source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "printing.h"
  29 #include "smbd/globals.h"
  30 #include "fake_file.h"
  31 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  32 #include "rpc_client/cli_spoolss.h"
  33 #include "rpc_client/init_spoolss.h"
  34 #include "rpc_server/rpc_ncacn_np.h"
  35 #include "libcli/security/security.h"
  36
  37 /****************************************************************************
  38  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  39  path or anything including wildcards.
  40  We're assuming here that '/' is not the second byte in any multibyte char
  41  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  42  set.
  43 ****************************************************************************/
  44
  45 /* Custom version for processing POSIX paths. */
  46 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  47
  48 static NTSTATUS check_path_syntax_internal(char *path,
  49                                            bool posix_path,
  50                                            bool *p_last_component_contains_wcard)
  51 {
  52         char *d = path;
  53         const char *s = path;
  54         NTSTATUS ret = NT_STATUS_OK;
  55         bool start_of_name_component = True;
  56         bool stream_started = false;
  57
  58         *p_last_component_contains_wcard = False;
  59
  60         while (*s) {
  61                 if (stream_started) {
  62                         switch (*s) {
  63                         case '/':
  64                         case '\\':
  65                                 return NT_STATUS_OBJECT_NAME_INVALID;
  66                         case ':':
  67                                 if (s[1] == '\0') {
  68                                         return NT_STATUS_OBJECT_NAME_INVALID;
  69                                 }
  70                                 if (strchr_m(&s[1], ':')) {
  71                                         return NT_STATUS_OBJECT_NAME_INVALID;
  72                                 }
  73                                 break;
  74                         }
  75                 }
  76
  77                 if ((*s == ':') && !posix_path && !stream_started) {
  78                         if (*p_last_component_contains_wcard) {
  79                                 return NT_STATUS_OBJECT_NAME_INVALID;
  80                         }
  81                         /* Stream names allow more characters than file names.
  82                            We're overloading posix_path here to allow a wider
  83                            range of characters. If stream_started is true this
  84                            is still a Windows path even if posix_path is true.
  85                            JRA.
  86                         */
  87                         stream_started = true;
  88                         start_of_name_component = false;
  89                         posix_path = true;
  90
  91                         if (s[1] == '\0') {
  92                                 return NT_STATUS_OBJECT_NAME_INVALID;
  93                         }
  94                 }
  95
  96                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
  97                         /*
  98                          * Safe to assume is not the second part of a mb char
  99                          * as this is handled below.
 100                          */
 101                         /* Eat multiple '/' or '\\' */
 102                         while (IS_PATH_SEP(*s,posix_path)) {
 103                                 s++;
 104                         }
 105                         if ((d != path) && (*s != '\0')) {
 106                                 /* We only care about non-leading or trailing '/' or '\\' */
 107                                 *d++ = '/';
 108                         }
 109
 110                         start_of_name_component = True;
 111                         /* New component. */
 112                         *p_last_component_contains_wcard = False;
 113                         continue;
 114                 }
 115
 116                 if (start_of_name_component) {
 117                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 118                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 119
 120                                 /*
 121                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 122                                  */
 123
 124                                 /* If  we just added a '/' - delete it */
 125                                 if ((d > path) && (*(d-1) == '/')) {
 126                                         *(d-1) = '\0';
 127                                         d--;
 128                                 }
 129
 130                                 /* Are we at the start ? Can't go back further if so. */
 131                                 if (d <= path) {
 132                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 133                                         break;
 134                                 }
 135                                 /* Go back one level... */
 136                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 137                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 138                                 /* Decrement d first as d points to the *next* char to write into. */
 139                                 for (d--; d > path; d--) {
 140                                         if (*d == '/')
 141                                                 break;
 142                                 }
 143                                 s += 2; /* Else go past the .. */
 144                                 /* We're still at the start of a name component, just the previous one. */
 145                                 continue;
 146
 147                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 148                                 if (posix_path) {
 149                                         /* Eat the '.' */
 150                                         s++;
 151                                         continue;
 152                                 }
 153                         }
 154
 155                 }
 156
 157                 if (!(*s & 0x80)) {
 158                         if (!posix_path) {
 159                                 if (*s <= 0x1f || *s == '|') {
 160                                         return NT_STATUS_OBJECT_NAME_INVALID;
 161                                 }
 162                                 switch (*s) {
 163                                         case '*':
 164                                         case '?':
 165                                         case '<':
 166                                         case '>':
 167                                         case '"':
 168                                                 *p_last_component_contains_wcard = True;
 169                                                 break;
 170                                         default:
 171                                                 break;
 172                                 }
 173                         }
 174                         *d++ = *s++;
 175                 } else {
 176                         size_t siz;
 177                         /* Get the size of the next MB character. */
 178                         next_codepoint(s,&siz);
 179                         switch(siz) {
 180                                 case 5:
 181                                         *d++ = *s++;
 182                                         /*fall through*/
 183                                 case 4:
 184                                         *d++ = *s++;
 185                                         /*fall through*/
 186                                 case 3:
 187                                         *d++ = *s++;
 188                                         /*fall through*/
 189                                 case 2:
 190                                         *d++ = *s++;
 191                                         /*fall through*/
 192                                 case 1:
 193                                         *d++ = *s++;
 194                                         break;
 195                                 default:
 196                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 197                                         *d = '\0';
 198                                         return NT_STATUS_INVALID_PARAMETER;
 199                         }
 200                 }
 201                 start_of_name_component = False;
 202         }
 203
 204         *d = '\0';
 205
 206         return ret;
 207 }
 208
 209 /****************************************************************************
 210  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 211  No wildcards allowed.
 212 ****************************************************************************/
 213
 214 NTSTATUS check_path_syntax(char *path)
 215 {
 216         bool ignore;
 217         return check_path_syntax_internal(path, False, &ignore);
 218 }
 219
 220 /****************************************************************************
 221  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 222  Wildcards allowed - p_contains_wcard returns true if the last component contained
 223  a wildcard.
 224 ****************************************************************************/
 225
 226 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 227 {
 228         return check_path_syntax_internal(path, False, p_contains_wcard);
 229 }
 230
 231 /****************************************************************************
 232  Check the path for a POSIX client.
 233  We're assuming here that '/' is not the second byte in any multibyte char
 234  set (a safe assumption).
 235 ****************************************************************************/
 236
 237 NTSTATUS check_path_syntax_posix(char *path)
 238 {
 239         bool ignore;
 240         return check_path_syntax_internal(path, True, &ignore);
 241 }
 242
 243 /****************************************************************************
 244  Pull a string and check the path allowing a wilcard - provide for error return.
 245 ****************************************************************************/
 246
 247 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 248                         const char *base_ptr,
 249                         uint16 smb_flags2,
 250                         char **pp_dest,
 251                         const char *src,
 252                         size_t src_len,
 253                         int flags,
 254                         NTSTATUS *err,
 255                         bool *contains_wcard)
 256 {
 257         size_t ret;
 258
 259         *pp_dest = NULL;
 260
 261         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 262                                  src_len, flags);
 263
 264         if (!*pp_dest) {
 265                 *err = NT_STATUS_INVALID_PARAMETER;
 266                 return ret;
 267         }
 268
 269         *contains_wcard = False;
 270
 271         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 272                 /*
 273                  * For a DFS path the function parse_dfs_path()
 274                  * will do the path processing, just make a copy.
 275                  */
 276                 *err = NT_STATUS_OK;
 277                 return ret;
 278         }
 279
 280         if (lp_posix_pathnames()) {
 281                 *err = check_path_syntax_posix(*pp_dest);
 282         } else {
 283                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 284         }
 285
 286         return ret;
 287 }
 288
 289 /****************************************************************************
 290  Pull a string and check the path - provide for error return.
 291 ****************************************************************************/
 292
 293 size_t srvstr_get_path(TALLOC_CTX *ctx,
 294                         const char *base_ptr,
 295                         uint16 smb_flags2,
 296                         char **pp_dest,
 297                         const char *src,
 298                         size_t src_len,
 299                         int flags,
 300                         NTSTATUS *err)
 301 {
 302         bool ignore;
 303         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 304                                      src_len, flags, err, &ignore);
 305 }
 306
 307 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 308                                  char **pp_dest, const char *src, int flags,
 309                                  NTSTATUS *err, bool *contains_wcard)
 310 {
 311         return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
 312                                      pp_dest, src, smbreq_bufrem(req, src),
 313                                      flags, err, contains_wcard);
 314 }
 315
 316 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 317                            char **pp_dest, const char *src, int flags,
 318                            NTSTATUS *err)
 319 {
 320         bool ignore;
 321         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 322                                          flags, err, &ignore);
 323 }
 324
 325 /****************************************************************************
 326  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 327 ****************************************************************************/
 328
 329 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 330                     files_struct *fsp)
 331 {
 332         if ((fsp == NULL) || (conn == NULL)) {
 333                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 334                 return False;
 335         }
 336         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 337                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 338                 return False;
 339         }
 340         return True;
 341 }
 342
 343 /****************************************************************************
 344  Check if we have a correct fsp pointing to a file.
 345 ****************************************************************************/
 346
 347 bool check_fsp(connection_struct *conn, struct smb_request *req,
 348                files_struct *fsp)
 349 {
 350         if (!check_fsp_open(conn, req, fsp)) {
 351                 return False;
 352         }
 353         if (fsp->is_directory) {
 354                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 355                 return False;
 356         }
 357         if (fsp->fh->fd == -1) {
 358                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 359                 return False;
 360         }
 361         fsp->num_smb_operations++;
 362         return True;
 363 }
 364
 365 /****************************************************************************
 366  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 367  the CHECK_NTQUOTA_HANDLE_OK macro.
 368 ****************************************************************************/
 369
 370 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 371                               files_struct *fsp)
 372 {
 373         if (!check_fsp_open(conn, req, fsp)) {
 374                 return false;
 375         }
 376
 377         if (fsp->is_directory) {
 378                 return false;
 379         }
 380
 381         if (fsp->fake_file_handle == NULL) {
 382                 return false;
 383         }
 384
 385         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 386                 return false;
 387         }
 388
 389         if (fsp->fake_file_handle->private_data == NULL) {
 390                 return false;
 391         }
 392
 393         return true;
 394 }
 395
 396 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 397                                      const char *name, int name_type)
 398 {
 399         char *trim_name;
 400         char *trim_name_type;
 401         const char *retarget_parm;
 402         char *retarget;
 403         char *p;
 404         int retarget_type = 0x20;
 405         int retarget_port = 139;
 406         struct sockaddr_storage retarget_addr;
 407         struct sockaddr_in *in_addr;
 408         bool ret = false;
 409         uint8_t outbuf[10];
 410
 411         if (get_socket_port(sconn->sock) != 139) {
 412                 return false;
 413         }
 414
 415         trim_name = talloc_strdup(talloc_tos(), name);
 416         if (trim_name == NULL) {
 417                 goto fail;
 418         }
 419         trim_char(trim_name, ' ', ' ');
 420
 421         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 422                                          name_type);
 423         if (trim_name_type == NULL) {
 424                 goto fail;
 425         }
 426
 427         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 428                                              trim_name_type, NULL);
 429         if (retarget_parm == NULL) {
 430                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 431                                                      trim_name, NULL);
 432         }
 433         if (retarget_parm == NULL) {
 434                 goto fail;
 435         }
 436
 437         retarget = talloc_strdup(trim_name, retarget_parm);
 438         if (retarget == NULL) {
 439                 goto fail;
 440         }
 441
 442         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 443
 444         p = strchr(retarget, ':');
 445         if (p != NULL) {
 446                 *p++ = '\0';
 447                 retarget_port = atoi(p);
 448         }
 449
 450         p = strchr_m(retarget, '#');
 451         if (p != NULL) {
 452                 *p++ = '\0';
 453                 sscanf(p, "%x", &retarget_type);
 454         }
 455
 456         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 457         if (!ret) {
 458                 DEBUG(10, ("could not resolve %s\n", retarget));
 459                 goto fail;
 460         }
 461
 462         if (retarget_addr.ss_family != AF_INET) {
 463                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 464                 goto fail;
 465         }
 466
 467         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 468
 469         _smb_setlen(outbuf, 6);
 470         SCVAL(outbuf, 0, 0x84);
 471         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 472         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 473
 474         if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
 475                           NULL)) {
 476                 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
 477                                     "failed.");
 478         }
 479
 480         ret = true;
 481  fail:
 482         TALLOC_FREE(trim_name);
 483         return ret;
 484 }
 485
 486 /****************************************************************************
 487  Reply to a (netbios-level) special message.
 488 ****************************************************************************/
 489
 490 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
 491 {
 492         int msg_type = CVAL(inbuf,0);
 493         int msg_flags = CVAL(inbuf,1);
 494         /*
 495          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 496          * calculation & friends (srv_send_smb uses that) we need the full smb
 497          * header.
 498          */
 499         char outbuf[smb_size];
 500
 501         memset(outbuf, '\0', sizeof(outbuf));
 502
 503         smb_setlen(outbuf,0);
 504
 505         switch (msg_type) {
 506         case 0x81: /* session request */
 507         {
 508                 /* inbuf_size is guarenteed to be at least 4. */
 509                 fstring name1,name2;
 510                 int name_type1, name_type2;
 511                 int name_len1, name_len2;
 512
 513                 *name1 = *name2 = 0;
 514
 515                 if (sconn->nbt.got_session) {
 516                         exit_server_cleanly("multiple session request not permitted");
 517                 }
 518
 519                 SCVAL(outbuf,0,0x82);
 520                 SCVAL(outbuf,3,0);
 521
 522                 /* inbuf_size is guaranteed to be at least 4. */
 523                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 524                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 525                         DEBUG(0,("Invalid name length in session request\n"));
 526                         break;
 527                 }
 528                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 529                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 530                         DEBUG(0,("Invalid name length in session request\n"));
 531                         break;
 532                 }
 533
 534                 name_type1 = name_extract((unsigned char *)inbuf,
 535                                 inbuf_size,(unsigned int)4,name1);
 536                 name_type2 = name_extract((unsigned char *)inbuf,
 537                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 538
 539                 if (name_type1 == -1 || name_type2 == -1) {
 540                         DEBUG(0,("Invalid name type in session request\n"));
 541                         break;
 542                 }
 543
 544                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 545                          name1, name_type1, name2, name_type2));
 546
 547                 if (netbios_session_retarget(sconn, name1, name_type1)) {
 548                         exit_server_cleanly("retargeted client");
 549                 }
 550
 551                 /*
 552                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 553                  * "*SMBSERV" arrggg!!!
 554                  */
 555                 if (strequal(name1, "*SMBSERVER     ")
 556                     || strequal(name1, "*SMBSERV       "))  {
 557                         fstrcpy(name1, sconn->client_id.addr);
 558                 }
 559
 560                 set_local_machine_name(name1, True);
 561                 set_remote_machine_name(name2, True);
 562
 563                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 564                          get_local_machine_name(), get_remote_machine_name(),
 565                          name_type2));
 566
 567                 if (name_type2 == 'R') {
 568                         /* We are being asked for a pathworks session ---
 569                            no thanks! */
 570                         SCVAL(outbuf, 0,0x83);
 571                         break;
 572                 }
 573
 574                 /* only add the client's machine name to the list
 575                    of possibly valid usernames if we are operating
 576                    in share mode security */
 577                 if (lp_security() == SEC_SHARE) {
 578                         add_session_user(sconn, get_remote_machine_name());
 579                 }
 580
 581                 reload_services(sconn->msg_ctx, sconn->sock, True);
 582                 reopen_logs();
 583
 584                 sconn->nbt.got_session = true;
 585                 break;
 586         }
 587
 588         case 0x89: /* session keepalive request
 589                       (some old clients produce this?) */
 590                 SCVAL(outbuf,0,SMBkeepalive);
 591                 SCVAL(outbuf,3,0);
 592                 break;
 593
 594         case 0x82: /* positive session response */
 595         case 0x83: /* negative session response */
 596         case 0x84: /* retarget session response */
 597                 DEBUG(0,("Unexpected session response\n"));
 598                 break;
 599
 600         case SMBkeepalive: /* session keepalive */
 601         default:
 602                 return;
 603         }
 604
 605         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 606                     msg_type, msg_flags));
 607
 608         srv_send_smb(sconn, outbuf, false, 0, false, NULL);
 609         return;
 610 }
 611
 612 /****************************************************************************
 613  Reply to a tcon.
 614  conn POINTER CAN BE NULL HERE !
 615 ****************************************************************************/
 616
 617 void reply_tcon(struct smb_request *req)
 618 {
 619         connection_struct *conn = req->conn;
 620         const char *service;
 621         char *service_buf = NULL;
 622         char *password = NULL;
 623         char *dev = NULL;
 624         int pwlen=0;
 625         NTSTATUS nt_status;
 626         const char *p;
 627         DATA_BLOB password_blob;
 628         TALLOC_CTX *ctx = talloc_tos();
 629         struct smbd_server_connection *sconn = req->sconn;
 630
 631         START_PROFILE(SMBtcon);
 632
 633         if (req->buflen < 4) {
 634                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 635                 END_PROFILE(SMBtcon);
 636                 return;
 637         }
 638
 639         p = (const char *)req->buf + 1;
 640         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 641         p += 1;
 642         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 643         p += pwlen+1;
 644         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 645         p += 1;
 646
 647         if (service_buf == NULL || password == NULL || dev == NULL) {
 648                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 649                 END_PROFILE(SMBtcon);
 650                 return;
 651         }
 652         p = strrchr_m(service_buf,'\\');
 653         if (p) {
 654                 service = p+1;
 655         } else {
 656                 service = service_buf;
 657         }
 658
 659         password_blob = data_blob(password, pwlen+1);
 660
 661         conn = make_connection(sconn,service,password_blob,dev,
 662                                req->vuid,&nt_status);
 663         req->conn = conn;
 664
 665         data_blob_clear_free(&password_blob);
 666
 667         if (!conn) {
 668                 reply_nterror(req, nt_status);
 669                 END_PROFILE(SMBtcon);
 670                 return;
 671         }
 672
 673         reply_outbuf(req, 2, 0);
 674         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 675         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 676         SSVAL(req->outbuf,smb_tid,conn->cnum);
 677
 678         DEBUG(3,("tcon service=%s cnum=%d\n",
 679                  service, conn->cnum));
 680
 681         END_PROFILE(SMBtcon);
 682         return;
 683 }
 684
 685 /****************************************************************************
 686  Reply to a tcon and X.
 687  conn POINTER CAN BE NULL HERE !
 688 ****************************************************************************/
 689
 690 void reply_tcon_and_X(struct smb_request *req)
 691 {
 692         connection_struct *conn = req->conn;
 693         const char *service = NULL;
 694         DATA_BLOB password;
 695         TALLOC_CTX *ctx = talloc_tos();
 696         /* what the cleint thinks the device is */
 697         char *client_devicetype = NULL;
 698         /* what the server tells the client the share represents */
 699         const char *server_devicetype;
 700         NTSTATUS nt_status;
 701         int passlen;
 702         char *path = NULL;
 703         const char *p, *q;
 704         uint16 tcon_flags;
 705         struct smbd_server_connection *sconn = req->sconn;
 706
 707         START_PROFILE(SMBtconX);
 708
 709         if (req->wct < 4) {
 710                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 711                 END_PROFILE(SMBtconX);
 712                 return;
 713         }
 714
 715         passlen = SVAL(req->vwv+3, 0);
 716         tcon_flags = SVAL(req->vwv+2, 0);
 717
 718         /* we might have to close an old one */
 719         if ((tcon_flags & 0x1) && conn) {
 720                 close_cnum(conn,req->vuid);
 721                 req->conn = NULL;
 722                 conn = NULL;
 723         }
 724
 725         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 726                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 727                 END_PROFILE(SMBtconX);
 728                 return;
 729         }
 730
 731         if (sconn->smb1.negprot.encrypted_passwords) {
 732                 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
 733                 if (lp_security() == SEC_SHARE) {
 734                         /*
 735                          * Security = share always has a pad byte
 736                          * after the password.
 737                          */
 738                         p = (const char *)req->buf + passlen + 1;
 739                 } else {
 740                         p = (const char *)req->buf + passlen;
 741                 }
 742         } else {
 743                 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
 744                 /* Ensure correct termination */
 745                 password.data[passlen]=0;
 746                 p = (const char *)req->buf + passlen + 1;
 747         }
 748
 749         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 750
 751         if (path == NULL) {
 752                 data_blob_clear_free(&password);
 753                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 754                 END_PROFILE(SMBtconX);
 755                 return;
 756         }
 757
 758         /*
 759          * the service name can be either: \\server\share
 760          * or share directly like on the DELL PowerVault 705
 761          */
 762         if (*path=='\\') {
 763                 q = strchr_m(path+2,'\\');
 764                 if (!q) {
 765                         data_blob_clear_free(&password);
 766                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 767                         END_PROFILE(SMBtconX);
 768                         return;
 769                 }
 770                 service = q+1;
 771         } else {
 772                 service = path;
 773         }
 774
 775         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 776                                 &client_devicetype, p,
 777                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 778
 779         if (client_devicetype == NULL) {
 780                 data_blob_clear_free(&password);
 781                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 782                 END_PROFILE(SMBtconX);
 783                 return;
 784         }
 785
 786         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 787
 788         conn = make_connection(sconn, service, password, client_devicetype,
 789                                req->vuid, &nt_status);
 790         req->conn =conn;
 791
 792         data_blob_clear_free(&password);
 793
 794         if (!conn) {
 795                 reply_nterror(req, nt_status);
 796                 END_PROFILE(SMBtconX);
 797                 return;
 798         }
 799
 800         if ( IS_IPC(conn) )
 801                 server_devicetype = "IPC";
 802         else if ( IS_PRINT(conn) )
 803                 server_devicetype = "LPT1:";
 804         else
 805                 server_devicetype = "A:";
 806
 807         if (get_Protocol() < PROTOCOL_NT1) {
 808                 reply_outbuf(req, 2, 0);
 809                 if (message_push_string(&req->outbuf, server_devicetype,
 810                                         STR_TERMINATE|STR_ASCII) == -1) {
 811                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 812                         END_PROFILE(SMBtconX);
 813                         return;
 814                 }
 815         } else {
 816                 /* NT sets the fstype of IPC$ to the null string */
 817                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 818
 819                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 820                         /* Return permissions. */
 821                         uint32 perm1 = 0;
 822                         uint32 perm2 = 0;
 823
 824                         reply_outbuf(req, 7, 0);
 825
 826                         if (IS_IPC(conn)) {
 827                                 perm1 = FILE_ALL_ACCESS;
 828                                 perm2 = FILE_ALL_ACCESS;
 829                         } else {
 830                                 perm1 = CAN_WRITE(conn) ?
 831                                                 SHARE_ALL_ACCESS :
 832                                                 SHARE_READ_ONLY;
 833                         }
 834
 835                         SIVAL(req->outbuf, smb_vwv3, perm1);
 836                         SIVAL(req->outbuf, smb_vwv5, perm2);
 837                 } else {
 838                         reply_outbuf(req, 3, 0);
 839                 }
 840
 841                 if ((message_push_string(&req->outbuf, server_devicetype,
 842                                          STR_TERMINATE|STR_ASCII) == -1)
 843                     || (message_push_string(&req->outbuf, fstype,
 844                                             STR_TERMINATE) == -1)) {
 845                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 846                         END_PROFILE(SMBtconX);
 847                         return;
 848                 }
 849
 850                 /* what does setting this bit do? It is set by NT4 and
 851                    may affect the ability to autorun mounted cdroms */
 852                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 853                       (lp_csc_policy(SNUM(conn)) << 2));
 854
 855                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
 856                         DEBUG(2,("Serving %s as a Dfs root\n",
 857                                  lp_servicename(SNUM(conn)) ));
 858                         SSVAL(req->outbuf, smb_vwv2,
 859                               SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
 860                 }
 861         }
 862
 863
 864         DEBUG(3,("tconX service=%s \n",
 865                  service));
 866
 867         /* set the incoming and outgoing tid to the just created one */
 868         SSVAL(req->inbuf,smb_tid,conn->cnum);
 869         SSVAL(req->outbuf,smb_tid,conn->cnum);
 870
 871         END_PROFILE(SMBtconX);
 872
 873         req->tid = conn->cnum;
 874         chain_reply(req);
 875         return;
 876 }
 877
 878 /****************************************************************************
 879  Reply to an unknown type.
 880 ****************************************************************************/
 881
 882 void reply_unknown_new(struct smb_request *req, uint8 type)
 883 {
 884         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 885                   smb_fn_name(type), type, type));
 886         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
 887         return;
 888 }
 889
 890 /****************************************************************************
 891  Reply to an ioctl.
 892  conn POINTER CAN BE NULL HERE !
 893 ****************************************************************************/
 894
 895 void reply_ioctl(struct smb_request *req)
 896 {
 897         connection_struct *conn = req->conn;
 898         uint16 device;
 899         uint16 function;
 900         uint32 ioctl_code;
 901         int replysize;
 902         char *p;
 903
 904         START_PROFILE(SMBioctl);
 905
 906         if (req->wct < 3) {
 907                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 908                 END_PROFILE(SMBioctl);
 909                 return;
 910         }
 911
 912         device     = SVAL(req->vwv+1, 0);
 913         function   = SVAL(req->vwv+2, 0);
 914         ioctl_code = (device << 16) + function;
 915
 916         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 917
 918         switch (ioctl_code) {
 919             case IOCTL_QUERY_JOB_INFO:
 920                     replysize = 32;
 921                     break;
 922             default:
 923                     reply_force_doserror(req, ERRSRV, ERRnosupport);
 924                     END_PROFILE(SMBioctl);
 925                     return;
 926         }
 927
 928         reply_outbuf(req, 8, replysize+1);
 929         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 930         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 931         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 932         p = smb_buf(req->outbuf);
 933         memset(p, '\0', replysize+1); /* valgrind-safe. */
 934         p += 1;          /* Allow for alignment */
 935
 936         switch (ioctl_code) {
 937                 case IOCTL_QUERY_JOB_INFO:
 938                 {
 939                         files_struct *fsp = file_fsp(
 940                                 req, SVAL(req->vwv+0, 0));
 941                         if (!fsp) {
 942                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 943                                 END_PROFILE(SMBioctl);
 944                                 return;
 945                         }
 946                         /* Job number */
 947                         if (fsp->print_file) {
 948                                 SSVAL(p, 0, fsp->print_file->rap_jobid);
 949                         } else {
 950                                 SSVAL(p, 0, 0);
 951                         }
 952                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 953                                     global_myname(), 15,
 954                                     STR_TERMINATE|STR_ASCII);
 955                         if (conn) {
 956                                 srvstr_push((char *)req->outbuf, req->flags2,
 957                                             p+18, lp_servicename(SNUM(conn)),
 958                                             13, STR_TERMINATE|STR_ASCII);
 959                         } else {
 960                                 memset(p+18, 0, 13);
 961                         }
 962                         break;
 963                 }
 964         }
 965
 966         END_PROFILE(SMBioctl);
 967         return;
 968 }
 969
 970 /****************************************************************************
 971  Strange checkpath NTSTATUS mapping.
 972 ****************************************************************************/
 973
 974 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
 975 {
 976         /* Strange DOS error code semantics only for checkpath... */
 977         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 978                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 979                         /* We need to map to ERRbadpath */
 980                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 981                 }
 982         }
 983         return status;
 984 }
 985
 986 /****************************************************************************
 987  Reply to a checkpath.
 988 ****************************************************************************/
 989
 990 void reply_checkpath(struct smb_request *req)
 991 {
 992         connection_struct *conn = req->conn;
 993         struct smb_filename *smb_fname = NULL;
 994         char *name = NULL;
 995         NTSTATUS status;
 996         TALLOC_CTX *ctx = talloc_tos();
 997
 998         START_PROFILE(SMBcheckpath);
 999
1000         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1001                             STR_TERMINATE, &status);
1002
1003         if (!NT_STATUS_IS_OK(status)) {
1004                 status = map_checkpath_error(req->flags2, status);
1005                 reply_nterror(req, status);
1006                 END_PROFILE(SMBcheckpath);
1007                 return;
1008         }
1009
1010         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1011
1012         status = filename_convert(ctx,
1013                                 conn,
1014                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1015                                 name,
1016                                 0,
1017                                 NULL,
1018                                 &smb_fname);
1019
1020         if (!NT_STATUS_IS_OK(status)) {
1021                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1022                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1023                                         ERRSRV, ERRbadpath);
1024                         END_PROFILE(SMBcheckpath);
1025                         return;
1026                 }
1027                 goto path_err;
1028         }
1029
1030         if (!VALID_STAT(smb_fname->st) &&
1031             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1032                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1033                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1034                 status = map_nt_error_from_unix(errno);
1035                 goto path_err;
1036         }
1037
1038         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1039                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1040                                 ERRDOS, ERRbadpath);
1041                 goto out;
1042         }
1043
1044         reply_outbuf(req, 0, 0);
1045
1046  path_err:
1047         /* We special case this - as when a Windows machine
1048                 is parsing a path is steps through the components
1049                 one at a time - if a component fails it expects
1050                 ERRbadpath, not ERRbadfile.
1051         */
1052         status = map_checkpath_error(req->flags2, status);
1053         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1054                 /*
1055                  * Windows returns different error codes if
1056                  * the parent directory is valid but not the
1057                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1058                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1059                  * if the path is invalid.
