRerror);
5298                 END_PROFILE(SMBsplclose);
5299                 return;
5300         }
5301
5302         DEBUG(3,("printclose fd=%d fnum=%d\n",
5303                  fsp->fh->fd,fsp->fnum));
5304
5305         status = close_file(req, fsp, NORMAL_CLOSE);
5306
5307         if(!NT_STATUS_IS_OK(status)) {
5308                 reply_nterror(req, status);
5309                 END_PROFILE(SMBsplclose);
5310                 return;
5311         }
5312
5313         reply_outbuf(req, 0, 0);
5314
5315         END_PROFILE(SMBsplclose);
5316         return;
5317 }
5318
5319 /****************************************************************************
5320  Reply to a printqueue.
5321 ****************************************************************************/
5322
5323 void reply_printqueue(struct smb_request *req)
5324 {
5325         connection_struct *conn = req->conn;
5326         int max_count;
5327         int start_index;
5328
5329         START_PROFILE(SMBsplretq);
5330
5331         if (req->wct < 2) {
5332                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5333                 END_PROFILE(SMBsplretq);
5334                 return;
5335         }
5336
5337         max_count = SVAL(req->vwv+0, 0);
5338         start_index = SVAL(req->vwv+1, 0);
5339
5340         /* we used to allow the client to get the cnum wrong, but that
5341            is really quite gross and only worked when there was only
5342            one printer - I think we should now only accept it if they
5343            get it right (tridge) */
5344         if (!CAN_PRINT(conn)) {
5345                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5346                 END_PROFILE(SMBsplretq);
5347                 return;
5348         }
5349
5350         reply_outbuf(req, 2, 3);
5351         SSVAL(req->outbuf,smb_vwv0,0);
5352         SSVAL(req->outbuf,smb_vwv1,0);
5353         SCVAL(smb_buf(req->outbuf),0,1);
5354         SSVAL(smb_buf(req->outbuf),1,0);
5355
5356         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5357                  start_index, max_count));
5358
5359         {
5360                 TALLOC_CTX *mem_ctx = talloc_tos();
5361                 NTSTATUS status;
5362                 WERROR werr;
5363                 const char *sharename = lp_servicename(SNUM(conn));
5364                 struct rpc_pipe_client *cli = NULL;
5365                 struct dcerpc_binding_handle *b = NULL;
5366                 struct policy_handle handle;
5367                 struct spoolss_DevmodeContainer devmode_ctr;
5368                 union spoolss_JobInfo *info;
5369                 uint32_t count;
5370                 uint32_t num_to_get;
5371                 uint32_t first;
5372                 uint32_t i;
5373
5374                 ZERO_STRUCT(handle);
5375
5376                 status = rpc_pipe_open_interface(conn,
5377                                                  &ndr_table_spoolss.syntax_id,
5378                                                  conn->session_info,
5379                                                  conn->sconn->remote_address,
5380                                                  conn->sconn->msg_ctx,
5381                                                  &cli);
5382                 if (!NT_STATUS_IS_OK(status)) {
5383                         DEBUG(0, ("reply_printqueue: "
5384                                   "could not connect to spoolss: %s\n",
5385                                   nt_errstr(status)));
5386                         reply_nterror(req, status);
5387                         goto out;
5388                 }
5389                 b = cli->binding_handle;
5390
5391                 ZERO_STRUCT(devmode_ctr);
5392
5393                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5394                                                 sharename,
5395                                                 NULL, devmode_ctr,
5396                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5397                                                 &handle,
5398                                                 &werr);
5399                 if (!NT_STATUS_IS_OK(status)) {
5400                         reply_nterror(req, status);
5401                         goto out;
5402                 }
5403                 if (!W_ERROR_IS_OK(werr)) {
5404                         reply_nterror(req, werror_to_ntstatus(werr));
5405                         goto out;
5406                 }
5407
5408                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5409                                                &handle,
5410                                                0, /* firstjob */
5411                                                0xff, /* numjobs */
5412                                                2, /* level */
5413                                                0, /* offered */
5414                                                &count,
5415                                                &info);
5416                 if (!W_ERROR_IS_OK(werr)) {
5417                         reply_nterror(req, werror_to_ntstatus(werr));
5418                         goto out;
5419                 }
5420
5421                 if (max_count > 0) {
5422                         first = start_index;
5423                 } else {
5424                         first = start_index + max_count + 1;
5425                 }
5426
5427                 if (first >= count) {
5428                         num_to_get = first;
5429                 } else {
5430                         num_to_get = first + MIN(ABS(max_count), count - first);
5431                 }
5432
5433                 for (i = first; i < num_to_get; i++) {
5434                         char blob[28];
5435                         char *p = blob;
5436                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5437                         int qstatus;
5438                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5439                                                         info[i].info2.job_id);
5440
5441                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5442                                 qstatus = 2;
5443                         } else {
5444                                 qstatus = 3;
5445                         }
5446
5447                         srv_put_dos_date2(p, 0, qtime);
5448                         SCVAL(p, 4, qstatus);
5449                         SSVAL(p, 5, qrapjobid);
5450                         SIVAL(p, 7, info[i].info2.size);
5451                         SCVAL(p, 11, 0);
5452                         srvstr_push(blob, req->flags2, p+12,
5453                                     info[i].info2.notify_name, 16, STR_ASCII);
5454
5455                         if (message_push_blob(
5456                                     &req->outbuf,
5457                                     data_blob_const(
5458                                             blob, sizeof(blob))) == -1) {
5459                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5460                                 goto out;
5461                         }
5462                 }
5463
5464                 if (count > 0) {
5465                         SSVAL(req->outbuf,smb_vwv0,count);
5466                         SSVAL(req->outbuf,smb_vwv1,
5467                               (max_count>0?first+count:first-1));
5468                         SCVAL(smb_buf(req->outbuf),0,1);
5469                         SSVAL(smb_buf(req->outbuf),1,28*count);
5470                 }
5471
5472
5473                 DEBUG(3, ("%u entries returned in queue\n",
5474                           (unsigned)count));
5475
5476 out:
5477                 if (b && is_valid_policy_hnd(&handle)) {
5478                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5479                 }
5480
5481         }
5482
5483         END_PROFILE(SMBsplretq);
5484         return;
5485 }
5486
5487 /****************************************************************************
5488  Reply to a printwrite.
5489 ****************************************************************************/
5490
5491 void reply_printwrite(struct smb_request *req)
5492 {
5493         connection_struct *conn = req->conn;
5494         int numtowrite;
5495         const char *data;
5496         files_struct *fsp;
5497
5498         START_PROFILE(SMBsplwr);
5499
5500         if (req->wct < 1) {
5501                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5502                 END_PROFILE(SMBsplwr);
5503                 return;
5504         }
5505
5506         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5507
5508         if (!check_fsp(conn, req, fsp)) {
5509                 END_PROFILE(SMBsplwr);
5510                 return;
5511         }
5512
5513         if (!fsp->print_file) {
5514                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5515                 END_PROFILE(SMBsplwr);
5516                 return;
5517         }
5518
5519         if (!CHECK_WRITE(fsp)) {
5520                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5521                 END_PROFILE(SMBsplwr);
5522                 return;
5523         }
5524
5525         numtowrite = SVAL(req->buf, 1);
5526
5527         if (req->buflen < numtowrite + 3) {
5528                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5529                 END_PROFILE(SMBsplwr);
5530                 return;
5531         }
5532
5533         data = (const char *)req->buf + 3;
5534
5535         if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5536                 reply_nterror(req, map_nt_error_from_unix(errno));
5537                 END_PROFILE(SMBsplwr);
5538                 return;
5539         }
5540
5541         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5542
5543         END_PROFILE(SMBsplwr);
5544         return;
5545 }
5546
5547 /****************************************************************************
5548  Reply to a mkdir.
5549 ****************************************************************************/
5550
5551 void reply_mkdir(struct smb_request *req)
5552 {
5553         connection_struct *conn = req->conn;
5554         struct smb_filename *smb_dname = NULL;
5555         char *directory = NULL;
5556         NTSTATUS status;
5557         TALLOC_CTX *ctx = talloc_tos();
5558
5559         START_PROFILE(SMBmkdir);
5560
5561         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5562                             STR_TERMINATE, &status);
5563         if (!NT_STATUS_IS_OK(status)) {
5564                 reply_nterror(req, status);
5565                 goto out;
5566         }
5567
5568         status = filename_convert(ctx, conn,
5569                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5570                                  directory,
5571                                  0,
5572                                  NULL,
5573                                  &smb_dname);
5574         if (!NT_STATUS_IS_OK(status)) {
5575                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5576                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5577                                         ERRSRV, ERRbadpath);
5578                         goto out;
5579                 }
5580                 reply_nterror(req, status);
5581                 goto out;
5582         }
5583
5584         status = create_directory(conn, req, smb_dname);
5585
5586         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5587
5588         if (!NT_STATUS_IS_OK(status)) {
5589
5590                 if (!use_nt_status()
5591                     && NT_STATUS_EQUAL(status,
5592                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5593                         /*
5594                          * Yes, in the DOS error code case we get a
5595                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5596                          * samba4 torture test.
5597                          */
5598                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5599                 }
5600
5601                 reply_nterror(req, status);
5602                 goto out;
5603         }
5604
5605         reply_outbuf(req, 0, 0);
5606
5607         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5608  out:
5609         TALLOC_FREE(smb_dname);
5610         END_PROFILE(SMBmkdir);
5611         return;
5612 }
5613
5614 /****************************************************************************
