source/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28
  29 /* look in server.c for some explanation of these variables */
  30 extern enum protocol_types Protocol;
  31 extern int max_send;
  32 extern int max_recv;
  33 unsigned int smb_echo_count = 0;
  34 extern uint32 global_client_caps;
  35
  36 extern struct current_user current_user;
  37 extern BOOL global_encrypted_passwords_negotiated;
  38
  39 /****************************************************************************
  40  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  41  path or anything including wildcards.
  42  We're assuming here that '/' is not the second byte in any multibyte char
  43  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  44  set.
  45 ****************************************************************************/
  46
  47 /* Custom version for processing POSIX paths. */
  48 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  49
  50 NTSTATUS check_path_syntax_internal(pstring destname,
  51                                     const pstring srcname,
  52                                     BOOL posix_path,
  53                                     BOOL *p_last_component_contains_wcard)
  54 {
  55         char *d = destname;
  56         const char *s = srcname;
  57         NTSTATUS ret = NT_STATUS_OK;
  58         BOOL start_of_name_component = True;
  59
  60         *p_last_component_contains_wcard = False;
  61
  62         while (*s) {
  63                 if (IS_PATH_SEP(*s,posix_path)) {
  64                         /*
  65                          * Safe to assume is not the second part of a mb char
  66                          * as this is handled below.
  67                          */
  68                         /* Eat multiple '/' or '\\' */
  69                         while (IS_PATH_SEP(*s,posix_path)) {
  70                                 s++;
  71                         }
  72                         if ((d != destname) && (*s != '\0')) {
  73                                 /* We only care about non-leading or trailing '/' or '\\' */
  74                                 *d++ = '/';
  75                         }
  76
  77                         start_of_name_component = True;
  78                         /* New component. */
  79                         *p_last_component_contains_wcard = False;
  80                         continue;
  81                 }
  82
  83                 if (start_of_name_component) {
  84                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
  85                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
  86
  87                                 /*
  88                                  * No mb char starts with '.' so we're safe checking the directory separator here.
  89                                  */
  90
  91                                 /* If  we just added a '/' - delete it */
  92                                 if ((d > destname) && (*(d-1) == '/')) {
  93                                         *(d-1) = '\0';
  94                                         d--;
  95                                 }
  96
  97                                 /* Are we at the start ? Can't go back further if so. */
  98                                 if (d <= destname) {
  99                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 100                                         break;
 101                                 }
 102                                 /* Go back one level... */
 103                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 104                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 105                                 /* Decrement d first as d points to the *next* char to write into. */
 106                                 for (d--; d > destname; d--) {
 107                                         if (*d == '/')
 108                                                 break;
 109                                 }
 110                                 s += 2; /* Else go past the .. */
 111                                 /* We're still at the start of a name component, just the previous one. */
 112                                 continue;
 113
 114                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 115                                 if (posix_path) {
 116                                         /* Eat the '.' */
 117                                         s++;
 118                                         continue;
 119                                 }
 120                         }
 121
 122                 }
 123
 124                 if (!(*s & 0x80)) {
 125                         if (!posix_path) {
 126                                 if (*s <= 0x1f) {
 127                                         return NT_STATUS_OBJECT_NAME_INVALID;
 128                                 }
 129                                 switch (*s) {
 130                                         case '*':
 131                                         case '?':
 132                                         case '<':
 133                                         case '>':
 134                                         case '"':
 135                                                 *p_last_component_contains_wcard = True;
 136                                                 break;
 137                                         default:
 138                                                 break;
 139                                 }
 140                         }
 141                         *d++ = *s++;
 142                 } else {
 143                         size_t siz;
 144                         /* Get the size of the next MB character. */
 145                         next_codepoint(s,&siz);
 146                         switch(siz) {
 147                                 case 5:
 148                                         *d++ = *s++;
 149                                         /*fall through*/
 150                                 case 4:
 151                                         *d++ = *s++;
 152                                         /*fall through*/
 153                                 case 3:
 154                                         *d++ = *s++;
 155                                         /*fall through*/
 156                                 case 2:
 157                                         *d++ = *s++;
 158                                         /*fall through*/
 159                                 case 1:
 160                                         *d++ = *s++;
 161                                         break;
 162                                 default:
 163                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 164                                         *d = '\0';
 165                                         return NT_STATUS_INVALID_PARAMETER;
 166                         }
 167                 }
 168                 start_of_name_component = False;
 169         }
 170
 171         *d = '\0';
 172         return ret;
 173 }
 174
 175 /****************************************************************************
 176  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 177  No wildcards allowed.