1060                  */
1061                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1062                                 ERRDOS, ERRbadpath);
1063                 goto out;
1064         }
1065
1066         reply_nterror(req, status);
1067
1068  out:
1069         TALLOC_FREE(smb_fname);
1070         END_PROFILE(SMBcheckpath);
1071         return;
1072 }
1073
1074 /****************************************************************************
1075  Reply to a getatr.
1076 ****************************************************************************/
1077
1078 void reply_getatr(struct smb_request *req)
1079 {
1080         connection_struct *conn = req->conn;
1081         struct smb_filename *smb_fname = NULL;
1082         char *fname = NULL;
1083         int mode=0;
1084         SMB_OFF_T size=0;
1085         time_t mtime=0;
1086         const char *p;
1087         NTSTATUS status;
1088         TALLOC_CTX *ctx = talloc_tos();
1089         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1090
1091         START_PROFILE(SMBgetatr);
1092
1093         p = (const char *)req->buf + 1;
1094         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1095         if (!NT_STATUS_IS_OK(status)) {
1096                 reply_nterror(req, status);
1097                 goto out;
1098         }
1099
1100         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1101                 under WfWg - weird! */
1102         if (*fname == '\0') {
1103                 mode = aHIDDEN | aDIR;
1104                 if (!CAN_WRITE(conn)) {
1105                         mode |= aRONLY;
1106                 }
1107                 size = 0;
1108                 mtime = 0;
1109         } else {
1110                 status = filename_convert(ctx,
1111                                 conn,
1112                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1113                                 fname,
1114                                 0,
1115                                 NULL,
1116                                 &smb_fname);
1117                 if (!NT_STATUS_IS_OK(status)) {
1118                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1119                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1120                                                 ERRSRV, ERRbadpath);
1121                                 goto out;
1122                         }
1123                         reply_nterror(req, status);
1124                         goto out;
1125                 }
1126                 if (!VALID_STAT(smb_fname->st) &&
1127                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1128                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1129                                  smb_fname_str_dbg(smb_fname),
1130                                  strerror(errno)));
1131                         reply_nterror(req,  map_nt_error_from_unix(errno));
1132                         goto out;
1133                 }
1134
1135                 mode = dos_mode(conn, smb_fname);
1136                 size = smb_fname->st.st_ex_size;
1137
1138                 if (ask_sharemode) {
1139                         struct timespec write_time_ts;
1140                         struct file_id fileid;
1141
1142                         ZERO_STRUCT(write_time_ts);
1143                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1144                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1145                         if (!null_timespec(write_time_ts)) {
1146                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1147                         }
1148                 }
1149
1150                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1151                 if (mode & aDIR) {
1152                         size = 0;
1153                 }
1154         }
1155
1156         reply_outbuf(req, 10, 0);
1157
1158         SSVAL(req->outbuf,smb_vwv0,mode);
1159         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1160                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1161         } else {
1162                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1163         }
1164         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1165
1166         if (get_Protocol() >= PROTOCOL_NT1) {
1167                 SSVAL(req->outbuf, smb_flg2,
1168                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1169         }
1170
1171         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1172                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1173
1174  out:
1175         TALLOC_FREE(smb_fname);
1176         TALLOC_FREE(fname);
1177         END_PROFILE(SMBgetatr);
1178         return;
1179 }
1180
1181 /****************************************************************************
1182  Reply to a setatr.
1183 ****************************************************************************/
1184
1185 void reply_setatr(struct smb_request *req)
1186 {
1187         struct smb_file_time ft;
1188         connection_struct *conn = req->conn;
1189         struct smb_filename *smb_fname = NULL;
1190         char *fname = NULL;
1191         int mode;
1192         time_t mtime;
1193         const char *p;
1194         NTSTATUS status;
1195         TALLOC_CTX *ctx = talloc_tos();
1196
1197         START_PROFILE(SMBsetatr);
1198
1199         ZERO_STRUCT(ft);
1200
1201         if (req->wct < 2) {
1202                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1203                 goto out;
1204         }
1205
1206         p = (const char *)req->buf + 1;
1207         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1208         if (!NT_STATUS_IS_OK(status)) {
1209                 reply_nterror(req, status);
1210                 goto out;
1211         }
1212
1213         status = filename_convert(ctx,
1214                                 conn,
1215                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1216                                 fname,
1217                                 0,
1218                                 NULL,
1219                                 &smb_fname);
1220         if (!NT_STATUS_IS_OK(status)) {
1221                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1222                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1223                                         ERRSRV, ERRbadpath);
1224                         goto out;
1225                 }
1226                 reply_nterror(req, status);
1227                 goto out;
1228         }
1229
1230         if (smb_fname->base_name[0] == '.' &&
1231             smb_fname->base_name[1] == '\0') {
1232                 /*
1233                  * Not sure here is the right place to catch this
1234                  * condition. Might be moved to somewhere else later -- vl
1235                  */
1236                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1237                 goto out;
1238         }
1239
1240         mode = SVAL(req->vwv+0, 0);
1241         mtime = srv_make_unix_date3(req->vwv+1);
1242
1243         ft.mtime = convert_time_t_to_timespec(mtime);
1244         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1245         if (!NT_STATUS_IS_OK(status)) {
1246                 reply_nterror(req, status);
1247                 goto out;
1248         }
1249
1250         if (mode != FILE_ATTRIBUTE_NORMAL) {
1251                 if (VALID_STAT_OF_DIR(smb_fname->st))
1252                         mode |= aDIR;
1253                 else
1254                         mode &= ~aDIR;
1255
1256                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1257                                      false) != 0) {
1258                         reply_nterror(req, map_nt_error_from_unix(errno));
1259                         goto out;
1260                 }
1261         }
1262
1263         reply_outbuf(req, 0, 0);
1264
1265         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1266                  mode));
1267  out:
1268         TALLOC_FREE(smb_fname);
1269         END_PROFILE(SMBsetatr);
1270         return;
1271 }
1272
1273 /****************************************************************************
1274  Reply to a dskattr.
1275 ****************************************************************************/
1276
1277 void reply_dskattr(struct smb_request *req)
1278 {
1279         connection_struct *conn = req->conn;
1280         uint64_t dfree,dsize,bsize;
1281         START_PROFILE(SMBdskattr);
1282
1283         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1284                 reply_nterror(req, map_nt_error_from_unix(errno));
1285                 END_PROFILE(SMBdskattr);
1286                 return;
1287         }
1288
1289         reply_outbuf(req, 5, 0);
1290
1291         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1292                 double total_space, free_space;
1293                 /* we need to scale this to a number that DOS6 can handle. We
1294                    use floating point so we can handle large drives on systems
1295                    that don't have 64 bit integers
1296
1297                    we end up displaying a maximum of 2G to DOS systems
1298                 */
1299                 total_space = dsize * (double)bsize;
1300                 free_space = dfree * (double)bsize;
1301
1302                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1303                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1304
1305                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1306                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1307
1308                 SSVAL(req->outbuf,smb_vwv0,dsize);
1309                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1310                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1311                 SSVAL(req->outbuf,smb_vwv3,dfree);
1312         } else {
1313                 SSVAL(req->outbuf,smb_vwv0,dsize);
1314                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1315                 SSVAL(req->outbuf,smb_vwv2,512);
1316                 SSVAL(req->outbuf,smb_vwv3,dfree);
1317         }
1318
1319         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1320
1321         END_PROFILE(SMBdskattr);
1322         return;
1323 }
1324
1325 /*
1326  * Utility function to split the filename from the directory.
1327  */
1328 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1329                                      char **fname_dir_out,
1330                                      char **fname_mask_out)
1331 {
1332         const char *p = NULL;
1333         char *fname_dir = NULL;
1334         char *fname_mask = NULL;
1335
1336         p = strrchr_m(fname_in, '/');
1337         if (!p) {
1338                 fname_dir = talloc_strdup(ctx, ".");
1339                 fname_mask = talloc_strdup(ctx, fname_in);
1340         } else {
1341                 fname_dir = talloc_strndup(ctx, fname_in,
1342                     PTR_DIFF(p, fname_in));
1343                 fname_mask = talloc_strdup(ctx, p+1);
1344         }
1345
1346         if (!fname_dir || !fname_mask) {
1347                 TALLOC_FREE(fname_dir);
1348                 TALLOC_FREE(fname_mask);
1349                 return NT_STATUS_NO_MEMORY;
1350         }
1351
1352         *fname_dir_out = fname_dir;
1353         *fname_mask_out = fname_mask;
1354         return NT_STATUS_OK;
1355 }
1356
1357 /****************************************************************************
1358  Reply to a search.
1359  Can be called from SMBsearch, SMBffirst or SMBfunique.
1360 ****************************************************************************/
1361
1362 void reply_search(struct smb_request *req)
1363 {
1364         connection_struct *conn = req->conn;
1365         char *path = NULL;
1366         const char *mask = NULL;
1367         char *directory = NULL;
1368         struct smb_filename *smb_fname = NULL;
1369         char *fname = NULL;
1370         SMB_OFF_T size;
1371         uint32 mode;
1372         struct timespec date;
1373         uint32 dirtype;
1374         unsigned int numentries = 0;
1375         unsigned int maxentries = 0;
1376         bool finished = False;
1377         const char *p;
1378         int status_len;
1379         char status[21];
1380         int dptr_num= -1;
1381         bool check_descend = False;
1382         bool expect_close = False;
1383         NTSTATUS nt_status;
1384         bool mask_contains_wcard = False;
1385         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1386         TALLOC_CTX *ctx = talloc_tos();
1387         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1388         struct dptr_struct *dirptr = NULL;
1389         struct smbd_server_connection *sconn = req->sconn;
1390
1391         START_PROFILE(SMBsearch);
1392
1393         if (req->wct < 2) {
1394                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1395                 goto out;
1396         }
1397
1398         if (lp_posix_pathnames()) {
1399                 reply_unknown_new(req, req->cmd);
1400                 goto out;
1401         }
1402
1403         /* If we were called as SMBffirst then we must expect close. */
1404         if(req->cmd == SMBffirst) {
1405                 expect_close = True;
1406         }
1407
1408         reply_outbuf(req, 1, 3);
1409         maxentries = SVAL(req->vwv+0, 0);
1410         dirtype = SVAL(req->vwv+1, 0);
1411         p = (const char *)req->buf + 1;
1412         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1413                                        &nt_status, &mask_contains_wcard);
1414         if (!NT_STATUS_IS_OK(nt_status)) {
1415                 reply_nterror(req, nt_status);
1416                 goto out;
1417         }
1418
1419         p++;
1420         status_len = SVAL(p, 0);
1421         p += 2;
1422
1423         /* dirtype &= ~aDIR; */
1424
1425         if (status_len == 0) {
1426                 nt_status = filename_convert(ctx, conn,
1427                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1428                                              path,
1429                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1430                                              &mask_contains_wcard,
1431                                              &smb_fname);
1432                 if (!NT_STATUS_IS_OK(nt_status)) {
1433                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1434                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1435                                                 ERRSRV, ERRbadpath);
1436                                 goto out;
1437                         }
1438                         reply_nterror(req, nt_status);
1439                         goto out;
1440                 }
1441
1442                 directory = smb_fname->base_name;
1443
1444                 p = strrchr_m(directory,'/');
1445                 if ((p != NULL) && (*directory != '/')) {
1446                         mask = p + 1;
1447                         directory = talloc_strndup(ctx, directory,
1448                                                    PTR_DIFF(p, directory));
1449                 } else {
1450                         mask = directory;
1451                         directory = talloc_strdup(ctx,".");
1452                 }
1453
1454                 if (!directory) {
1455                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1456                         goto out;
1457                 }
1458
1459                 memset((char *)status,'\0',21);
1460                 SCVAL(status,0,(dirtype & 0x1F));
1461
1462                 nt_status = dptr_create(conn,
1463                                         NULL, /* fsp */
1464                                         directory,
1465                                         True,
1466                                         expect_close,
1467                                         req->smbpid,
1468                                         mask,
1469                                         mask_contains_wcard,
1470                                         dirtype,
1471                                         &dirptr);
1472                 if (!NT_STATUS_IS_OK(nt_status)) {
1473                         reply_nterror(req, nt_status);
1474                         goto out;
1475                 }
1476                 dptr_num = dptr_dnum(dirptr);
1477         } else {
1478                 int status_dirtype;
1479                 const char *dirpath;
1480
1481                 memcpy(status,p,21);
1482                 status_dirtype = CVAL(status,0) & 0x1F;
1483                 if (status_dirtype != (dirtype & 0x1F)) {
1484                         dirtype = status_dirtype;
1485                 }
1486
1487                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1488                 if (!dirptr) {
1489                         goto SearchEmpty;
1490                 }
1491                 dirpath = dptr_path(sconn, dptr_num);
1492                 directory = talloc_strdup(ctx, dirpath);
1493                 if (!directory) {
1494                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1495                         goto out;
1496                 }
1497
1498                 mask = dptr_wcard(sconn, dptr_num);
1499                 if (!mask) {
1500                         goto SearchEmpty;
1501                 }
1502                 /*
1503                  * For a 'continue' search we have no string. So
1504                  * check from the initial saved string.
1505                  */
1506                 mask_contains_wcard = ms_has_wild(mask);
1507                 dirtype = dptr_attr(sconn, dptr_num);
1508         }
1509
1510         DEBUG(4,("dptr_num is %d\n",dptr_num));
1511
1512         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1513         dptr_init_search_op(dirptr);
1514
1515         if ((dirtype&0x1F) == aVOLID) {
1516                 char buf[DIR_STRUCT_SIZE];
1517                 memcpy(buf,status,21);
1518                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1519                                 0,aVOLID,0,!allow_long_path_components)) {
1520                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1521                         goto out;
1522                 }
1523                 dptr_fill(sconn, buf+12,dptr_num);
1524                 if (dptr_zero(buf+12) && (status_len==0)) {
1525                         numentries = 1;
1526                 } else {
1527                         numentries = 0;
1528                 }
1529                 if (message_push_blob(&req->outbuf,
1530                                       data_blob_const(buf, sizeof(buf)))
1531                     == -1) {
1532                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1533                         goto out;
1534                 }
1535         } else {
1536                 unsigned int i;
1537                 maxentries = MIN(
1538                         maxentries,
1539                         ((BUFFER_SIZE -
1540                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1541                          /DIR_STRUCT_SIZE));
1542
1543                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1544                         directory,lp_dontdescend(SNUM(conn))));
1545                 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1546                         check_descend = True;
1547                 }
1548
1549                 for (i=numentries;(i<maxentries) && !finished;i++) {
1550                         finished = !get_dir_entry(ctx,
1551                                                   dirptr,
1552                                                   mask,
1553                                                   dirtype,
1554                                                   &fname,
1555                                                   &size,
1556                                                   &mode,
1557                                                   &date,
1558                                                   check_descend,
1559                                                   ask_sharemode);
1560                         if (!finished) {
1561                                 char buf[DIR_STRUCT_SIZE];
1562                                 memcpy(buf,status,21);
1563                                 if (!make_dir_struct(ctx,
1564                                                 buf,
1565                                                 mask,
1566                                                 fname,
1567                                                 size,
1568                                                 mode,
1569                                                 convert_timespec_to_time_t(date),
1570                                                 !allow_long_path_components)) {
1571                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1572                                         goto out;
1573                                 }
1574                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1575                                         break;
1576                                 }
1577                                 if (message_push_blob(&req->outbuf,
1578                                                       data_blob_const(buf, sizeof(buf)))
1579                                     == -1) {
1580                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1581                                         goto out;
1582                                 }
1583                                 numentries++;
1584                         }
1585                 }
1586         }
1587
1588   SearchEmpty:
1589
1590         /* If we were called as SMBffirst with smb_search_id == NULL
1591                 and no entries were found then return error and close dirptr
1592                 (X/Open spec) */
1593
1594         if (numentries == 0) {
1595                 dptr_close(sconn, &dptr_num);
1596         } else if(expect_close && status_len == 0) {
1597                 /* Close the dptr - we know it's gone */
1598                 dptr_close(sconn, &dptr_num);
1599         }
1600
1601         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1602         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1603                 dptr_close(sconn, &dptr_num);
1604         }
1605
1606         if ((numentries == 0) && !mask_contains_wcard) {
1607                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1608                 goto out;
1609         }
1610
1611         SSVAL(req->outbuf,smb_vwv0,numentries);
1612         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1613         SCVAL(smb_buf(req->outbuf),0,5);
1614         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1615
1616         /* The replies here are never long name. */
1617         SSVAL(req->outbuf, smb_flg2,
1618               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1619         if (!allow_long_path_components) {
1620                 SSVAL(req->outbuf, smb_flg2,
1621                       SVAL(req->outbuf, smb_flg2)
1622                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1623         }
1624
1625         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1626         SSVAL(req->outbuf, smb_flg2,
1627               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1628
1629         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1630                 smb_fn_name(req->cmd),
1631                 mask,
1632                 directory,
1633                 dirtype,
1634                 numentries,
1635                 maxentries ));
1636  out:
1637         TALLOC_FREE(directory);
1638         TALLOC_FREE(smb_fname);
1639         END_PROFILE(SMBsearch);
1640         return;
1641 }
1642
1643 /****************************************************************************
1644  Reply to a fclose (stop directory search).
1645 ****************************************************************************/
1646
1647 void reply_fclose(struct smb_request *req)
1648 {
1649         int status_len;
1650         char status[21];
1651         int dptr_num= -2;
1652         const char *p;
1653         char *path = NULL;
1654         NTSTATUS err;
1655         bool path_contains_wcard = False;
1656         TALLOC_CTX *ctx = talloc_tos();
1657         struct smbd_server_connection *sconn = req->sconn;
1658
1659         START_PROFILE(SMBfclose);
1660
1661         if (lp_posix_pathnames()) {
1662                 reply_unknown_new(req, req->cmd);
1663                 END_PROFILE(SMBfclose);
1664                 return;
1665         }
1666
1667         p = (const char *)req->buf + 1;
1668         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1669                                        &err, &path_contains_wcard);
1670         if (!NT_STATUS_IS_OK(err)) {
1671                 reply_nterror(req, err);
1672                 END_PROFILE(SMBfclose);
1673                 return;
1674         }
1675         p++;
1676         status_len = SVAL(p,0);
1677         p += 2;
1678
1679         if (status_len == 0) {
1680                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1681                 END_PROFILE(SMBfclose);
1682                 return;
1683         }
1684
1685         memcpy(status,p,21);
1686
1687         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1688                 /*  Close the dptr - we know it's gone */
1689                 dptr_close(sconn, &dptr_num);
1690         }
1691
1692         reply_outbuf(req, 1, 0);
1693         SSVAL(req->outbuf,smb_vwv0,0);
1694
1695         DEBUG(3,("search close\n"));
1696
1697         END_PROFILE(SMBfclose);
1698         return;
1699 }
1700
1701 /****************************************************************************
1702  Reply to an open.
1703 ****************************************************************************/
1704
1705 void reply_open(struct smb_request *req)
1706 {
1707         connection_struct *conn = req->conn;
1708         struct smb_filename *smb_fname = NULL;
1709         char *fname = NULL;
1710         uint32 fattr=0;
1711         SMB_OFF_T size = 0;
1712         time_t mtime=0;
1713         int info;
1714         files_struct *fsp;
1715         int oplock_request;
1716         int deny_mode;
1717         uint32 dos_attr;
1718         uint32 access_mask;
1719         uint32 share_mode;
1720         uint32 create_disposition;
1721         uint32 create_options = 0;
1722         uint32_t private_flags = 0;
1723         NTSTATUS status;
1724         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1725         TALLOC_CTX *ctx = talloc_tos();
1726
1727         START_PROFILE(SMBopen);
1728
1729         if (req->wct < 2) {
1730                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1731                 goto out;
1732         }
1733
1734         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1735         deny_mode = SVAL(req->vwv+0, 0);
1736         dos_attr = SVAL(req->vwv+1, 0);
1737
1738         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1739                             STR_TERMINATE, &status);
1740         if (!NT_STATUS_IS_OK(status)) {
1741                 reply_nterror(req, status);
1742                 goto out;
1743         }
1744
1745         status = filename_convert(ctx,
1746                                 conn,
1747                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1748                                 fname,
1749                                 0,
1750                                 NULL,
1751                                 &smb_fname);
1752         if (!NT_STATUS_IS_OK(status)) {
1753                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1754                         reply_botherror(req,
1755                                         NT_STATUS_PATH_NOT_COVERED,
1756                                         ERRSRV, ERRbadpath);
1757                         goto out;
1758                 }
1759                 reply_nterror(req, status);
1760                 goto out;
1761         }
1762
1763         if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1764                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1765                                          &share_mode, &create_disposition,
1766                                          &create_options, &private_flags)) {
1767                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1768                 goto out;
1769         }
1770
1771         status = SMB_VFS_CREATE_FILE(
1772                 conn,                                   /* conn */
1773                 req,                                    /* req */
1774                 0,                                      /* root_dir_fid */
1775                 smb_fname,                              /* fname */
1776                 access_mask,                            /* access_mask */
1777                 share_mode,                             /* share_access */
1778                 create_disposition,                     /* create_disposition*/
1779                 create_options,                         /* create_options */
1780                 dos_attr,                               /* file_attributes */
1781                 oplock_request,                         /* oplock_request */
1782                 0,                                      /* allocation_size */
1783                 private_flags,
1784                 NULL,                                   /* sd */
1785                 NULL,                                   /* ea_list */
1786                 &fsp,                                   /* result */
1787                 &info);                                 /* pinfo */
1788
1789         if (!NT_STATUS_IS_OK(status)) {
1790                 if (open_was_deferred(req->mid)) {
1791                         /* We have re-scheduled this call. */
1792                         goto out;
1793                 }
1794                 reply_openerror(req, status);
1795                 goto out;
1796         }
1797
1798         size = smb_fname->st.st_ex_size;
1799         fattr = dos_mode(conn, smb_fname);
1800
1801         /* Deal with other possible opens having a modified
1802            write time. JRA. */
1803         if (ask_sharemode) {
1804                 struct timespec write_time_ts;
1805
1806                 ZERO_STRUCT(write_time_ts);
1807                 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1808                 if (!null_timespec(write_time_ts)) {
1809                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1810                 }
1811         }
1812
1813         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1814
1815         if (fattr & aDIR) {
1816                 DEBUG(3,("attempt to open a directory %s\n",
1817                          fsp_str_dbg(fsp)));
1818                 close_file(req, fsp, ERROR_CLOSE);
1819                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1820                         ERRDOS, ERRnoaccess);
1821                 goto out;
1822         }
1823
1824         reply_outbuf(req, 7, 0);
1825         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1826         SSVAL(req->outbuf,smb_vwv1,fattr);
1827         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1828                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1829         } else {
1830                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1831         }
1832         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1833         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1834
1835         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1836                 SCVAL(req->outbuf,smb_flg,
1837                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1838         }
1839
1840         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1841                 SCVAL(req->outbuf,smb_flg,
1842                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1843         }
1844  out:
1845         TALLOC_FREE(smb_fname);
1846         END_PROFILE(SMBopen);
1847         return;
1848 }
1849
1850 /****************************************************************************
1851  Reply to an open and X.
1852 ****************************************************************************/
1853
1854 void reply_open_and_X(struct smb_request *req)
1855 {
1856         connection_struct *conn = req->conn;
1857         struct smb_filename *smb_fname = NULL;
1858         char *fname = NULL;
1859         uint16 open_flags;
1860         int deny_mode;
1861         uint32 smb_attr;
1862         /* Breakout the oplock request bits so we can set the
1863                 reply bits separately. */
1864         int ex_oplock_request;
1865         int core_oplock_request;
1866         int oplock_request;
1867 #if 0
1868         int smb_sattr = SVAL(req->vwv+4, 0);
1869         uint32 smb_time = make_unix_date3(req->vwv+6);
1870 #endif
1871         int smb_ofun;
1872         uint32 fattr=0;
1873         int mtime=0;
1874         int smb_action = 0;
1875         files_struct *fsp;
1876         NTSTATUS status;
1877         uint64_t allocation_size;
1878         ssize_t retval = -1;
1879         uint32 access_mask;
1880         uint32 share_mode;
1881         uint32 create_disposition;
1882         uint32 create_options = 0;
1883         uint32_t private_flags = 0;
1884         TALLOC_CTX *ctx = talloc_tos();
1885
1886         START_PROFILE(SMBopenX);
1887
1888         if (req->wct < 15) {
1889                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1890                 goto out;
1891         }
1892
1893         open_flags = SVAL(req->vwv+2, 0);
1894         deny_mode = SVAL(req->vwv+3, 0);
1895         smb_attr = SVAL(req->vwv+5, 0);
1896         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1897         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1898         oplock_request = ex_oplock_request | core_oplock_request;
1899         smb_ofun = SVAL(req->vwv+8, 0);
1900         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1901
1902         /* If it's an IPC, pass off the pipe handler. */
1903         if (IS_IPC(conn)) {
1904                 if (lp_nt_pipe_support()) {
1905                         reply_open_pipe_and_X(conn, req);
1906                 } else {
1907                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1908                 }
1909                 goto out;
1910         }
1911
1912         /* XXXX we need to handle passed times, sattr and flags */
1913         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1914                         STR_TERMINATE, &status);
1915         if (!NT_STATUS_IS_OK(status)) {
1916                 reply_nterror(req, status);
1917                 goto out;
1918         }
1919
1920         status = filename_convert(ctx,
1921                                 conn,
1922                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1923                                 fname,
1924                                 0,
1925                                 NULL,
1926                                 &smb_fname);
1927         if (!NT_STATUS_IS_OK(status)) {
1928                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1929                         reply_botherror(req,
1930                                         NT_STATUS_PATH_NOT_COVERED,
1931                                         ERRSRV, ERRbadpath);
1932                         goto out;
1933                 }
1934                 reply_nterror(req, status);
1935                 goto out;
1936         }
1937
1938         if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1939                                          &access_mask, &share_mode,
1940                                          &create_disposition,
1941                                          &create_options,
1942                                          &private_flags)) {
1943                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1944                 goto out;
1945         }
1946
1947         status = SMB_VFS_CREATE_FILE(
1948                 conn,                                   /* conn */
1949                 req,                                    /* req */
1950                 0,                                      /* root_dir_fid */
1951                 smb_fname,                              /* fname */
1952                 access_mask,                            /* access_mask */
1953                 share_mode,                             /* share_access */
1954                 create_disposition,                     /* create_disposition*/
1955                 create_options,                         /* create_options */
1956                 smb_attr,                               /* file_attributes */
1957                 oplock_request,                         /* oplock_request */
1958                 0,                                      /* allocation_size */
1959                 private_flags,
1960                 NULL,                                   /* sd */
1961                 NULL,                                   /* ea_list */
1962                 &fsp,                                   /* result */
1963                 &smb_action);                           /* pinfo */
1964
1965         if (!NT_STATUS_IS_OK(status)) {
1966                 if (open_was_deferred(req->mid)) {
1967                         /* We have re-scheduled this call. */
1968                         goto out;
1969                 }
1970                 reply_openerror(req, status);
1971                 goto out;
1972         }
1973
1974         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1975            if the file is truncated or created. */
1976         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1977                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1978                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1979                         close_file(req, fsp, ERROR_CLOSE);
1980                         reply_nterror(req, NT_STATUS_DISK_FULL);
1981                         goto out;
1982                 }
1983                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1984                 if (retval < 0) {
1985                         close_file(req, fsp, ERROR_CLOSE);
1986                         reply_nterror(req, NT_STATUS_DISK_FULL);
1987                         goto out;
1988                 }
1989                 status = vfs_stat_fsp(fsp);
1990                 if (!NT_STATUS_IS_OK(status)) {
1991                         close_file(req, fsp, ERROR_CLOSE);
1992                         reply_nterror(req, status);
1993                         goto out;
1994                 }
1995         }
1996
1997         fattr = dos_mode(conn, fsp->fsp_name);
1998         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
1999         if (fattr & aDIR) {
2000                 close_file(req, fsp, ERROR_CLOSE);
2001                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2002                 goto out;
2003         }
2004
2005         /* If the caller set the extended oplock request bit
2006                 and we granted one (by whatever means) - set the
2007                 correct bit for extended oplock reply.
2008         */
2009
2010         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2011                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2012         }
2013
2014         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2015                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2016         }
2017
2018         /* If the caller set the core oplock request bit
2019                 and we granted one (by whatever means) - set the
2020                 correct bit for core oplock reply.