5615  Reply to a rmdir.
5616 ****************************************************************************/
5617
5618 void reply_rmdir(struct smb_request *req)
5619 {
5620         connection_struct *conn = req->conn;
5621         struct smb_filename *smb_dname = NULL;
5622         char *directory = NULL;
5623         NTSTATUS status;
5624         TALLOC_CTX *ctx = talloc_tos();
5625         files_struct *fsp = NULL;
5626         int info = 0;
5627         struct smbd_server_connection *sconn = req->sconn;
5628
5629         START_PROFILE(SMBrmdir);
5630
5631         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5632                             STR_TERMINATE, &status);
5633         if (!NT_STATUS_IS_OK(status)) {
5634                 reply_nterror(req, status);
5635                 goto out;
5636         }
5637
5638         status = filename_convert(ctx, conn,
5639                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5640                                  directory,
5641                                  0,
5642                                  NULL,
5643                                  &smb_dname);
5644         if (!NT_STATUS_IS_OK(status)) {
5645                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5646                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5647                                         ERRSRV, ERRbadpath);
5648                         goto out;
5649                 }
5650                 reply_nterror(req, status);
5651                 goto out;
5652         }
5653
5654         if (is_ntfs_stream_smb_fname(smb_dname)) {
5655                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5656                 goto out;
5657         }
5658
5659         status = SMB_VFS_CREATE_FILE(
5660                 conn,                                   /* conn */
5661                 req,                                    /* req */
5662                 0,                                      /* root_dir_fid */
5663                 smb_dname,                              /* fname */
5664                 DELETE_ACCESS,                          /* access_mask */
5665                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5666                         FILE_SHARE_DELETE),
5667                 FILE_OPEN,                              /* create_disposition*/
5668                 FILE_DIRECTORY_FILE,                    /* create_options */
5669                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5670                 0,                                      /* oplock_request */
5671                 0,                                      /* allocation_size */
5672                 0,                                      /* private_flags */
5673                 NULL,                                   /* sd */
5674                 NULL,                                   /* ea_list */
5675                 &fsp,                                   /* result */
5676                 &info);                                 /* pinfo */
5677
5678         if (!NT_STATUS_IS_OK(status)) {
5679                 if (open_was_deferred(req->sconn, req->mid)) {
5680                         /* We have re-scheduled this call. */
5681                         goto out;
5682                 }
5683                 reply_nterror(req, status);
5684                 goto out;
5685         }
5686
5687         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5688         if (!NT_STATUS_IS_OK(status)) {
5689                 close_file(req, fsp, ERROR_CLOSE);
5690                 reply_nterror(req, status);
5691                 goto out;
5692         }
5693
5694         if (!set_delete_on_close(fsp, true, conn->session_info->unix_token)) {
5695                 close_file(req, fsp, ERROR_CLOSE);
5696                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5697                 goto out;
5698         }
5699
5700         status = close_file(req, fsp, NORMAL_CLOSE);
5701         if (!NT_STATUS_IS_OK(status)) {
5702                 reply_nterror(req, status);
5703         } else {
5704                 reply_outbuf(req, 0, 0);
5705         }
5706
5707         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5708
5709         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5710  out:
5711         TALLOC_FREE(smb_dname);
5712         END_PROFILE(SMBrmdir);
5713         return;
5714 }
5715
5716 /*******************************************************************
5717  Resolve wildcards in a filename rename.
5718 ********************************************************************/
5719
5720 static bool resolve_wildcards(TALLOC_CTX *ctx,
5721                                 const char *name1,
5722                                 const char *name2,
5723                                 char **pp_newname)
5724 {
5725         char *name2_copy = NULL;
5726         char *root1 = NULL;
5727         char *root2 = NULL;
5728         char *ext1 = NULL;
5729         char *ext2 = NULL;
5730         char *p,*p2, *pname1, *pname2;
5731
5732         name2_copy = talloc_strdup(ctx, name2);
5733         if (!name2_copy) {
5734                 return False;
5735         }
5736
5737         pname1 = strrchr_m(name1,'/');
5738         pname2 = strrchr_m(name2_copy,'/');
5739
5740         if (!pname1 || !pname2) {
5741                 return False;
5742         }
5743
5744         /* Truncate the copy of name2 at the last '/' */
5745         *pname2 = '\0';
5746
5747         /* Now go past the '/' */
5748         pname1++;
5749         pname2++;
5750
5751         root1 = talloc_strdup(ctx, pname1);
5752         root2 = talloc_strdup(ctx, pname2);
5753
5754         if (!root1 || !root2) {
5755                 return False;
5756         }
5757
5758         p = strrchr_m(root1,'.');
5759         if (p) {
5760                 *p = 0;
5761                 ext1 = talloc_strdup(ctx, p+1);
5762         } else {
5763                 ext1 = talloc_strdup(ctx, "");
5764         }
5765         p = strrchr_m(root2,'.');
5766         if (p) {
5767                 *p = 0;
5768                 ext2 = talloc_strdup(ctx, p+1);
5769         } else {
5770                 ext2 = talloc_strdup(ctx, "");
5771         }
5772
5773         if (!ext1 || !ext2) {
5774                 return False;
5775         }
5776
5777         p = root1;
5778         p2 = root2;
5779         while (*p2) {
5780                 if (*p2 == '?') {
5781                         /* Hmmm. Should this be mb-aware ? */
5782                         *p2 = *p;
5783                         p2++;
5784                 } else if (*p2 == '*') {
5785                         *p2 = '\0';
5786                         root2 = talloc_asprintf(ctx, "%s%s",
5787                                                 root2,
5788                                                 p);
5789                         if (!root2) {
5790                                 return False;
5791                         }
5792                         break;
5793                 } else {
5794                         p2++;
5795                 }
5796                 if (*p) {
5797                         p++;
5798                 }
5799         }
5800
5801         p = ext1;
5802         p2 = ext2;
5803         while (*p2) {
5804                 if (*p2 == '?') {
5805                         /* Hmmm. Should this be mb-aware ? */
5806                         *p2 = *p;
5807                         p2++;
5808                 } else if (*p2 == '*') {
5809                         *p2 = '\0';
5810                         ext2 = talloc_asprintf(ctx, "%s%s",
5811                                                 ext2,
5812                                                 p);
5813                         if (!ext2) {
5814                                 return False;
5815                         }
5816                         break;
5817                 } else {
5818                         p2++;
5819                 }
5820                 if (*p) {
5821                         p++;
5822                 }
5823         }
5824
5825         if (*ext2) {
5826                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5827                                 name2_copy,
5828                                 root2,
5829                                 ext2);
5830         } else {
5831                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5832                                 name2_copy,
5833                                 root2);
5834         }
5835
5836         if (!*pp_newname) {
5837                 return False;
5838         }
5839
5840         return True;
5841 }
5842
5843 /****************************************************************************
5844  Ensure open files have their names updated. Updated to notify other smbd's
5845  asynchronously.
5846 ****************************************************************************/
5847
5848 static void rename_open_files(connection_struct *conn,
5849                               struct share_mode_lock *lck,
5850                               uint32_t orig_name_hash,
5851                               const struct smb_filename *smb_fname_dst)
5852 {
5853         files_struct *fsp;
5854         bool did_rename = False;
5855         NTSTATUS status;
5856         uint32_t new_name_hash = 0;
5857
5858         for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
5859             fsp = file_find_di_next(fsp)) {
5860                 /* fsp_name is a relative path under the fsp. To change this for other
5861                    sharepaths we need to manipulate relative paths. */
5862                 /* TODO - create the absolute path and manipulate the newname
5863                    relative to the sharepath. */
5864                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5865                         continue;
5866                 }
5867                 if (fsp->name_hash != orig_name_hash) {
5868                         continue;
5869                 }
5870                 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5871                            "(file_id %s) from %s -> %s\n", fsp->fnum,
5872                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5873                            smb_fname_str_dbg(smb_fname_dst)));
5874
5875                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5876                 if (NT_STATUS_IS_OK(status)) {
5877                         did_rename = True;
5878                         new_name_hash = fsp->name_hash;
5879                 }
5880         }
5881
5882         if (!did_rename) {
5883                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5884                            "for %s\n", file_id_string_tos(&lck->data->id),
5885                            smb_fname_str_dbg(smb_fname_dst)));
5886         }
5887
5888         /* Send messages to all smbd's (not ourself) that the name has changed. */
5889         rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5890                               orig_name_hash, new_name_hash,
5891                               smb_fname_dst);
5892
5893 }
5894
5895 /****************************************************************************
5896  We need to check if the source path is a parent directory of the destination
5897  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5898  refuse the rename with a sharing violation. Under UNIX the above call can
5899  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5900  probably need to check that the client is a Windows one before disallowing
5901  this as a UNIX client (one with UNIX extensions) can know the source is a
5902  symlink and make this decision intelligently. Found by an excellent bug
5903  report from <AndyLiebman@aol.com>.
5904 ****************************************************************************/
5905
5906 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5907                                      const struct smb_filename *smb_fname_dst)
5908 {
5909         const char *psrc = smb_fname_src->base_name;
5910         const char *pdst = smb_fname_dst->base_name;
5911         size_t slen;
5912
5913         if (psrc[0] == '.' && psrc[1] == '/') {
5914                 psrc += 2;
5915         }
5916         if (pdst[0] == '.' && pdst[1] == '/') {
5917                 pdst += 2;
5918         }
5919         if ((slen = strlen(psrc)) > strlen(pdst)) {
5920                 return False;
5921         }
5922         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5923 }
5924
5925 /*
5926  * Do the notify calls from a rename
5927  */
5928
5929 static void notify_rename(connection_struct *conn, bool is_dir,
5930                           const struct smb_filename *smb_fname_src,
5931                           const struct smb_filename *smb_fname_dst)
5932 {
5933         char *parent_dir_src = NULL;
5934         char *parent_dir_dst = NULL;
5935         uint32 mask;
5936
5937         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5938                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5939
5940         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5941                             &parent_dir_src, NULL) ||
5942             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5943                             &parent_dir_dst, NULL)) {
5944                 goto out;
5945         }
5946
5947         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5948                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5949                              smb_fname_src->base_name);
5950                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5951                              smb_fname_dst->base_name);
5952         }
5953         else {
5954                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5955                              smb_fname_src->base_name);
5956                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5957                              smb_fname_dst->base_name);
5958         }
5959
5960         /* this is a strange one. w2k3 gives an additional event for
5961            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5962            files, but not directories */
5963         if (!is_dir) {
5964                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5965                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5966                              |FILE_NOTIFY_CHANGE_CREATION,
5967                              smb_fname_dst->base_name);
5968         }
5969  out:
5970         TALLOC_FREE(parent_dir_src);
5971         TALLOC_FREE(parent_dir_dst);
5972 }
5973
5974 /****************************************************************************
5975  Returns an error if the parent directory for a filename is open in an
5976  incompatible way.
5977 ****************************************************************************/
5978
5979 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
5980                                         const struct smb_filename *smb_fname_dst_in)
5981 {
5982         char *parent_dir = NULL;
5983         struct smb_filename smb_fname_parent;
5984         struct file_id id;
5985         files_struct *fsp = NULL;
5986         int ret;
5987
5988         if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
5989                         &parent_dir, NULL)) {
5990                 return NT_STATUS_NO_MEMORY;
5991         }
5992         ZERO_STRUCT(smb_fname_parent);
5993         smb_fname_parent.base_name = parent_dir;
5994
5995         ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
5996         if (ret == -1) {
5997                 return map_nt_error_from_unix(errno);
5998         }
5999
6000         /*
6001          * We're only checking on this smbd here, mostly good
6002          * enough.. and will pass tests.