 178 ****************************************************************************/
 179
 180 NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
 181 {
 182         BOOL ignore;
 183         return check_path_syntax_internal(destname, srcname, False, &ignore);
 184 }
 185
 186 /****************************************************************************
 187  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 188  Wildcards allowed - p_contains_wcard returns true if the last component contained
 189  a wildcard.
 190 ****************************************************************************/
 191
 192 NTSTATUS check_path_syntax_wcard(pstring destname, const pstring srcname, BOOL *p_contains_wcard)
 193 {
 194         return check_path_syntax_internal(destname, srcname, False, p_contains_wcard);
 195 }
 196
 197 /****************************************************************************
 198  Check the path for a POSIX client.
 199  We're assuming here that '/' is not the second byte in any multibyte char
 200  set (a safe assumption).
 201 ****************************************************************************/
 202
 203 NTSTATUS check_path_syntax_posix(pstring destname, const pstring srcname)
 204 {
 205         BOOL ignore;
 206         return check_path_syntax_internal(destname, srcname, True, &ignore);
 207 }
 208
 209 /****************************************************************************
 210  Pull a string and check the path allowing a wilcard - provide for error return.
 211 ****************************************************************************/
 212
 213 size_t srvstr_get_path_wcard(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags,
 214                                 NTSTATUS *err, BOOL *contains_wcard)
 215 {
 216         pstring tmppath;
 217         char *tmppath_ptr = tmppath;
 218         size_t ret;
 219 #ifdef DEVELOPER
 220         SMB_ASSERT(dest_len == sizeof(pstring));
 221 #endif
 222
 223         if (src_len == 0) {
 224                 ret = srvstr_pull_buf( inbuf, tmppath_ptr, src, dest_len, flags);
 225         } else {
 226                 ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
 227         }
 228
 229         *contains_wcard = False;
 230
 231         if (SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES) {
 232                 /*
 233                  * For a DFS path the function parse_dfs_path()
 234                  * will do the path processing, just make a copy.
 235                  */
 236                 pstrcpy(dest, tmppath);
 237                 *err = NT_STATUS_OK;
 238                 return ret;
 239         }
 240
 241         if (lp_posix_pathnames()) {
 242                 *err = check_path_syntax_posix(dest, tmppath);
 243         } else {
 244                 *err = check_path_syntax_wcard(dest, tmppath, contains_wcard);
 245         }
 246
 247         return ret;
 248 }
 249
 250 /****************************************************************************
 251  Pull a string and check the path - provide for error return.
 252 ****************************************************************************/
 253
 254 size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags, NTSTATUS *err)
 255 {
 256         pstring tmppath;
 257         char *tmppath_ptr = tmppath;
 258         size_t ret;
 259 #ifdef DEVELOPER
 260         SMB_ASSERT(dest_len == sizeof(pstring));
 261 #endif
 262
 263         if (src_len == 0) {
 264                 ret = srvstr_pull_buf( inbuf, tmppath_ptr, src, dest_len, flags);
 265         } else {
 266                 ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
 267         }
 268
 269         if (SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES) {
 270                 /*
 271                  * For a DFS path the function parse_dfs_path()
 272                  * will do the path processing, just make a copy.