2021         */
2022
2023         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2024                 reply_outbuf(req, 19, 0);
2025         } else {
2026                 reply_outbuf(req, 15, 0);
2027         }
2028
2029         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2030                 SCVAL(req->outbuf, smb_flg,
2031                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2032         }
2033
2034         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2035                 SCVAL(req->outbuf, smb_flg,
2036                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2037         }
2038
2039         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2040         SSVAL(req->outbuf,smb_vwv3,fattr);
2041         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2042                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2043         } else {
2044                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2045         }
2046         SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2047         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2048         SSVAL(req->outbuf,smb_vwv11,smb_action);
2049
2050         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2051                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2052         }
2053
2054         chain_reply(req);
2055  out:
2056         TALLOC_FREE(smb_fname);
2057         END_PROFILE(SMBopenX);
2058         return;
2059 }
2060
2061 /****************************************************************************
2062  Reply to a SMBulogoffX.
2063 ****************************************************************************/
2064
2065 void reply_ulogoffX(struct smb_request *req)
2066 {
2067         struct smbd_server_connection *sconn = req->sconn;
2068         user_struct *vuser;
2069
2070         START_PROFILE(SMBulogoffX);
2071
2072         vuser = get_valid_user_struct(sconn, req->vuid);
2073
2074         if(vuser == NULL) {
2075                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2076                          req->vuid));
2077         }
2078
2079         /* in user level security we are supposed to close any files
2080                 open by this user */
2081         if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2082                 file_close_user(sconn, req->vuid);
2083         }
2084
2085         invalidate_vuid(sconn, req->vuid);
2086
2087         reply_outbuf(req, 2, 0);
2088
2089         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2090
2091         END_PROFILE(SMBulogoffX);
2092         req->vuid = UID_FIELD_INVALID;
2093         chain_reply(req);
2094 }
2095
2096 /****************************************************************************
2097  Reply to a mknew or a create.
2098 ****************************************************************************/
2099
2100 void reply_mknew(struct smb_request *req)
2101 {
2102         connection_struct *conn = req->conn;
2103         struct smb_filename *smb_fname = NULL;
2104         char *fname = NULL;
2105         uint32 fattr = 0;
2106         struct smb_file_time ft;
2107         files_struct *fsp;
2108         int oplock_request = 0;
2109         NTSTATUS status;
2110         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2111         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2112         uint32 create_disposition;
2113         uint32 create_options = 0;
2114         TALLOC_CTX *ctx = talloc_tos();
2115
2116         START_PROFILE(SMBcreate);
2117         ZERO_STRUCT(ft);
2118
2119         if (req->wct < 3) {
2120                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2121                 goto out;
2122         }
2123
2124         fattr = SVAL(req->vwv+0, 0);
2125         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2126
2127         /* mtime. */
2128         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2129
2130         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2131                             STR_TERMINATE, &status);
2132         if (!NT_STATUS_IS_OK(status)) {
2133                 reply_nterror(req, status);
2134                 goto out;
2135         }
2136
2137         status = filename_convert(ctx,
2138                                 conn,
2139                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2140                                 fname,
2141                                 0,
2142                                 NULL,
2143                                 &smb_fname);
2144         if (!NT_STATUS_IS_OK(status)) {
2145                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2146                         reply_botherror(req,
2147                                         NT_STATUS_PATH_NOT_COVERED,
2148                                         ERRSRV, ERRbadpath);
2149                         goto out;
2150                 }
2151                 reply_nterror(req, status);
2152                 goto out;
2153         }
2154
2155         if (fattr & aVOLID) {
2156                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2157                          "please report this\n",
2158                          smb_fname_str_dbg(smb_fname)));
2159         }
2160
2161         if(req->cmd == SMBmknew) {
2162                 /* We should fail if file exists. */
2163                 create_disposition = FILE_CREATE;
2164         } else {
2165                 /* Create if file doesn't exist, truncate if it does. */
2166                 create_disposition = FILE_OVERWRITE_IF;
2167         }
2168
2169         status = SMB_VFS_CREATE_FILE(
2170                 conn,                                   /* conn */
2171                 req,                                    /* req */
2172                 0,                                      /* root_dir_fid */
2173                 smb_fname,                              /* fname */
2174                 access_mask,                            /* access_mask */
2175                 share_mode,                             /* share_access */
2176                 create_disposition,                     /* create_disposition*/
2177                 create_options,                         /* create_options */
2178                 fattr,                                  /* file_attributes */
2179                 oplock_request,                         /* oplock_request */
2180                 0,                                      /* allocation_size */
2181                 0,                                      /* private_flags */
2182                 NULL,                                   /* sd */
2183                 NULL,                                   /* ea_list */
2184                 &fsp,                                   /* result */
2185                 NULL);                                  /* pinfo */
2186
2187         if (!NT_STATUS_IS_OK(status)) {
2188                 if (open_was_deferred(req->mid)) {
2189                         /* We have re-scheduled this call. */
2190                         goto out;
2191                 }
2192                 reply_openerror(req, status);
2193                 goto out;
2194         }
2195
2196         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2197         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2198         if (!NT_STATUS_IS_OK(status)) {
2199                 END_PROFILE(SMBcreate);
2200                 goto out;
2201         }
2202
2203         reply_outbuf(req, 1, 0);
2204         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2205
2206         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2207                 SCVAL(req->outbuf,smb_flg,
2208                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2209         }
2210
2211         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2212                 SCVAL(req->outbuf,smb_flg,
2213                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2214         }
2215
2216         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2217         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2218                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2219                   (unsigned int)fattr));
2220
2221  out:
2222         TALLOC_FREE(smb_fname);
2223         END_PROFILE(SMBcreate);
2224         return;
2225 }
2226
2227 /****************************************************************************
2228  Reply to a create temporary file.
2229 ****************************************************************************/
2230
2231 void reply_ctemp(struct smb_request *req)
2232 {
2233         connection_struct *conn = req->conn;
2234         struct smb_filename *smb_fname = NULL;
2235         char *fname = NULL;
2236         uint32 fattr;
2237         files_struct *fsp;
2238         int oplock_request;
2239         int tmpfd;
2240         char *s;
2241         NTSTATUS status;
2242         TALLOC_CTX *ctx = talloc_tos();
2243
2244         START_PROFILE(SMBctemp);
2245
2246         if (req->wct < 3) {
2247                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2248                 goto out;
2249         }
2250
2251         fattr = SVAL(req->vwv+0, 0);
2252         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2253
2254         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2255                             STR_TERMINATE, &status);
2256         if (!NT_STATUS_IS_OK(status)) {
2257                 reply_nterror(req, status);
2258                 goto out;
2259         }
2260         if (*fname) {
2261                 fname = talloc_asprintf(ctx,
2262                                 "%s/TMXXXXXX",
2263                                 fname);
2264         } else {
2265                 fname = talloc_strdup(ctx, "TMXXXXXX");
2266         }
2267
2268         if (!fname) {
2269                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2270                 goto out;
2271         }
2272
2273         status = filename_convert(ctx, conn,
2274                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2275                                 fname,
2276                                 0,
2277                                 NULL,
2278                                 &smb_fname);
2279         if (!NT_STATUS_IS_OK(status)) {
2280                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2281                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2282                                         ERRSRV, ERRbadpath);
2283                         goto out;
2284                 }
2285                 reply_nterror(req, status);
2286                 goto out;
2287         }
2288
2289         tmpfd = mkstemp(smb_fname->base_name);
2290         if (tmpfd == -1) {
2291                 reply_nterror(req, map_nt_error_from_unix(errno));
2292                 goto out;
2293         }
2294
2295         SMB_VFS_STAT(conn, smb_fname);
2296
2297         /* We should fail if file does not exist. */
2298         status = SMB_VFS_CREATE_FILE(
2299                 conn,                                   /* conn */
2300                 req,                                    /* req */
2301                 0,                                      /* root_dir_fid */
2302                 smb_fname,                              /* fname */
2303                 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2304                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2305                 FILE_OPEN,                              /* create_disposition*/
2306                 0,                                      /* create_options */
2307                 fattr,                                  /* file_attributes */
2308                 oplock_request,                         /* oplock_request */
2309                 0,                                      /* allocation_size */
2310                 0,                                      /* private_flags */
2311                 NULL,                                   /* sd */
2312                 NULL,                                   /* ea_list */
2313                 &fsp,                                   /* result */
2314                 NULL);                                  /* pinfo */
2315
2316         /* close fd from mkstemp() */
2317         close(tmpfd);
2318
2319         if (!NT_STATUS_IS_OK(status)) {
2320                 if (open_was_deferred(req->mid)) {
2321                         /* We have re-scheduled this call. */
2322                         goto out;
2323                 }
2324                 reply_openerror(req, status);
2325                 goto out;
2326         }
2327
2328         reply_outbuf(req, 1, 0);
2329         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2330
2331         /* the returned filename is relative to the directory */
2332         s = strrchr_m(fsp->fsp_name->base_name, '/');
2333         if (!s) {
2334                 s = fsp->fsp_name->base_name;
2335         } else {
2336                 s++;
2337         }
2338
2339 #if 0
2340         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2341            thing in the byte section. JRA */
2342         SSVALS(p, 0, -1); /* what is this? not in spec */
2343 #endif
2344         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2345             == -1) {
2346                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2347                 goto out;
2348         }
2349
2350         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2351                 SCVAL(req->outbuf, smb_flg,
2352                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2353         }
2354
2355         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2356                 SCVAL(req->outbuf, smb_flg,
2357                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2358         }
2359
2360         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2361         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2362                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2363  out:
2364         TALLOC_FREE(smb_fname);
2365         END_PROFILE(SMBctemp);
2366         return;
2367 }
2368
2369 /*******************************************************************
2370  Check if a user is allowed to rename a file.
2371 ********************************************************************/
2372
2373 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2374                         uint16 dirtype)
2375 {
2376         uint32 fmode;
2377
2378         if (!CAN_WRITE(conn)) {
2379                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2380         }
2381
2382         fmode = dos_mode(conn, fsp->fsp_name);
2383         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2384                 return NT_STATUS_NO_SUCH_FILE;
2385         }
2386
2387         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2388                 if (fsp->posix_open) {
2389                         return NT_STATUS_OK;
2390                 }
2391
2392                 /* If no pathnames are open below this
2393                    directory, allow the rename. */
2394
2395                 if (file_find_subpath(fsp)) {
2396                         return NT_STATUS_ACCESS_DENIED;
2397                 }
2398                 return NT_STATUS_OK;
2399         }
2400
2401         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2402                 return NT_STATUS_OK;
2403         }
2404
2405         return NT_STATUS_ACCESS_DENIED;
2406 }
2407
2408 /*******************************************************************
2409  * unlink a file with all relevant access checks
2410  *******************************************************************/
2411
2412 static NTSTATUS do_unlink(connection_struct *conn,
2413                         struct smb_request *req,
2414                         struct smb_filename *smb_fname,
2415                         uint32 dirtype)
2416 {
2417         uint32 fattr;
2418         files_struct *fsp;
2419         uint32 dirtype_orig = dirtype;
2420         NTSTATUS status;
2421         int ret;
2422         bool posix_paths = lp_posix_pathnames();
2423
2424         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2425                   smb_fname_str_dbg(smb_fname),
2426                   dirtype));
2427
2428         if (!CAN_WRITE(conn)) {
2429                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2430         }
2431
2432         if (posix_paths) {
2433                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2434         } else {
2435                 ret = SMB_VFS_STAT(conn, smb_fname);
2436         }
2437         if (ret != 0) {
2438                 return map_nt_error_from_unix(errno);
2439         }
2440
2441         fattr = dos_mode(conn, smb_fname);
2442
2443         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2444                 dirtype = aDIR|aARCH|aRONLY;
2445         }
2446
2447         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2448         if (!dirtype) {
2449                 return NT_STATUS_NO_SUCH_FILE;
2450         }
2451
2452         if (!dir_check_ftype(conn, fattr, dirtype)) {
2453                 if (fattr & aDIR) {
2454                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2455                 }
2456                 return NT_STATUS_NO_SUCH_FILE;
2457         }
2458
2459         if (dirtype_orig & 0x8000) {
2460                 /* These will never be set for POSIX. */
2461                 return NT_STATUS_NO_SUCH_FILE;
2462         }
2463
2464 #if 0
2465         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2466                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2467         }
2468
2469         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2470                 return NT_STATUS_NO_SUCH_FILE;
2471         }
2472
2473         if (dirtype & 0xFF00) {
2474                 /* These will never be set for POSIX. */
2475                 return NT_STATUS_NO_SUCH_FILE;
2476         }
2477
2478         dirtype &= 0xFF;
2479         if (!dirtype) {
2480                 return NT_STATUS_NO_SUCH_FILE;
2481         }
2482
2483         /* Can't delete a directory. */
2484         if (fattr & aDIR) {
2485                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2486         }
2487 #endif
2488
2489 #if 0 /* JRATEST */
2490         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2491                 return NT_STATUS_OBJECT_NAME_INVALID;
2492 #endif /* JRATEST */
2493
2494         /* On open checks the open itself will check the share mode, so
2495            don't do it here as we'll get it wrong. */
2496
2497         status = SMB_VFS_CREATE_FILE
2498                 (conn,                  /* conn */
2499                  req,                   /* req */
2500                  0,                     /* root_dir_fid */
2501                  smb_fname,             /* fname */
2502                  DELETE_ACCESS,         /* access_mask */
2503                  FILE_SHARE_NONE,       /* share_access */
2504                  FILE_OPEN,             /* create_disposition*/
2505                  FILE_NON_DIRECTORY_FILE, /* create_options */
2506                                         /* file_attributes */
2507                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2508                                 FILE_ATTRIBUTE_NORMAL,
2509                  0,                     /* oplock_request */
2510                  0,                     /* allocation_size */
2511                  0,                     /* private_flags */
2512                  NULL,                  /* sd */
2513                  NULL,                  /* ea_list */
2514                  &fsp,                  /* result */
2515                  NULL);                 /* pinfo */
2516
2517         if (!NT_STATUS_IS_OK(status)) {
2518                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2519                            nt_errstr(status)));
2520                 return status;
2521         }
2522
2523         status = can_set_delete_on_close(fsp, fattr);
2524         if (!NT_STATUS_IS_OK(status)) {
2525                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2526                         "(%s)\n",
2527                         smb_fname_str_dbg(smb_fname),
2528                         nt_errstr(status)));
2529                 close_file(req, fsp, NORMAL_CLOSE);
2530                 return status;
2531         }
2532
2533         /* The set is across all open files on this dev/inode pair. */
2534         if (!set_delete_on_close(fsp, True, &conn->session_info->utok)) {
2535                 close_file(req, fsp, NORMAL_CLOSE);
2536                 return NT_STATUS_ACCESS_DENIED;
2537         }
2538
2539         return close_file(req, fsp, NORMAL_CLOSE);
2540 }
2541
2542 /****************************************************************************
2543  The guts of the unlink command, split out so it may be called by the NT SMB
2544  code.
2545 ****************************************************************************/
2546
2547 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2548                           uint32 dirtype, struct smb_filename *smb_fname,
2549                           bool has_wild)
2550 {
2551         char *fname_dir = NULL;
2552         char *fname_mask = NULL;
2553         int count=0;
2554         NTSTATUS status = NT_STATUS_OK;
2555         TALLOC_CTX *ctx = talloc_tos();
2556
2557         /* Split up the directory from the filename/mask. */
2558         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2559                                       &fname_dir, &fname_mask);
2560         if (!NT_STATUS_IS_OK(status)) {
2561                 goto out;
2562         }
2563
2564         /*
2565          * We should only check the mangled cache
2566          * here if unix_convert failed. This means
2567          * that the path in 'mask' doesn't exist
2568          * on the file system and so we need to look
2569          * for a possible mangle. This patch from
2570          * Tine Smukavec <valentin.smukavec@hermes.si>.
2571          */
2572
2573         if (!VALID_STAT(smb_fname->st) &&
2574             mangle_is_mangled(fname_mask, conn->params)) {
2575                 char *new_mask = NULL;
2576                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2577                                             &new_mask, conn->params);
2578                 if (new_mask) {
2579                         TALLOC_FREE(fname_mask);
2580                         fname_mask = new_mask;
2581                 }
2582         }
2583
2584         if (!has_wild) {
2585
2586                 /*
2587                  * Only one file needs to be unlinked. Append the mask back
2588                  * onto the directory.
2589                  */
2590                 TALLOC_FREE(smb_fname->base_name);
2591                 if (ISDOT(fname_dir)) {
2592                         /* Ensure we use canonical names on open. */
2593                         smb_fname->base_name = talloc_asprintf(smb_fname,
2594                                                         "%s",
2595                                                         fname_mask);
2596                 } else {
2597                         smb_fname->base_name = talloc_asprintf(smb_fname,
2598                                                         "%s/%s",
2599                                                         fname_dir,
2600                                                         fname_mask);
2601                 }
2602                 if (!smb_fname->base_name) {
2603                         status = NT_STATUS_NO_MEMORY;
2604                         goto out;
2605                 }
2606                 if (dirtype == 0) {
2607                         dirtype = FILE_ATTRIBUTE_NORMAL;
2608                 }
2609
2610                 status = check_name(conn, smb_fname->base_name);
2611                 if (!NT_STATUS_IS_OK(status)) {
2612                         goto out;
2613                 }
2614
2615                 status = do_unlink(conn, req, smb_fname, dirtype);
2616                 if (!NT_STATUS_IS_OK(status)) {
2617                         goto out;
2618                 }
2619
2620                 count++;
2621         } else {
2622                 struct smb_Dir *dir_hnd = NULL;
2623                 long offset = 0;
2624                 const char *dname = NULL;
2625                 char *talloced = NULL;
2626
2627                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2628                         status = NT_STATUS_OBJECT_NAME_INVALID;
2629                         goto out;
2630                 }
2631
2632                 if (strequal(fname_mask,"????????.???")) {
2633                         TALLOC_FREE(fname_mask);
2634                         fname_mask = talloc_strdup(ctx, "*");
2635                         if (!fname_mask) {
2636                                 status = NT_STATUS_NO_MEMORY;
2637                                 goto out;
2638                         }
2639                 }
2640
2641                 status = check_name(conn, fname_dir);
2642                 if (!NT_STATUS_IS_OK(status)) {
2643                         goto out;
2644                 }
2645
2646                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2647                                   dirtype);
2648                 if (dir_hnd == NULL) {
2649                         status = map_nt_error_from_unix(errno);
2650                         goto out;
2651                 }
2652
2653                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2654                    the pattern matches against the long name, otherwise the short name
2655                    We don't implement this yet XXXX
2656                 */
2657
2658                 status = NT_STATUS_NO_SUCH_FILE;
2659
2660                 while ((dname = ReadDirName(dir_hnd, &offset,
2661                                             &smb_fname->st, &talloced))) {
2662                         TALLOC_CTX *frame = talloc_stackframe();
2663
2664                         if (!is_visible_file(conn, fname_dir, dname,
2665                                              &smb_fname->st, true)) {
2666                                 TALLOC_FREE(frame);
2667                                 TALLOC_FREE(talloced);
2668                                 continue;
2669                         }
2670
2671                         /* Quick check for "." and ".." */
2672                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2673                                 TALLOC_FREE(frame);
2674                                 TALLOC_FREE(talloced);
2675                                 continue;
2676                         }
2677
2678                         if(!mask_match(dname, fname_mask,
2679                                        conn->case_sensitive)) {
2680                                 TALLOC_FREE(frame);
2681                                 TALLOC_FREE(talloced);
2682                                 continue;
2683                         }
2684
2685                         TALLOC_FREE(smb_fname->base_name);
2686                         if (ISDOT(fname_dir)) {
2687                                 /* Ensure we use canonical names on open. */
2688                                 smb_fname->base_name =
2689                                         talloc_asprintf(smb_fname, "%s",
2690                                                 dname);
2691                         } else {
2692                                 smb_fname->base_name =
2693                                         talloc_asprintf(smb_fname, "%s/%s",
2694                                                 fname_dir, dname);
2695                         }
2696
2697                         if (!smb_fname->base_name) {
2698                                 TALLOC_FREE(dir_hnd);
2699                                 status = NT_STATUS_NO_MEMORY;
2700                                 TALLOC_FREE(frame);
2701                                 TALLOC_FREE(talloced);
2702                                 goto out;
2703                         }
2704
2705                         status = check_name(conn, smb_fname->base_name);
2706                         if (!NT_STATUS_IS_OK(status)) {
2707                                 TALLOC_FREE(dir_hnd);
2708                                 TALLOC_FREE(frame);
2709                                 TALLOC_FREE(talloced);
2710                                 goto out;
2711                         }
2712
2713                         status = do_unlink(conn, req, smb_fname, dirtype);
2714                         if (!NT_STATUS_IS_OK(status)) {
2715                                 TALLOC_FREE(frame);
2716                                 TALLOC_FREE(talloced);
2717                                 continue;
2718                         }
2719
2720                         count++;
2721                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2722                                  smb_fname->base_name));
2723
2724                         TALLOC_FREE(frame);
2725                         TALLOC_FREE(talloced);
2726                 }
2727                 TALLOC_FREE(dir_hnd);
2728         }
2729
2730         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2731                 status = map_nt_error_from_unix(errno);
2732         }
2733
2734  out:
2735         TALLOC_FREE(fname_dir);
2736         TALLOC_FREE(fname_mask);
2737         return status;
2738 }
2739
2740 /****************************************************************************
2741  Reply to a unlink
2742 ****************************************************************************/
2743
2744 void reply_unlink(struct smb_request *req)
2745 {
2746         connection_struct *conn = req->conn;
2747         char *name = NULL;
2748         struct smb_filename *smb_fname = NULL;
2749         uint32 dirtype;
2750         NTSTATUS status;
2751         bool path_contains_wcard = False;
2752         TALLOC_CTX *ctx = talloc_tos();
2753
2754         START_PROFILE(SMBunlink);
2755
2756         if (req->wct < 1) {
2757                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2758                 goto out;
2759         }
2760
2761         dirtype = SVAL(req->vwv+0, 0);
2762
2763         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2764                                   STR_TERMINATE, &status,
2765                                   &path_contains_wcard);
2766         if (!NT_STATUS_IS_OK(status)) {
2767                 reply_nterror(req, status);
2768                 goto out;
2769         }
2770
2771         status = filename_convert(ctx, conn,
2772                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2773                                   name,
2774                                   UCF_COND_ALLOW_WCARD_LCOMP,
2775                                   &path_contains_wcard,
2776                                   &smb_fname);
2777         if (!NT_STATUS_IS_OK(status)) {
2778                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2779                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2780                                         ERRSRV, ERRbadpath);
2781                         goto out;
2782                 }
2783                 reply_nterror(req, status);
2784                 goto out;
2785         }
2786
2787         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2788
2789         status = unlink_internals(conn, req, dirtype, smb_fname,
2790                                   path_contains_wcard);
2791         if (!NT_STATUS_IS_OK(status)) {
2792                 if (open_was_deferred(req->mid)) {
2793                         /* We have re-scheduled this call. */
2794                         goto out;
2795                 }
2796                 reply_nterror(req, status);
2797                 goto out;
2798         }
2799
2800         reply_outbuf(req, 0, 0);
2801  out:
2802         TALLOC_FREE(smb_fname);
2803         END_PROFILE(SMBunlink);
2804         return;
2805 }
2806
2807 /****************************************************************************
2808  Fail for readbraw.
2809 ****************************************************************************/
2810
2811 static void fail_readraw(void)
2812 {
2813         const char *errstr = talloc_asprintf(talloc_tos(),
2814                         "FAIL ! reply_readbraw: socket write fail (%s)",
2815                         strerror(errno));
2816         if (!errstr) {
2817                 errstr = "";
2818         }
2819         exit_server_cleanly(errstr);
2820 }
2821
2822 /****************************************************************************
2823  Fake (read/write) sendfile. Returns -1 on read or write fail.
2824 ****************************************************************************/
2825
2826 ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
2827 {
2828         size_t bufsize;
2829         size_t tosend = nread;
2830         char *buf;
2831
2832         if (nread == 0) {
2833                 return 0;
2834         }
2835
2836         bufsize = MIN(nread, 65536);
2837
2838         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2839                 return -1;
2840         }
2841
2842         while (tosend > 0) {
2843                 ssize_t ret;
2844                 size_t cur_read;
2845
2846                 if (tosend > bufsize) {
2847                         cur_read = bufsize;
2848                 } else {
2849                         cur_read = tosend;
2850                 }
2851                 ret = read_file(fsp,buf,startpos,cur_read);
2852                 if (ret == -1) {
2853                         SAFE_FREE(buf);
2854                         return -1;
2855                 }
2856
2857                 /* If we had a short read, fill with zeros. */
2858                 if (ret < cur_read) {
2859                         memset(buf + ret, '\0', cur_read - ret);
2860                 }
2861
2862                 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2863                     != cur_read) {
2864                         char addr[INET6_ADDRSTRLEN];
2865                         /*
2866                          * Try and give an error message saying what
2867                          * client failed.
2868                          */
2869                         DEBUG(0, ("write_data failed for client %s. "
2870                                   "Error %s\n",
2871                                   get_peer_addr(fsp->conn->sconn->sock, addr,
2872                                                 sizeof(addr)),
2873                                   strerror(errno)));
2874                         SAFE_FREE(buf);
2875                         return -1;
2876                 }
2877                 tosend -= cur_read;
2878                 startpos += cur_read;
2879         }
2880
2881         SAFE_FREE(buf);
2882         return (ssize_t)nread;
2883 }
2884
2885 /****************************************************************************
2886  Deal with the case of sendfile reading less bytes from the file than
2887  requested. Fill with zeros (all we can do).
2888 ****************************************************************************/
2889
2890 void sendfile_short_send(files_struct *fsp,
2891                                 ssize_t nread,
2892                                 size_t headersize,
2893                                 size_t smb_maxcnt)
2894 {
2895 #define SHORT_SEND_BUFSIZE 1024
2896         if (nread < headersize) {
2897                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2898                         "header for file %s (%s). Terminating\n",
2899                         fsp_str_dbg(fsp), strerror(errno)));
2900                 exit_server_cleanly("sendfile_short_send failed");
2901         }
2902
2903         nread -= headersize;
2904
2905         if (nread < smb_maxcnt) {
2906                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2907                 if (!buf) {
2908                         exit_server_cleanly("sendfile_short_send: "
2909                                 "malloc failed");
2910                 }
2911
2912                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2913                         "with zeros !\n", fsp_str_dbg(fsp)));
2914
2915                 while (nread < smb_maxcnt) {
2916                         /*
2917                          * We asked for the real file size and told sendfile
2918                          * to not go beyond the end of the file. But it can
2919                          * happen that in between our fstat call and the
2920                          * sendfile call the file was truncated. This is very
2921                          * bad because we have already announced the larger
2922                          * number of bytes to the client.
2923                          *
2924                          * The best we can do now is to send 0-bytes, just as
2925                          * a read from a hole in a sparse file would do.
2926                          *
2927                          * This should happen rarely enough that I don't care
2928                          * about efficiency here :-)
2929                          */
2930                         size_t to_write;
2931
2932                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2933                         if (write_data(fsp->conn->sconn->sock, buf, to_write)
2934                             != to_write) {
2935                                 char addr[INET6_ADDRSTRLEN];
2936                                 /*
2937                                  * Try and give an error message saying what
2938                                  * client failed.
2939                                  */
2940                                 DEBUG(0, ("write_data failed for client %s. "
2941                                           "Error %s\n",
2942                                           get_peer_addr(
2943                                                   fsp->conn->sconn->sock, addr,
2944                                                   sizeof(addr)),
2945                                           strerror(errno)));
2946                                 exit_server_cleanly("sendfile_short_send: "
2947                                                     "write_data failed");
2948                         }
2949                         nread += to_write;
2950                 }
2951                 SAFE_FREE(buf);
2952         }
2953 }
2954
2955 /****************************************************************************
2956  Return a readbraw error (4 bytes of zero).
2957 ****************************************************************************/
2958
2959 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2960 {
2961         char header[4];
2962
2963         SIVAL(header,0,0);
2964
2965         smbd_lock_socket(sconn);
2966         if (write_data(sconn->sock,header,4) != 4) {
2967                 char addr[INET6_ADDRSTRLEN];
2968                 /*
2969                  * Try and give an error message saying what
2970                  * client failed.
2971                  */
2972                 DEBUG(0, ("write_data failed for client %s. "
2973                           "Error %s\n",
2974                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2975                           strerror(errno)));
2976
2977                 fail_readraw();
2978         }
2979         smbd_unlock_socket(sconn);
2980 }
2981
2982 /****************************************************************************
2983  Use sendfile in readbraw.
2984 ****************************************************************************/
2985
2986 static void send_file_readbraw(connection_struct *conn,
2987                                struct smb_request *req,
2988                                files_struct *fsp,
2989                                SMB_OFF_T startpos,
2990                                size_t nread,
2991                                ssize_t mincount)
2992 {
2993         struct smbd_server_connection *sconn = req->sconn;
2994         char *outbuf = NULL;
2995         ssize_t ret=0;
2996
2997         /*
2998          * We can only use sendfile on a non-chained packet
2999          * but we can use on a non-oplocked file. tridge proved this
3000          * on a train in Germany :-). JRA.
3001          * reply_readbraw has already checked the length.
3002          */
3003
3004         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3005             (fsp->wcp == NULL) &&
3006             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3007                 ssize_t sendfile_read = -1;
3008                 char header[4];
3009                 DATA_BLOB header_blob;
3010
3011                 _smb_setlen(header,nread);
3012                 header_blob = data_blob_const(header, 4);
3013
3014                 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3015                                                  &header_blob, startpos,
3016                                                  nread);
3017                 if (sendfile_read == -1) {
3018                         /* Returning ENOSYS means no data at all was sent.
3019                          * Do this as a normal read. */
3020                         if (errno == ENOSYS) {
3021                                 goto normal_readbraw;
3022                         }
3023
3024                         /*
3025                          * Special hack for broken Linux with no working sendfile. If we
3026                          * return EINTR we sent the header but not the rest of the data.