6003          */
6004
6005         id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6006         for (fsp = file_find_di_first(conn->sconn, id); fsp;
6007                         fsp = file_find_di_next(fsp)) {
6008                 if (fsp->access_mask & DELETE_ACCESS) {
6009                         return NT_STATUS_SHARING_VIOLATION;
6010                 }
6011         }
6012         return NT_STATUS_OK;
6013 }
6014
6015 /****************************************************************************
6016  Rename an open file - given an fsp.
6017 ****************************************************************************/
6018
6019 NTSTATUS rename_internals_fsp(connection_struct *conn,
6020                         files_struct *fsp,
6021                         const struct smb_filename *smb_fname_dst_in,
6022                         uint32 attrs,
6023                         bool replace_if_exists)
6024 {
6025         TALLOC_CTX *ctx = talloc_tos();
6026         struct smb_filename *smb_fname_dst = NULL;
6027         NTSTATUS status = NT_STATUS_OK;
6028         struct share_mode_lock *lck = NULL;
6029         bool dst_exists, old_is_stream, new_is_stream;
6030
6031         status = check_name(conn, smb_fname_dst_in->base_name);
6032         if (!NT_STATUS_IS_OK(status)) {
6033                 return status;
6034         }
6035
6036         status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6037         if (!NT_STATUS_IS_OK(status)) {
6038                 return status;
6039         }
6040
6041         /* Make a copy of the dst smb_fname structs */
6042
6043         status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
6044         if (!NT_STATUS_IS_OK(status)) {
6045                 goto out;
6046         }
6047
6048         /*
6049          * Check for special case with case preserving and not
6050          * case sensitive. If the old last component differs from the original
6051          * last component only by case, then we should allow
6052          * the rename (user is trying to change the case of the
6053          * filename).
6054          */
6055         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6056             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6057             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6058                 char *last_slash;
6059                 char *fname_dst_lcomp_base_mod = NULL;
6060                 struct smb_filename *smb_fname_orig_lcomp = NULL;
6061
6062                 /*
6063                  * Get the last component of the destination name.
6064                  */
6065                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6066                 if (last_slash) {
6067                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6068                 } else {
6069                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6070                 }
6071                 if (!fname_dst_lcomp_base_mod) {
6072                         status = NT_STATUS_NO_MEMORY;
6073                         goto out;
6074                 }
6075
6076                 /*
6077                  * Create an smb_filename struct using the original last
6078                  * component of the destination.
6079                  */
6080                 status = create_synthetic_smb_fname_split(ctx,
6081                     smb_fname_dst->original_lcomp, NULL,
6082                     &smb_fname_orig_lcomp);
6083                 if (!NT_STATUS_IS_OK(status)) {
6084                         TALLOC_FREE(fname_dst_lcomp_base_mod);
6085                         goto out;
6086                 }
6087
6088                 /* If the base names only differ by case, use original. */
6089                 if(!strcsequal(fname_dst_lcomp_base_mod,
6090                                smb_fname_orig_lcomp->base_name)) {
6091                         char *tmp;
6092                         /*
6093                          * Replace the modified last component with the
6094                          * original.
6095                          */
6096                         if (last_slash) {
6097                                 *last_slash = '\0'; /* Truncate at the '/' */
6098                                 tmp = talloc_asprintf(smb_fname_dst,
6099                                         "%s/%s",
6100                                         smb_fname_dst->base_name,
6101                                         smb_fname_orig_lcomp->base_name);
6102                         } else {
6103                                 tmp = talloc_asprintf(smb_fname_dst,
6104                                         "%s",
6105                                         smb_fname_orig_lcomp->base_name);
6106                         }
6107                         if (tmp == NULL) {
6108                                 status = NT_STATUS_NO_MEMORY;
6109                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6110                                 TALLOC_FREE(smb_fname_orig_lcomp);
6111                                 goto out;
6112                         }
6113                         TALLOC_FREE(smb_fname_dst->base_name);
6114                         smb_fname_dst->base_name = tmp;
6115                 }
6116
6117                 /* If the stream_names only differ by case, use original. */
6118                 if(!strcsequal(smb_fname_dst->stream_name,
6119                                smb_fname_orig_lcomp->stream_name)) {
6120                         char *tmp = NULL;
6121                         /* Use the original stream. */
6122                         tmp = talloc_strdup(smb_fname_dst,
6123                                             smb_fname_orig_lcomp->stream_name);
6124                         if (tmp == NULL) {
6125                                 status = NT_STATUS_NO_MEMORY;
6126                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6127                                 TALLOC_FREE(smb_fname_orig_lcomp);
6128                                 goto out;
6129                         }
6130                         TALLOC_FREE(smb_fname_dst->stream_name);
6131                         smb_fname_dst->stream_name = tmp;
6132                 }
6133                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6134                 TALLOC_FREE(smb_fname_orig_lcomp);
6135         }
6136
6137         /*
6138          * If the src and dest names are identical - including case,
6139          * don't do the rename, just return success.
6140          */
6141
6142         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6143             strcsequal(fsp->fsp_name->stream_name,
6144                        smb_fname_dst->stream_name)) {
6145                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6146                           "- returning success\n",
6147                           smb_fname_str_dbg(smb_fname_dst)));
6148                 status = NT_STATUS_OK;
6149                 goto out;
6150         }
6151
6152         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6153         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6154
6155         /* Return the correct error code if both names aren't streams. */
6156         if (!old_is_stream && new_is_stream) {
6157                 status = NT_STATUS_OBJECT_NAME_INVALID;
6158                 goto out;
6159         }
6160
6161         if (old_is_stream && !new_is_stream) {
6162                 status = NT_STATUS_INVALID_PARAMETER;
6163                 goto out;
6164         }
6165
6166         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6167
6168         if(!replace_if_exists && dst_exists) {
6169                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6170                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6171                           smb_fname_str_dbg(smb_fname_dst)));
6172                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6173                 goto out;
6174         }
6175
6176         if (dst_exists) {
6177                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6178                     &smb_fname_dst->st);
6179                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6180                                                            fileid);
6181                 /* The file can be open when renaming a stream */
6182                 if (dst_fsp && !new_is_stream) {
6183                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6184                         status = NT_STATUS_ACCESS_DENIED;
6185                         goto out;
6186                 }
6187         }
6188
6189         /* Ensure we have a valid stat struct for the source. */
6190         status = vfs_stat_fsp(fsp);
6191         if (!NT_STATUS_IS_OK(status)) {
6192                 goto out;
6193         }
6194
6195         status = can_rename(conn, fsp, attrs);
6196
6197         if (!NT_STATUS_IS_OK(status)) {
6198                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6199                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6200                           smb_fname_str_dbg(smb_fname_dst)));
6201                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6202                         status = NT_STATUS_ACCESS_DENIED;
6203                 goto out;
6204         }
6205
6206         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6207                 status = NT_STATUS_ACCESS_DENIED;
6208         }
6209
6210         lck = get_share_mode_lock(talloc_tos(), fsp->file_id);
6211
6212         /*
6213          * We have the file open ourselves, so not being able to get the
6214          * corresponding share mode lock is a fatal error.
6215          */
6216
6217         SMB_ASSERT(lck != NULL);
6218
6219         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6220                 uint32 create_options = fsp->fh->private_options;
6221
6222                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6223                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6224                           smb_fname_str_dbg(smb_fname_dst)));
6225
6226                 if (!lp_posix_pathnames() &&
6227                     (lp_map_archive(SNUM(conn)) ||
6228                     lp_store_dos_attributes(SNUM(conn)))) {
6229                         /* We must set the archive bit on the newly
6230                            renamed file. */
6231                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6232                                 uint32_t old_dosmode = dos_mode(conn,
6233                                                         smb_fname_dst);
6234                                 file_set_dosmode(conn,
6235                                         smb_fname_dst,
6236                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6237                                         NULL,
6238                                         true);
6239                         }
6240                 }
6241
6242                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6243                               smb_fname_dst);
6244
6245                 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6246
6247                 /*
6248                  * A rename acts as a new file create w.r.t. allowing an initial delete
6249                  * on close, probably because in Windows there is a new handle to the
6250                  * new file. If initial delete on close was requested but not
6251                  * originally set, we need to set it here. This is probably not 100% correct,
6252                  * but will work for the CIFSFS client which in non-posix mode
6253                  * depends on these semantics. JRA.
6254                  */
6255
6256                 if (create_options & FILE_DELETE_ON_CLOSE) {
6257                         status = can_set_delete_on_close(fsp, 0);
6258
6259                         if (NT_STATUS_IS_OK(status)) {
6260                                 /* Note that here we set the *inital* delete on close flag,
6261                                  * not the regular one. The magic gets handled in close. */
6262                                 fsp->initial_delete_on_close = True;
6263                         }
6264                 }
6265                 TALLOC_FREE(lck);
6266                 status = NT_STATUS_OK;
6267                 goto out;
6268         }
6269
6270         TALLOC_FREE(lck);
6271
6272         if (errno == ENOTDIR || errno == EISDIR) {
6273                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6274         } else {
6275                 status = map_nt_error_from_unix(errno);
6276         }
6277
6278         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6279                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6280                   smb_fname_str_dbg(smb_fname_dst)));
6281
6282  out:
6283         TALLOC_FREE(smb_fname_dst);
6284
6285         return status;
6286 }
6287
6288 /****************************************************************************
6289  The guts of the rename command, split out so it may be called by the NT SMB
6290  code.
6291 ****************************************************************************/
6292
6293 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6294                         connection_struct *conn,
6295                         struct smb_request *req,
6296                         struct smb_filename *smb_fname_src,
6297                         struct smb_filename *smb_fname_dst,
6298                         uint32 attrs,
6299                         bool replace_if_exists,
6300                         bool src_has_wild,
6301                         bool dest_has_wild,
6302                         uint32_t access_mask)
6303 {
6304         char *fname_src_dir = NULL;
6305         char *fname_src_mask = NULL;
6306         int count=0;
6307         NTSTATUS status = NT_STATUS_OK;
6308         struct smb_Dir *dir_hnd = NULL;
6309         const char *dname = NULL;
6310         char *talloced = NULL;
6311         long offset = 0;
6312         int create_options = 0;
6313         bool posix_pathnames = lp_posix_pathnames();
6314
6315         /*
6316          * Split the old name into directory and last component
6317          * strings. Note that unix_convert may have stripped off a
6318          * leading ./ from both name and newname if the rename is
6319          * at the root of the share. We need to make sure either both
6320          * name and newname contain a / character or neither of them do
6321          * as this is checked in resolve_wildcards().
6322          */
6323
6324         /* Split up the directory from the filename/mask. */
6325         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6326                                       &fname_src_dir, &fname_src_mask);
6327         if (!NT_STATUS_IS_OK(status)) {
6328                 status = NT_STATUS_NO_MEMORY;
6329                 goto out;
6330         }
6331
6332         /*
6333          * We should only check the mangled cache
6334          * here if unix_convert failed. This means
6335          * that the path in 'mask' doesn't exist
6336          * on the file system and so we need to look
6337          * for a possible mangle. This patch from
6338          * Tine Smukavec <valentin.smukavec@hermes.si>.