 273                  */
 274                 pstrcpy(dest, tmppath);
 275                 *err = NT_STATUS_OK;
 276                 return ret;
 277         }
 278
 279         if (lp_posix_pathnames()) {
 280                 *err = check_path_syntax_posix(dest, tmppath);
 281         } else {
 282                 *err = check_path_syntax(dest, tmppath);
 283         }
 284
 285         return ret;
 286 }
 287
 288 /****************************************************************************
 289  Reply to a special message.
 290 ****************************************************************************/
 291
 292 int reply_special(char *inbuf,char *outbuf)
 293 {
 294         int outsize = 4;
 295         int msg_type = CVAL(inbuf,0);
 296         int msg_flags = CVAL(inbuf,1);
 297         fstring name1,name2;
 298         char name_type = 0;
 299
 300         static BOOL already_got_session = False;
 301
 302         *name1 = *name2 = 0;
 303
 304         memset(outbuf,'\0',smb_size);
 305
 306         smb_setlen(inbuf,outbuf,0);
 307
 308         switch (msg_type) {
 309         case 0x81: /* session request */
 310
 311                 if (already_got_session) {
 312                         exit_server_cleanly("multiple session request not permitted");
 313                 }
 314
 315                 SCVAL(outbuf,0,0x82);
 316                 SCVAL(outbuf,3,0);
 317                 if (name_len(inbuf+4) > 50 ||
 318                     name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
 319                         DEBUG(0,("Invalid name length in session request\n"));
 320                         return(0);
 321                 }
 322                 name_extract(inbuf,4,name1);
 323                 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
 324                 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
 325                          name1,name2));
 326
 327                 set_local_machine_name(name1, True);
 328                 set_remote_machine_name(name2, True);
 329
 330                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 331                          get_local_machine_name(), get_remote_machine_name(),
 332                          name_type));
 333
 334                 if (name_type == 'R') {
 335                         /* We are being asked for a pathworks session ---
 336                            no thanks! */
 337                         SCVAL(outbuf, 0,0x83);
 338                         break;
 339                 }
 340
 341                 /* only add the client's machine name to the list
 342                    of possibly valid usernames if we are operating
 343                    in share mode security */
 344                 if (lp_security() == SEC_SHARE) {
 345                         add_session_user(get_remote_machine_name());
 346                 }
 347
 348                 reload_services(True);
 349                 reopen_logs();
 350
 351                 already_got_session = True;
 352                 break;
 353
 354         case 0x89: /* session keepalive request
 355                       (some old clients produce this?) */
 356                 SCVAL(outbuf,0,SMBkeepalive);
 357                 SCVAL(outbuf,3,0);
 358                 break;
 359
 360         case 0x82: /* positive session response */
 361         case 0x83: /* negative session response */
 362         case 0x84: /* retarget session response */
 363                 DEBUG(0,("Unexpected session response\n"));
 364                 break;
 365
 366         case SMBkeepalive: /* session keepalive */
 367         default:
 368                 return(0);
 369         }
 370
 371         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 372                     msg_type, msg_flags));
 373
 374         return(outsize);
 375 }
 376
 377 /****************************************************************************
 378  Reply to a tcon.
 379  conn POINTER CAN BE NULL HERE !