3027                          * Fake this up by doing read/write calls.
3028                          */
3029                         if (errno == EINTR) {
3030                                 /* Ensure we don't do this again. */
3031                                 set_use_sendfile(SNUM(conn), False);
3032                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3033
3034                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
3035                                         DEBUG(0,("send_file_readbraw: "
3036                                                  "fake_sendfile failed for "
3037                                                  "file %s (%s).\n",
3038                                                  fsp_str_dbg(fsp),
3039                                                  strerror(errno)));
3040                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3041                                 }
3042                                 return;
3043                         }
3044
3045                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3046                                  "file %s (%s). Terminating\n",
3047                                  fsp_str_dbg(fsp), strerror(errno)));
3048                         exit_server_cleanly("send_file_readbraw sendfile failed");
3049                 } else if (sendfile_read == 0) {
3050                         /*
3051                          * Some sendfile implementations return 0 to indicate
3052                          * that there was a short read, but nothing was
3053                          * actually written to the socket.  In this case,
3054                          * fallback to the normal read path so the header gets
3055                          * the correct byte count.
3056                          */
3057                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3058                                   "bytes falling back to the normal read: "
3059                                   "%s\n", fsp_str_dbg(fsp)));
3060                         goto normal_readbraw;
3061                 }
3062
3063                 /* Deal with possible short send. */
3064                 if (sendfile_read != 4+nread) {
3065                         sendfile_short_send(fsp, sendfile_read, 4, nread);
3066                 }
3067                 return;
3068         }
3069
3070 normal_readbraw:
3071
3072         outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3073         if (!outbuf) {
3074                 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3075                         (unsigned)(nread+4)));
3076                 reply_readbraw_error(sconn);
3077                 return;
3078         }
3079
3080         if (nread > 0) {
3081                 ret = read_file(fsp,outbuf+4,startpos,nread);
3082 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3083                 if (ret < mincount)
3084                         ret = 0;
3085 #else
3086                 if (ret < nread)
3087                         ret = 0;
3088 #endif
3089         }
3090
3091         _smb_setlen(outbuf,ret);
3092         if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3093                 char addr[INET6_ADDRSTRLEN];
3094                 /*
3095                  * Try and give an error message saying what
3096                  * client failed.
3097                  */
3098                 DEBUG(0, ("write_data failed for client %s. "
3099                           "Error %s\n",
3100                           get_peer_addr(fsp->conn->sconn->sock, addr,
3101                                         sizeof(addr)),
3102                           strerror(errno)));
3103
3104                 fail_readraw();
3105         }
3106
3107         TALLOC_FREE(outbuf);
3108 }
3109
3110 /****************************************************************************
3111  Reply to a readbraw (core+ protocol).
3112 ****************************************************************************/
3113
3114 void reply_readbraw(struct smb_request *req)
3115 {
3116         connection_struct *conn = req->conn;
3117         struct smbd_server_connection *sconn = req->sconn;
3118         ssize_t maxcount,mincount;
3119         size_t nread = 0;
3120         SMB_OFF_T startpos;
3121         files_struct *fsp;
3122         struct lock_struct lock;
3123         SMB_OFF_T size = 0;
3124
3125         START_PROFILE(SMBreadbraw);
3126
3127         if (srv_is_signing_active(sconn) ||
3128             is_encrypted_packet(req->inbuf)) {
3129                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3130                         "raw reads/writes are disallowed.");
3131         }
3132
3133         if (req->wct < 8) {
3134                 reply_readbraw_error(sconn);
3135                 END_PROFILE(SMBreadbraw);
3136                 return;
3137         }
3138
3139         if (sconn->smb1.echo_handler.trusted_fde) {
3140                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3141                          "'async smb echo handler = yes'\n"));
3142                 reply_readbraw_error(sconn);
3143                 END_PROFILE(SMBreadbraw);
3144                 return;
3145         }
3146
3147         /*
3148          * Special check if an oplock break has been issued
3149          * and the readraw request croses on the wire, we must
3150          * return a zero length response here.
3151          */
3152
3153         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3154
3155         /*
3156          * We have to do a check_fsp by hand here, as
3157          * we must always return 4 zero bytes on error,
3158          * not a NTSTATUS.
3159          */
3160
3161         if (!fsp || !conn || conn != fsp->conn ||
3162                         req->vuid != fsp->vuid ||
3163                         fsp->is_directory || fsp->fh->fd == -1) {
3164                 /*
3165                  * fsp could be NULL here so use the value from the packet. JRA.
3166                  */
3167                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3168                         "- cache prime?\n",
3169                         (int)SVAL(req->vwv+0, 0)));
3170                 reply_readbraw_error(sconn);
3171                 END_PROFILE(SMBreadbraw);
3172                 return;
3173         }
3174
3175         /* Do a "by hand" version of CHECK_READ. */
3176         if (!(fsp->can_read ||
3177                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3178                                 (fsp->access_mask & FILE_EXECUTE)))) {
3179                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3180                                 (int)SVAL(req->vwv+0, 0)));
3181                 reply_readbraw_error(sconn);
3182                 END_PROFILE(SMBreadbraw);
3183                 return;
3184         }
3185
3186         flush_write_cache(fsp, READRAW_FLUSH);
3187
3188         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3189         if(req->wct == 10) {
3190                 /*
3191                  * This is a large offset (64 bit) read.
3192                  */
3193 #ifdef LARGE_SMB_OFF_T
3194
3195                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3196
3197 #else /* !LARGE_SMB_OFF_T */
3198
3199                 /*
3200                  * Ensure we haven't been sent a >32 bit offset.
3201                  */
3202
3203                 if(IVAL(req->vwv+8, 0) != 0) {
3204                         DEBUG(0,("reply_readbraw: large offset "
3205                                 "(%x << 32) used and we don't support "
3206                                 "64 bit offsets.\n",
3207                         (unsigned int)IVAL(req->vwv+8, 0) ));
3208                         reply_readbraw_error();
3209                         END_PROFILE(SMBreadbraw);
3210                         return;
3211                 }
3212
3213 #endif /* LARGE_SMB_OFF_T */
3214
3215                 if(startpos < 0) {
3216                         DEBUG(0,("reply_readbraw: negative 64 bit "
3217                                 "readraw offset (%.0f) !\n",
3218                                 (double)startpos ));
3219                         reply_readbraw_error(sconn);
3220                         END_PROFILE(SMBreadbraw);
3221                         return;
3222                 }
3223         }
3224
3225         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3226         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3227
3228         /* ensure we don't overrun the packet size */
3229         maxcount = MIN(65535,maxcount);
3230
3231         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3232             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3233             &lock);
3234
3235         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3236                 reply_readbraw_error(sconn);
3237                 END_PROFILE(SMBreadbraw);
3238                 return;
3239         }
3240
3241         if (fsp_stat(fsp) == 0) {
3242                 size = fsp->fsp_name->st.st_ex_size;
3243         }
3244
3245         if (startpos >= size) {
3246                 nread = 0;
3247         } else {
3248                 nread = MIN(maxcount,(size - startpos));
3249         }
3250
3251 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3252         if (nread < mincount)
3253                 nread = 0;
3254 #endif
3255
3256         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3257                 "min=%lu nread=%lu\n",
3258                 fsp->fnum, (double)startpos,
3259                 (unsigned long)maxcount,
3260                 (unsigned long)mincount,
3261                 (unsigned long)nread ) );
3262
3263         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3264
3265         DEBUG(5,("reply_readbraw finished\n"));
3266
3267         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3268
3269         END_PROFILE(SMBreadbraw);
3270         return;
3271 }
3272
3273 #undef DBGC_CLASS
3274 #define DBGC_CLASS DBGC_LOCKING
3275
3276 /****************************************************************************
3277  Reply to a lockread (core+ protocol).
3278 ****************************************************************************/
3279
3280 void reply_lockread(struct smb_request *req)
3281 {
3282         connection_struct *conn = req->conn;
3283         ssize_t nread = -1;
3284         char *data;
3285         SMB_OFF_T startpos;
3286         size_t numtoread;
3287         NTSTATUS status;
3288         files_struct *fsp;
3289         struct byte_range_lock *br_lck = NULL;
3290         char *p = NULL;
3291         struct smbd_server_connection *sconn = req->sconn;
3292
3293         START_PROFILE(SMBlockread);
3294
3295         if (req->wct < 5) {
3296                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3297                 END_PROFILE(SMBlockread);
3298                 return;
3299         }
3300
3301         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3302
3303         if (!check_fsp(conn, req, fsp)) {
3304                 END_PROFILE(SMBlockread);
3305                 return;
3306         }
3307
3308         if (!CHECK_READ(fsp,req)) {
3309                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3310                 END_PROFILE(SMBlockread);
3311                 return;
3312         }
3313
3314         numtoread = SVAL(req->vwv+1, 0);
3315         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3316
3317         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3318
3319         reply_outbuf(req, 5, numtoread + 3);
3320
3321         data = smb_buf(req->outbuf) + 3;
3322
3323         /*
3324          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3325          * protocol request that predates the read/write lock concept.
3326          * Thus instead of asking for a read lock here we need to ask
3327          * for a write lock. JRA.
3328          * Note that the requested lock size is unaffected by max_recv.
3329          */
3330
3331         br_lck = do_lock(req->sconn->msg_ctx,
3332                         fsp,
3333                         (uint64_t)req->smbpid,
3334                         (uint64_t)numtoread,
3335                         (uint64_t)startpos,
3336                         WRITE_LOCK,
3337                         WINDOWS_LOCK,
3338                         False, /* Non-blocking lock. */
3339                         &status,
3340                         NULL,
3341                         NULL);
3342         TALLOC_FREE(br_lck);
3343
3344         if (NT_STATUS_V(status)) {
3345                 reply_nterror(req, status);
3346                 END_PROFILE(SMBlockread);
3347                 return;
3348         }
3349
3350         /*
3351          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3352          */
3353
3354         if (numtoread > sconn->smb1.negprot.max_recv) {
3355                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3356 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3357                         (unsigned int)numtoread,
3358                         (unsigned int)sconn->smb1.negprot.max_recv));
3359                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3360         }
3361         nread = read_file(fsp,data,startpos,numtoread);
3362
3363         if (nread < 0) {
3364                 reply_nterror(req, map_nt_error_from_unix(errno));
3365                 END_PROFILE(SMBlockread);
3366                 return;
3367         }
3368
3369         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3370
3371         SSVAL(req->outbuf,smb_vwv0,nread);
3372         SSVAL(req->outbuf,smb_vwv5,nread+3);
3373         p = smb_buf(req->outbuf);
3374         SCVAL(p,0,0); /* pad byte. */
3375         SSVAL(p,1,nread);
3376
3377         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3378                  fsp->fnum, (int)numtoread, (int)nread));
3379
3380         END_PROFILE(SMBlockread);
3381         return;
3382 }
3383
3384 #undef DBGC_CLASS
3385 #define DBGC_CLASS DBGC_ALL
3386
3387 /****************************************************************************
3388  Reply to a read.
3389 ****************************************************************************/
3390
3391 void reply_read(struct smb_request *req)
3392 {
3393         connection_struct *conn = req->conn;
3394         size_t numtoread;
3395         ssize_t nread = 0;
3396         char *data;
3397         SMB_OFF_T startpos;
3398         int outsize = 0;
3399         files_struct *fsp;
3400         struct lock_struct lock;
3401         struct smbd_server_connection *sconn = req->sconn;
3402
3403         START_PROFILE(SMBread);
3404
3405         if (req->wct < 3) {
3406                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3407                 END_PROFILE(SMBread);
3408                 return;
3409         }
3410
3411         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3412
3413         if (!check_fsp(conn, req, fsp)) {
3414                 END_PROFILE(SMBread);
3415                 return;
3416         }
3417
3418         if (!CHECK_READ(fsp,req)) {
3419                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3420                 END_PROFILE(SMBread);
3421                 return;
3422         }
3423
3424         numtoread = SVAL(req->vwv+1, 0);
3425         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3426
3427         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3428
3429         /*
3430          * The requested read size cannot be greater than max_recv. JRA.
3431          */
3432         if (numtoread > sconn->smb1.negprot.max_recv) {
3433                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3434 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3435                         (unsigned int)numtoread,
3436                         (unsigned int)sconn->smb1.negprot.max_recv));
3437                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3438         }
3439
3440         reply_outbuf(req, 5, numtoread+3);
3441
3442         data = smb_buf(req->outbuf) + 3;
3443
3444         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3445             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3446             &lock);
3447
3448         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3449                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3450                 END_PROFILE(SMBread);
3451                 return;
3452         }
3453
3454         if (numtoread > 0)
3455                 nread = read_file(fsp,data,startpos,numtoread);
3456
3457         if (nread < 0) {
3458                 reply_nterror(req, map_nt_error_from_unix(errno));
3459                 goto strict_unlock;
3460         }
3461
3462         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3463
3464         SSVAL(req->outbuf,smb_vwv0,nread);
3465         SSVAL(req->outbuf,smb_vwv5,nread+3);
3466         SCVAL(smb_buf(req->outbuf),0,1);
3467         SSVAL(smb_buf(req->outbuf),1,nread);
3468
3469         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3470                 fsp->fnum, (int)numtoread, (int)nread ) );
3471
3472 strict_unlock:
3473         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3474
3475         END_PROFILE(SMBread);
3476         return;
3477 }
3478
3479 /****************************************************************************
3480  Setup readX header.
3481 ****************************************************************************/
3482
3483 static int setup_readX_header(struct smb_request *req, char *outbuf,
3484                               size_t smb_maxcnt)
3485 {
3486         int outsize;
3487         char *data;
3488
3489         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3490         data = smb_buf(outbuf);
3491
3492         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3493
3494         SCVAL(outbuf,smb_vwv0,0xFF);
3495         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3496         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3497         SSVAL(outbuf,smb_vwv6,
3498               req_wct_ofs(req)
3499               + 1               /* the wct field */
3500               + 12 * sizeof(uint16_t) /* vwv */
3501               + 2);             /* the buflen field */
3502         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3503         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3504         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3505         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3506         return outsize;
3507 }
3508
3509 /****************************************************************************
3510  Reply to a read and X - possibly using sendfile.
3511 ****************************************************************************/
3512
3513 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3514                             files_struct *fsp, SMB_OFF_T startpos,
3515                             size_t smb_maxcnt)
3516 {
3517         ssize_t nread = -1;
3518         struct lock_struct lock;
3519         int saved_errno = 0;
3520
3521         if(fsp_stat(fsp) == -1) {
3522                 reply_nterror(req, map_nt_error_from_unix(errno));
3523                 return;
3524         }
3525
3526         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3527             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3528             &lock);
3529
3530         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3531                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3532                 return;
3533         }
3534
3535         if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3536                         (startpos > fsp->fsp_name->st.st_ex_size)
3537                         || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3538                 /*
3539                  * We already know that we would do a short read, so don't
3540                  * try the sendfile() path.
3541                  */
3542                 goto nosendfile_read;
3543         }
3544
3545         /*
3546          * We can only use sendfile on a non-chained packet
3547          * but we can use on a non-oplocked file. tridge proved this
3548          * on a train in Germany :-). JRA.
3549          */
3550
3551         if (!req_is_in_chain(req) &&
3552             !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3553             (fsp->wcp == NULL) &&
3554             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3555                 uint8 headerbuf[smb_size + 12 * 2];
3556                 DATA_BLOB header;
3557
3558                 /*
3559                  * Set up the packet header before send. We
3560                  * assume here the sendfile will work (get the
3561                  * correct amount of data).
3562                  */
3563
3564                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3565
3566                 construct_reply_common_req(req, (char *)headerbuf);
3567                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3568
3569                 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3570                                          startpos, smb_maxcnt);
3571                 if (nread == -1) {
3572                         /* Returning ENOSYS means no data at all was sent.
3573                            Do this as a normal read. */
3574                         if (errno == ENOSYS) {
3575                                 goto normal_read;
3576                         }
3577
3578                         /*
3579                          * Special hack for broken Linux with no working sendfile. If we
3580                          * return EINTR we sent the header but not the rest of the data.
3581                          * Fake this up by doing read/write calls.
3582                          */
3583
3584                         if (errno == EINTR) {
3585                                 /* Ensure we don't do this again. */
3586                                 set_use_sendfile(SNUM(conn), False);
3587                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3588                                 nread = fake_sendfile(fsp, startpos,
3589                                                       smb_maxcnt);
3590                                 if (nread == -1) {
3591                                         DEBUG(0,("send_file_readX: "
3592                                                  "fake_sendfile failed for "
3593                                                  "file %s (%s).\n",
3594                                                  fsp_str_dbg(fsp),
3595                                                  strerror(errno)));
3596                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3597                                 }
3598                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3599                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3600                                 /* No outbuf here means successful sendfile. */
3601                                 goto strict_unlock;
3602                         }
3603
3604                         DEBUG(0,("send_file_readX: sendfile failed for file "
3605                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3606                                  strerror(errno)));
3607                         exit_server_cleanly("send_file_readX sendfile failed");
3608                 } else if (nread == 0) {
3609                         /*
3610                          * Some sendfile implementations return 0 to indicate
3611                          * that there was a short read, but nothing was
3612                          * actually written to the socket.  In this case,
3613                          * fallback to the normal read path so the header gets
3614                          * the correct byte count.
3615                          */
3616                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3617                                   "falling back to the normal read: %s\n",
3618                                   fsp_str_dbg(fsp)));
3619                         goto normal_read;
3620                 }
3621
3622                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3623                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3624
3625                 /* Deal with possible short send. */
3626                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3627                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3628                 }
3629                 /* No outbuf here means successful sendfile. */
3630                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3631                 SMB_PERFCOUNT_END(&req->pcd);
3632                 goto strict_unlock;
3633         }
3634
3635 normal_read:
3636
3637         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3638                 uint8 headerbuf[smb_size + 2*12];
3639
3640                 construct_reply_common_req(req, (char *)headerbuf);
3641                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3642
3643                 /* Send out the header. */
3644                 if (write_data(req->sconn->sock, (char *)headerbuf,
3645                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3646
3647                         char addr[INET6_ADDRSTRLEN];
3648                         /*
3649                          * Try and give an error message saying what
3650                          * client failed.
3651                          */
3652                         DEBUG(0, ("write_data failed for client %s. "
3653                                   "Error %s\n",
3654                                   get_peer_addr(req->sconn->sock, addr,
3655                                                 sizeof(addr)),
3656                                   strerror(errno)));
3657
3658                         DEBUG(0,("send_file_readX: write_data failed for file "
3659                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3660                                  strerror(errno)));
3661                         exit_server_cleanly("send_file_readX sendfile failed");
3662                 }
3663                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3664                 if (nread == -1) {
3665                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3666                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3667                                  strerror(errno)));
3668                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3669                 }
3670                 goto strict_unlock;
3671         }
3672
3673 nosendfile_read:
3674
3675         reply_outbuf(req, 12, smb_maxcnt);
3676
3677         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3678         saved_errno = errno;
3679
3680         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3681
3682         if (nread < 0) {
3683                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3684                 return;
3685         }
3686
3687         setup_readX_header(req, (char *)req->outbuf, nread);
3688
3689         DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3690                     fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3691
3692         chain_reply(req);
3693         return;
3694
3695  strict_unlock:
3696         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3697         TALLOC_FREE(req->outbuf);
3698         return;
3699 }
3700
3701 /****************************************************************************
3702  Reply to a read and X.
3703 ****************************************************************************/
3704
3705 void reply_read_and_X(struct smb_request *req)
3706 {
3707         connection_struct *conn = req->conn;
3708         files_struct *fsp;
3709         SMB_OFF_T startpos;
3710         size_t smb_maxcnt;
3711         bool big_readX = False;
3712 #if 0
3713         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3714 #endif
3715
3716         START_PROFILE(SMBreadX);
3717
3718         if ((req->wct != 10) && (req->wct != 12)) {
3719                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3720                 return;
3721         }
3722
3723         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3724         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3725         smb_maxcnt = SVAL(req->vwv+5, 0);
3726
3727         /* If it's an IPC, pass off the pipe handler. */
3728         if (IS_IPC(conn)) {
3729                 reply_pipe_read_and_X(req);
3730                 END_PROFILE(SMBreadX);
3731                 return;
3732         }
3733
3734         if (!check_fsp(conn, req, fsp)) {
3735                 END_PROFILE(SMBreadX);
3736                 return;
3737         }
3738
3739         if (!CHECK_READ(fsp,req)) {
3740                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3741                 END_PROFILE(SMBreadX);
3742                 return;
3743         }
3744
3745         if (global_client_caps & CAP_LARGE_READX) {
3746                 size_t upper_size = SVAL(req->vwv+7, 0);
3747                 smb_maxcnt |= (upper_size<<16);
3748                 if (upper_size > 1) {
3749                         /* Can't do this on a chained packet. */
3750                         if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3751                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3752                                 END_PROFILE(SMBreadX);
3753                                 return;
3754                         }
3755                         /* We currently don't do this on signed or sealed data. */
3756                         if (srv_is_signing_active(req->sconn) ||
3757                             is_encrypted_packet(req->inbuf)) {
3758                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3759                                 END_PROFILE(SMBreadX);
3760                                 return;
3761                         }
3762                         /* Is there room in the reply for this data ? */
3763                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3764                                 reply_nterror(req,
3765                                               NT_STATUS_INVALID_PARAMETER);
3766                                 END_PROFILE(SMBreadX);
3767                                 return;
3768                         }
3769                         big_readX = True;
3770                 }
3771         }
3772
3773         if (req->wct == 12) {
3774 #ifdef LARGE_SMB_OFF_T
3775                 /*
3776                  * This is a large offset (64 bit) read.
3777                  */
3778                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3779
3780 #else /* !LARGE_SMB_OFF_T */
3781
3782                 /*
3783                  * Ensure we haven't been sent a >32 bit offset.
3784                  */
3785
3786                 if(IVAL(req->vwv+10, 0) != 0) {
3787                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3788                                  "used and we don't support 64 bit offsets.\n",
3789                                  (unsigned int)IVAL(req->vwv+10, 0) ));
3790                         END_PROFILE(SMBreadX);
3791                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3792                         return;
3793                 }
3794
3795 #endif /* LARGE_SMB_OFF_T */
3796
3797         }
3798
3799         if (!big_readX) {
3800                 NTSTATUS status = schedule_aio_read_and_X(conn,
3801                                         req,
3802                                         fsp,
3803                                         startpos,
3804                                         smb_maxcnt);
3805                 if (NT_STATUS_IS_OK(status)) {
3806                         /* Read scheduled - we're done. */
3807                         goto out;
3808                 }
3809                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3810                         /* Real error - report to client. */
3811                         END_PROFILE(SMBreadX);
3812                         reply_nterror(req, status);
3813                         return;
3814                 }
3815                 /* NT_STATUS_RETRY - fall back to sync read. */
3816         }
3817
3818         smbd_lock_socket(req->sconn);
3819         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3820         smbd_unlock_socket(req->sconn);
3821
3822  out:
3823         END_PROFILE(SMBreadX);
3824         return;
3825 }
3826
3827 /****************************************************************************
3828  Error replies to writebraw must have smb_wct == 1. Fix this up.
3829 ****************************************************************************/
3830
3831 void error_to_writebrawerr(struct smb_request *req)
3832 {
3833         uint8 *old_outbuf = req->outbuf;
3834
3835         reply_outbuf(req, 1, 0);
3836
3837         memcpy(req->outbuf, old_outbuf, smb_size);
3838         TALLOC_FREE(old_outbuf);
3839 }
3840
3841 /****************************************************************************
3842  Read 4 bytes of a smb packet and return the smb length of the packet.
3843  Store the result in the buffer. This version of the function will
3844  never return a session keepalive (length of zero).
3845  Timeout is in milliseconds.
3846 ****************************************************************************/
3847
3848 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3849                                 size_t *len)
3850 {
3851         uint8_t msgtype = SMBkeepalive;
3852
3853         while (msgtype == SMBkeepalive) {
3854                 NTSTATUS status;
3855
3856                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3857                                                           len);
3858                 if (!NT_STATUS_IS_OK(status)) {
3859                         char addr[INET6_ADDRSTRLEN];
3860                         /* Try and give an error message
3861                          * saying what client failed. */
3862                         DEBUG(0, ("read_fd_with_timeout failed for "
3863                                   "client %s read error = %s.\n",
3864                                   get_peer_addr(fd,addr,sizeof(addr)),
3865                                   nt_errstr(status)));
3866                         return status;
3867                 }
3868
3869                 msgtype = CVAL(inbuf, 0);
3870         }
3871
3872         DEBUG(10,("read_smb_length: got smb length of %lu\n",
3873                   (unsigned long)len));
3874
3875         return NT_STATUS_OK;
3876 }
3877
3878 /****************************************************************************
3879  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3880 ****************************************************************************/
3881
3882 void reply_writebraw(struct smb_request *req)
3883 {
3884         connection_struct *conn = req->conn;
3885         char *buf = NULL;
3886         ssize_t nwritten=0;
3887         ssize_t total_written=0;
3888         size_t numtowrite=0;
3889         size_t tcount;
3890         SMB_OFF_T startpos;
3891         char *data=NULL;
3892         bool write_through;
3893         files_struct *fsp;
3894         struct lock_struct lock;
3895         NTSTATUS status;
3896
3897         START_PROFILE(SMBwritebraw);
3898
3899         /*
3900          * If we ever reply with an error, it must have the SMB command
3901          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3902          * we're finished.
3903          */
3904         SCVAL(req->inbuf,smb_com,SMBwritec);
3905
3906         if (srv_is_signing_active(req->sconn)) {
3907                 END_PROFILE(SMBwritebraw);
3908                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3909                                 "raw reads/writes are disallowed.");
3910         }
3911
3912         if (req->wct < 12) {
3913                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3914                 error_to_writebrawerr(req);
3915                 END_PROFILE(SMBwritebraw);
3916                 return;
3917         }
3918
3919         if (req->sconn->smb1.echo_handler.trusted_fde) {
3920                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3921                          "'async smb echo handler = yes'\n"));
3922                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3923                 error_to_writebrawerr(req);
3924                 END_PROFILE(SMBwritebraw);
3925                 return;
3926         }
3927
3928         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3929         if (!check_fsp(conn, req, fsp)) {
3930                 error_to_writebrawerr(req);
3931                 END_PROFILE(SMBwritebraw);
3932                 return;
3933         }
3934
3935         if (!CHECK_WRITE(fsp)) {
3936                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3937                 error_to_writebrawerr(req);
3938                 END_PROFILE(SMBwritebraw);
3939                 return;
3940         }
3941
3942         tcount = IVAL(req->vwv+1, 0);
3943         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3944         write_through = BITSETW(req->vwv+7,0);
3945
3946         /* We have to deal with slightly different formats depending
3947                 on whether we are using the core+ or lanman1.0 protocol */
3948
3949         if(get_Protocol() <= PROTOCOL_COREPLUS) {
3950                 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3951                 data = smb_buf(req->inbuf);
3952         } else {
3953                 numtowrite = SVAL(req->vwv+10, 0);
3954                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3955         }
3956
3957         /* Ensure we don't write bytes past the end of this packet. */
3958         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3959                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3960                 error_to_writebrawerr(req);
3961                 END_PROFILE(SMBwritebraw);
3962                 return;
3963         }
3964
3965         if (!fsp->print_file) {
3966                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3967                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3968                     &lock);
3969
3970                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3971                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3972                         error_to_writebrawerr(req);
3973                         END_PROFILE(SMBwritebraw);
3974                         return;
3975                 }
3976         }
3977
3978         if (numtowrite>0) {
3979                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3980         }
3981
3982         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3983                         "wrote=%d sync=%d\n",
3984                 fsp->fnum, (double)startpos, (int)numtowrite,
3985                 (int)nwritten, (int)write_through));
3986
3987         if (nwritten < (ssize_t)numtowrite)  {
3988                 reply_nterror(req, NT_STATUS_DISK_FULL);
3989                 error_to_writebrawerr(req);
3990                 goto strict_unlock;
3991         }
3992
3993         total_written = nwritten;
3994
3995         /* Allocate a buffer of 64k + length. */
3996         buf = TALLOC_ARRAY(NULL, char, 65540);
3997         if (!buf) {
3998                 reply_nterror(req, NT_STATUS_NO_MEMORY);
3999                 error_to_writebrawerr(req);
4000                 goto strict_unlock;
4001         }
4002
4003         /* Return a SMBwritebraw message to the redirector to tell
4004          * it to send more bytes */
4005
4006         memcpy(buf, req->inbuf, smb_size);
4007         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4008         SCVAL(buf,smb_com,SMBwritebraw);
4009         SSVALS(buf,smb_vwv0,0xFFFF);
4010         show_msg(buf);
4011         if (!srv_send_smb(req->sconn,
4012                           buf,
4013                           false, 0, /* no signing */
4014                           IS_CONN_ENCRYPTED(conn),
4015                           &req->pcd)) {
4016                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4017                         "failed.");
4018         }
4019
4020         /* Now read the raw data into the buffer and write it */
4021         status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4022                                  &numtowrite);
4023         if (!NT_STATUS_IS_OK(status)) {
4024                 exit_server_cleanly("secondary writebraw failed");
4025         }
4026
4027         /* Set up outbuf to return the correct size */
4028         reply_outbuf(req, 1, 0);
4029
4030         if (numtowrite != 0) {
4031
4032                 if (numtowrite > 0xFFFF) {
4033                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4034                                 "raw requested (%u). Terminating\n",
4035                                 (unsigned int)numtowrite ));
4036                         exit_server_cleanly("secondary writebraw failed");
4037                 }
4038
4039                 if (tcount > nwritten+numtowrite) {
4040                         DEBUG(3,("reply_writebraw: Client overestimated the "
4041                                 "write %d %d %d\n",
4042                                 (int)tcount,(int)nwritten,(int)numtowrite));
4043                 }
4044
4045                 status = read_data(req->sconn->sock, buf+4, numtowrite);
4046
4047                 if (!NT_STATUS_IS_OK(status)) {
4048                         char addr[INET6_ADDRSTRLEN];
4049                         /* Try and give an error message
4050                          * saying what client failed. */
4051                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4052                                   "raw read failed (%s) for client %s. "
4053                                   "Terminating\n", nt_errstr(status),
4054                                   get_peer_addr(req->sconn->sock, addr,
4055                                                 sizeof(addr))));
4056                         exit_server_cleanly("secondary writebraw failed");
4057                 }
4058
4059                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4060                 if (nwritten == -1) {
4061                         TALLOC_FREE(buf);
4062                         reply_nterror(req, map_nt_error_from_unix(errno));
4063                         error_to_writebrawerr(req);
4064                         goto strict_unlock;
4065                 }
4066
4067                 if (nwritten < (ssize_t)numtowrite) {
4068                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4069                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4070                 }
4071
4072                 if (nwritten > 0) {
4073                         total_written += nwritten;
4074                 }
4075         }
4076
4077         TALLOC_FREE(buf);
4078         SSVAL(req->outbuf,smb_vwv0,total_written);
4079
4080         status = sync_file(conn, fsp, write_through);
4081         if (!NT_STATUS_IS_OK(status)) {
4082                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4083                          fsp_str_dbg(fsp), nt_errstr(status)));
4084                 reply_nterror(req, status);
4085                 error_to_writebrawerr(req);
4086                 goto strict_unlock;
4087         }
4088
4089         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4090                 "wrote=%d\n",
4091                 fsp->fnum, (double)startpos, (int)numtowrite,
4092                 (int)total_written));
4093
4094         if (!fsp->print_file) {
4095                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4096         }
4097
4098         /* We won't return a status if write through is not selected - this
4099          * follows what WfWg does */
4100         END_PROFILE(SMBwritebraw);
4101
4102         if (!write_through && total_written==tcount) {
4103
4104 #if RABBIT_PELLET_FIX
4105                 /*
4106                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4107                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
4108                  * JRA.