6339          */
6340
6341         if (!VALID_STAT(smb_fname_src->st) &&
6342             mangle_is_mangled(fname_src_mask, conn->params)) {
6343                 char *new_mask = NULL;
6344                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6345                                             conn->params);
6346                 if (new_mask) {
6347                         TALLOC_FREE(fname_src_mask);
6348                         fname_src_mask = new_mask;
6349                 }
6350         }
6351
6352         if (!src_has_wild) {
6353                 files_struct *fsp;
6354
6355                 /*
6356                  * Only one file needs to be renamed. Append the mask back
6357                  * onto the directory.
6358                  */
6359                 TALLOC_FREE(smb_fname_src->base_name);
6360                 if (ISDOT(fname_src_dir)) {
6361                         /* Ensure we use canonical names on open. */
6362                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6363                                                         "%s",
6364                                                         fname_src_mask);
6365                 } else {
6366                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6367                                                         "%s/%s",
6368                                                         fname_src_dir,
6369                                                         fname_src_mask);
6370                 }
6371                 if (!smb_fname_src->base_name) {
6372                         status = NT_STATUS_NO_MEMORY;
6373                         goto out;
6374                 }
6375
6376                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6377                           "case_preserve = %d, short case preserve = %d, "
6378                           "directory = %s, newname = %s, "
6379                           "last_component_dest = %s\n",
6380                           conn->case_sensitive, conn->case_preserve,
6381                           conn->short_case_preserve,
6382                           smb_fname_str_dbg(smb_fname_src),
6383                           smb_fname_str_dbg(smb_fname_dst),
6384                           smb_fname_dst->original_lcomp));
6385
6386                 /* The dest name still may have wildcards. */
6387                 if (dest_has_wild) {
6388                         char *fname_dst_mod = NULL;
6389                         if (!resolve_wildcards(smb_fname_dst,
6390                                                smb_fname_src->base_name,
6391                                                smb_fname_dst->base_name,
6392                                                &fname_dst_mod)) {
6393                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6394                                           "%s %s failed\n",
6395                                           smb_fname_src->base_name,
6396                                           smb_fname_dst->base_name));
6397                                 status = NT_STATUS_NO_MEMORY;
6398                                 goto out;
6399                         }
6400                         TALLOC_FREE(smb_fname_dst->base_name);
6401                         smb_fname_dst->base_name = fname_dst_mod;
6402                 }
6403
6404                 ZERO_STRUCT(smb_fname_src->st);
6405                 if (posix_pathnames) {
6406                         SMB_VFS_LSTAT(conn, smb_fname_src);
6407                 } else {
6408                         SMB_VFS_STAT(conn, smb_fname_src);
6409                 }
6410
6411                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6412                         create_options |= FILE_DIRECTORY_FILE;
6413                 }
6414
6415                 status = SMB_VFS_CREATE_FILE(
6416                         conn,                           /* conn */
6417                         req,                            /* req */
6418                         0,                              /* root_dir_fid */
6419                         smb_fname_src,                  /* fname */
6420                         access_mask,                    /* access_mask */
6421                         (FILE_SHARE_READ |              /* share_access */
6422                             FILE_SHARE_WRITE),
6423                         FILE_OPEN,                      /* create_disposition*/
6424                         create_options,                 /* create_options */
6425                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6426                         0,                              /* oplock_request */
6427                         0,                              /* allocation_size */
6428                         0,                              /* private_flags */
6429                         NULL,                           /* sd */
6430                         NULL,                           /* ea_list */
6431                         &fsp,                           /* result */
6432                         NULL);                          /* pinfo */
6433
6434                 if (!NT_STATUS_IS_OK(status)) {
6435                         DEBUG(3, ("Could not open rename source %s: %s\n",
6436                                   smb_fname_str_dbg(smb_fname_src),
6437                                   nt_errstr(status)));
6438                         goto out;
6439                 }
6440
6441                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6442                                               attrs, replace_if_exists);
6443
6444                 close_file(req, fsp, NORMAL_CLOSE);
6445
6446                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6447                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6448                           smb_fname_str_dbg(smb_fname_dst)));
6449
6450                 goto out;
6451         }
6452
6453         /*
6454          * Wildcards - process each file that matches.
6455          */
6456         if (strequal(fname_src_mask, "????????.???")) {
6457                 TALLOC_FREE(fname_src_mask);
6458                 fname_src_mask = talloc_strdup(ctx, "*");
6459                 if (!fname_src_mask) {
6460                         status = NT_STATUS_NO_MEMORY;
6461                         goto out;
6462                 }
6463         }
6464
6465         status = check_name(conn, fname_src_dir);
6466         if (!NT_STATUS_IS_OK(status)) {
6467                 goto out;
6468         }
6469
6470         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6471                           attrs);
6472         if (dir_hnd == NULL) {
6473                 status = map_nt_error_from_unix(errno);
6474                 goto out;
6475         }
6476
6477         status = NT_STATUS_NO_SUCH_FILE;
6478         /*
6479          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6480          * - gentest fix. JRA
6481          */
6482
6483         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6484                                     &talloced))) {
6485                 files_struct *fsp = NULL;
6486                 char *destname = NULL;
6487                 bool sysdir_entry = False;
6488
6489                 /* Quick check for "." and ".." */
6490                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6491                         if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6492                                 sysdir_entry = True;
6493                         } else {
6494                                 TALLOC_FREE(talloced);
6495                                 continue;
6496                         }
6497                 }
6498
6499                 if (!is_visible_file(conn, fname_src_dir, dname,
6500                                      &smb_fname_src->st, false)) {
6501                         TALLOC_FREE(talloced);
6502                         continue;
6503                 }
6504
6505                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6506                         TALLOC_FREE(talloced);
6507                         continue;
6508                 }
6509
6510                 if (sysdir_entry) {
6511                         status = NT_STATUS_OBJECT_NAME_INVALID;
6512                         break;
6513                 }
6514
6515                 TALLOC_FREE(smb_fname_src->base_name);
6516                 if (ISDOT(fname_src_dir)) {
6517                         /* Ensure we use canonical names on open. */
6518                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6519                                                         "%s",
6520                                                         dname);
6521                 } else {
6522                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6523                                                         "%s/%s",
6524                                                         fname_src_dir,
6525                                                         dname);
6526                 }
6527                 if (!smb_fname_src->base_name) {
6528                         status = NT_STATUS_NO_MEMORY;
6529                         goto out;
6530                 }
6531
6532                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6533                                        smb_fname_dst->base_name,
6534                                        &destname)) {
6535                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6536                                   smb_fname_src->base_name, destname));
6537                         TALLOC_FREE(talloced);
6538                         continue;
6539                 }
6540                 if (!destname) {
6541                         status = NT_STATUS_NO_MEMORY;
6542                         goto out;
6543                 }
6544
6545                 TALLOC_FREE(smb_fname_dst->base_name);
6546                 smb_fname_dst->base_name = destname;
6547
6548                 ZERO_STRUCT(smb_fname_src->st);
6549                 if (posix_pathnames) {
6550                         SMB_VFS_LSTAT(conn, smb_fname_src);
6551                 } else {
6552                         SMB_VFS_STAT(conn, smb_fname_src);
6553                 }
6554
6555                 create_options = 0;
6556
6557                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6558                         create_options |= FILE_DIRECTORY_FILE;
6559                 }
6560
6561                 status = SMB_VFS_CREATE_FILE(
6562                         conn,                           /* conn */
6563                         req,                            /* req */
6564                         0,                              /* root_dir_fid */
6565                         smb_fname_src,                  /* fname */
6566                         access_mask,                    /* access_mask */
6567                         (FILE_SHARE_READ |              /* share_access */
6568                             FILE_SHARE_WRITE),
6569                         FILE_OPEN,                      /* create_disposition*/
6570                         create_options,                 /* create_options */
6571                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6572                         0,                              /* oplock_request */
6573                         0,                              /* allocation_size */
6574                         0,                              /* private_flags */
6575                         NULL,                           /* sd */
6576                         NULL,                           /* ea_list */
6577                         &fsp,                           /* result */
6578                         NULL);                          /* pinfo */
6579
6580                 if (!NT_STATUS_IS_OK(status)) {
6581                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6582                                  "returned %s rename %s -> %s\n",
6583                                  nt_errstr(status),
6584                                  smb_fname_str_dbg(smb_fname_src),
6585                                  smb_fname_str_dbg(smb_fname_dst)));
6586                         break;
6587                 }
6588
6589                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6590                                                               dname);
6591                 if (!smb_fname_dst->original_lcomp) {
6592                         status = NT_STATUS_NO_MEMORY;
6593                         goto out;
6594                 }
6595
6596                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6597                                               attrs, replace_if_exists);
6598
6599                 close_file(req, fsp, NORMAL_CLOSE);
6600
6601                 if (!NT_STATUS_IS_OK(status)) {
6602                         DEBUG(3, ("rename_internals_fsp returned %s for "
6603                                   "rename %s -> %s\n", nt_errstr(status),
6604                                   smb_fname_str_dbg(smb_fname_src),
6605                                   smb_fname_str_dbg(smb_fname_dst)));
6606                         break;
6607                 }
6608
6609                 count++;
6610
6611                 DEBUG(3,("rename_internals: doing rename on %s -> "
6612                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6613                          smb_fname_str_dbg(smb_fname_src)));
6614                 TALLOC_FREE(talloced);
6615         }
6616         TALLOC_FREE(dir_hnd);
6617
6618         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6619                 status = map_nt_error_from_unix(errno);
6620         }
6621
6622  out:
6623         TALLOC_FREE(talloced);
6624         TALLOC_FREE(fname_src_dir);
6625         TALLOC_FREE(fname_src_mask);
6626         return status;
6627 }
6628
6629 /****************************************************************************