 380 ****************************************************************************/
 381
 382 int reply_tcon(connection_struct *conn,
 383                char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 384 {
 385         const char *service;
 386         pstring service_buf;
 387         pstring password;
 388         pstring dev;
 389         int outsize = 0;
 390         uint16 vuid = SVAL(inbuf,smb_uid);
 391         int pwlen=0;
 392         NTSTATUS nt_status;
 393         char *p;
 394         DATA_BLOB password_blob;
 395
 396         START_PROFILE(SMBtcon);
 397
 398         *service_buf = *password = *dev = 0;
 399
 400         p = smb_buf(inbuf)+1;
 401         p += srvstr_pull_buf(inbuf, service_buf, p, sizeof(service_buf), STR_TERMINATE) + 1;
 402         pwlen = srvstr_pull_buf(inbuf, password, p, sizeof(password), STR_TERMINATE) + 1;
 403         p += pwlen;
 404         p += srvstr_pull_buf(inbuf, dev, p, sizeof(dev), STR_TERMINATE) + 1;
 405
 406         p = strrchr_m(service_buf,'\\');
 407         if (p) {
 408                 service = p+1;
 409         } else {
 410                 service = service_buf;
 411         }
 412
 413         password_blob = data_blob(password, pwlen+1);
 414
 415         conn = make_connection(service,password_blob,dev,vuid,&nt_status);
 416
 417         data_blob_clear_free(&password_blob);
 418
 419         if (!conn) {
 420                 END_PROFILE(SMBtcon);
 421                 return ERROR_NT(nt_status);
 422         }
 423
 424         outsize = set_message(inbuf,outbuf,2,0,True);
 425         SSVAL(outbuf,smb_vwv0,max_recv);
 426         SSVAL(outbuf,smb_vwv1,conn->cnum);
 427         SSVAL(outbuf,smb_tid,conn->cnum);
 428
 429         DEBUG(3,("tcon service=%s cnum=%d\n",
 430                  service, conn->cnum));
 431
 432         END_PROFILE(SMBtcon);
 433         return(outsize);
 434 }
 435
 436 /****************************************************************************
 437  Reply to a tcon and X.
 438  conn POINTER CAN BE NULL HERE !
 439 ****************************************************************************/
 440
 441 int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
 442 {
 443         fstring service;
 444         DATA_BLOB password;
 445
 446         /* what the cleint thinks the device is */
 447         fstring client_devicetype;
 448         /* what the server tells the client the share represents */
 449         const char *server_devicetype;
 450         NTSTATUS nt_status;
 451         uint16 vuid = SVAL(inbuf,smb_uid);
 452         int passlen = SVAL(inbuf,smb_vwv3);
 453         pstring path;
 454         char *p, *q;
 455         uint16 tcon_flags = SVAL(inbuf,smb_vwv2);
 456
 457         START_PROFILE(SMBtconX);
 458
 459         *service = *client_devicetype = 0;
 460
 461         /* we might have to close an old one */
 462         if ((SVAL(inbuf,smb_vwv2) & 0x1) && conn) {
 463                 close_cnum(conn,vuid);
 464         }
 465
 466         if (passlen > MAX_PASS_LEN) {
 467                 return ERROR_DOS(ERRDOS,ERRbuftoosmall);
 468         }
 469
 470         if (global_encrypted_passwords_negotiated) {
 471                 password = data_blob(smb_buf(inbuf),passlen);
 472                 if (lp_security() == SEC_SHARE) {
 473                         /*
 474                          * Security = share always has a pad byte
 475                          * after the password.