4109                  */
4110                 if (!send_keepalive(req->sconn->sock)) {
4111                         exit_server_cleanly("reply_writebraw: send of "
4112                                 "keepalive failed");
4113                 }
4114 #endif
4115                 TALLOC_FREE(req->outbuf);
4116         }
4117         return;
4118
4119 strict_unlock:
4120         if (!fsp->print_file) {
4121                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4122         }
4123
4124         END_PROFILE(SMBwritebraw);
4125         return;
4126 }
4127
4128 #undef DBGC_CLASS
4129 #define DBGC_CLASS DBGC_LOCKING
4130
4131 /****************************************************************************
4132  Reply to a writeunlock (core+).
4133 ****************************************************************************/
4134
4135 void reply_writeunlock(struct smb_request *req)
4136 {
4137         connection_struct *conn = req->conn;
4138         ssize_t nwritten = -1;
4139         size_t numtowrite;
4140         SMB_OFF_T startpos;
4141         const char *data;
4142         NTSTATUS status = NT_STATUS_OK;
4143         files_struct *fsp;
4144         struct lock_struct lock;
4145         int saved_errno = 0;
4146
4147         START_PROFILE(SMBwriteunlock);
4148
4149         if (req->wct < 5) {
4150                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4151                 END_PROFILE(SMBwriteunlock);
4152                 return;
4153         }
4154
4155         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4156
4157         if (!check_fsp(conn, req, fsp)) {
4158                 END_PROFILE(SMBwriteunlock);
4159                 return;
4160         }
4161
4162         if (!CHECK_WRITE(fsp)) {
4163                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4164                 END_PROFILE(SMBwriteunlock);
4165                 return;
4166         }
4167
4168         numtowrite = SVAL(req->vwv+1, 0);
4169         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4170         data = (const char *)req->buf + 3;
4171
4172         if (!fsp->print_file && numtowrite > 0) {
4173                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4174                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4175                     &lock);
4176
4177                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4178                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4179                         END_PROFILE(SMBwriteunlock);
4180                         return;
4181                 }
4182         }
4183
4184         /* The special X/Open SMB protocol handling of
4185            zero length writes is *NOT* done for
4186            this call */
4187         if(numtowrite == 0) {
4188                 nwritten = 0;
4189         } else {
4190                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4191                 saved_errno = errno;
4192         }
4193
4194         status = sync_file(conn, fsp, False /* write through */);
4195         if (!NT_STATUS_IS_OK(status)) {
4196                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4197                          fsp_str_dbg(fsp), nt_errstr(status)));
4198                 reply_nterror(req, status);
4199                 goto strict_unlock;
4200         }
4201
4202         if(nwritten < 0) {
4203                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4204                 goto strict_unlock;
4205         }
4206
4207         if((nwritten < numtowrite) && (numtowrite != 0)) {
4208                 reply_nterror(req, NT_STATUS_DISK_FULL);
4209                 goto strict_unlock;
4210         }
4211
4212         if (numtowrite && !fsp->print_file) {
4213                 status = do_unlock(req->sconn->msg_ctx,
4214                                 fsp,
4215                                 (uint64_t)req->smbpid,
4216                                 (uint64_t)numtowrite,
4217                                 (uint64_t)startpos,
4218                                 WINDOWS_LOCK);
4219
4220                 if (NT_STATUS_V(status)) {
4221                         reply_nterror(req, status);
4222                         goto strict_unlock;
4223                 }
4224         }
4225
4226         reply_outbuf(req, 1, 0);
4227
4228         SSVAL(req->outbuf,smb_vwv0,nwritten);
4229
4230         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4231                  fsp->fnum, (int)numtowrite, (int)nwritten));
4232
4233 strict_unlock:
4234         if (numtowrite && !fsp->print_file) {
4235                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4236         }
4237
4238         END_PROFILE(SMBwriteunlock);
4239         return;
4240 }
4241
4242 #undef DBGC_CLASS
4243 #define DBGC_CLASS DBGC_ALL
4244
4245 /****************************************************************************
4246  Reply to a write.
4247 ****************************************************************************/
4248
4249 void reply_write(struct smb_request *req)
4250 {
4251         connection_struct *conn = req->conn;
4252         size_t numtowrite;
4253         ssize_t nwritten = -1;
4254         SMB_OFF_T startpos;
4255         const char *data;
4256         files_struct *fsp;
4257         struct lock_struct lock;
4258         NTSTATUS status;
4259         int saved_errno = 0;
4260
4261         START_PROFILE(SMBwrite);
4262
4263         if (req->wct < 5) {
4264                 END_PROFILE(SMBwrite);
4265                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4266                 return;
4267         }
4268
4269         /* If it's an IPC, pass off the pipe handler. */
4270         if (IS_IPC(conn)) {
4271                 reply_pipe_write(req);
4272                 END_PROFILE(SMBwrite);
4273                 return;
4274         }
4275
4276         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4277
4278         if (!check_fsp(conn, req, fsp)) {
4279                 END_PROFILE(SMBwrite);
4280                 return;
4281         }
4282
4283         if (!CHECK_WRITE(fsp)) {
4284                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4285                 END_PROFILE(SMBwrite);
4286                 return;
4287         }
4288
4289         numtowrite = SVAL(req->vwv+1, 0);
4290         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4291         data = (const char *)req->buf + 3;
4292
4293         if (!fsp->print_file) {
4294                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4295                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4296                         &lock);
4297
4298                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4299                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4300                         END_PROFILE(SMBwrite);
4301                         return;
4302                 }
4303         }
4304
4305         /*
4306          * X/Open SMB protocol says that if smb_vwv1 is
4307          * zero then the file size should be extended or
4308          * truncated to the size given in smb_vwv[2-3].
4309          */
4310
4311         if(numtowrite == 0) {
4312                 /*
4313                  * This is actually an allocate call, and set EOF. JRA.
4314                  */
4315                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4316                 if (nwritten < 0) {
4317                         reply_nterror(req, NT_STATUS_DISK_FULL);
4318                         goto strict_unlock;
4319                 }
4320                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4321                 if (nwritten < 0) {
4322                         reply_nterror(req, NT_STATUS_DISK_FULL);
4323                         goto strict_unlock;
4324                 }
4325                 trigger_write_time_update_immediate(fsp);
4326         } else {
4327                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4328         }
4329
4330         status = sync_file(conn, fsp, False);
4331         if (!NT_STATUS_IS_OK(status)) {
4332                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4333                          fsp_str_dbg(fsp), nt_errstr(status)));
4334                 reply_nterror(req, status);
4335                 goto strict_unlock;
4336         }
4337
4338         if(nwritten < 0) {
4339                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4340                 goto strict_unlock;
4341         }
4342
4343         if((nwritten == 0) && (numtowrite != 0)) {
4344                 reply_nterror(req, NT_STATUS_DISK_FULL);
4345                 goto strict_unlock;
4346         }
4347
4348         reply_outbuf(req, 1, 0);
4349
4350         SSVAL(req->outbuf,smb_vwv0,nwritten);
4351
4352         if (nwritten < (ssize_t)numtowrite) {
4353                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4354                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4355         }
4356
4357         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4358
4359 strict_unlock:
4360         if (!fsp->print_file) {
4361                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4362         }
4363
4364         END_PROFILE(SMBwrite);
4365         return;
4366 }
4367
4368 /****************************************************************************
4369  Ensure a buffer is a valid writeX for recvfile purposes.
4370 ****************************************************************************/
4371
4372 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4373                                                 (2*14) + /* word count (including bcc) */ \
4374                                                 1 /* pad byte */)
4375
4376 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4377                             const uint8_t *inbuf)
4378 {
4379         size_t numtowrite;
4380         connection_struct *conn = NULL;
4381         unsigned int doff = 0;
4382         size_t len = smb_len_large(inbuf);
4383
4384         if (is_encrypted_packet(inbuf)) {
4385                 /* Can't do this on encrypted
4386                  * connections. */
4387                 return false;
4388         }
4389
4390         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4391                 return false;
4392         }
4393
4394         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4395                         CVAL(inbuf,smb_wct) != 14) {
4396                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4397                         "invalid word length.\n"));
4398                 return false;
4399         }
4400
4401         conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4402         if (conn == NULL) {
4403                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4404                 return false;
4405         }
4406         if (IS_IPC(conn)) {
4407                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4408                 return false;
4409         }
4410         if (IS_PRINT(conn)) {
4411                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4412                 return false;
4413         }
4414         doff = SVAL(inbuf,smb_vwv11);
4415
4416         numtowrite = SVAL(inbuf,smb_vwv10);
4417
4418         if (len > doff && len - doff > 0xFFFF) {
4419                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4420         }
4421
4422         if (numtowrite == 0) {
4423                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4424                 return false;
4425         }
4426
4427         /* Ensure the sizes match up. */
4428         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4429                 /* no pad byte...old smbclient :-( */
4430                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4431                         (unsigned int)doff,
4432                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4433                 return false;
4434         }
4435
4436         if (len - doff != numtowrite) {
4437                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4438                         "len = %u, doff = %u, numtowrite = %u\n",
4439                         (unsigned int)len,
4440                         (unsigned int)doff,
4441                         (unsigned int)numtowrite ));
4442                 return false;
4443         }
4444
4445         DEBUG(10,("is_valid_writeX_buffer: true "
4446                 "len = %u, doff = %u, numtowrite = %u\n",
4447                 (unsigned int)len,
4448                 (unsigned int)doff,
4449                 (unsigned int)numtowrite ));
4450
4451         return true;
4452 }
4453
4454 /****************************************************************************
4455  Reply to a write and X.
4456 ****************************************************************************/
4457
4458 void reply_write_and_X(struct smb_request *req)
4459 {
4460         connection_struct *conn = req->conn;
4461         files_struct *fsp;
4462         struct lock_struct lock;
4463         SMB_OFF_T startpos;
4464         size_t numtowrite;
4465         bool write_through;
4466         ssize_t nwritten;
4467         unsigned int smb_doff;
4468         unsigned int smblen;
4469         char *data;
4470         NTSTATUS status;
4471         int saved_errno = 0;
4472
4473         START_PROFILE(SMBwriteX);
4474
4475         if ((req->wct != 12) && (req->wct != 14)) {
4476                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4477                 END_PROFILE(SMBwriteX);
4478                 return;
4479         }
4480
4481         numtowrite = SVAL(req->vwv+10, 0);
4482         smb_doff = SVAL(req->vwv+11, 0);
4483         smblen = smb_len(req->inbuf);
4484
4485         if (req->unread_bytes > 0xFFFF ||
4486                         (smblen > smb_doff &&
4487                                 smblen - smb_doff > 0xFFFF)) {
4488                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4489         }
4490
4491         if (req->unread_bytes) {
4492                 /* Can't do a recvfile write on IPC$ */
4493                 if (IS_IPC(conn)) {
4494                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4495                         END_PROFILE(SMBwriteX);
4496                         return;
4497                 }
4498                 if (numtowrite != req->unread_bytes) {
4499                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4500                         END_PROFILE(SMBwriteX);
4501                         return;
4502                 }
4503         } else {
4504                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4505                                 smb_doff + numtowrite > smblen) {
4506                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4507                         END_PROFILE(SMBwriteX);
4508                         return;
4509                 }
4510         }
4511
4512         /* If it's an IPC, pass off the pipe handler. */
4513         if (IS_IPC(conn)) {
4514                 if (req->unread_bytes) {
4515                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4516                         END_PROFILE(SMBwriteX);
4517                         return;
4518                 }
4519                 reply_pipe_write_and_X(req);
4520                 END_PROFILE(SMBwriteX);
4521                 return;
4522         }
4523
4524         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4525         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4526         write_through = BITSETW(req->vwv+7,0);
4527
4528         if (!check_fsp(conn, req, fsp)) {
4529                 END_PROFILE(SMBwriteX);
4530                 return;
4531         }
4532
4533         if (!CHECK_WRITE(fsp)) {
4534                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4535                 END_PROFILE(SMBwriteX);
4536                 return;
4537         }
4538
4539         data = smb_base(req->inbuf) + smb_doff;
4540
4541         if(req->wct == 14) {
4542 #ifdef LARGE_SMB_OFF_T
4543                 /*
4544                  * This is a large offset (64 bit) write.
4545                  */
4546                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4547
4548 #else /* !LARGE_SMB_OFF_T */
4549
4550                 /*
4551                  * Ensure we haven't been sent a >32 bit offset.
4552                  */
4553
4554                 if(IVAL(req->vwv+12, 0) != 0) {
4555                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4556                                  "used and we don't support 64 bit offsets.\n",
4557                                  (unsigned int)IVAL(req->vwv+12, 0) ));
4558                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4559                         END_PROFILE(SMBwriteX);
4560                         return;
4561                 }
4562
4563 #endif /* LARGE_SMB_OFF_T */
4564         }
4565
4566         /* X/Open SMB protocol says that, unlike SMBwrite
4567         if the length is zero then NO truncation is
4568         done, just a write of zero. To truncate a file,
4569         use SMBwrite. */
4570
4571         if(numtowrite == 0) {
4572                 nwritten = 0;
4573         } else {
4574                 if (req->unread_bytes == 0) {
4575                         status = schedule_aio_write_and_X(conn,
4576                                                 req,
4577                                                 fsp,
4578                                                 data,
4579                                                 startpos,
4580                                                 numtowrite);
4581
4582                         if (NT_STATUS_IS_OK(status)) {
4583                                 /* write scheduled - we're done. */
4584                                 goto out;
4585                         }
4586                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4587                                 /* Real error - report to client. */
4588                                 reply_nterror(req, status);
4589                                 goto out;
4590                         }
4591                         /* NT_STATUS_RETRY - fall through to sync write. */
4592                 }
4593
4594                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4595                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4596                     &lock);
4597
4598                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4599                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4600                         goto out;
4601                 }
4602
4603                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4604                 saved_errno = errno;
4605
4606                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4607         }
4608
4609         if(nwritten < 0) {
4610                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4611                 goto out;
4612         }
4613
4614         if((nwritten == 0) && (numtowrite != 0)) {
4615                 reply_nterror(req, NT_STATUS_DISK_FULL);
4616                 goto out;
4617         }
4618
4619         reply_outbuf(req, 6, 0);
4620         SSVAL(req->outbuf,smb_vwv2,nwritten);
4621         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4622
4623         if (nwritten < (ssize_t)numtowrite) {
4624                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4625                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4626         }
4627
4628         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4629                 fsp->fnum, (int)numtowrite, (int)nwritten));
4630
4631         status = sync_file(conn, fsp, write_through);
4632         if (!NT_STATUS_IS_OK(status)) {
4633                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4634                          fsp_str_dbg(fsp), nt_errstr(status)));
4635                 reply_nterror(req, status);
4636                 goto out;
4637         }
4638
4639         END_PROFILE(SMBwriteX);
4640         chain_reply(req);
4641         return;
4642
4643 out:
4644         END_PROFILE(SMBwriteX);
4645         return;
4646 }
4647
4648 /****************************************************************************
4649  Reply to a lseek.
4650 ****************************************************************************/
4651
4652 void reply_lseek(struct smb_request *req)
4653 {
4654         connection_struct *conn = req->conn;
4655         SMB_OFF_T startpos;
4656         SMB_OFF_T res= -1;
4657         int mode,umode;
4658         files_struct *fsp;
4659
4660         START_PROFILE(SMBlseek);
4661
4662         if (req->wct < 4) {
4663                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4664                 END_PROFILE(SMBlseek);
4665                 return;
4666         }
4667
4668         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4669
4670         if (!check_fsp(conn, req, fsp)) {
4671                 return;
4672         }
4673
4674         flush_write_cache(fsp, SEEK_FLUSH);
4675
4676         mode = SVAL(req->vwv+1, 0) & 3;
4677         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4678         startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4679
4680         switch (mode) {
4681                 case 0:
4682                         umode = SEEK_SET;
4683                         res = startpos;
4684                         break;
4685                 case 1:
4686                         umode = SEEK_CUR;
4687                         res = fsp->fh->pos + startpos;
4688                         break;
4689                 case 2:
4690                         umode = SEEK_END;
4691                         break;
4692                 default:
4693                         umode = SEEK_SET;
4694                         res = startpos;
4695                         break;
4696         }
4697
4698         if (umode == SEEK_END) {
4699                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4700                         if(errno == EINVAL) {
4701                                 SMB_OFF_T current_pos = startpos;
4702
4703                                 if(fsp_stat(fsp) == -1) {
4704                                         reply_nterror(req,
4705                                                 map_nt_error_from_unix(errno));
4706                                         END_PROFILE(SMBlseek);
4707                                         return;
4708                                 }
4709
4710                                 current_pos += fsp->fsp_name->st.st_ex_size;
4711                                 if(current_pos < 0)
4712                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4713                         }
4714                 }
4715
4716                 if(res == -1) {
4717                         reply_nterror(req, map_nt_error_from_unix(errno));
4718                         END_PROFILE(SMBlseek);
4719                         return;
4720                 }
4721         }
4722
4723         fsp->fh->pos = res;
4724
4725         reply_outbuf(req, 2, 0);
4726         SIVAL(req->outbuf,smb_vwv0,res);
4727
4728         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4729                 fsp->fnum, (double)startpos, (double)res, mode));
4730
4731         END_PROFILE(SMBlseek);
4732         return;
4733 }
4734
4735 /****************************************************************************
4736  Reply to a flush.
4737 ****************************************************************************/
4738
4739 void reply_flush(struct smb_request *req)
4740 {
4741         connection_struct *conn = req->conn;
4742         uint16 fnum;
4743         files_struct *fsp;
4744
4745         START_PROFILE(SMBflush);
4746
4747         if (req->wct < 1) {
4748                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4749                 return;
4750         }
4751
4752         fnum = SVAL(req->vwv+0, 0);
4753         fsp = file_fsp(req, fnum);
4754
4755         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4756                 return;
4757         }
4758
4759         if (!fsp) {
4760                 file_sync_all(conn);
4761         } else {
4762                 NTSTATUS status = sync_file(conn, fsp, True);
4763                 if (!NT_STATUS_IS_OK(status)) {
4764                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4765                                 fsp_str_dbg(fsp), nt_errstr(status)));
4766                         reply_nterror(req, status);
4767                         END_PROFILE(SMBflush);
4768                         return;
4769                 }
4770         }
4771
4772         reply_outbuf(req, 0, 0);
4773
4774         DEBUG(3,("flush\n"));
4775         END_PROFILE(SMBflush);
4776         return;
4777 }
4778
4779 /****************************************************************************
4780  Reply to a exit.
4781  conn POINTER CAN BE NULL HERE !
4782 ****************************************************************************/
4783
4784 void reply_exit(struct smb_request *req)
4785 {
4786         START_PROFILE(SMBexit);
4787
4788         file_close_pid(req->sconn, req->smbpid, req->vuid);
4789
4790         reply_outbuf(req, 0, 0);
4791
4792         DEBUG(3,("exit\n"));
4793
4794         END_PROFILE(SMBexit);
4795         return;
4796 }
4797
4798 /****************************************************************************
4799  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4800 ****************************************************************************/
4801
4802 void reply_close(struct smb_request *req)
4803 {
4804         connection_struct *conn = req->conn;
4805         NTSTATUS status = NT_STATUS_OK;
4806         files_struct *fsp = NULL;
4807         START_PROFILE(SMBclose);
4808
4809         if (req->wct < 3) {
4810                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4811                 END_PROFILE(SMBclose);
4812                 return;
4813         }
4814
4815         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4816
4817         /*
4818          * We can only use check_fsp if we know it's not a directory.
4819          */
4820
4821         if (!check_fsp_open(conn, req, fsp)) {
4822                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4823                 END_PROFILE(SMBclose);
4824                 return;
4825         }
4826
4827         if(fsp->is_directory) {
4828                 /*
4829                  * Special case - close NT SMB directory handle.
4830                  */
4831                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4832                 status = close_file(req, fsp, NORMAL_CLOSE);
4833         } else {
4834                 time_t t;
4835                 /*
4836                  * Close ordinary file.
4837                  */
4838
4839                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4840                          fsp->fh->fd, fsp->fnum,
4841                          conn->num_files_open));
4842
4843                 /*
4844                  * Take care of any time sent in the close.
4845                  */
4846
4847                 t = srv_make_unix_date3(req->vwv+1);
4848                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4849
4850                 /*
4851                  * close_file() returns the unix errno if an error
4852                  * was detected on close - normally this is due to
4853                  * a disk full error. If not then it was probably an I/O error.
4854                  */
4855
4856                 status = close_file(req, fsp, NORMAL_CLOSE);
4857         }
4858
4859         if (!NT_STATUS_IS_OK(status)) {
4860                 reply_nterror(req, status);
4861                 END_PROFILE(SMBclose);
4862                 return;
4863         }
4864
4865         reply_outbuf(req, 0, 0);
4866         END_PROFILE(SMBclose);
4867         return;
4868 }
4869
4870 /****************************************************************************
4871  Reply to a writeclose (Core+ protocol).
4872 ****************************************************************************/
4873
4874 void reply_writeclose(struct smb_request *req)
4875 {
4876         connection_struct *conn = req->conn;
4877         size_t numtowrite;
4878         ssize_t nwritten = -1;
4879         NTSTATUS close_status = NT_STATUS_OK;
4880         SMB_OFF_T startpos;
4881         const char *data;
4882         struct timespec mtime;
4883         files_struct *fsp;
4884         struct lock_struct lock;
4885
4886         START_PROFILE(SMBwriteclose);
4887
4888         if (req->wct < 6) {
4889                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4890                 END_PROFILE(SMBwriteclose);
4891                 return;
4892         }
4893
4894         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4895
4896         if (!check_fsp(conn, req, fsp)) {
4897                 END_PROFILE(SMBwriteclose);
4898                 return;
4899         }
4900         if (!CHECK_WRITE(fsp)) {
4901                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4902                 END_PROFILE(SMBwriteclose);
4903                 return;
4904         }
4905
4906         numtowrite = SVAL(req->vwv+1, 0);
4907         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4908         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4909         data = (const char *)req->buf + 1;
4910
4911         if (!fsp->print_file) {
4912                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4913                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4914                     &lock);
4915
4916                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4917                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4918                         END_PROFILE(SMBwriteclose);
4919                         return;
4920                 }
4921         }
4922
4923         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4924
4925         set_close_write_time(fsp, mtime);
4926
4927         /*
4928          * More insanity. W2K only closes the file if writelen > 0.
4929          * JRA.
4930          */
4931
4932         if (numtowrite) {
4933                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4934                          "file %s\n", fsp_str_dbg(fsp)));
4935                 close_status = close_file(req, fsp, NORMAL_CLOSE);
4936         }
4937
4938         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4939                  fsp->fnum, (int)numtowrite, (int)nwritten,
4940                  conn->num_files_open));
4941
4942         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4943                 reply_nterror(req, NT_STATUS_DISK_FULL);
4944                 goto strict_unlock;
4945         }
4946
4947         if(!NT_STATUS_IS_OK(close_status)) {
4948                 reply_nterror(req, close_status);
4949                 goto strict_unlock;
4950         }
4951
4952         reply_outbuf(req, 1, 0);
4953
4954         SSVAL(req->outbuf,smb_vwv0,nwritten);
4955
4956 strict_unlock:
4957         if (numtowrite && !fsp->print_file) {
4958                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4959         }
4960
4961         END_PROFILE(SMBwriteclose);
4962         return;
4963 }
4964
4965 #undef DBGC_CLASS
4966 #define DBGC_CLASS DBGC_LOCKING
4967
4968 /****************************************************************************
4969  Reply to a lock.
4970 ****************************************************************************/
4971
4972 void reply_lock(struct smb_request *req)
4973 {
4974         connection_struct *conn = req->conn;
4975         uint64_t count,offset;
4976         NTSTATUS status;
4977         files_struct *fsp;
4978         struct byte_range_lock *br_lck = NULL;
4979
4980         START_PROFILE(SMBlock);
4981
4982         if (req->wct < 5) {
4983                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4984                 END_PROFILE(SMBlock);
4985                 return;
4986         }
4987
4988         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4989
4990         if (!check_fsp(conn, req, fsp)) {
4991                 END_PROFILE(SMBlock);
4992                 return;
4993         }
4994
4995         count = (uint64_t)IVAL(req->vwv+1, 0);
4996         offset = (uint64_t)IVAL(req->vwv+3, 0);
4997
4998         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4999                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
5000
5001         br_lck = do_lock(req->sconn->msg_ctx,
5002                         fsp,
5003                         (uint64_t)req->smbpid,
5004                         count,
5005                         offset,
5006                         WRITE_LOCK,
5007                         WINDOWS_LOCK,
5008                         False, /* Non-blocking lock. */
5009                         &status,
5010                         NULL,
5011                         NULL);
5012
5013         TALLOC_FREE(br_lck);
5014
5015         if (NT_STATUS_V(status)) {
5016                 reply_nterror(req, status);
5017                 END_PROFILE(SMBlock);
5018                 return;
5019         }
5020
5021         reply_outbuf(req, 0, 0);
5022
5023         END_PROFILE(SMBlock);
5024         return;
5025 }
5026
5027 /****************************************************************************
5028  Reply to a unlock.
5029 ****************************************************************************/
5030
5031 void reply_unlock(struct smb_request *req)
5032 {
5033         connection_struct *conn = req->conn;
5034         uint64_t count,offset;
5035         NTSTATUS status;
5036         files_struct *fsp;
5037
5038         START_PROFILE(SMBunlock);
5039
5040         if (req->wct < 5) {
5041                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5042                 END_PROFILE(SMBunlock);
5043                 return;
5044         }
5045
5046         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5047
5048         if (!check_fsp(conn, req, fsp)) {
5049                 END_PROFILE(SMBunlock);
5050                 return;
5051         }
5052
5053         count = (uint64_t)IVAL(req->vwv+1, 0);
5054         offset = (uint64_t)IVAL(req->vwv+3, 0);
5055
5056         status = do_unlock(req->sconn->msg_ctx,
5057                         fsp,
5058                         (uint64_t)req->smbpid,
5059                         count,
5060                         offset,
5061                         WINDOWS_LOCK);
5062
5063         if (NT_STATUS_V(status)) {
5064                 reply_nterror(req, status);
5065                 END_PROFILE(SMBunlock);
5066                 return;
5067         }
5068
5069         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5070                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5071
5072         reply_outbuf(req, 0, 0);
5073
5074         END_PROFILE(SMBunlock);
5075         return;
5076 }
5077
5078 #undef DBGC_CLASS
5079 #define DBGC_CLASS DBGC_ALL
5080
5081 /****************************************************************************
5082  Reply to a tdis.
5083  conn POINTER CAN BE NULL HERE !