6630  Reply to a mv.
6631 ****************************************************************************/
6632
6633 void reply_mv(struct smb_request *req)
6634 {
6635         connection_struct *conn = req->conn;
6636         char *name = NULL;
6637         char *newname = NULL;
6638         const char *p;
6639         uint32 attrs;
6640         NTSTATUS status;
6641         bool src_has_wcard = False;
6642         bool dest_has_wcard = False;
6643         TALLOC_CTX *ctx = talloc_tos();
6644         struct smb_filename *smb_fname_src = NULL;
6645         struct smb_filename *smb_fname_dst = NULL;
6646         uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6647         uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6648         bool stream_rename = false;
6649
6650         START_PROFILE(SMBmv);
6651
6652         if (req->wct < 1) {
6653                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6654                 goto out;
6655         }
6656
6657         attrs = SVAL(req->vwv+0, 0);
6658
6659         p = (const char *)req->buf + 1;
6660         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6661                                        &status, &src_has_wcard);
6662         if (!NT_STATUS_IS_OK(status)) {
6663                 reply_nterror(req, status);
6664                 goto out;
6665         }
6666         p++;
6667         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6668                                        &status, &dest_has_wcard);
6669         if (!NT_STATUS_IS_OK(status)) {
6670                 reply_nterror(req, status);
6671                 goto out;
6672         }
6673
6674         if (!lp_posix_pathnames()) {
6675                 /* The newname must begin with a ':' if the
6676                    name contains a ':'. */
6677                 if (strchr_m(name, ':')) {
6678                         if (newname[0] != ':') {
6679                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6680                                 goto out;
6681                         }
6682                         stream_rename = true;
6683                 }
6684         }
6685
6686         status = filename_convert(ctx,
6687                                   conn,
6688                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6689                                   name,
6690                                   src_ucf_flags,
6691                                   &src_has_wcard,
6692                                   &smb_fname_src);
6693
6694         if (!NT_STATUS_IS_OK(status)) {
6695                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6696                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6697                                         ERRSRV, ERRbadpath);
6698                         goto out;
6699                 }
6700                 reply_nterror(req, status);
6701                 goto out;
6702         }
6703
6704         status = filename_convert(ctx,
6705                                   conn,
6706                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6707                                   newname,
6708                                   dst_ucf_flags,
6709                                   &dest_has_wcard,
6710                                   &smb_fname_dst);
6711
6712         if (!NT_STATUS_IS_OK(status)) {
6713                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6714                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6715                                         ERRSRV, ERRbadpath);
6716                         goto out;
6717                 }
6718                 reply_nterror(req, status);
6719                 goto out;
6720         }
6721
6722         if (stream_rename) {
6723                 /* smb_fname_dst->base_name must be the same as
6724                    smb_fname_src->base_name. */
6725                 TALLOC_FREE(smb_fname_dst->base_name);
6726                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6727                                                 smb_fname_src->base_name);
6728                 if (!smb_fname_dst->base_name) {
6729                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6730                         goto out;
6731                 }
6732         }
6733
6734         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6735                  smb_fname_str_dbg(smb_fname_dst)));
6736
6737         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6738                                   attrs, False, src_has_wcard, dest_has_wcard,
6739                                   DELETE_ACCESS);
6740         if (!NT_STATUS_IS_OK(status)) {
6741                 if (open_was_deferred(req->sconn, req->mid)) {
6742                         /* We have re-scheduled this call. */
6743                         goto out;
6744                 }
6745                 reply_nterror(req, status);
6746                 goto out;
6747         }
6748
6749         reply_outbuf(req, 0, 0);
6750  out:
6751         TALLOC_FREE(smb_fname_src);
6752         TALLOC_FREE(smb_fname_dst);
6753         END_PROFILE(SMBmv);
6754         return;
6755 }
6756
6757 /*******************************************************************
6758  Copy a file as part of a reply_copy.
6759 ******************************************************************/
6760
6761 /*
6762  * TODO: check error codes on all callers
6763  */
6764
6765 NTSTATUS copy_file(TALLOC_CTX *ctx,
6766                         connection_struct *conn,
6767                         struct smb_filename *smb_fname_src,
6768                         struct smb_filename *smb_fname_dst,
6769                         int ofun,
6770                         int count,
6771                         bool target_is_directory)
6772 {
6773         struct smb_filename *smb_fname_dst_tmp = NULL;
6774         SMB_OFF_T ret=-1;
6775         files_struct *fsp1,*fsp2;
6776         uint32 dosattrs;
6777         uint32 new_create_disposition;
6778         NTSTATUS status;
6779
6780
6781         status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6782         if (!NT_STATUS_IS_OK(status)) {
6783                 return status;
6784         }
6785
6786         /*
6787          * If the target is a directory, extract the last component from the
6788          * src filename and append it to the dst filename
6789          */
6790         if (target_is_directory) {
6791                 const char *p;
6792
6793                 /* dest/target can't be a stream if it's a directory. */
6794                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6795
6796                 p = strrchr_m(smb_fname_src->base_name,'/');
6797                 if (p) {
6798                         p++;
6799                 } else {
6800                         p = smb_fname_src->base_name;
6801                 }
6802                 smb_fname_dst_tmp->base_name =
6803                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6804                                            p);
6805                 if (!smb_fname_dst_tmp->base_name) {
6806                         status = NT_STATUS_NO_MEMORY;
6807                         goto out;
6808                 }
6809         }
6810
6811         status = vfs_file_exist(conn, smb_fname_src);
6812         if (!NT_STATUS_IS_OK(status)) {
6813                 goto out;
6814         }
6815
6816         if (!target_is_directory && count) {
6817                 new_create_disposition = FILE_OPEN;
6818         } else {
6819                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6820                                                  0, ofun,
6821                                                  NULL, NULL,
6822                                                  &new_create_disposition,
6823                                                  NULL,
6824                                                  NULL)) {
6825                         status = NT_STATUS_INVALID_PARAMETER;
6826                         goto out;
6827                 }
6828         }
6829
6830         /* Open the src file for reading. */
6831         status = SMB_VFS_CREATE_FILE(
6832                 conn,                                   /* conn */
6833                 NULL,                                   /* req */
6834                 0,                                      /* root_dir_fid */
6835                 smb_fname_src,                          /* fname */
6836                 FILE_GENERIC_READ,                      /* access_mask */
6837                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6838                 FILE_OPEN,                              /* create_disposition*/
6839                 0,                                      /* create_options */
6840                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
6841                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6842                 0,                                      /* allocation_size */
6843                 0,                                      /* private_flags */
6844                 NULL,                                   /* sd */
6845                 NULL,                                   /* ea_list */
6846                 &fsp1,                                  /* result */
6847                 NULL);                                  /* psbuf */
6848
6849         if (!NT_STATUS_IS_OK(status)) {
6850                 goto out;
6851         }
6852
6853         dosattrs = dos_mode(conn, smb_fname_src);
6854
6855         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6856                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6857         }
6858
6859         /* Open the dst file for writing. */
6860         status = SMB_VFS_CREATE_FILE(
6861                 conn,                                   /* conn */
6862                 NULL,                                   /* req */
6863                 0,                                      /* root_dir_fid */
6864                 smb_fname_dst,                          /* fname */
6865                 FILE_GENERIC_WRITE,                     /* access_mask */
6866                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6867                 new_create_disposition,                 /* create_disposition*/
6868                 0,                                      /* create_options */
6869                 dosattrs,                               /* file_attributes */
6870                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6871                 0,                                      /* allocation_size */
6872                 0,                                      /* private_flags */
6873                 NULL,                                   /* sd */
6874                 NULL,                                   /* ea_list */
6875                 &fsp2,                                  /* result */
6876                 NULL);                                  /* psbuf */
6877
6878         if (!NT_STATUS_IS_OK(status)) {
6879                 close_file(NULL, fsp1, ERROR_CLOSE);
6880                 goto out;
6881         }
6882
6883         if (ofun & OPENX_FILE_EXISTS_OPEN) {
6884                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6885                 if (ret == -1) {
6886                         DEBUG(0, ("error - vfs lseek returned error %s\n",
6887                                 strerror(errno)));
6888                         status = map_nt_error_from_unix(errno);
6889                         close_file(NULL, fsp1, ERROR_CLOSE);
6890                         close_file(NULL, fsp2, ERROR_CLOSE);
6891                         goto out;
6892                 }
6893         }
6894
6895         /* Do the actual copy. */
6896         if (smb_fname_src->st.st_ex_size) {
6897                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6898         } else {
6899                 ret = 0;
6900         }
6901
6902         close_file(NULL, fsp1, NORMAL_CLOSE);
6903
6904         /* Ensure the modtime is set correctly on the destination file. */
6905         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6906
6907         /*
6908          * As we are opening fsp1 read-only we only expect
6909          * an error on close on fsp2 if we are out of space.
6910          * Thus we don't look at the error return from the
6911          * close of fsp1.
6912          */
6913         status = close_file(NULL, fsp2, NORMAL_CLOSE);
6914
6915         if (!NT_STATUS_IS_OK(status)) {
6916                 goto out;
6917         }
6918
6919         if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6920                 status = NT_STATUS_DISK_FULL;
6921                 goto out;
6922         }
6923
6924         status = NT_STATUS_OK;
6925
6926  out:
6927         TALLOC_FREE(smb_fname_dst_tmp);
6928         return status;
6929 }
6930
6931 /****************************************************************************
6932  Reply to a file copy.
6933 ****************************************************************************/
6934
6935 void reply_copy(struct smb_request *req)
6936 {
6937         connection_struct *conn = req->conn;
6938         struct smb_filename *smb_fname_src = NULL;
6939         struct smb_filename *smb_fname_dst = NULL;
6940         char *fname_src = NULL;
6941         char *fname_dst = NULL;
6942         char *fname_src_mask = NULL;
6943         char *fname_src_dir = NULL;
6944         const char *p;
6945         int count=0;
6946         int error = ERRnoaccess;
6947         int tid2;
6948         int ofun;
6949         int flags;
6950         bool target_is_directory=False;
6951         bool source_has_wild = False;
6952         bool dest_has_wild = False;
6953         NTSTATUS status;
6954         TALLOC_CTX *ctx = talloc_tos();
6955
6956         START_PROFILE(SMBcopy);
6957
6958         if (req->wct < 3) {
6959                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6960                 goto out;
6961         }
6962
6963         tid2 = SVAL(req->vwv+0, 0);
6964         ofun = SVAL(req->vwv+1, 0);
6965         flags = SVAL(req->vwv+2, 0);
6966
6967         p = (const char *)req->buf;
6968         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6969                                        &status, &source_has_wild);
6970         if (!NT_STATUS_IS_OK(status)) {
6971                 reply_nterror(req, status);
6972                 goto out;
6973         }
6974         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6975                                        &status, &dest_has_wild);
6976         if (!NT_STATUS_IS_OK(status)) {
6977                 reply_nterror(req, status);
6978                 goto out;
6979         }
6980
6981         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6982
6983         if (tid2 != conn->cnum) {
6984                 /* can't currently handle inter share copies XXXX */
6985                 DEBUG(3,("Rejecting inter-share copy\n"));
6986                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6987                 goto out;
6988         }
6989
6990         status = filename_convert(ctx, conn,
6991                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6992                                   fname_src,
6993                                   UCF_COND_ALLOW_WCARD_LCOMP,
6994                                   &source_has_wild,
6995                                   &smb_fname_src);
6996         if (!NT_STATUS_IS_OK(status)) {
6997                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6998                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6999                                         ERRSRV, ERRbadpath);
7000                         goto out;
7001                 }
7002                 reply_nterror(req, status);
7003                 goto out;
7004         }
7005
7006         status = filename_convert(ctx, conn,
7007                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7008                                   fname_dst,
7009                                   UCF_COND_ALLOW_WCARD_LCOMP,
7010                                   &dest_has_wild,
7011                                   &smb_fname_dst);
7012         if (!NT_STATUS_IS_OK(status)) {
7013                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7014                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7015                                         ERRSRV, ERRbadpath);
7016                         goto out;
7017                 }
7018                 reply_nterror(req, status);
7019                 goto out;
7020         }
7021
7022         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7023
7024         if ((flags&1) && target_is_directory) {
7025                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7026                 goto out;
7027         }
7028
7029         if ((flags&2) && !target_is_directory) {
7030                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7031                 goto out;
7032         }
7033
7034         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7035                 /* wants a tree copy! XXXX */
7036                 DEBUG(3,("Rejecting tree copy\n"));
7037                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7038                 goto out;
7039         }
7040
7041         /* Split up the directory from the filename/mask. */
7042         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7043                                       &fname_src_dir, &fname_src_mask);
7044         if (!NT_STATUS_IS_OK(status)) {
7045                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7046                 goto out;
7047         }
7048
7049         /*
7050          * We should only check the mangled cache
7051          * here if unix_convert failed. This means
7052          * that the path in 'mask' doesn't exist
7053          * on the file system and so we need to look
7054          * for a possible mangle. This patch from
7055          * Tine Smukavec <valentin.smukavec@hermes.si>.