 476                          */
 477                         p = smb_buf(inbuf) + passlen + 1;
 478                 } else {
 479                         p = smb_buf(inbuf) + passlen;
 480                 }
 481         } else {
 482                 password = data_blob(smb_buf(inbuf),passlen+1);
 483                 /* Ensure correct termination */
 484                 password.data[passlen]=0;
 485                 p = smb_buf(inbuf) + passlen + 1;
 486         }
 487
 488         p += srvstr_pull_buf(inbuf, path, p, sizeof(path), STR_TERMINATE);
 489
 490         /*
 491          * the service name can be either: \\server\share
 492          * or share directly like on the DELL PowerVault 705
 493          */
 494         if (*path=='\\') {
 495                 q = strchr_m(path+2,'\\');
 496                 if (!q) {
 497                         END_PROFILE(SMBtconX);
 498                         return(ERROR_DOS(ERRDOS,ERRnosuchshare));
 499                 }
 500                 fstrcpy(service,q+1);
 501         }
 502         else
 503                 fstrcpy(service,path);
 504
 505         p += srvstr_pull(inbuf, client_devicetype, p, sizeof(client_devicetype), 6, STR_ASCII);
 506
 507         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 508
 509         conn = make_connection(service,password,client_devicetype,vuid,&nt_status);
 510
 511         data_blob_clear_free(&password);
 512
 513         if (!conn) {
 514                 END_PROFILE(SMBtconX);
 515                 return ERROR_NT(nt_status);
 516         }
 517
 518         if ( IS_IPC(conn) )
 519                 server_devicetype = "IPC";
 520         else if ( IS_PRINT(conn) )
 521                 server_devicetype = "LPT1:";
 522         else
 523                 server_devicetype = "A:";
 524
 525         if (Protocol < PROTOCOL_NT1) {
 526                 set_message(inbuf,outbuf,2,0,True);
 527                 p = smb_buf(outbuf);
 528                 p += srvstr_push(outbuf, p, server_devicetype, -1,
 529                                  STR_TERMINATE|STR_ASCII);
 530                 set_message_end(inbuf,outbuf,p);
 531         } else {
 532                 /* NT sets the fstype of IPC$ to the null string */
 533                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 534
 535                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 536                         /* Return permissions. */
 537                         uint32 perm1 = 0;
 538                         uint32 perm2 = 0;
 539
 540                         set_message(inbuf,outbuf,7,0,True);
 541
 542                         if (IS_IPC(conn)) {
 543                                 perm1 = FILE_ALL_ACCESS;
 544                                 perm2 = FILE_ALL_ACCESS;
 545                         } else {
 546                                 perm1 = CAN_WRITE(conn) ?
 547                                                 SHARE_ALL_ACCESS :
 548                                                 SHARE_READ_ONLY;
 549                         }
 550
 551                         SIVAL(outbuf, smb_vwv3, perm1);
 552                         SIVAL(outbuf, smb_vwv5, perm2);
 553                 } else {
 554                         set_message(inbuf,outbuf,3,0,True);
 555                 }
 556
 557                 p = smb_buf(outbuf);
 558                 p += srvstr_push(outbuf, p, server_devicetype, -1,
 559                                  STR_TERMINATE|STR_ASCII);
 560                 p += srvstr_push(outbuf, p, fstype, -1,
 561                                  STR_TERMINATE);
 562
 563                 set_message_end(inbuf,outbuf,p);
 564
 565                 /* what does setting this bit do? It is set by NT4 and
 566                    may affect the ability to autorun mounted cdroms */
 567                 SSVAL(outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 568                                 (lp_csc_policy(SNUM(conn)) << 2));
 569
 570                 init_dfsroot(conn, inbuf, outbuf);
 571         }
 572
 573
 574         DEBUG(3,("tconX service=%s \n",
 575                  service));
 576
 577         /* set the incoming and outgoing tid to the just created one */
 578         SSVAL(inbuf,smb_tid,conn->cnum);
 579         SSVAL(outbuf,smb_tid,conn->cnum);
 580
 581         END_PROFILE(SMBtconX);
 582         return chain_reply(inbuf,outbuf,length,bufsize);
 583 }
 584
 585 /****************************************************************************
 586  Reply to an unknown type.
 587 ****************************************************************************/
 588
 589 int reply_unknown(char *inbuf,char *outbuf)
 590 {
 591         int type;
 592         type = CVAL(inbuf,smb_com);
 593
 594         DEBUG(0,("unknown command type (%s): type=%d (0x%X)\n",
 595                  smb_fn_name(type), type, type));
 596
 597         return(ERROR_DOS(ERRSRV,ERRunknownsmb));
 598 }
 599
 600 /****************************************************************************
 601  Reply to an ioctl.
 602  conn POINTER CAN BE NULL HERE !