5084 ****************************************************************************/
5085
5086 void reply_tdis(struct smb_request *req)
5087 {
5088         connection_struct *conn = req->conn;
5089         START_PROFILE(SMBtdis);
5090
5091         if (!conn) {
5092                 DEBUG(4,("Invalid connection in tdis\n"));
5093                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5094                 END_PROFILE(SMBtdis);
5095                 return;
5096         }
5097
5098         conn->used = False;
5099
5100         close_cnum(conn,req->vuid);
5101         req->conn = NULL;
5102
5103         reply_outbuf(req, 0, 0);
5104         END_PROFILE(SMBtdis);
5105         return;
5106 }
5107
5108 /****************************************************************************
5109  Reply to a echo.
5110  conn POINTER CAN BE NULL HERE !
5111 ****************************************************************************/
5112
5113 void reply_echo(struct smb_request *req)
5114 {
5115         connection_struct *conn = req->conn;
5116         struct smb_perfcount_data local_pcd;
5117         struct smb_perfcount_data *cur_pcd;
5118         int smb_reverb;
5119         int seq_num;
5120
5121         START_PROFILE(SMBecho);
5122
5123         smb_init_perfcount_data(&local_pcd);
5124
5125         if (req->wct < 1) {
5126                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5127                 END_PROFILE(SMBecho);
5128                 return;
5129         }
5130
5131         smb_reverb = SVAL(req->vwv+0, 0);
5132
5133         reply_outbuf(req, 1, req->buflen);
5134
5135         /* copy any incoming data back out */
5136         if (req->buflen > 0) {
5137                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5138         }
5139
5140         if (smb_reverb > 100) {
5141                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5142                 smb_reverb = 100;
5143         }
5144
5145         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5146
5147                 /* this makes sure we catch the request pcd */
5148                 if (seq_num == smb_reverb) {
5149                         cur_pcd = &req->pcd;
5150                 } else {
5151                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5152                         cur_pcd = &local_pcd;
5153                 }
5154
5155                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5156
5157                 show_msg((char *)req->outbuf);
5158                 if (!srv_send_smb(req->sconn,
5159                                 (char *)req->outbuf,
5160                                 true, req->seqnum+1,
5161                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5162                                 cur_pcd))
5163                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5164         }
5165
5166         DEBUG(3,("echo %d times\n", smb_reverb));
5167
5168         TALLOC_FREE(req->outbuf);
5169
5170         END_PROFILE(SMBecho);
5171         return;
5172 }
5173
5174 /****************************************************************************
5175  Reply to a printopen.
5176 ****************************************************************************/
5177
5178 void reply_printopen(struct smb_request *req)
5179 {
5180         connection_struct *conn = req->conn;
5181         files_struct *fsp;
5182         NTSTATUS status;
5183
5184         START_PROFILE(SMBsplopen);
5185
5186         if (req->wct < 2) {
5187                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5188                 END_PROFILE(SMBsplopen);
5189                 return;
5190         }
5191
5192         if (!CAN_PRINT(conn)) {
5193                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5194                 END_PROFILE(SMBsplopen);
5195                 return;
5196         }
5197
5198         status = file_new(req, conn, &fsp);
5199         if(!NT_STATUS_IS_OK(status)) {
5200                 reply_nterror(req, status);
5201                 END_PROFILE(SMBsplopen);
5202                 return;
5203         }
5204
5205         /* Open for exclusive use, write only. */
5206         status = print_spool_open(fsp, NULL, req->vuid);
5207
5208         if (!NT_STATUS_IS_OK(status)) {
5209                 file_free(req, fsp);
5210                 reply_nterror(req, status);
5211                 END_PROFILE(SMBsplopen);
5212                 return;
5213         }
5214
5215         reply_outbuf(req, 1, 0);
5216         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5217
5218         DEBUG(3,("openprint fd=%d fnum=%d\n",
5219                  fsp->fh->fd, fsp->fnum));
5220
5221         END_PROFILE(SMBsplopen);
5222         return;
5223 }
5224
5225 /****************************************************************************
5226  Reply to a printclose.
5227 ****************************************************************************/
5228
5229 void reply_printclose(struct smb_request *req)
5230 {
5231         connection_struct *conn = req->conn;
5232         files_struct *fsp;
5233         NTSTATUS status;
5234
5235         START_PROFILE(SMBsplclose);
5236
5237         if (req->wct < 1) {
5238                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5239                 END_PROFILE(SMBsplclose);
5240                 return;
5241         }
5242
5243         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5244
5245         if (!check_fsp(conn, req, fsp)) {
5246                 END_PROFILE(SMBsplclose);
5247                 return;
5248         }
5249
5250         if (!CAN_PRINT(conn)) {
5251                 reply_force_doserror(req, ERRSRV, ERRerror);
5252                 END_PROFILE(SMBsplclose);
5253                 return;
5254         }
5255
5256         DEBUG(3,("printclose fd=%d fnum=%d\n",
5257                  fsp->fh->fd,fsp->fnum));
5258
5259         status = close_file(req, fsp, NORMAL_CLOSE);
5260
5261         if(!NT_STATUS_IS_OK(status)) {
5262                 reply_nterror(req, status);
5263                 END_PROFILE(SMBsplclose);
5264                 return;
5265         }
5266
5267         reply_outbuf(req, 0, 0);
5268
5269         END_PROFILE(SMBsplclose);
5270         return;
5271 }
5272
5273 /****************************************************************************
5274  Reply to a printqueue.
5275 ****************************************************************************/
5276
5277 void reply_printqueue(struct smb_request *req)
5278 {
5279         connection_struct *conn = req->conn;
5280         int max_count;
5281         int start_index;
5282
5283         START_PROFILE(SMBsplretq);
5284
5285         if (req->wct < 2) {
5286                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5287                 END_PROFILE(SMBsplretq);
5288                 return;
5289         }
5290
5291         max_count = SVAL(req->vwv+0, 0);
5292         start_index = SVAL(req->vwv+1, 0);
5293
5294         /* we used to allow the client to get the cnum wrong, but that
5295            is really quite gross and only worked when there was only
5296            one printer - I think we should now only accept it if they
5297            get it right (tridge) */
5298         if (!CAN_PRINT(conn)) {
5299                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5300                 END_PROFILE(SMBsplretq);
5301                 return;
5302         }
5303
5304         reply_outbuf(req, 2, 3);
5305         SSVAL(req->outbuf,smb_vwv0,0);
5306         SSVAL(req->outbuf,smb_vwv1,0);
5307         SCVAL(smb_buf(req->outbuf),0,1);
5308         SSVAL(smb_buf(req->outbuf),1,0);
5309
5310         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5311                  start_index, max_count));
5312
5313         {
5314                 TALLOC_CTX *mem_ctx = talloc_tos();
5315                 NTSTATUS status;
5316                 WERROR werr;
5317                 const char *sharename = lp_servicename(SNUM(conn));
5318                 struct rpc_pipe_client *cli = NULL;
5319                 struct dcerpc_binding_handle *b = NULL;
5320                 struct policy_handle handle;
5321                 struct spoolss_DevmodeContainer devmode_ctr;
5322                 union spoolss_JobInfo *info;
5323                 uint32_t count;
5324                 uint32_t num_to_get;
5325                 uint32_t first;
5326                 uint32_t i;
5327
5328                 ZERO_STRUCT(handle);
5329
5330                 status = rpc_pipe_open_interface(conn,
5331                                                  &ndr_table_spoolss.syntax_id,
5332                                                  conn->session_info,
5333                                                  &conn->sconn->client_id,
5334                                                  conn->sconn->msg_ctx,
5335                                                  &cli);
5336                 if (!NT_STATUS_IS_OK(status)) {
5337                         DEBUG(0, ("reply_printqueue: "
5338                                   "could not connect to spoolss: %s\n",
5339                                   nt_errstr(status)));
5340                         reply_nterror(req, status);
5341                         goto out;
5342                 }
5343                 b = cli->binding_handle;
5344
5345                 ZERO_STRUCT(devmode_ctr);
5346
5347                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5348                                                 sharename,
5349                                                 NULL, devmode_ctr,
5350                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5351                                                 &handle,
5352                                                 &werr);
5353                 if (!NT_STATUS_IS_OK(status)) {
5354                         reply_nterror(req, status);
5355                         goto out;
5356                 }
5357                 if (!W_ERROR_IS_OK(werr)) {
5358                         reply_nterror(req, werror_to_ntstatus(werr));
5359                         goto out;
5360                 }
5361
5362                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5363                                                &handle,
5364                                                0, /* firstjob */
5365                                                0xff, /* numjobs */
5366                                                2, /* level */
5367                                                0, /* offered */
5368                                                &count,
5369                                                &info);
5370                 if (!W_ERROR_IS_OK(werr)) {
5371                         reply_nterror(req, werror_to_ntstatus(werr));
5372                         goto out;
5373                 }
5374
5375                 if (max_count > 0) {
5376                         first = start_index;
5377                 } else {
5378                         first = start_index + max_count + 1;
5379                 }
5380
5381                 if (first >= count) {
5382                         num_to_get = first;
5383                 } else {
5384                         num_to_get = first + MIN(ABS(max_count), count - first);
5385                 }
5386
5387                 for (i = first; i < num_to_get; i++) {
5388                         char blob[28];
5389                         char *p = blob;
5390                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5391                         int qstatus;
5392                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5393                                                         info[i].info2.job_id);
5394
5395                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5396                                 qstatus = 2;
5397                         } else {
5398                                 qstatus = 3;
5399                         }
5400
5401                         srv_put_dos_date2(p, 0, qtime);
5402                         SCVAL(p, 4, qstatus);
5403                         SSVAL(p, 5, qrapjobid);
5404                         SIVAL(p, 7, info[i].info2.size);
5405                         SCVAL(p, 11, 0);
5406                         srvstr_push(blob, req->flags2, p+12,
5407                                     info[i].info2.notify_name, 16, STR_ASCII);
5408
5409                         if (message_push_blob(
5410                                     &req->outbuf,
5411                                     data_blob_const(
5412                                             blob, sizeof(blob))) == -1) {
5413                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5414                                 goto out;
5415                         }
5416                 }
5417
5418                 if (count > 0) {
5419                         SSVAL(req->outbuf,smb_vwv0,count);
5420                         SSVAL(req->outbuf,smb_vwv1,
5421                               (max_count>0?first+count:first-1));
5422                         SCVAL(smb_buf(req->outbuf),0,1);
5423                         SSVAL(smb_buf(req->outbuf),1,28*count);
5424                 }
5425
5426
5427                 DEBUG(3, ("%u entries returned in queue\n",
5428                           (unsigned)count));
5429
5430 out:
5431                 if (b && is_valid_policy_hnd(&handle)) {
5432                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5433                 }
5434
5435         }
5436
5437         END_PROFILE(SMBsplretq);
5438         return;
5439 }
5440
5441 /****************************************************************************
5442  Reply to a printwrite.
5443 ****************************************************************************/
5444
5445 void reply_printwrite(struct smb_request *req)
5446 {
5447         connection_struct *conn = req->conn;
5448         int numtowrite;
5449         const char *data;
5450         files_struct *fsp;
5451
5452         START_PROFILE(SMBsplwr);
5453
5454         if (req->wct < 1) {
5455                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5456                 END_PROFILE(SMBsplwr);
5457                 return;
5458         }
5459
5460         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5461
5462         if (!check_fsp(conn, req, fsp)) {
5463                 END_PROFILE(SMBsplwr);
5464                 return;
5465         }
5466
5467         if (!fsp->print_file) {
5468                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5469                 END_PROFILE(SMBsplwr);
5470                 return;
5471         }
5472
5473         if (!CHECK_WRITE(fsp)) {
5474                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5475                 END_PROFILE(SMBsplwr);
5476                 return;
5477         }
5478
5479         numtowrite = SVAL(req->buf, 1);
5480
5481         if (req->buflen < numtowrite + 3) {
5482                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5483                 END_PROFILE(SMBsplwr);
5484                 return;
5485         }
5486
5487         data = (const char *)req->buf + 3;
5488
5489         if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5490                 reply_nterror(req, map_nt_error_from_unix(errno));
5491                 END_PROFILE(SMBsplwr);
5492                 return;
5493         }
5494
5495         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5496
5497         END_PROFILE(SMBsplwr);
5498         return;
5499 }
5500
5501 /****************************************************************************
5502  Reply to a mkdir.
5503 ****************************************************************************/
5504
5505 void reply_mkdir(struct smb_request *req)
5506 {
5507         connection_struct *conn = req->conn;
5508         struct smb_filename *smb_dname = NULL;
5509         char *directory = NULL;
5510         NTSTATUS status;
5511         TALLOC_CTX *ctx = talloc_tos();
5512
5513         START_PROFILE(SMBmkdir);
5514
5515         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5516                             STR_TERMINATE, &status);
5517         if (!NT_STATUS_IS_OK(status)) {
5518                 reply_nterror(req, status);
5519                 goto out;
5520         }
5521
5522         status = filename_convert(ctx, conn,
5523                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5524                                  directory,
5525                                  0,
5526                                  NULL,
5527                                  &smb_dname);
5528         if (!NT_STATUS_IS_OK(status)) {
5529                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5530                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5531                                         ERRSRV, ERRbadpath);
5532                         goto out;
5533                 }
5534                 reply_nterror(req, status);
5535                 goto out;
5536         }
5537
5538         status = create_directory(conn, req, smb_dname);
5539
5540         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5541
5542         if (!NT_STATUS_IS_OK(status)) {
5543
5544                 if (!use_nt_status()
5545                     && NT_STATUS_EQUAL(status,
5546                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5547                         /*
5548                          * Yes, in the DOS error code case we get a
5549                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5550                          * samba4 torture test.
5551                          */
5552                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5553                 }
5554
5555                 reply_nterror(req, status);
5556                 goto out;
5557         }
5558
5559         reply_outbuf(req, 0, 0);
5560
5561         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5562  out:
5563         TALLOC_FREE(smb_dname);
5564         END_PROFILE(SMBmkdir);
5565         return;
5566 }
5567
5568 /****************************************************************************
5569  Reply to a rmdir.
5570 ****************************************************************************/
5571
5572 void reply_rmdir(struct smb_request *req)
5573 {
5574         connection_struct *conn = req->conn;
5575         struct smb_filename *smb_dname = NULL;
5576         char *directory = NULL;
5577         NTSTATUS status;
5578         TALLOC_CTX *ctx = talloc_tos();
5579         files_struct *fsp = NULL;
5580         int info = 0;
5581         struct smbd_server_connection *sconn = req->sconn;
5582
5583         START_PROFILE(SMBrmdir);
5584
5585         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5586                             STR_TERMINATE, &status);
5587         if (!NT_STATUS_IS_OK(status)) {
5588                 reply_nterror(req, status);
5589                 goto out;
5590         }
5591
5592         status = filename_convert(ctx, conn,
5593                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5594                                  directory,
5595                                  0,
5596                                  NULL,
5597                                  &smb_dname);
5598         if (!NT_STATUS_IS_OK(status)) {
5599                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5600                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5601                                         ERRSRV, ERRbadpath);
5602                         goto out;
5603                 }
5604                 reply_nterror(req, status);
5605                 goto out;
5606         }
5607
5608         if (is_ntfs_stream_smb_fname(smb_dname)) {
5609                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5610                 goto out;
5611         }
5612
5613         status = SMB_VFS_CREATE_FILE(
5614                 conn,                                   /* conn */
5615                 req,                                    /* req */
5616                 0,                                      /* root_dir_fid */
5617                 smb_dname,                              /* fname */
5618                 DELETE_ACCESS,                          /* access_mask */
5619                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5620                         FILE_SHARE_DELETE),
5621                 FILE_OPEN,                              /* create_disposition*/
5622                 FILE_DIRECTORY_FILE,                    /* create_options */
5623                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5624                 0,                                      /* oplock_request */
5625                 0,                                      /* allocation_size */
5626                 0,                                      /* private_flags */
5627                 NULL,                                   /* sd */
5628                 NULL,                                   /* ea_list */
5629                 &fsp,                                   /* result */
5630                 &info);                                 /* pinfo */
5631
5632         if (!NT_STATUS_IS_OK(status)) {
5633                 if (open_was_deferred(req->mid)) {
5634                         /* We have re-scheduled this call. */
5635                         goto out;
5636                 }
5637                 reply_nterror(req, status);
5638                 goto out;
5639         }
5640
5641         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5642         if (!NT_STATUS_IS_OK(status)) {
5643                 close_file(req, fsp, ERROR_CLOSE);
5644                 reply_nterror(req, status);
5645                 goto out;
5646         }
5647
5648         if (!set_delete_on_close(fsp, true, &conn->session_info->utok)) {
5649                 close_file(req, fsp, ERROR_CLOSE);
5650                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5651                 goto out;
5652         }
5653
5654         status = close_file(req, fsp, NORMAL_CLOSE);
5655         if (!NT_STATUS_IS_OK(status)) {
5656                 reply_nterror(req, status);
5657         } else {
5658                 reply_outbuf(req, 0, 0);
5659         }
5660
5661         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5662
5663         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5664  out:
5665         TALLOC_FREE(smb_dname);
5666         END_PROFILE(SMBrmdir);
5667         return;
5668 }
5669
5670 /*******************************************************************
5671  Resolve wildcards in a filename rename.
5672 ********************************************************************/
5673
5674 static bool resolve_wildcards(TALLOC_CTX *ctx,
5675                                 const char *name1,
5676                                 const char *name2,
5677                                 char **pp_newname)
5678 {
5679         char *name2_copy = NULL;
5680         char *root1 = NULL;
5681         char *root2 = NULL;
5682         char *ext1 = NULL;
5683         char *ext2 = NULL;
5684         char *p,*p2, *pname1, *pname2;
5685
5686         name2_copy = talloc_strdup(ctx, name2);
5687         if (!name2_copy) {
5688                 return False;
5689         }
5690
5691         pname1 = strrchr_m(name1,'/');
5692         pname2 = strrchr_m(name2_copy,'/');
5693
5694         if (!pname1 || !pname2) {
5695                 return False;
5696         }
5697
5698         /* Truncate the copy of name2 at the last '/' */
5699         *pname2 = '\0';
5700
5701         /* Now go past the '/' */
5702         pname1++;
5703         pname2++;
5704
5705         root1 = talloc_strdup(ctx, pname1);
5706         root2 = talloc_strdup(ctx, pname2);
5707
5708         if (!root1 || !root2) {
5709                 return False;
5710         }
5711
5712         p = strrchr_m(root1,'.');
5713         if (p) {
5714                 *p = 0;
5715                 ext1 = talloc_strdup(ctx, p+1);
5716         } else {
5717                 ext1 = talloc_strdup(ctx, "");
5718         }
5719         p = strrchr_m(root2,'.');
5720         if (p) {
5721                 *p = 0;
5722                 ext2 = talloc_strdup(ctx, p+1);
5723         } else {
5724                 ext2 = talloc_strdup(ctx, "");
5725         }
5726
5727         if (!ext1 || !ext2) {
5728                 return False;
5729         }
5730
5731         p = root1;
5732         p2 = root2;
5733         while (*p2) {
5734                 if (*p2 == '?') {
5735                         /* Hmmm. Should this be mb-aware ? */
5736                         *p2 = *p;
5737                         p2++;
5738                 } else if (*p2 == '*') {
5739                         *p2 = '\0';
5740                         root2 = talloc_asprintf(ctx, "%s%s",
5741                                                 root2,
5742                                                 p);
5743                         if (!root2) {
5744                                 return False;
5745                         }
5746                         break;
5747                 } else {
5748                         p2++;
5749                 }
5750                 if (*p) {
5751                         p++;
5752                 }
5753         }
5754
5755         p = ext1;
5756         p2 = ext2;
5757         while (*p2) {
5758                 if (*p2 == '?') {
5759                         /* Hmmm. Should this be mb-aware ? */
5760                         *p2 = *p;
5761                         p2++;
5762                 } else if (*p2 == '*') {
5763                         *p2 = '\0';
5764                         ext2 = talloc_asprintf(ctx, "%s%s",
5765                                                 ext2,
5766                                                 p);
5767                         if (!ext2) {
5768                                 return False;
5769                         }
5770                         break;
5771                 } else {
5772                         p2++;
5773                 }
5774                 if (*p) {
5775                         p++;
5776                 }
5777         }
5778
5779         if (*ext2) {
5780                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5781                                 name2_copy,
5782                                 root2,
5783                                 ext2);
5784         } else {
5785                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5786                                 name2_copy,
5787                                 root2);
5788         }
5789
5790         if (!*pp_newname) {
5791                 return False;
5792         }
5793
5794         return True;
5795 }
5796
5797 /****************************************************************************
5798  Ensure open files have their names updated. Updated to notify other smbd's
5799  asynchronously.
5800 ****************************************************************************/
5801
5802 static void rename_open_files(connection_struct *conn,
5803                               struct share_mode_lock *lck,
5804                               uint32_t orig_name_hash,
5805                               const struct smb_filename *smb_fname_dst)
5806 {
5807         files_struct *fsp;
5808         bool did_rename = False;
5809         NTSTATUS status;
5810         uint32_t new_name_hash;
5811
5812         for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
5813             fsp = file_find_di_next(fsp)) {
5814                 /* fsp_name is a relative path under the fsp. To change this for other
5815                    sharepaths we need to manipulate relative paths. */
5816                 /* TODO - create the absolute path and manipulate the newname
5817                    relative to the sharepath. */
5818                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5819                         continue;
5820                 }
5821                 if (fsp->name_hash != orig_name_hash) {
5822                         continue;
5823                 }
5824                 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5825                            "(file_id %s) from %s -> %s\n", fsp->fnum,
5826                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5827                            smb_fname_str_dbg(smb_fname_dst)));
5828
5829                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5830                 if (NT_STATUS_IS_OK(status)) {
5831                         did_rename = True;
5832                         new_name_hash = fsp->name_hash;
5833                 }
5834         }
5835
5836         if (!did_rename) {
5837                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5838                            "for %s\n", file_id_string_tos(&lck->id),
5839                            smb_fname_str_dbg(smb_fname_dst)));
5840         }
5841
5842         /* Send messages to all smbd's (not ourself) that the name has changed. */
5843         rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5844                               orig_name_hash, new_name_hash,
5845                               smb_fname_dst);
5846
5847 }
5848
5849 /****************************************************************************
5850  We need to check if the source path is a parent directory of the destination
5851  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5852  refuse the rename with a sharing violation. Under UNIX the above call can
5853  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5854  probably need to check that the client is a Windows one before disallowing
5855  this as a UNIX client (one with UNIX extensions) can know the source is a
5856  symlink and make this decision intelligently. Found by an excellent bug
5857  report from <AndyLiebman@aol.com>.
5858 ****************************************************************************/
5859
5860 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5861                                      const struct smb_filename *smb_fname_dst)
5862 {
5863         const char *psrc = smb_fname_src->base_name;
5864         const char *pdst = smb_fname_dst->base_name;
5865         size_t slen;
5866
5867         if (psrc[0] == '.' && psrc[1] == '/') {
5868                 psrc += 2;
5869         }
5870         if (pdst[0] == '.' && pdst[1] == '/') {
5871                 pdst += 2;
5872         }
5873         if ((slen = strlen(psrc)) > strlen(pdst)) {
5874                 return False;
5875         }
5876         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5877 }
5878
5879 /*
5880  * Do the notify calls from a rename
5881  */
5882
5883 static void notify_rename(connection_struct *conn, bool is_dir,
5884                           const struct smb_filename *smb_fname_src,
5885                           const struct smb_filename *smb_fname_dst)
5886 {
5887         char *parent_dir_src = NULL;
5888         char *parent_dir_dst = NULL;
5889         uint32 mask;
5890
5891         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5892                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5893
5894         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5895                             &parent_dir_src, NULL) ||
5896             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5897                             &parent_dir_dst, NULL)) {
5898                 goto out;
5899         }
5900
5901         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5902                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5903                              smb_fname_src->base_name);
5904                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5905                              smb_fname_dst->base_name);
5906         }
5907         else {
5908                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5909                              smb_fname_src->base_name);
5910                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5911                              smb_fname_dst->base_name);
5912         }
5913
5914         /* this is a strange one. w2k3 gives an additional event for
5915            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5916            files, but not directories */
5917         if (!is_dir) {
5918                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5919                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5920                              |FILE_NOTIFY_CHANGE_CREATION,
5921                              smb_fname_dst->base_name);
5922         }
5923  out:
5924         TALLOC_FREE(parent_dir_src);
5925         TALLOC_FREE(parent_dir_dst);
5926 }
5927
5928 /****************************************************************************
5929  Rename an open file - given an fsp.
5930 ****************************************************************************/
5931
5932 NTSTATUS rename_internals_fsp(connection_struct *conn,
5933                         files_struct *fsp,
5934                         const struct smb_filename *smb_fname_dst_in,
5935                         uint32 attrs,
5936                         bool replace_if_exists)
5937 {
5938         TALLOC_CTX *ctx = talloc_tos();
5939         struct smb_filename *smb_fname_dst = NULL;
5940         NTSTATUS status = NT_STATUS_OK;
5941         struct share_mode_lock *lck = NULL;
5942         bool dst_exists, old_is_stream, new_is_stream;
5943
5944         status = check_name(conn, smb_fname_dst_in->base_name);
5945         if (!NT_STATUS_IS_OK(status)) {
5946                 return status;
5947         }
5948
5949         /* Make a copy of the dst smb_fname structs */
5950
5951         status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5952         if (!NT_STATUS_IS_OK(status)) {
5953                 goto out;
5954         }
5955
5956         /*
5957          * Check for special case with case preserving and not
5958          * case sensitive. If the old last component differs from the original
5959          * last component only by case, then we should allow
5960          * the rename (user is trying to change the case of the
5961          * filename).
5962          */
5963         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5964             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5965             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5966                 char *last_slash;
5967                 char *fname_dst_lcomp_base_mod = NULL;
5968                 struct smb_filename *smb_fname_orig_lcomp = NULL;
5969
5970                 /*
5971                  * Get the last component of the destination name.
5972                  */
5973                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5974                 if (last_slash) {
5975                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5976                 } else {
5977                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
5978                 }
5979                 if (!fname_dst_lcomp_base_mod) {
5980                         status = NT_STATUS_NO_MEMORY;
5981                         goto out;
5982                 }
5983
5984                 /*
5985                  * Create an smb_filename struct using the original last
5986                  * component of the destination.
5987                  */
5988                 status = create_synthetic_smb_fname_split(ctx,
5989                     smb_fname_dst->original_lcomp, NULL,
5990                     &smb_fname_orig_lcomp);
5991                 if (!NT_STATUS_IS_OK(status)) {
5992                         TALLOC_FREE(fname_dst_lcomp_base_mod);
5993                         goto out;
5994                 }
5995
5996                 /* If the base names only differ by case, use original. */
5997                 if(!strcsequal(fname_dst_lcomp_base_mod,
5998                                smb_fname_orig_lcomp->base_name)) {
5999                         char *tmp;
6000                         /*
6001                          * Replace the modified last component with the
6002                          * original.
6003                          */
6004                         if (last_slash) {
6005                                 *last_slash = '\0'; /* Truncate at the '/' */
6006                                 tmp = talloc_asprintf(smb_fname_dst,
6007                                         "%s/%s",
6008                                         smb_fname_dst->base_name,
6009                                         smb_fname_orig_lcomp->base_name);
6010                         } else {
6011                                 tmp = talloc_asprintf(smb_fname_dst,
6012                                         "%s",
6013                                         smb_fname_orig_lcomp->base_name);
6014                         }
6015                         if (tmp == NULL) {
6016                                 status = NT_STATUS_NO_MEMORY;
6017                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6018                                 TALLOC_FREE(smb_fname_orig_lcomp);
6019                                 goto out;
6020                         }
6021                         TALLOC_FREE(smb_fname_dst->base_name);
6022                         smb_fname_dst->base_name = tmp;
6023                 }
6024
6025                 /* If the stream_names only differ by case, use original. */
6026                 if(!strcsequal(smb_fname_dst->stream_name,
6027                                smb_fname_orig_lcomp->stream_name)) {
6028                         char *tmp = NULL;
6029                         /* Use the original stream. */
6030                         tmp = talloc_strdup(smb_fname_dst,
6031                                             smb_fname_orig_lcomp->stream_name);
6032                         if (tmp == NULL) {
6033                                 status = NT_STATUS_NO_MEMORY;
6034                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6035                                 TALLOC_FREE(smb_fname_orig_lcomp);
6036                                 goto out;
6037                         }
6038                         TALLOC_FREE(smb_fname_dst->stream_name);
6039                         smb_fname_dst->stream_name = tmp;
6040                 }
6041                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6042                 TALLOC_FREE(smb_fname_orig_lcomp);
6043         }
6044
6045         /*
6046          * If the src and dest names are identical - including case,
6047          * don't do the rename, just return success.