7056          */
7057         if (!VALID_STAT(smb_fname_src->st) &&
7058             mangle_is_mangled(fname_src_mask, conn->params)) {
7059                 char *new_mask = NULL;
7060                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7061                                             &new_mask, conn->params);
7062
7063                 /* Use demangled name if one was successfully found. */
7064                 if (new_mask) {
7065                         TALLOC_FREE(fname_src_mask);
7066                         fname_src_mask = new_mask;
7067                 }
7068         }
7069
7070         if (!source_has_wild) {
7071
7072                 /*
7073                  * Only one file needs to be copied. Append the mask back onto
7074                  * the directory.
7075                  */
7076                 TALLOC_FREE(smb_fname_src->base_name);
7077                 if (ISDOT(fname_src_dir)) {
7078                         /* Ensure we use canonical names on open. */
7079                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7080                                                         "%s",
7081                                                         fname_src_mask);
7082                 } else {
7083                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7084                                                         "%s/%s",
7085                                                         fname_src_dir,
7086                                                         fname_src_mask);
7087                 }
7088                 if (!smb_fname_src->base_name) {
7089                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7090                         goto out;
7091                 }
7092
7093                 if (dest_has_wild) {
7094                         char *fname_dst_mod = NULL;
7095                         if (!resolve_wildcards(smb_fname_dst,
7096                                                smb_fname_src->base_name,
7097                                                smb_fname_dst->base_name,
7098                                                &fname_dst_mod)) {
7099                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7100                                 goto out;
7101                         }
7102                         TALLOC_FREE(smb_fname_dst->base_name);
7103                         smb_fname_dst->base_name = fname_dst_mod;
7104                 }
7105
7106                 status = check_name(conn, smb_fname_src->base_name);
7107                 if (!NT_STATUS_IS_OK(status)) {
7108                         reply_nterror(req, status);
7109                         goto out;
7110                 }
7111
7112                 status = check_name(conn, smb_fname_dst->base_name);
7113                 if (!NT_STATUS_IS_OK(status)) {
7114                         reply_nterror(req, status);
7115                         goto out;
7116                 }
7117
7118                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7119                                    ofun, count, target_is_directory);
7120
7121                 if(!NT_STATUS_IS_OK(status)) {
7122                         reply_nterror(req, status);
7123                         goto out;
7124                 } else {
7125                         count++;
7126                 }
7127         } else {
7128                 struct smb_Dir *dir_hnd = NULL;
7129                 const char *dname = NULL;
7130                 char *talloced = NULL;
7131                 long offset = 0;
7132
7133                 /*
7134                  * There is a wildcard that requires us to actually read the
7135                  * src dir and copy each file matching the mask to the dst.
7136                  * Right now streams won't be copied, but this could
7137                  * presumably be added with a nested loop for reach dir entry.
7138                  */
7139                 SMB_ASSERT(!smb_fname_src->stream_name);
7140                 SMB_ASSERT(!smb_fname_dst->stream_name);
7141
7142                 smb_fname_src->stream_name = NULL;
7143                 smb_fname_dst->stream_name = NULL;
7144
7145                 if (strequal(fname_src_mask,"????????.???")) {
7146                         TALLOC_FREE(fname_src_mask);
7147                         fname_src_mask = talloc_strdup(ctx, "*");
7148                         if (!fname_src_mask) {
7149                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7150                                 goto out;
7151                         }
7152                 }
7153
7154                 status = check_name(conn, fname_src_dir);
7155                 if (!NT_STATUS_IS_OK(status)) {
7156                         reply_nterror(req, status);
7157                         goto out;
7158                 }
7159
7160                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7161                 if (dir_hnd == NULL) {
7162                         status = map_nt_error_from_unix(errno);
7163                         reply_nterror(req, status);
7164                         goto out;
7165                 }
7166
7167                 error = ERRbadfile;
7168
7169                 /* Iterate over the src dir copying each entry to the dst. */
7170                 while ((dname = ReadDirName(dir_hnd, &offset,
7171                                             &smb_fname_src->st, &talloced))) {
7172                         char *destname = NULL;
7173
7174                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7175                                 TALLOC_FREE(talloced);
7176                                 continue;
7177                         }
7178
7179                         if (!is_visible_file(conn, fname_src_dir, dname,
7180                                              &smb_fname_src->st, false)) {
7181                                 TALLOC_FREE(talloced);
7182                                 continue;
7183                         }
7184
7185                         if(!mask_match(dname, fname_src_mask,
7186                                        conn->case_sensitive)) {
7187                                 TALLOC_FREE(talloced);
7188                                 continue;
7189                         }
7190
7191                         error = ERRnoaccess;
7192
7193                         /* Get the src smb_fname struct setup. */
7194                         TALLOC_FREE(smb_fname_src->base_name);
7195                         if (ISDOT(fname_src_dir)) {
7196                                 /* Ensure we use canonical names on open. */
7197                                 smb_fname_src->base_name =
7198                                         talloc_asprintf(smb_fname_src, "%s",
7199                                                 dname);
7200                         } else {
7201                                 smb_fname_src->base_name =
7202                                         talloc_asprintf(smb_fname_src, "%s/%s",
7203                                                 fname_src_dir, dname);
7204                         }
7205
7206                         if (!smb_fname_src->base_name) {
7207                                 TALLOC_FREE(dir_hnd);
7208                                 TALLOC_FREE(talloced);
7209                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7210                                 goto out;
7211                         }
7212
7213                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7214                                                smb_fname_dst->base_name,
7215                                                &destname)) {
7216                                 TALLOC_FREE(talloced);
7217                                 continue;
7218                         }
7219                         if (!destname) {
7220                                 TALLOC_FREE(dir_hnd);
7221                                 TALLOC_FREE(talloced);
7222                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7223                                 goto out;
7224                         }
7225
7226                         TALLOC_FREE(smb_fname_dst->base_name);
7227                         smb_fname_dst->base_name = destname;
7228
7229                         status = check_name(conn, smb_fname_src->base_name);
7230                         if (!NT_STATUS_IS_OK(status)) {
7231                                 TALLOC_FREE(dir_hnd);
7232                                 TALLOC_FREE(talloced);
7233                                 reply_nterror(req, status);
7234                                 goto out;
7235                         }
7236
7237                         status = check_name(conn, smb_fname_dst->base_name);
7238                         if (!NT_STATUS_IS_OK(status)) {
7239                                 TALLOC_FREE(dir_hnd);
7240                                 TALLOC_FREE(talloced);
7241                                 reply_nterror(req, status);
7242                                 goto out;
7243                         }
7244
7245                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7246                                 smb_fname_src->base_name,
7247                                 smb_fname_dst->base_name));
7248
7249                         status = copy_file(ctx, conn, smb_fname_src,
7250                                            smb_fname_dst, ofun, count,
7251                                            target_is_directory);
7252                         if (NT_STATUS_IS_OK(status)) {
7253                                 count++;
7254                         }
7255
7256                         TALLOC_FREE(talloced);
7257                 }
7258                 TALLOC_FREE(dir_hnd);
7259         }
7260
7261         if (count == 0) {
7262                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7263                 goto out;
7264         }
7265
7266         reply_outbuf(req, 1, 0);
7267         SSVAL(req->outbuf,smb_vwv0,count);
7268  out:
7269         TALLOC_FREE(smb_fname_src);
7270         TALLOC_FREE(smb_fname_dst);
7271         TALLOC_FREE(fname_src);
7272         TALLOC_FREE(fname_dst);
7273         TALLOC_FREE(fname_src_mask);
7274         TALLOC_FREE(fname_src_dir);
7275
7276         END_PROFILE(SMBcopy);
7277         return;
7278 }
7279
7280 #undef DBGC_CLASS
7281 #define DBGC_CLASS DBGC_LOCKING
7282
7283 /****************************************************************************
7284  Get a lock pid, dealing with large count requests.
7285 ****************************************************************************/
7286
7287 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7288                     bool large_file_format)
7289 {
7290         if(!large_file_format)
7291                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7292         else
7293                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7294 }
7295
7296 /****************************************************************************
7297  Get a lock count, dealing with large count requests.
7298 ****************************************************************************/
7299
7300 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7301                         bool large_file_format)
7302 {
7303         uint64_t count = 0;
7304
7305         if(!large_file_format) {
7306                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7307         } else {
7308
7309 #if defined(HAVE_LONGLONG)
7310                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7311                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7312 #else /* HAVE_LONGLONG */
7313
7314                 /*
7315                  * NT4.x seems to be broken in that it sends large file (64 bit)
7316                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7317                  * negotiated. For boxes without large unsigned ints truncate the
7318                  * lock count by dropping the top 32 bits.
7319                  */
7320
7321                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7322                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7323                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7324                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7325                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7326                 }
7327
7328                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7329 #endif /* HAVE_LONGLONG */
7330         }
7331
7332         return count;
7333 }
7334
7335 #if !defined(HAVE_LONGLONG)
7336 /****************************************************************************
7337  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7338 ****************************************************************************/
7339
7340 static uint32 map_lock_offset(uint32 high, uint32 low)
7341 {
7342         unsigned int i;
7343         uint32 mask = 0;
7344         uint32 highcopy = high;
7345
7346         /*
7347          * Try and find out how many significant bits there are in high.
7348          */
7349
7350         for(i = 0; highcopy; i++)
7351                 highcopy >>= 1;
7352
7353         /*
7354          * We use 31 bits not 32 here as POSIX
7355          * lock offsets may not be negative.