 603 ****************************************************************************/
 604
 605 int reply_ioctl(connection_struct *conn,
 606                 char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 607 {
 608         uint16 device     = SVAL(inbuf,smb_vwv1);
 609         uint16 function   = SVAL(inbuf,smb_vwv2);
 610         uint32 ioctl_code = (device << 16) + function;
 611         int replysize, outsize;
 612         char *p;
 613         START_PROFILE(SMBioctl);
 614
 615         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 616
 617         switch (ioctl_code) {
 618             case IOCTL_QUERY_JOB_INFO:
 619                 replysize = 32;
 620                 break;
 621             default:
 622                 END_PROFILE(SMBioctl);
 623                 return(ERROR_DOS(ERRSRV,ERRnosupport));
 624         }
 625
 626         outsize = set_message(inbuf,outbuf,8,replysize+1,True);
 627         SSVAL(outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 628         SSVAL(outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 629         SSVAL(outbuf,smb_vwv6,52);        /* Offset to data */
 630         p = smb_buf(outbuf) + 1;          /* Allow for alignment */
 631
 632         switch (ioctl_code) {
 633                 case IOCTL_QUERY_JOB_INFO:
 634                 {
 635                         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
 636                         if (!fsp) {
 637                                 END_PROFILE(SMBioctl);
 638                                 return(UNIXERROR(ERRDOS,ERRbadfid));
 639                         }
 640                         SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
 641                         srvstr_push(outbuf, p+2, global_myname(), 15, STR_TERMINATE|STR_ASCII);
 642                         if (conn) {
 643                                 srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII);
 644                         }
 645                         break;
 646                 }
 647         }
 648
 649         END_PROFILE(SMBioctl);
 650         return outsize;
 651 }
 652
 653 /****************************************************************************
 654  Strange checkpath NTSTATUS mapping.
 655 ****************************************************************************/
 656
 657 static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
 658 {
 659         /* Strange DOS error code semantics only for checkpath... */
 660         if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
 661                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 662                         /* We need to map to ERRbadpath */
 663                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 664                 }
 665         }
 666         return status;
 667 }
 668
 669 /****************************************************************************
 670  Reply to a checkpath.
 671 ****************************************************************************/
 672
 673 int reply_checkpath(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 674 {
 675         int outsize = 0;
 676         pstring name;
 677         SMB_STRUCT_STAT sbuf;
 678         NTSTATUS status;
 679
 680         START_PROFILE(SMBcheckpath);
 681
 682         srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status);
 683         if (!NT_STATUS_IS_OK(status)) {
 684                 END_PROFILE(SMBcheckpath);
 685                 status = map_checkpath_error(inbuf, status);
 686                 return ERROR_NT(status);
 687         }
 688
 689         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, name);
 690         if (!NT_STATUS_IS_OK(status)) {
 691                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
 692                         END_PROFILE(SMBcheckpath);
 693                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
 694                 }
 695                 goto path_err;
 696         }
 697
 698         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(inbuf,smb_vwv0)));
 699
 700         status = unix_convert(conn, name, False, NULL, &sbuf);
 701         if (!NT_STATUS_IS_OK(status)) {
 702                 goto path_err;
 703         }
 704
 705         status = check_name(conn, name);
 706         if (!NT_STATUS_IS_OK(status)) {
 707                 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
 708                 goto path_err;
 709         }
 710
 711         if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
 712                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
 713                 status = map_nt_error_from_unix(errno);
 714                 goto path_err;
 715         }
 716
 717         if (!S_ISDIR(sbuf.st_mode)) {
 718                 END_PROFILE(SMBcheckpath);
 719                 return ERROR_BOTH(NT_STATUS_NOT_A_DIRECTORY,ERRDOS,ERRbadpath);
 720         }
 721
 722         outsize = set_message(inbuf,outbuf,0,0,False);
 723
 724         END_PROFILE(SMBcheckpath);
 725         return outsize;
 726
 727   path_err:
 728
 729         END_PROFILE(SMBcheckpath);
 730
 731         /* We special case this - as when a Windows machine
 732                 is parsing a path is steps through the components
 733                 one at a time - if a component fails it expects
 734                 ERRbadpath, not ERRbadfile.
 735         */
 736         status = map_checkpath_error(inbuf, status);
 737         if(NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 738                 /*
 739                  * Windows returns different error codes if
 740                  * the parent directory is valid but not the
 741                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
 742                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
 743                  * if the path is invalid.