6048          */
6049
6050         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6051             strcsequal(fsp->fsp_name->stream_name,
6052                        smb_fname_dst->stream_name)) {
6053                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6054                           "- returning success\n",
6055                           smb_fname_str_dbg(smb_fname_dst)));
6056                 status = NT_STATUS_OK;
6057                 goto out;
6058         }
6059
6060         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6061         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6062
6063         /* Return the correct error code if both names aren't streams. */
6064         if (!old_is_stream && new_is_stream) {
6065                 status = NT_STATUS_OBJECT_NAME_INVALID;
6066                 goto out;
6067         }
6068
6069         if (old_is_stream && !new_is_stream) {
6070                 status = NT_STATUS_INVALID_PARAMETER;
6071                 goto out;
6072         }
6073
6074         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6075
6076         if(!replace_if_exists && dst_exists) {
6077                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6078                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6079                           smb_fname_str_dbg(smb_fname_dst)));
6080                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6081                 goto out;
6082         }
6083
6084         if (dst_exists) {
6085                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6086                     &smb_fname_dst->st);
6087                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6088                                                            fileid);
6089                 /* The file can be open when renaming a stream */
6090                 if (dst_fsp && !new_is_stream) {
6091                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6092                         status = NT_STATUS_ACCESS_DENIED;
6093                         goto out;
6094                 }
6095         }
6096
6097         /* Ensure we have a valid stat struct for the source. */
6098         status = vfs_stat_fsp(fsp);
6099         if (!NT_STATUS_IS_OK(status)) {
6100                 goto out;
6101         }
6102
6103         status = can_rename(conn, fsp, attrs);
6104
6105         if (!NT_STATUS_IS_OK(status)) {
6106                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6107                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6108                           smb_fname_str_dbg(smb_fname_dst)));
6109                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6110                         status = NT_STATUS_ACCESS_DENIED;
6111                 goto out;
6112         }
6113
6114         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6115                 status = NT_STATUS_ACCESS_DENIED;
6116         }
6117
6118         lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6119                                   NULL);
6120
6121         /*
6122          * We have the file open ourselves, so not being able to get the
6123          * corresponding share mode lock is a fatal error.
6124          */
6125
6126         SMB_ASSERT(lck != NULL);
6127
6128         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6129                 uint32 create_options = fsp->fh->private_options;
6130
6131                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6132                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6133                           smb_fname_str_dbg(smb_fname_dst)));
6134
6135                 if (!lp_posix_pathnames() &&
6136                     (lp_map_archive(SNUM(conn)) ||
6137                     lp_store_dos_attributes(SNUM(conn)))) {
6138                         /* We must set the archive bit on the newly
6139                            renamed file. */
6140                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6141                                 uint32_t old_dosmode = dos_mode(conn,
6142                                                         smb_fname_dst);
6143                                 file_set_dosmode(conn,
6144                                         smb_fname_dst,
6145                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6146                                         NULL,
6147                                         true);
6148                         }
6149                 }
6150
6151                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6152                               smb_fname_dst);
6153
6154                 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6155
6156                 /*
6157                  * A rename acts as a new file create w.r.t. allowing an initial delete
6158                  * on close, probably because in Windows there is a new handle to the
6159                  * new file. If initial delete on close was requested but not
6160                  * originally set, we need to set it here. This is probably not 100% correct,
6161                  * but will work for the CIFSFS client which in non-posix mode
6162                  * depends on these semantics. JRA.
6163                  */
6164
6165                 if (create_options & FILE_DELETE_ON_CLOSE) {
6166                         status = can_set_delete_on_close(fsp, 0);
6167
6168                         if (NT_STATUS_IS_OK(status)) {
6169                                 /* Note that here we set the *inital* delete on close flag,
6170                                  * not the regular one. The magic gets handled in close. */
6171                                 fsp->initial_delete_on_close = True;
6172                         }
6173                 }
6174                 TALLOC_FREE(lck);
6175                 status = NT_STATUS_OK;
6176                 goto out;
6177         }
6178
6179         TALLOC_FREE(lck);
6180
6181         if (errno == ENOTDIR || errno == EISDIR) {
6182                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6183         } else {
6184                 status = map_nt_error_from_unix(errno);
6185         }
6186
6187         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6188                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6189                   smb_fname_str_dbg(smb_fname_dst)));
6190
6191  out:
6192         TALLOC_FREE(smb_fname_dst);
6193
6194         return status;
6195 }
6196
6197 /****************************************************************************
6198  The guts of the rename command, split out so it may be called by the NT SMB
6199  code.
6200 ****************************************************************************/
6201
6202 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6203                         connection_struct *conn,
6204                         struct smb_request *req,
6205                         struct smb_filename *smb_fname_src,
6206                         struct smb_filename *smb_fname_dst,
6207                         uint32 attrs,
6208                         bool replace_if_exists,
6209                         bool src_has_wild,
6210                         bool dest_has_wild,
6211                         uint32_t access_mask)
6212 {
6213         char *fname_src_dir = NULL;
6214         char *fname_src_mask = NULL;
6215         int count=0;
6216         NTSTATUS status = NT_STATUS_OK;
6217         struct smb_Dir *dir_hnd = NULL;
6218         const char *dname = NULL;
6219         char *talloced = NULL;
6220         long offset = 0;
6221         int create_options = 0;
6222         bool posix_pathnames = lp_posix_pathnames();
6223
6224         /*
6225          * Split the old name into directory and last component
6226          * strings. Note that unix_convert may have stripped off a
6227          * leading ./ from both name and newname if the rename is
6228          * at the root of the share. We need to make sure either both
6229          * name and newname contain a / character or neither of them do
6230          * as this is checked in resolve_wildcards().
6231          */
6232
6233         /* Split up the directory from the filename/mask. */
6234         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6235                                       &fname_src_dir, &fname_src_mask);
6236         if (!NT_STATUS_IS_OK(status)) {
6237                 status = NT_STATUS_NO_MEMORY;
6238                 goto out;
6239         }
6240
6241         /*
6242          * We should only check the mangled cache
6243          * here if unix_convert failed. This means
6244          * that the path in 'mask' doesn't exist
6245          * on the file system and so we need to look
6246          * for a possible mangle. This patch from
6247          * Tine Smukavec <valentin.smukavec@hermes.si>.
6248          */
6249
6250         if (!VALID_STAT(smb_fname_src->st) &&
6251             mangle_is_mangled(fname_src_mask, conn->params)) {
6252                 char *new_mask = NULL;
6253                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6254                                             conn->params);
6255                 if (new_mask) {
6256                         TALLOC_FREE(fname_src_mask);
6257                         fname_src_mask = new_mask;
6258                 }
6259         }
6260
6261         if (!src_has_wild) {
6262                 files_struct *fsp;
6263
6264                 /*
6265                  * Only one file needs to be renamed. Append the mask back
6266                  * onto the directory.
6267                  */
6268                 TALLOC_FREE(smb_fname_src->base_name);
6269                 if (ISDOT(fname_src_dir)) {
6270                         /* Ensure we use canonical names on open. */
6271                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6272                                                         "%s",
6273                                                         fname_src_mask);
6274                 } else {
6275                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6276                                                         "%s/%s",
6277                                                         fname_src_dir,
6278                                                         fname_src_mask);
6279                 }
6280                 if (!smb_fname_src->base_name) {
6281                         status = NT_STATUS_NO_MEMORY;
6282                         goto out;
6283                 }
6284
6285                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6286                           "case_preserve = %d, short case preserve = %d, "
6287                           "directory = %s, newname = %s, "
6288                           "last_component_dest = %s\n",
6289                           conn->case_sensitive, conn->case_preserve,
6290                           conn->short_case_preserve,
6291                           smb_fname_str_dbg(smb_fname_src),
6292                           smb_fname_str_dbg(smb_fname_dst),
6293                           smb_fname_dst->original_lcomp));
6294
6295                 /* The dest name still may have wildcards. */
6296                 if (dest_has_wild) {
6297                         char *fname_dst_mod = NULL;
6298                         if (!resolve_wildcards(smb_fname_dst,
6299                                                smb_fname_src->base_name,
6300                                                smb_fname_dst->base_name,
6301                                                &fname_dst_mod)) {
6302                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6303                                           "%s %s failed\n",
6304                                           smb_fname_src->base_name,
6305                                           smb_fname_dst->base_name));
6306                                 status = NT_STATUS_NO_MEMORY;
6307                                 goto out;
6308                         }
6309                         TALLOC_FREE(smb_fname_dst->base_name);
6310                         smb_fname_dst->base_name = fname_dst_mod;
6311                 }
6312
6313                 ZERO_STRUCT(smb_fname_src->st);
6314                 if (posix_pathnames) {
6315                         SMB_VFS_LSTAT(conn, smb_fname_src);
6316                 } else {
6317                         SMB_VFS_STAT(conn, smb_fname_src);
6318                 }
6319
6320                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6321                         create_options |= FILE_DIRECTORY_FILE;
6322                 }
6323
6324                 status = SMB_VFS_CREATE_FILE(
6325                         conn,                           /* conn */
6326                         req,                            /* req */
6327                         0,                              /* root_dir_fid */
6328                         smb_fname_src,                  /* fname */
6329                         access_mask,                    /* access_mask */
6330                         (FILE_SHARE_READ |              /* share_access */
6331                             FILE_SHARE_WRITE),
6332                         FILE_OPEN,                      /* create_disposition*/
6333                         create_options,                 /* create_options */
6334                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6335                         0,                              /* oplock_request */
6336                         0,                              /* allocation_size */
6337                         0,                              /* private_flags */
6338                         NULL,                           /* sd */
6339                         NULL,                           /* ea_list */
6340                         &fsp,                           /* result */
6341                         NULL);                          /* pinfo */
6342
6343                 if (!NT_STATUS_IS_OK(status)) {
6344                         DEBUG(3, ("Could not open rename source %s: %s\n",
6345                                   smb_fname_str_dbg(smb_fname_src),
6346                                   nt_errstr(status)));
6347                         goto out;
6348                 }
6349
6350                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6351                                               attrs, replace_if_exists);
6352
6353                 close_file(req, fsp, NORMAL_CLOSE);
6354
6355                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6356                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6357                           smb_fname_str_dbg(smb_fname_dst)));
6358
6359                 goto out;
6360         }
6361
6362         /*
6363          * Wildcards - process each file that matches.
6364          */
6365         if (strequal(fname_src_mask, "????????.???")) {
6366                 TALLOC_FREE(fname_src_mask);
6367                 fname_src_mask = talloc_strdup(ctx, "*");
6368                 if (!fname_src_mask) {
6369                         status = NT_STATUS_NO_MEMORY;
6370                         goto out;
6371                 }
6372         }
6373
6374         status = check_name(conn, fname_src_dir);
6375         if (!NT_STATUS_IS_OK(status)) {
6376                 goto out;
6377         }
6378
6379         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6380                           attrs);
6381         if (dir_hnd == NULL) {
6382                 status = map_nt_error_from_unix(errno);
6383                 goto out;
6384         }
6385
6386         status = NT_STATUS_NO_SUCH_FILE;
6387         /*
6388          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6389          * - gentest fix. JRA
6390          */
6391
6392         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6393                                     &talloced))) {
6394                 files_struct *fsp = NULL;
6395                 char *destname = NULL;
6396                 bool sysdir_entry = False;
6397
6398                 /* Quick check for "." and ".." */
6399                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6400                         if (attrs & aDIR) {
6401                                 sysdir_entry = True;
6402                         } else {
6403                                 TALLOC_FREE(talloced);
6404                                 continue;
6405                         }
6406                 }
6407
6408                 if (!is_visible_file(conn, fname_src_dir, dname,
6409                                      &smb_fname_src->st, false)) {
6410                         TALLOC_FREE(talloced);
6411                         continue;
6412                 }
6413
6414                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6415                         TALLOC_FREE(talloced);
6416                         continue;
6417                 }
6418
6419                 if (sysdir_entry) {
6420                         status = NT_STATUS_OBJECT_NAME_INVALID;
6421                         break;
6422                 }
6423
6424                 TALLOC_FREE(smb_fname_src->base_name);
6425                 if (ISDOT(fname_src_dir)) {
6426                         /* Ensure we use canonical names on open. */
6427                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6428                                                         "%s",
6429                                                         dname);
6430                 } else {
6431                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6432                                                         "%s/%s",
6433                                                         fname_src_dir,
6434                                                         dname);
6435                 }
6436                 if (!smb_fname_src->base_name) {
6437                         status = NT_STATUS_NO_MEMORY;
6438                         goto out;
6439                 }
6440
6441                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6442                                        smb_fname_dst->base_name,
6443                                        &destname)) {
6444                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6445                                   smb_fname_src->base_name, destname));
6446                         TALLOC_FREE(talloced);
6447                         continue;
6448                 }
6449                 if (!destname) {
6450                         status = NT_STATUS_NO_MEMORY;
6451                         goto out;
6452                 }
6453
6454                 TALLOC_FREE(smb_fname_dst->base_name);
6455                 smb_fname_dst->base_name = destname;
6456
6457                 ZERO_STRUCT(smb_fname_src->st);
6458                 if (posix_pathnames) {
6459                         SMB_VFS_LSTAT(conn, smb_fname_src);
6460                 } else {
6461                         SMB_VFS_STAT(conn, smb_fname_src);
6462                 }
6463
6464                 create_options = 0;
6465
6466                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6467                         create_options |= FILE_DIRECTORY_FILE;
6468                 }
6469
6470                 status = SMB_VFS_CREATE_FILE(
6471                         conn,                           /* conn */
6472                         req,                            /* req */
6473                         0,                              /* root_dir_fid */
6474                         smb_fname_src,                  /* fname */
6475                         access_mask,                    /* access_mask */
6476                         (FILE_SHARE_READ |              /* share_access */
6477                             FILE_SHARE_WRITE),
6478                         FILE_OPEN,                      /* create_disposition*/
6479                         create_options,                 /* create_options */
6480                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6481                         0,                              /* oplock_request */
6482                         0,                              /* allocation_size */
6483                         0,                              /* private_flags */
6484                         NULL,                           /* sd */
6485                         NULL,                           /* ea_list */
6486                         &fsp,                           /* result */
6487                         NULL);                          /* pinfo */
6488
6489                 if (!NT_STATUS_IS_OK(status)) {
6490                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6491                                  "returned %s rename %s -> %s\n",
6492                                  nt_errstr(status),
6493                                  smb_fname_str_dbg(smb_fname_src),
6494                                  smb_fname_str_dbg(smb_fname_dst)));
6495                         break;
6496                 }
6497
6498                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6499                                                               dname);
6500                 if (!smb_fname_dst->original_lcomp) {
6501                         status = NT_STATUS_NO_MEMORY;
6502                         goto out;
6503                 }
6504
6505                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6506                                               attrs, replace_if_exists);
6507
6508                 close_file(req, fsp, NORMAL_CLOSE);
6509
6510                 if (!NT_STATUS_IS_OK(status)) {
6511                         DEBUG(3, ("rename_internals_fsp returned %s for "
6512                                   "rename %s -> %s\n", nt_errstr(status),
6513                                   smb_fname_str_dbg(smb_fname_src),
6514                                   smb_fname_str_dbg(smb_fname_dst)));
6515                         break;
6516                 }
6517
6518                 count++;
6519
6520                 DEBUG(3,("rename_internals: doing rename on %s -> "
6521                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6522                          smb_fname_str_dbg(smb_fname_src)));
6523                 TALLOC_FREE(talloced);
6524         }
6525         TALLOC_FREE(dir_hnd);
6526
6527         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6528                 status = map_nt_error_from_unix(errno);
6529         }
6530
6531  out:
6532         TALLOC_FREE(talloced);
6533         TALLOC_FREE(fname_src_dir);
6534         TALLOC_FREE(fname_src_mask);
6535         return status;
6536 }
6537
6538 /****************************************************************************
6539  Reply to a mv.
6540 ****************************************************************************/
6541
6542 void reply_mv(struct smb_request *req)
6543 {
6544         connection_struct *conn = req->conn;
6545         char *name = NULL;
6546         char *newname = NULL;
6547         const char *p;
6548         uint32 attrs;
6549         NTSTATUS status;
6550         bool src_has_wcard = False;
6551         bool dest_has_wcard = False;
6552         TALLOC_CTX *ctx = talloc_tos();
6553         struct smb_filename *smb_fname_src = NULL;
6554         struct smb_filename *smb_fname_dst = NULL;
6555         bool stream_rename = false;
6556
6557         START_PROFILE(SMBmv);
6558
6559         if (req->wct < 1) {
6560                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6561                 goto out;
6562         }
6563
6564         attrs = SVAL(req->vwv+0, 0);
6565
6566         p = (const char *)req->buf + 1;
6567         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6568                                        &status, &src_has_wcard);
6569         if (!NT_STATUS_IS_OK(status)) {
6570                 reply_nterror(req, status);
6571                 goto out;
6572         }
6573         p++;
6574         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6575                                        &status, &dest_has_wcard);
6576         if (!NT_STATUS_IS_OK(status)) {
6577                 reply_nterror(req, status);
6578                 goto out;
6579         }
6580
6581         if (!lp_posix_pathnames()) {
6582                 /* The newname must begin with a ':' if the
6583                    name contains a ':'. */
6584                 if (strchr_m(name, ':')) {
6585                         if (newname[0] != ':') {
6586                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6587                                 goto out;
6588                         }
6589                         stream_rename = true;
6590                 }
6591         }
6592
6593         status = filename_convert(ctx,
6594                                   conn,
6595                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6596                                   name,
6597                                   UCF_COND_ALLOW_WCARD_LCOMP,
6598                                   &src_has_wcard,
6599                                   &smb_fname_src);
6600
6601         if (!NT_STATUS_IS_OK(status)) {
6602                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6603                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6604                                         ERRSRV, ERRbadpath);
6605                         goto out;
6606                 }
6607                 reply_nterror(req, status);
6608                 goto out;
6609         }
6610
6611         status = filename_convert(ctx,
6612                                   conn,
6613                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6614                                   newname,
6615                                   UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6616                                   &dest_has_wcard,
6617                                   &smb_fname_dst);
6618
6619         if (!NT_STATUS_IS_OK(status)) {
6620                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6621                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6622                                         ERRSRV, ERRbadpath);
6623                         goto out;
6624                 }
6625                 reply_nterror(req, status);
6626                 goto out;
6627         }
6628
6629         if (stream_rename) {
6630                 /* smb_fname_dst->base_name must be the same as
6631                    smb_fname_src->base_name. */
6632                 TALLOC_FREE(smb_fname_dst->base_name);
6633                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6634                                                 smb_fname_src->base_name);
6635                 if (!smb_fname_dst->base_name) {
6636                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6637                         goto out;
6638                 }
6639         }
6640
6641         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6642                  smb_fname_str_dbg(smb_fname_dst)));
6643
6644         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6645                                   attrs, False, src_has_wcard, dest_has_wcard,
6646                                   DELETE_ACCESS);
6647         if (!NT_STATUS_IS_OK(status)) {
6648                 if (open_was_deferred(req->mid)) {
6649                         /* We have re-scheduled this call. */
6650                         goto out;
6651                 }
6652                 reply_nterror(req, status);
6653                 goto out;
6654         }
6655
6656         reply_outbuf(req, 0, 0);
6657  out:
6658         TALLOC_FREE(smb_fname_src);
6659         TALLOC_FREE(smb_fname_dst);
6660         END_PROFILE(SMBmv);
6661         return;
6662 }
6663
6664 /*******************************************************************
6665  Copy a file as part of a reply_copy.
6666 ******************************************************************/
6667
6668 /*
6669  * TODO: check error codes on all callers
6670  */
6671
6672 NTSTATUS copy_file(TALLOC_CTX *ctx,
6673                         connection_struct *conn,
6674                         struct smb_filename *smb_fname_src,
6675                         struct smb_filename *smb_fname_dst,
6676                         int ofun,
6677                         int count,
6678                         bool target_is_directory)
6679 {
6680         struct smb_filename *smb_fname_dst_tmp = NULL;
6681         SMB_OFF_T ret=-1;
6682         files_struct *fsp1,*fsp2;
6683         uint32 dosattrs;
6684         uint32 new_create_disposition;
6685         NTSTATUS status;
6686
6687
6688         status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6689         if (!NT_STATUS_IS_OK(status)) {
6690                 return status;
6691         }
6692
6693         /*
6694          * If the target is a directory, extract the last component from the
6695          * src filename and append it to the dst filename
6696          */
6697         if (target_is_directory) {
6698                 const char *p;
6699
6700                 /* dest/target can't be a stream if it's a directory. */
6701                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6702
6703                 p = strrchr_m(smb_fname_src->base_name,'/');
6704                 if (p) {
6705                         p++;
6706                 } else {
6707                         p = smb_fname_src->base_name;
6708                 }
6709                 smb_fname_dst_tmp->base_name =
6710                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6711                                            p);
6712                 if (!smb_fname_dst_tmp->base_name) {
6713                         status = NT_STATUS_NO_MEMORY;
6714                         goto out;
6715                 }
6716         }
6717
6718         status = vfs_file_exist(conn, smb_fname_src);
6719         if (!NT_STATUS_IS_OK(status)) {
6720                 goto out;
6721         }
6722
6723         if (!target_is_directory && count) {
6724                 new_create_disposition = FILE_OPEN;
6725         } else {
6726                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6727                                                  NULL, NULL,
6728                                                  &new_create_disposition,
6729                                                  NULL,
6730                                                  NULL)) {
6731                         status = NT_STATUS_INVALID_PARAMETER;
6732                         goto out;
6733                 }
6734         }
6735
6736         /* Open the src file for reading. */
6737         status = SMB_VFS_CREATE_FILE(
6738                 conn,                                   /* conn */
6739                 NULL,                                   /* req */
6740                 0,                                      /* root_dir_fid */
6741                 smb_fname_src,                          /* fname */
6742                 FILE_GENERIC_READ,                      /* access_mask */
6743                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6744                 FILE_OPEN,                              /* create_disposition*/
6745                 0,                                      /* create_options */
6746                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
6747                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6748                 0,                                      /* allocation_size */
6749                 0,                                      /* private_flags */
6750                 NULL,                                   /* sd */
6751                 NULL,                                   /* ea_list */
6752                 &fsp1,                                  /* result */
6753                 NULL);                                  /* psbuf */
6754
6755         if (!NT_STATUS_IS_OK(status)) {
6756                 goto out;
6757         }
6758
6759         dosattrs = dos_mode(conn, smb_fname_src);
6760
6761         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6762                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6763         }
6764
6765         /* Open the dst file for writing. */
6766         status = SMB_VFS_CREATE_FILE(
6767                 conn,                                   /* conn */
6768                 NULL,                                   /* req */
6769                 0,                                      /* root_dir_fid */
6770                 smb_fname_dst,                          /* fname */
6771                 FILE_GENERIC_WRITE,                     /* access_mask */
6772                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6773                 new_create_disposition,                 /* create_disposition*/
6774                 0,                                      /* create_options */
6775                 dosattrs,                               /* file_attributes */
6776                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6777                 0,                                      /* allocation_size */
6778                 0,                                      /* private_flags */
6779                 NULL,                                   /* sd */
6780                 NULL,                                   /* ea_list */
6781                 &fsp2,                                  /* result */
6782                 NULL);                                  /* psbuf */
6783
6784         if (!NT_STATUS_IS_OK(status)) {
6785                 close_file(NULL, fsp1, ERROR_CLOSE);
6786                 goto out;
6787         }
6788
6789         if (ofun & OPENX_FILE_EXISTS_OPEN) {
6790                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6791                 if (ret == -1) {
6792                         DEBUG(0, ("error - vfs lseek returned error %s\n",
6793                                 strerror(errno)));
6794                         status = map_nt_error_from_unix(errno);
6795                         close_file(NULL, fsp1, ERROR_CLOSE);
6796                         close_file(NULL, fsp2, ERROR_CLOSE);
6797                         goto out;
6798                 }
6799         }
6800
6801         /* Do the actual copy. */
6802         if (smb_fname_src->st.st_ex_size) {
6803                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6804         } else {
6805                 ret = 0;
6806         }
6807
6808         close_file(NULL, fsp1, NORMAL_CLOSE);
6809
6810         /* Ensure the modtime is set correctly on the destination file. */
6811         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6812
6813         /*
6814          * As we are opening fsp1 read-only we only expect
6815          * an error on close on fsp2 if we are out of space.
6816          * Thus we don't look at the error return from the
6817          * close of fsp1.
6818          */
6819         status = close_file(NULL, fsp2, NORMAL_CLOSE);
6820
6821         if (!NT_STATUS_IS_OK(status)) {
6822                 goto out;
6823         }
6824
6825         if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6826                 status = NT_STATUS_DISK_FULL;
6827                 goto out;
6828         }
6829
6830         status = NT_STATUS_OK;
6831
6832  out:
6833         TALLOC_FREE(smb_fname_dst_tmp);
6834         return status;
6835 }
6836
6837 /****************************************************************************
6838  Reply to a file copy.
6839 ****************************************************************************/
6840
6841 void reply_copy(struct smb_request *req)
6842 {
6843         connection_struct *conn = req->conn;
6844         struct smb_filename *smb_fname_src = NULL;
6845         struct smb_filename *smb_fname_dst = NULL;
6846         char *fname_src = NULL;
6847         char *fname_dst = NULL;
6848         char *fname_src_mask = NULL;
6849         char *fname_src_dir = NULL;
6850         const char *p;
6851         int count=0;
6852         int error = ERRnoaccess;
6853         int tid2;
6854         int ofun;
6855         int flags;
6856         bool target_is_directory=False;
6857         bool source_has_wild = False;
6858         bool dest_has_wild = False;
6859         NTSTATUS status;
6860         TALLOC_CTX *ctx = talloc_tos();
6861
6862         START_PROFILE(SMBcopy);
6863
6864         if (req->wct < 3) {
6865                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6866                 goto out;
6867         }
6868
6869         tid2 = SVAL(req->vwv+0, 0);
6870         ofun = SVAL(req->vwv+1, 0);
6871         flags = SVAL(req->vwv+2, 0);
6872
6873         p = (const char *)req->buf;
6874         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6875                                        &status, &source_has_wild);
6876         if (!NT_STATUS_IS_OK(status)) {
6877                 reply_nterror(req, status);
6878                 goto out;
6879         }
6880         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6881                                        &status, &dest_has_wild);
6882         if (!NT_STATUS_IS_OK(status)) {
6883                 reply_nterror(req, status);
6884                 goto out;
6885         }
6886
6887         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6888
6889         if (tid2 != conn->cnum) {
6890                 /* can't currently handle inter share copies XXXX */
6891                 DEBUG(3,("Rejecting inter-share copy\n"));
6892                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6893                 goto out;
6894         }
6895
6896         status = filename_convert(ctx, conn,
6897                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6898                                   fname_src,
6899                                   UCF_COND_ALLOW_WCARD_LCOMP,
6900                                   &source_has_wild,
6901                                   &smb_fname_src);
6902         if (!NT_STATUS_IS_OK(status)) {
6903                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6904                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6905                                         ERRSRV, ERRbadpath);
6906                         goto out;
6907                 }
6908                 reply_nterror(req, status);
6909                 goto out;
6910         }
6911
6912         status = filename_convert(ctx, conn,
6913                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6914                                   fname_dst,
6915                                   UCF_COND_ALLOW_WCARD_LCOMP,
6916                                   &dest_has_wild,
6917                                   &smb_fname_dst);
6918         if (!NT_STATUS_IS_OK(status)) {
6919                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6920                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6921                                         ERRSRV, ERRbadpath);
6922                         goto out;
6923                 }
6924                 reply_nterror(req, status);
6925                 goto out;
6926         }
6927
6928         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6929
6930         if ((flags&1) && target_is_directory) {
6931                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6932                 goto out;
6933         }
6934
6935         if ((flags&2) && !target_is_directory) {
6936                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6937                 goto out;
6938         }
6939
6940         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6941                 /* wants a tree copy! XXXX */
6942                 DEBUG(3,("Rejecting tree copy\n"));
6943                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6944                 goto out;
6945         }
6946
6947         /* Split up the directory from the filename/mask. */
6948         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6949                                       &fname_src_dir, &fname_src_mask);
6950         if (!NT_STATUS_IS_OK(status)) {
6951                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6952                 goto out;
6953         }
6954
6955         /*
6956          * We should only check the mangled cache
6957          * here if unix_convert failed. This means
6958          * that the path in 'mask' doesn't exist
6959          * on the file system and so we need to look
6960          * for a possible mangle. This patch from
6961          * Tine Smukavec <valentin.smukavec@hermes.si>.
6962          */
6963         if (!VALID_STAT(smb_fname_src->st) &&
6964             mangle_is_mangled(fname_src_mask, conn->params)) {
6965                 char *new_mask = NULL;
6966                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6967                                             &new_mask, conn->params);
6968
6969                 /* Use demangled name if one was successfully found. */
6970                 if (new_mask) {
6971                         TALLOC_FREE(fname_src_mask);
6972                         fname_src_mask = new_mask;
6973                 }
6974         }
6975
6976         if (!source_has_wild) {
6977
6978                 /*
6979                  * Only one file needs to be copied. Append the mask back onto
6980                  * the directory.