7356          */
7357
7358         mask = (~0) << (31 - i);
7359
7360         if(low & mask)
7361                 return 0; /* Fail. */
7362
7363         high <<= (31 - i);
7364
7365         return (high|low);
7366 }
7367 #endif /* !defined(HAVE_LONGLONG) */
7368
7369 /****************************************************************************
7370  Get a lock offset, dealing with large offset requests.
7371 ****************************************************************************/
7372
7373 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7374                          bool large_file_format, bool *err)
7375 {
7376         uint64_t offset = 0;
7377
7378         *err = False;
7379
7380         if(!large_file_format) {
7381                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7382         } else {
7383
7384 #if defined(HAVE_LONGLONG)
7385                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7386                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7387 #else /* HAVE_LONGLONG */
7388
7389                 /*
7390                  * NT4.x seems to be broken in that it sends large file (64 bit)
7391                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7392                  * negotiated. For boxes without large unsigned ints mangle the
7393                  * lock offset by mapping the top 32 bits onto the lower 32.
7394                  */
7395
7396                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7397                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7398                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7399                         uint32 new_low = 0;
7400
7401                         if((new_low = map_lock_offset(high, low)) == 0) {
7402                                 *err = True;
7403                                 return (uint64_t)-1;
7404                         }
7405
7406                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7407                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7408                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7409                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7410                 }
7411
7412                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7413 #endif /* HAVE_LONGLONG */
7414         }
7415
7416         return offset;
7417 }
7418
7419 NTSTATUS smbd_do_locking(struct smb_request *req,
7420                          files_struct *fsp,
7421                          uint8_t type,
7422                          int32_t timeout,
7423                          uint16_t num_ulocks,
7424                          struct smbd_lock_element *ulocks,
7425                          uint16_t num_locks,
7426                          struct smbd_lock_element *locks,
7427                          bool *async)
7428 {
7429         connection_struct *conn = req->conn;
7430         int i;
7431         NTSTATUS status = NT_STATUS_OK;
7432
7433         *async = false;
7434
7435         /* Data now points at the beginning of the list
7436            of smb_unlkrng structs */
7437         for(i = 0; i < (int)num_ulocks; i++) {
7438                 struct smbd_lock_element *e = &ulocks[i];
7439
7440                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7441                           "pid %u, file %s\n",
7442                           (double)e->offset,
7443                           (double)e->count,
7444                           (unsigned int)e->smblctx,
7445                           fsp_str_dbg(fsp)));
7446
7447                 if (e->brltype != UNLOCK_LOCK) {
7448                         /* this can only happen with SMB2 */
7449                         return NT_STATUS_INVALID_PARAMETER;
7450                 }
7451
7452                 status = do_unlock(req->sconn->msg_ctx,
7453                                 fsp,
7454                                 e->smblctx,
7455                                 e->count,
7456                                 e->offset,
7457                                 WINDOWS_LOCK);
7458
7459                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7460                     nt_errstr(status)));
7461
7462                 if (!NT_STATUS_IS_OK(status)) {
7463                         return status;
7464                 }
7465         }
7466
7467         /* Setup the timeout in seconds. */
7468
7469         if (!lp_blocking_locks(SNUM(conn))) {
7470                 timeout = 0;
7471         }
7472
7473         /* Data now points at the beginning of the list
7474            of smb_lkrng structs */
7475
7476         for(i = 0; i < (int)num_locks; i++) {
7477                 struct smbd_lock_element *e = &locks[i];
7478
7479                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7480                           "%llu, file %s timeout = %d\n",
7481                           (double)e->offset,
7482                           (double)e->count,
7483                           (unsigned long long)e->smblctx,
7484                           fsp_str_dbg(fsp),
7485                           (int)timeout));
7486
7487                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7488                         struct blocking_lock_record *blr = NULL;
7489
7490                         if (num_locks > 1) {
7491                                 /*
7492                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7493                                  * if the lock vector contains one entry. When given mutliple cancel
7494                                  * requests in a single PDU we expect the server to return an
7495                                  * error. Windows servers seem to accept the request but only
7496                                  * cancel the first lock.
7497                                  * JRA - Do what Windows does (tm) :-).
7498                                  */
7499
7500 #if 0
7501                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7502                                 return NT_STATUS_DOS(ERRDOS,
7503                                                 ERRcancelviolation);
7504 #else
7505                                 /* Windows behavior. */
7506                                 if (i != 0) {
7507                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7508                                                 "cancel request\n"));
7509                                         continue;
7510                                 }
7511 #endif
7512                         }
7513
7514                         if (lp_blocking_locks(SNUM(conn))) {
7515
7516                                 /* Schedule a message to ourselves to
7517                                    remove the blocking lock record and
7518                                    return the right error. */
7519
7520                                 blr = blocking_lock_cancel_smb1(fsp,
7521                                                 e->smblctx,
7522                                                 e->offset,
7523                                                 e->count,
7524                                                 WINDOWS_LOCK,
7525                                                 type,
7526                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7527                                 if (blr == NULL) {
7528                                         return NT_STATUS_DOS(
7529                                                         ERRDOS,
7530                                                         ERRcancelviolation);
7531                                 }
7532                         }
7533                         /* Remove a matching pending lock. */
7534                         status = do_lock_cancel(fsp,
7535                                                 e->smblctx,
7536                                                 e->count,
7537                                                 e->offset,
7538                                                 WINDOWS_LOCK,
7539                                                 blr);
7540                 } else {
7541                         bool blocking_lock = timeout ? true : false;
7542                         bool defer_lock = false;
7543                         struct byte_range_lock *br_lck;
7544                         uint64_t block_smblctx;
7545
7546                         br_lck = do_lock(req->sconn->msg_ctx,
7547                                         fsp,
7548                                         e->smblctx,
7549                                         e->count,
7550                                         e->offset,
7551                                         e->brltype,
7552                                         WINDOWS_LOCK,
7553                                         blocking_lock,
7554                                         &status,
7555                                         &block_smblctx,
7556                                         NULL);
7557
7558                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7559                                 /* Windows internal resolution for blocking locks seems
7560                                    to be about 200ms... Don't wait for less than that. JRA. */
7561                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7562                                         timeout = lp_lock_spin_time();
7563                                 }
7564                                 defer_lock = true;
7565                         }
7566
7567                         /* If a lock sent with timeout of zero would fail, and
7568                          * this lock has been requested multiple times,
7569                          * according to brl_lock_failed() we convert this
7570                          * request to a blocking lock with a timeout of between
7571                          * 150 - 300 milliseconds.
7572                          *
7573                          * If lp_lock_spin_time() has been set to 0, we skip
7574                          * this blocking retry and fail immediately.
7575                          *
7576                          * Replacement for do_lock_spin(). JRA. */
7577
7578                         if (!req->sconn->using_smb2 &&
7579                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7580                             lp_lock_spin_time() && !blocking_lock &&
7581                             NT_STATUS_EQUAL((status),
7582                                 NT_STATUS_FILE_LOCK_CONFLICT))
7583                         {
7584                                 defer_lock = true;
7585                                 timeout = lp_lock_spin_time();
7586                         }
7587
7588                         if (br_lck && defer_lock) {
7589                                 /*
7590                                  * A blocking lock was requested. Package up
7591                                  * this smb into a queued request and push it
7592                                  * onto the blocking lock queue.
7593                                  */
7594                                 if(push_blocking_lock_request(br_lck,
7595                                                         req,
7596                                                         fsp,
7597                                                         timeout,
7598                                                         i,
7599                                                         e->smblctx,
7600                                                         e->brltype,
7601                                                         WINDOWS_LOCK,
7602                                                         e->offset,
7603                                                         e->count,
7604                                                         block_smblctx)) {
7605                                         TALLOC_FREE(br_lck);
7606                                         *async = true;
7607                                         return NT_STATUS_OK;
7608                                 }
7609                         }
7610
7611                         TALLOC_FREE(br_lck);
7612                 }
7613
7614                 if (!NT_STATUS_IS_OK(status)) {
7615                         break;
7616                 }
7617         }
7618
7619         /* If any of the above locks failed, then we must unlock
7620            all of the previous locks (X/Open spec). */
7621
7622         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7623
7624                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7625                         i = -1; /* we want to skip the for loop */
7626                 }
7627
7628                 /*
7629                  * Ensure we don't do a remove on the lock that just failed,
7630                  * as under POSIX rules, if we have a lock already there, we
7631                  * will delete it (and we shouldn't) .....
7632                  */
7633                 for(i--; i >= 0; i--) {
7634                         struct smbd_lock_element *e = &locks[i];
7635
7636                         do_unlock(req->sconn->msg_ctx,
7637                                 fsp,
7638                                 e->smblctx,
7639                                 e->count,
7640                                 e->offset,
7641                                 WINDOWS_LOCK);
7642                 }
7643                 return status;
7644         }
7645
7646         DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7647                   fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7648
7649         return NT_STATUS_OK;
7650 }
7651
7652 /****************************************************************************
7653  Reply to a lockingX request.
7654 ****************************************************************************/
7655
7656 void reply_lockingX(struct smb_request *req)
7657 {
7658         connection_struct *conn = req->conn;
7659         files_struct *fsp;
7660         unsigned char locktype;
7661         unsigned char oplocklevel;
7662         uint16 num_ulocks;
7663         uint16 num_locks;
7664         int32 lock_timeout;
7665         int i;
7666         const uint8_t *data;
7667         bool large_file_format;
7668         bool err;
7669         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7670         struct smbd_lock_element *ulocks;
7671         struct smbd_lock_element *locks;
7672         bool async = false;
7673
7674         START_PROFILE(SMBlockingX);
7675
7676         if (req->wct < 8) {
7677                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7678                 END_PROFILE(SMBlockingX);
7679                 return;
7680         }
7681
7682         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7683         locktype = CVAL(req->vwv+3, 0);
7684         oplocklevel = CVAL(req->vwv+3, 1);
7685         num_ulocks = SVAL(req->vwv+6, 0);
7686         num_locks = SVAL(req->vwv+7, 0);
7687         lock_timeout = IVAL(req->vwv+4, 0);
7688         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7689
7690         if (!check_fsp(conn, req, fsp)) {
7691                 END_PROFILE(SMBlockingX);
7692                 return;
7693         }
7694
7695         data = req->buf;
7696
7697         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7698                 /* we don't support these - and CANCEL_LOCK makes w2k
7699                    and XP reboot so I don't really want to be
7700                    compatible! (tridge) */
7701                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7702                 END_PROFILE(SMBlockingX);
7703                 return;
7704         }
7705
7706         /* Check if this is an oplock break on a file
7707            we have granted an oplock on.
7708         */
7709         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7710                 /* Client can insist on breaking to none. */
7711                 bool break_to_none = (oplocklevel == 0);
7712                 bool result;
7713
7714                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7715                          "for fnum = %d\n", (unsigned int)oplocklevel,
7716                          fsp->fnum ));
7717
7718                 /*
7719                  * Make sure we have granted an exclusive or batch oplock on
7720                  * this file.
7721                  */
7722
7723                 if (fsp->oplock_type == 0) {
7724
7725                         /* The Samba4 nbench simulator doesn't understand
7726                            the difference between break to level2 and break
7727                            to none from level2 - it sends oplock break
7728                            replies in both cases. Don't keep logging an error
7729                            message here - just ignore it. JRA. */
7730
7731                         DEBUG(5,("reply_lockingX: Error : oplock break from "
7732                                  "client for fnum = %d (oplock=%d) and no "
7733                                  "oplock granted on this file (%s).\n",
7734                                  fsp->fnum, fsp->oplock_type,
7735                                  fsp_str_dbg(fsp)));
7736
7737                         /* if this is a pure oplock break request then don't
7738                          * send a reply */
7739                         if (num_locks == 0 && num_ulocks == 0) {
7740                                 END_PROFILE(SMBlockingX);
7741                                 return;
7742                         } else {
7743                                 END_PROFILE(SMBlockingX);
7744                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7745                                 return;
7746                         }
7747                 }
7748
7749                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7750                     (break_to_none)) {
7751                         result = remove_oplock(fsp);
7752                 } else {
7753                         result = downgrade_oplock(fsp);
7754                 }
7755
7756                 if (!result) {
7757                         DEBUG(0, ("reply_lockingX: error in removing "
7758                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
7759                         /* Hmmm. Is this panic justified? */
7760                         smb_panic("internal tdb error");
7761                 }
7762
7763                 reply_to_oplock_break_requests(fsp);
7764
7765                 /* if this is a pure oplock break request then don't send a
7766                  * reply */
7767                 if (num_locks == 0 && num_ulocks == 0) {
7768                         /* Sanity check - ensure a pure oplock break is not a
7769                            chained request. */
7770                         if(CVAL(req->vwv+0, 0) != 0xff)
7771                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
7772                                          "break is a chained %d request !\n",
7773                                          (unsigned int)CVAL(req->vwv+0, 0)));
7774                         END_PROFILE(SMBlockingX);
7775                         return;
7776                 }
7777         }
7778
7779         if (req->buflen <
7780             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7781                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7782                 END_PROFILE(SMBlockingX);
7783                 return;
7784         }
7785
7786         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7787         if (ulocks == NULL) {
7788                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7789                 END_PROFILE(SMBlockingX);
7790                 return;
7791         }
7792
7793         locks = talloc_array(req, struct smbd_lock_element, num_locks);
7794         if (locks == NULL) {
7795                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7796                 END_PROFILE(SMBlockingX);
7797                 return;
7798         }
7799
7800         /* Data now points at the beginning of the list
7801            of smb_unlkrng structs */
7802         for(i = 0; i < (int)num_ulocks; i++) {
7803                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7804                 ulocks[i].count = get_lock_count(data, i, large_file_format);
7805                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7806                 ulocks[i].brltype = UNLOCK_LOCK;
7807
7808                 /*
7809                  * There is no error code marked "stupid client bug".... :-).
7810                  */
7811                 if(err) {
7812                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7813                         END_PROFILE(SMBlockingX);
7814                         return;
7815                 }
7816         }
7817
7818         /* Now do any requested locks */
7819         data += ((large_file_format ? 20 : 10)*num_ulocks);
7820
7821         /* Data now points at the beginning of the list
7822            of smb_lkrng structs */
7823
7824         for(i = 0; i < (int)num_locks; i++) {
7825                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7826                 locks[i].count = get_lock_count(data, i, large_file_format);
7827                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7828
7829                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7830                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7831                                 locks[i].brltype = PENDING_READ_LOCK;
7832                         } else {
7833                                 locks[i].brltype = READ_LOCK;
7834                         }
7835                 } else {
7836                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7837                                 locks[i].brltype = PENDING_WRITE_LOCK;
7838                         } else {
7839                                 locks[i].brltype = WRITE_LOCK;
7840                         }
7841                 }
7842
7843                 /*
7844                  * There is no error code marked "stupid client bug".... :-).
7845                  */
7846                 if(err) {
7847                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7848                         END_PROFILE(SMBlockingX);
7849                         return;
7850                 }
7851         }
7852
7853         status = smbd_do_locking(req, fsp,
7854                                  locktype, lock_timeout,
7855                                  num_ulocks, ulocks,
7856                                  num_locks, locks,
7857                                  &async);
7858         if (!NT_STATUS_IS_OK(status)) {
7859                 END_PROFILE(SMBlockingX);
7860                 reply_nterror(req, status);
7861                 return;
7862         }
7863         if (async) {
7864                 END_PROFILE(SMBlockingX);
7865                 return;
7866         }
7867
7868         reply_outbuf(req, 2, 0);
7869
7870         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7871                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7872
7873         END_PROFILE(SMBlockingX);
7874         chain_reply(req);
7875 }
7876
7877 #undef DBGC_CLASS
7878 #define DBGC_CLASS DBGC_ALL
7879
7880 /****************************************************************************
7881  Reply to a SMBreadbmpx (read block multiplex) request.
7882  Always reply with an error, if someone has a platform really needs this,
7883  please contact vl@samba.org
7884 ****************************************************************************/
7885
7886 void reply_readbmpx(struct smb_request *req)
7887 {
7888         START_PROFILE(SMBreadBmpx);
7889         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7890         END_PROFILE(SMBreadBmpx);
7891         return;
7892 }
7893
7894 /****************************************************************************
7895  Reply to a SMBreadbs (read block multiplex secondary) request.
7896  Always reply with an error, if someone has a platform really needs this,
7897  please contact vl@samba.org
7898 ****************************************************************************/
7899
7900 void reply_readbs(struct smb_request *req)
7901 {
7902         START_PROFILE(SMBreadBs);
7903         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7904         END_PROFILE(SMBreadBs);
7905         return;
7906 }
7907
7908 /****************************************************************************
7909  Reply to a SMBsetattrE.
7910 ****************************************************************************/
7911
7912 void reply_setattrE(struct smb_request *req)
7913 {
7914         connection_struct *conn = req->conn;
7915         struct smb_file_time ft;
7916         files_struct *fsp;
7917         NTSTATUS status;
7918
7919         START_PROFILE(SMBsetattrE);
7920         ZERO_STRUCT(ft);
7921
7922         if (req->wct < 7) {
7923                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7924                 goto out;
7925         }
7926
7927         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7928
7929         if(!fsp || (fsp->conn != conn)) {
7930                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7931                 goto out;
7932         }
7933
7934         /*
7935          * Convert the DOS times into unix times.
7936          */
7937
7938         ft.atime = convert_time_t_to_timespec(
7939             srv_make_unix_date2(req->vwv+3));
7940         ft.mtime = convert_time_t_to_timespec(
7941             srv_make_unix_date2(req->vwv+5));
7942         ft.create_time = convert_time_t_to_timespec(
7943             srv_make_unix_date2(req->vwv+1));
7944
7945         reply_outbuf(req, 0, 0);
7946
7947         /*
7948          * Patch from Ray Frush <frush@engr.colostate.edu>
7949          * Sometimes times are sent as zero - ignore them.
7950          */
7951
7952         /* Ensure we have a valid stat struct for the source. */
7953         status = vfs_stat_fsp(fsp);
7954         if (!NT_STATUS_IS_OK(status)) {
7955                 reply_nterror(req, status);
7956                 goto out;
7957         }
7958
7959         if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
7960                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7961                 goto out;
7962         }
7963
7964         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7965         if (!NT_STATUS_IS_OK(status)) {
7966                 reply_nterror(req, status);
7967                 goto out;
7968         }
7969
7970         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7971                " createtime=%u\n",
7972                 fsp->fnum,
7973                 (unsigned int)ft.atime.tv_sec,
7974                 (unsigned int)ft.mtime.tv_sec,
7975                 (unsigned int)ft.create_time.tv_sec
7976                 ));
7977  out:
7978         END_PROFILE(SMBsetattrE);
7979         return;
7980 }
7981
7982
7983 /* Back from the dead for OS/2..... JRA. */
7984
7985 /****************************************************************************
7986  Reply to a SMBwritebmpx (write block multiplex primary) request.
7987  Always reply with an error, if someone has a platform really needs this,
7988  please contact vl@samba.org
7989 ****************************************************************************/
7990
7991 void reply_writebmpx(struct smb_request *req)
7992 {
7993         START_PROFILE(SMBwriteBmpx);
7994         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7995         END_PROFILE(SMBwriteBmpx);
7996         return;
7997 }
7998
7999 /****************************************************************************
8000  Reply to a SMBwritebs (write block multiplex secondary) request.
8001  Always reply with an error, if someone has a platform really needs this,
8002  please contact vl@samba.org
8003 ****************************************************************************/
8004
8005 void reply_writebs(struct smb_request *req)
8006 {
8007         START_PROFILE(SMBwriteBs);
8008         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8009         END_PROFILE(SMBwriteBs);
8010         return;
8011 }
8012
8013 /****************************************************************************
8014  Reply to a SMBgetattrE.
8015 ****************************************************************************/
8016
8017 void reply_getattrE(struct smb_request *req)
8018 {
8019         connection_struct *conn = req->conn;
8020         int mode;
8021         files_struct *fsp;
8022         struct timespec create_ts;
8023
8024         START_PROFILE(SMBgetattrE);
8025
8026         if (req->wct < 1) {
8027                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8028                 END_PROFILE(SMBgetattrE);
8029                 return;
8030         }
8031
8032         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8033
8034         if(!fsp || (fsp->conn != conn)) {
8035                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8036                 END_PROFILE(SMBgetattrE);
8037                 return;
8038         }
8039
8040         /* Do an fstat on this file */
8041         if(fsp_stat(fsp)) {
8042                 reply_nterror(req, map_nt_error_from_unix(errno));
8043                 END_PROFILE(SMBgetattrE);
8044                 return;
8045         }
8046
8047         mode = dos_mode(conn, fsp->fsp_name);
8048
8049         /*
8050          * Convert the times into dos times. Set create
8051          * date to be last modify date as UNIX doesn't save
8052          * this.
8053          */
8054
8055         reply_outbuf(req, 11, 0);
8056
8057         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8058         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8059         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8060                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8061         /* Should we check pending modtime here ? JRA */
8062         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8063                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8064
8065         if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8066                 SIVAL(req->outbuf, smb_vwv6, 0);
8067                 SIVAL(req->outbuf, smb_vwv8, 0);
8068         } else {
8069                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8070                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8071                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8072         }
8073         SSVAL(req->outbuf,smb_vwv10, mode);
8074
8075         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
8076
8077         END_PROFILE(SMBgetattrE);
8078         return;
8079 }