6981                  */
6982                 TALLOC_FREE(smb_fname_src->base_name);
6983                 if (ISDOT(fname_src_dir)) {
6984                         /* Ensure we use canonical names on open. */
6985                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6986                                                         "%s",
6987                                                         fname_src_mask);
6988                 } else {
6989                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6990                                                         "%s/%s",
6991                                                         fname_src_dir,
6992                                                         fname_src_mask);
6993                 }
6994                 if (!smb_fname_src->base_name) {
6995                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6996                         goto out;
6997                 }
6998
6999                 if (dest_has_wild) {
7000                         char *fname_dst_mod = NULL;
7001                         if (!resolve_wildcards(smb_fname_dst,
7002                                                smb_fname_src->base_name,
7003                                                smb_fname_dst->base_name,
7004                                                &fname_dst_mod)) {
7005                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7006                                 goto out;
7007                         }
7008                         TALLOC_FREE(smb_fname_dst->base_name);
7009                         smb_fname_dst->base_name = fname_dst_mod;
7010                 }
7011
7012                 status = check_name(conn, smb_fname_src->base_name);
7013                 if (!NT_STATUS_IS_OK(status)) {
7014                         reply_nterror(req, status);
7015                         goto out;
7016                 }
7017
7018                 status = check_name(conn, smb_fname_dst->base_name);
7019                 if (!NT_STATUS_IS_OK(status)) {
7020                         reply_nterror(req, status);
7021                         goto out;
7022                 }
7023
7024                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7025                                    ofun, count, target_is_directory);
7026
7027                 if(!NT_STATUS_IS_OK(status)) {
7028                         reply_nterror(req, status);
7029                         goto out;
7030                 } else {
7031                         count++;
7032                 }
7033         } else {
7034                 struct smb_Dir *dir_hnd = NULL;
7035                 const char *dname = NULL;
7036                 char *talloced = NULL;
7037                 long offset = 0;
7038
7039                 /*
7040                  * There is a wildcard that requires us to actually read the
7041                  * src dir and copy each file matching the mask to the dst.
7042                  * Right now streams won't be copied, but this could
7043                  * presumably be added with a nested loop for reach dir entry.
7044                  */
7045                 SMB_ASSERT(!smb_fname_src->stream_name);
7046                 SMB_ASSERT(!smb_fname_dst->stream_name);
7047
7048                 smb_fname_src->stream_name = NULL;
7049                 smb_fname_dst->stream_name = NULL;
7050
7051                 if (strequal(fname_src_mask,"????????.???")) {
7052                         TALLOC_FREE(fname_src_mask);
7053                         fname_src_mask = talloc_strdup(ctx, "*");
7054                         if (!fname_src_mask) {
7055                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7056                                 goto out;
7057                         }
7058                 }
7059
7060                 status = check_name(conn, fname_src_dir);
7061                 if (!NT_STATUS_IS_OK(status)) {
7062                         reply_nterror(req, status);
7063                         goto out;
7064                 }
7065
7066                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7067                 if (dir_hnd == NULL) {
7068                         status = map_nt_error_from_unix(errno);
7069                         reply_nterror(req, status);
7070                         goto out;
7071                 }
7072
7073                 error = ERRbadfile;
7074
7075                 /* Iterate over the src dir copying each entry to the dst. */
7076                 while ((dname = ReadDirName(dir_hnd, &offset,
7077                                             &smb_fname_src->st, &talloced))) {
7078                         char *destname = NULL;
7079
7080                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7081                                 TALLOC_FREE(talloced);
7082                                 continue;
7083                         }
7084
7085                         if (!is_visible_file(conn, fname_src_dir, dname,
7086                                              &smb_fname_src->st, false)) {
7087                                 TALLOC_FREE(talloced);
7088                                 continue;
7089                         }
7090
7091                         if(!mask_match(dname, fname_src_mask,
7092                                        conn->case_sensitive)) {
7093                                 TALLOC_FREE(talloced);
7094                                 continue;
7095                         }
7096
7097                         error = ERRnoaccess;
7098
7099                         /* Get the src smb_fname struct setup. */
7100                         TALLOC_FREE(smb_fname_src->base_name);
7101                         if (ISDOT(fname_src_dir)) {
7102                                 /* Ensure we use canonical names on open. */
7103                                 smb_fname_src->base_name =
7104                                         talloc_asprintf(smb_fname_src, "%s",
7105                                                 dname);
7106                         } else {
7107                                 smb_fname_src->base_name =
7108                                         talloc_asprintf(smb_fname_src, "%s/%s",
7109                                                 fname_src_dir, dname);
7110                         }
7111
7112                         if (!smb_fname_src->base_name) {
7113                                 TALLOC_FREE(dir_hnd);
7114                                 TALLOC_FREE(talloced);
7115                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7116                                 goto out;
7117                         }
7118
7119                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7120                                                smb_fname_dst->base_name,
7121                                                &destname)) {
7122                                 TALLOC_FREE(talloced);
7123                                 continue;
7124                         }
7125                         if (!destname) {
7126                                 TALLOC_FREE(dir_hnd);
7127                                 TALLOC_FREE(talloced);
7128                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7129                                 goto out;
7130                         }
7131
7132                         TALLOC_FREE(smb_fname_dst->base_name);
7133                         smb_fname_dst->base_name = destname;
7134
7135                         status = check_name(conn, smb_fname_src->base_name);
7136                         if (!NT_STATUS_IS_OK(status)) {
7137                                 TALLOC_FREE(dir_hnd);
7138                                 TALLOC_FREE(talloced);
7139                                 reply_nterror(req, status);
7140                                 goto out;
7141                         }
7142
7143                         status = check_name(conn, smb_fname_dst->base_name);
7144                         if (!NT_STATUS_IS_OK(status)) {
7145                                 TALLOC_FREE(dir_hnd);
7146                                 TALLOC_FREE(talloced);
7147                                 reply_nterror(req, status);
7148                                 goto out;
7149                         }
7150
7151                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7152                                 smb_fname_src->base_name,
7153                                 smb_fname_dst->base_name));
7154
7155                         status = copy_file(ctx, conn, smb_fname_src,
7156                                            smb_fname_dst, ofun, count,
7157                                            target_is_directory);
7158                         if (NT_STATUS_IS_OK(status)) {
7159                                 count++;
7160                         }
7161
7162                         TALLOC_FREE(talloced);
7163                 }
7164                 TALLOC_FREE(dir_hnd);
7165         }
7166
7167         if (count == 0) {
7168                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7169                 goto out;
7170         }
7171
7172         reply_outbuf(req, 1, 0);
7173         SSVAL(req->outbuf,smb_vwv0,count);
7174  out:
7175         TALLOC_FREE(smb_fname_src);
7176         TALLOC_FREE(smb_fname_dst);
7177         TALLOC_FREE(fname_src);
7178         TALLOC_FREE(fname_dst);
7179         TALLOC_FREE(fname_src_mask);
7180         TALLOC_FREE(fname_src_dir);
7181
7182         END_PROFILE(SMBcopy);
7183         return;
7184 }
7185
7186 #undef DBGC_CLASS
7187 #define DBGC_CLASS DBGC_LOCKING
7188
7189 /****************************************************************************
7190  Get a lock pid, dealing with large count requests.
7191 ****************************************************************************/
7192
7193 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7194                     bool large_file_format)
7195 {
7196         if(!large_file_format)
7197                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7198         else
7199                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7200 }
7201
7202 /****************************************************************************
7203  Get a lock count, dealing with large count requests.
7204 ****************************************************************************/
7205
7206 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7207                         bool large_file_format)
7208 {
7209         uint64_t count = 0;
7210
7211         if(!large_file_format) {
7212                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7213         } else {
7214
7215 #if defined(HAVE_LONGLONG)
7216                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7217                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7218 #else /* HAVE_LONGLONG */
7219
7220                 /*
7221                  * NT4.x seems to be broken in that it sends large file (64 bit)
7222                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7223                  * negotiated. For boxes without large unsigned ints truncate the
7224                  * lock count by dropping the top 32 bits.
7225                  */
7226
7227                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7228                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7229                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7230                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7231                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7232                 }
7233
7234                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7235 #endif /* HAVE_LONGLONG */
7236         }
7237
7238         return count;
7239 }
7240
7241 #if !defined(HAVE_LONGLONG)
7242 /****************************************************************************
7243  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7244 ****************************************************************************/
7245
7246 static uint32 map_lock_offset(uint32 high, uint32 low)
7247 {
7248         unsigned int i;
7249         uint32 mask = 0;
7250         uint32 highcopy = high;
7251
7252         /*
7253          * Try and find out how many significant bits there are in high.
7254          */
7255
7256         for(i = 0; highcopy; i++)
7257                 highcopy >>= 1;
7258
7259         /*
7260          * We use 31 bits not 32 here as POSIX
7261          * lock offsets may not be negative.
7262          */
7263
7264         mask = (~0) << (31 - i);
7265
7266         if(low & mask)
7267                 return 0; /* Fail. */
7268
7269         high <<= (31 - i);
7270
7271         return (high|low);
7272 }
7273 #endif /* !defined(HAVE_LONGLONG) */
7274
7275 /****************************************************************************
7276  Get a lock offset, dealing with large offset requests.
7277 ****************************************************************************/
7278
7279 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7280                          bool large_file_format, bool *err)
7281 {
7282         uint64_t offset = 0;
7283
7284         *err = False;
7285
7286         if(!large_file_format) {
7287                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7288         } else {
7289
7290 #if defined(HAVE_LONGLONG)
7291                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7292                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7293 #else /* HAVE_LONGLONG */
7294
7295                 /*
7296                  * NT4.x seems to be broken in that it sends large file (64 bit)
7297                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7298                  * negotiated. For boxes without large unsigned ints mangle the
7299                  * lock offset by mapping the top 32 bits onto the lower 32.
7300                  */
7301
7302                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7303                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7304                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7305                         uint32 new_low = 0;
7306
7307                         if((new_low = map_lock_offset(high, low)) == 0) {
7308                                 *err = True;
7309                                 return (uint64_t)-1;
7310                         }
7311
7312                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7313                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7314                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7315                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7316                 }
7317
7318                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7319 #endif /* HAVE_LONGLONG */
7320         }
7321
7322         return offset;
7323 }
7324
7325 NTSTATUS smbd_do_locking(struct smb_request *req,
7326                          files_struct *fsp,
7327                          uint8_t type,
7328                          int32_t timeout,
7329                          uint16_t num_ulocks,
7330                          struct smbd_lock_element *ulocks,
7331                          uint16_t num_locks,
7332                          struct smbd_lock_element *locks,
7333                          bool *async)
7334 {
7335         connection_struct *conn = req->conn;
7336         int i;
7337         NTSTATUS status = NT_STATUS_OK;
7338
7339         *async = false;
7340
7341         /* Data now points at the beginning of the list
7342            of smb_unlkrng structs */
7343         for(i = 0; i < (int)num_ulocks; i++) {
7344                 struct smbd_lock_element *e = &ulocks[i];
7345
7346                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7347                           "pid %u, file %s\n",
7348                           (double)e->offset,
7349                           (double)e->count,
7350                           (unsigned int)e->smblctx,
7351                           fsp_str_dbg(fsp)));
7352
7353                 if (e->brltype != UNLOCK_LOCK) {
7354                         /* this can only happen with SMB2 */
7355                         return NT_STATUS_INVALID_PARAMETER;
7356                 }
7357
7358                 status = do_unlock(req->sconn->msg_ctx,
7359                                 fsp,
7360                                 e->smblctx,
7361                                 e->count,
7362                                 e->offset,
7363                                 WINDOWS_LOCK);
7364
7365                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7366                     nt_errstr(status)));
7367
7368                 if (!NT_STATUS_IS_OK(status)) {
7369                         return status;
7370                 }
7371         }
7372
7373         /* Setup the timeout in seconds. */
7374
7375         if (!lp_blocking_locks(SNUM(conn))) {
7376                 timeout = 0;
7377         }
7378
7379         /* Data now points at the beginning of the list
7380            of smb_lkrng structs */
7381
7382         for(i = 0; i < (int)num_locks; i++) {
7383                 struct smbd_lock_element *e = &locks[i];
7384
7385                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7386                           "%llu, file %s timeout = %d\n",
7387                           (double)e->offset,
7388                           (double)e->count,
7389                           (unsigned long long)e->smblctx,
7390                           fsp_str_dbg(fsp),
7391                           (int)timeout));
7392
7393                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7394                         struct blocking_lock_record *blr = NULL;
7395
7396                         if (num_locks > 1) {
7397                                 /*
7398                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7399                                  * if the lock vector contains one entry. When given mutliple cancel
7400                                  * requests in a single PDU we expect the server to return an
7401                                  * error. Windows servers seem to accept the request but only
7402                                  * cancel the first lock.
7403                                  * JRA - Do what Windows does (tm) :-).
7404                                  */
7405
7406 #if 0
7407                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7408                                 return NT_STATUS_DOS(ERRDOS,
7409                                                 ERRcancelviolation);
7410 #else
7411                                 /* Windows behavior. */
7412                                 if (i != 0) {
7413                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7414                                                 "cancel request\n"));
7415                                         continue;
7416                                 }
7417 #endif
7418                         }
7419
7420                         if (lp_blocking_locks(SNUM(conn))) {
7421
7422                                 /* Schedule a message to ourselves to
7423                                    remove the blocking lock record and
7424                                    return the right error. */
7425
7426                                 blr = blocking_lock_cancel_smb1(fsp,
7427                                                 e->smblctx,
7428                                                 e->offset,
7429                                                 e->count,
7430                                                 WINDOWS_LOCK,
7431                                                 type,
7432                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7433                                 if (blr == NULL) {
7434                                         return NT_STATUS_DOS(
7435                                                         ERRDOS,
7436                                                         ERRcancelviolation);
7437                                 }
7438                         }
7439                         /* Remove a matching pending lock. */
7440                         status = do_lock_cancel(fsp,
7441                                                 e->smblctx,
7442                                                 e->count,
7443                                                 e->offset,
7444                                                 WINDOWS_LOCK,
7445                                                 blr);
7446                 } else {
7447                         bool blocking_lock = timeout ? true : false;
7448                         bool defer_lock = false;
7449                         struct byte_range_lock *br_lck;
7450                         uint64_t block_smblctx;
7451
7452                         br_lck = do_lock(req->sconn->msg_ctx,
7453                                         fsp,
7454                                         e->smblctx,
7455                                         e->count,
7456                                         e->offset,
7457                                         e->brltype,
7458                                         WINDOWS_LOCK,
7459                                         blocking_lock,
7460                                         &status,
7461                                         &block_smblctx,
7462                                         NULL);
7463
7464                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7465                                 /* Windows internal resolution for blocking locks seems
7466                                    to be about 200ms... Don't wait for less than that. JRA. */
7467                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7468                                         timeout = lp_lock_spin_time();
7469                                 }
7470                                 defer_lock = true;
7471                         }
7472
7473                         /* If a lock sent with timeout of zero would fail, and
7474                          * this lock has been requested multiple times,
7475                          * according to brl_lock_failed() we convert this
7476                          * request to a blocking lock with a timeout of between
7477                          * 150 - 300 milliseconds.
7478                          *
7479                          * If lp_lock_spin_time() has been set to 0, we skip
7480                          * this blocking retry and fail immediately.
7481                          *
7482                          * Replacement for do_lock_spin(). JRA. */
7483
7484                         if (!req->sconn->using_smb2 &&
7485                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7486                             lp_lock_spin_time() && !blocking_lock &&
7487                             NT_STATUS_EQUAL((status),
7488                                 NT_STATUS_FILE_LOCK_CONFLICT))
7489                         {
7490                                 defer_lock = true;
7491                                 timeout = lp_lock_spin_time();
7492                         }
7493
7494                         if (br_lck && defer_lock) {
7495                                 /*
7496                                  * A blocking lock was requested. Package up
7497                                  * this smb into a queued request and push it
7498                                  * onto the blocking lock queue.
7499                                  */
7500                                 if(push_blocking_lock_request(br_lck,
7501                                                         req,
7502                                                         fsp,
7503                                                         timeout,
7504                                                         i,
7505                                                         e->smblctx,
7506                                                         e->brltype,
7507                                                         WINDOWS_LOCK,
7508                                                         e->offset,
7509                                                         e->count,
7510                                                         block_smblctx)) {
7511                                         TALLOC_FREE(br_lck);
7512                                         *async = true;
7513                                         return NT_STATUS_OK;
7514                                 }
7515                         }
7516
7517                         TALLOC_FREE(br_lck);
7518                 }
7519
7520                 if (!NT_STATUS_IS_OK(status)) {
7521                         break;
7522                 }
7523         }
7524
7525         /* If any of the above locks failed, then we must unlock
7526            all of the previous locks (X/Open spec). */
7527
7528         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7529
7530                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7531                         i = -1; /* we want to skip the for loop */
7532                 }
7533
7534                 /*
7535                  * Ensure we don't do a remove on the lock that just failed,
7536                  * as under POSIX rules, if we have a lock already there, we
7537                  * will delete it (and we shouldn't) .....
7538                  */
7539                 for(i--; i >= 0; i--) {
7540                         struct smbd_lock_element *e = &locks[i];
7541
7542                         do_unlock(req->sconn->msg_ctx,
7543                                 fsp,
7544                                 e->smblctx,
7545                                 e->count,
7546                                 e->offset,
7547                                 WINDOWS_LOCK);
7548                 }
7549                 return status;
7550         }
7551
7552         DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7553                   fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7554
7555         return NT_STATUS_OK;
7556 }
7557
7558 /****************************************************************************
7559  Reply to a lockingX request.
7560 ****************************************************************************/
7561
7562 void reply_lockingX(struct smb_request *req)
7563 {
7564         connection_struct *conn = req->conn;
7565         files_struct *fsp;
7566         unsigned char locktype;
7567         unsigned char oplocklevel;
7568         uint16 num_ulocks;
7569         uint16 num_locks;
7570         int32 lock_timeout;
7571         int i;
7572         const uint8_t *data;
7573         bool large_file_format;
7574         bool err;
7575         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7576         struct smbd_lock_element *ulocks;
7577         struct smbd_lock_element *locks;
7578         bool async = false;
7579
7580         START_PROFILE(SMBlockingX);
7581
7582         if (req->wct < 8) {
7583                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7584                 END_PROFILE(SMBlockingX);
7585                 return;
7586         }
7587
7588         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7589         locktype = CVAL(req->vwv+3, 0);
7590         oplocklevel = CVAL(req->vwv+3, 1);
7591         num_ulocks = SVAL(req->vwv+6, 0);
7592         num_locks = SVAL(req->vwv+7, 0);
7593         lock_timeout = IVAL(req->vwv+4, 0);
7594         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7595
7596         if (!check_fsp(conn, req, fsp)) {
7597                 END_PROFILE(SMBlockingX);
7598                 return;
7599         }
7600
7601         data = req->buf;
7602
7603         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7604                 /* we don't support these - and CANCEL_LOCK makes w2k
7605                    and XP reboot so I don't really want to be
7606                    compatible! (tridge) */
7607                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7608                 END_PROFILE(SMBlockingX);
7609                 return;
7610         }
7611
7612         /* Check if this is an oplock break on a file
7613            we have granted an oplock on.
7614         */
7615         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7616                 /* Client can insist on breaking to none. */
7617                 bool break_to_none = (oplocklevel == 0);
7618                 bool result;
7619
7620                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7621                          "for fnum = %d\n", (unsigned int)oplocklevel,
7622                          fsp->fnum ));
7623
7624                 /*
7625                  * Make sure we have granted an exclusive or batch oplock on
7626                  * this file.
7627                  */
7628
7629                 if (fsp->oplock_type == 0) {
7630
7631                         /* The Samba4 nbench simulator doesn't understand
7632                            the difference between break to level2 and break
7633                            to none from level2 - it sends oplock break
7634                            replies in both cases. Don't keep logging an error
7635                            message here - just ignore it. JRA. */
7636
7637                         DEBUG(5,("reply_lockingX: Error : oplock break from "
7638                                  "client for fnum = %d (oplock=%d) and no "
7639                                  "oplock granted on this file (%s).\n",
7640                                  fsp->fnum, fsp->oplock_type,
7641                                  fsp_str_dbg(fsp)));
7642
7643                         /* if this is a pure oplock break request then don't
7644                          * send a reply */
7645                         if (num_locks == 0 && num_ulocks == 0) {
7646                                 END_PROFILE(SMBlockingX);
7647                                 return;
7648                         } else {
7649                                 END_PROFILE(SMBlockingX);
7650                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7651                                 return;
7652                         }
7653                 }
7654
7655                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7656                     (break_to_none)) {
7657                         result = remove_oplock(fsp);
7658                 } else {
7659                         result = downgrade_oplock(fsp);
7660                 }
7661
7662                 if (!result) {
7663                         DEBUG(0, ("reply_lockingX: error in removing "
7664                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
7665                         /* Hmmm. Is this panic justified? */
7666                         smb_panic("internal tdb error");
7667                 }
7668
7669                 reply_to_oplock_break_requests(fsp);
7670
7671                 /* if this is a pure oplock break request then don't send a
7672                  * reply */
7673                 if (num_locks == 0 && num_ulocks == 0) {
7674                         /* Sanity check - ensure a pure oplock break is not a
7675                            chained request. */
7676                         if(CVAL(req->vwv+0, 0) != 0xff)
7677                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
7678                                          "break is a chained %d request !\n",
7679                                          (unsigned int)CVAL(req->vwv+0, 0)));
7680                         END_PROFILE(SMBlockingX);
7681                         return;
7682                 }
7683         }
7684
7685         if (req->buflen <
7686             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7687                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7688                 END_PROFILE(SMBlockingX);
7689                 return;
7690         }
7691
7692         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7693         if (ulocks == NULL) {
7694                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7695                 END_PROFILE(SMBlockingX);
7696                 return;
7697         }
7698
7699         locks = talloc_array(req, struct smbd_lock_element, num_locks);
7700         if (locks == NULL) {
7701                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7702                 END_PROFILE(SMBlockingX);
7703                 return;
7704         }
7705
7706         /* Data now points at the beginning of the list
7707            of smb_unlkrng structs */
7708         for(i = 0; i < (int)num_ulocks; i++) {
7709                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7710                 ulocks[i].count = get_lock_count(data, i, large_file_format);
7711                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7712                 ulocks[i].brltype = UNLOCK_LOCK;
7713
7714                 /*
7715                  * There is no error code marked "stupid client bug".... :-).
7716                  */
7717                 if(err) {
7718                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7719                         END_PROFILE(SMBlockingX);
7720                         return;
7721                 }
7722         }
7723
7724         /* Now do any requested locks */
7725         data += ((large_file_format ? 20 : 10)*num_ulocks);
7726
7727         /* Data now points at the beginning of the list
7728            of smb_lkrng structs */
7729
7730         for(i = 0; i < (int)num_locks; i++) {
7731                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7732                 locks[i].count = get_lock_count(data, i, large_file_format);
7733                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7734
7735                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7736                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7737                                 locks[i].brltype = PENDING_READ_LOCK;
7738                         } else {
7739                                 locks[i].brltype = READ_LOCK;
7740                         }
7741                 } else {
7742                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7743                                 locks[i].brltype = PENDING_WRITE_LOCK;
7744                         } else {
7745                                 locks[i].brltype = WRITE_LOCK;
7746                         }
7747                 }
7748
7749                 /*
7750                  * There is no error code marked "stupid client bug".... :-).
7751                  */
7752                 if(err) {
7753                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7754                         END_PROFILE(SMBlockingX);
7755                         return;
7756                 }
7757         }
7758
7759         status = smbd_do_locking(req, fsp,
7760                                  locktype, lock_timeout,
7761                                  num_ulocks, ulocks,
7762                                  num_locks, locks,
7763                                  &async);
7764         if (!NT_STATUS_IS_OK(status)) {
7765                 END_PROFILE(SMBlockingX);
7766                 reply_nterror(req, status);
7767                 return;
7768         }
7769         if (async) {
7770                 END_PROFILE(SMBlockingX);
7771                 return;
7772         }
7773
7774         reply_outbuf(req, 2, 0);
7775
7776         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7777                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7778
7779         END_PROFILE(SMBlockingX);
7780         chain_reply(req);
7781 }
7782
7783 #undef DBGC_CLASS
7784 #define DBGC_CLASS DBGC_ALL
7785
7786 /****************************************************************************
7787  Reply to a SMBreadbmpx (read block multiplex) request.
7788  Always reply with an error, if someone has a platform really needs this,
7789  please contact vl@samba.org
7790 ****************************************************************************/
7791
7792 void reply_readbmpx(struct smb_request *req)
7793 {
7794         START_PROFILE(SMBreadBmpx);
7795         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7796         END_PROFILE(SMBreadBmpx);
7797         return;
7798 }
7799
7800 /****************************************************************************
7801  Reply to a SMBreadbs (read block multiplex secondary) request.
7802  Always reply with an error, if someone has a platform really needs this,
7803  please contact vl@samba.org
7804 ****************************************************************************/
7805
7806 void reply_readbs(struct smb_request *req)
7807 {
7808         START_PROFILE(SMBreadBs);
7809         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7810         END_PROFILE(SMBreadBs);
7811         return;
7812 }
7813
7814 /****************************************************************************
7815  Reply to a SMBsetattrE.
7816 ****************************************************************************/
7817
7818 void reply_setattrE(struct smb_request *req)
7819 {
7820         connection_struct *conn = req->conn;
7821         struct smb_file_time ft;
7822         files_struct *fsp;
7823         NTSTATUS status;
7824
7825         START_PROFILE(SMBsetattrE);
7826         ZERO_STRUCT(ft);
7827
7828         if (req->wct < 7) {
7829                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7830                 goto out;
7831         }
7832
7833         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7834
7835         if(!fsp || (fsp->conn != conn)) {
7836                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7837                 goto out;
7838         }
7839
7840         /*
7841          * Convert the DOS times into unix times.
7842          */
7843
7844         ft.atime = convert_time_t_to_timespec(
7845             srv_make_unix_date2(req->vwv+3));
7846         ft.mtime = convert_time_t_to_timespec(
7847             srv_make_unix_date2(req->vwv+5));
7848         ft.create_time = convert_time_t_to_timespec(
7849             srv_make_unix_date2(req->vwv+1));
7850
7851         reply_outbuf(req, 0, 0);
7852
7853         /*
7854          * Patch from Ray Frush <frush@engr.colostate.edu>
7855          * Sometimes times are sent as zero - ignore them.
7856          */
7857
7858         /* Ensure we have a valid stat struct for the source. */
7859         status = vfs_stat_fsp(fsp);
7860         if (!NT_STATUS_IS_OK(status)) {
7861                 reply_nterror(req, status);
7862                 goto out;
7863         }
7864
7865         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7866         if (!NT_STATUS_IS_OK(status)) {
7867                 reply_nterror(req, status);
7868                 goto out;
7869         }
7870
7871         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7872                " createtime=%u\n",
7873                 fsp->fnum,
7874                 (unsigned int)ft.atime.tv_sec,
7875                 (unsigned int)ft.mtime.tv_sec,
7876                 (unsigned int)ft.create_time.tv_sec
7877                 ));
7878  out:
7879         END_PROFILE(SMBsetattrE);
7880         return;
7881 }
7882
7883
7884 /* Back from the dead for OS/2..... JRA. */
7885
7886 /****************************************************************************
7887  Reply to a SMBwritebmpx (write block multiplex primary) request.
7888  Always reply with an error, if someone has a platform really needs this,
7889  please contact vl@samba.org
7890 ****************************************************************************/
7891
7892 void reply_writebmpx(struct smb_request *req)
7893 {
7894         START_PROFILE(SMBwriteBmpx);
7895         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7896         END_PROFILE(SMBwriteBmpx);
7897         return;
7898 }
7899
7900 /****************************************************************************
7901  Reply to a SMBwritebs (write block multiplex secondary) request.
7902  Always reply with an error, if someone has a platform really needs this,
7903  please contact vl@samba.org
7904 ****************************************************************************/
7905
7906 void reply_writebs(struct smb_request *req)
7907 {
7908         START_PROFILE(SMBwriteBs);
7909         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7910         END_PROFILE(SMBwriteBs);
7911         return;
7912 }
7913
7914 /****************************************************************************
7915  Reply to a SMBgetattrE.
7916 ****************************************************************************/
7917
7918 void reply_getattrE(struct smb_request *req)
7919 {
7920         connection_struct *conn = req->conn;
7921         int mode;
7922         files_struct *fsp;
7923         struct timespec create_ts;
7924
7925         START_PROFILE(SMBgetattrE);
7926
7927         if (req->wct < 1) {
7928                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7929                 END_PROFILE(SMBgetattrE);
7930                 return;
7931         }
7932
7933         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7934
7935         if(!fsp || (fsp->conn != conn)) {
7936                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7937                 END_PROFILE(SMBgetattrE);
7938                 return;
7939         }
7940
7941         /* Do an fstat on this file */
7942         if(fsp_stat(fsp)) {
7943                 reply_nterror(req, map_nt_error_from_unix(errno));
7944                 END_PROFILE(SMBgetattrE);
7945                 return;
7946         }
7947
7948         mode = dos_mode(conn, fsp->fsp_name);
7949
7950         /*
7951          * Convert the times into dos times. Set create
7952          * date to be last modify date as UNIX doesn't save
7953          * this.
7954          */
7955
7956         reply_outbuf(req, 11, 0);
7957
7958         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7959         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7960         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7961                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7962         /* Should we check pending modtime here ? JRA */
7963         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7964                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7965
7966         if (mode & aDIR) {
7967                 SIVAL(req->outbuf, smb_vwv6, 0);
7968                 SIVAL(req->outbuf, smb_vwv8, 0);
7969         } else {
7970                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7971                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7972                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7973         }
7974         SSVAL(req->outbuf,smb_vwv10, mode);
7975
7976         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7977
7978         END_PROFILE(SMBgetattrE);
7979         return;
7980 }