 744                  */
 745                 return ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpath);
 746         }
 747
 748         return ERROR_NT(status);
 749 }
 750
 751 /****************************************************************************
 752  Reply to a getatr.
 753 ****************************************************************************/
 754
 755 int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 756 {
 757         pstring fname;
 758         int outsize = 0;
 759         SMB_STRUCT_STAT sbuf;
 760         int mode=0;
 761         SMB_OFF_T size=0;
 762         time_t mtime=0;
 763         char *p;
 764         NTSTATUS status;
 765
 766         START_PROFILE(SMBgetatr);
 767
 768         p = smb_buf(inbuf) + 1;
 769         p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
 770         if (!NT_STATUS_IS_OK(status)) {
 771                 END_PROFILE(SMBgetatr);
 772                 return ERROR_NT(status);
 773         }
 774
 775         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
 776         if (!NT_STATUS_IS_OK(status)) {
 777                 END_PROFILE(SMBgetatr);
 778                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
 779                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
 780                 }
 781                 return ERROR_NT(status);
 782         }
 783
 784         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
 785                 under WfWg - weird! */
 786         if (*fname == '\0') {
 787                 mode = aHIDDEN | aDIR;
 788                 if (!CAN_WRITE(conn)) {
 789                         mode |= aRONLY;
 790                 }
 791                 size = 0;
 792                 mtime = 0;
 793         } else {
 794                 status = unix_convert(conn, fname, False, NULL,&sbuf);
 795                 if (!NT_STATUS_IS_OK(status)) {
 796                         END_PROFILE(SMBgetatr);
 797                         return ERROR_NT(status);
 798                 }
 799                 status = check_name(conn, fname);
 800                 if (!NT_STATUS_IS_OK(status)) {
 801                         DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
 802                         END_PROFILE(SMBgetatr);
 803                         return ERROR_NT(status);
 804                 }
 805                 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
 806                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
 807                         return UNIXERROR(ERRDOS,ERRbadfile);
 808                 }
 809
 810                 mode = dos_mode(conn,fname,&sbuf);
 811                 size = sbuf.st_size;
 812                 mtime = sbuf.st_mtime;
 813                 if (mode & aDIR) {
 814                         size = 0;
 815                 }
 816         }
 817
 818         outsize = set_message(inbuf,outbuf,10,0,True);
 819
 820         SSVAL(outbuf,smb_vwv0,mode);
 821         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
 822                 srv_put_dos_date3(outbuf,smb_vwv1,mtime & ~1);
 823         } else {
 824                 srv_put_dos_date3(outbuf,smb_vwv1,mtime);
 825         }
 826         SIVAL(outbuf,smb_vwv3,(uint32)size);
 827
 828         if (Protocol >= PROTOCOL_NT1) {
 829                 SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
 830         }
 831
 832         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
 833
 834         END_PROFILE(SMBgetatr);
 835         return(outsize);
 836 }
 837
 838 /****************************************************************************
 839  Reply to a setatr.
 840 ****************************************************************************/
 841
 842 int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 843 {
 844         pstring fname;
 845         int outsize = 0;
 846         int mode;
 847         time_t mtime;
 848         SMB_STRUCT_STAT sbuf;
 849         char *p;
 850         NTSTATUS status;
 851
 852         START_PROFILE(SMBsetatr);
 853
 854         p = smb_buf(inbuf) + 1;
 855         p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
 856         if (!NT_STATUS_IS_OK(status)) {
 857                 END_PROFILE(SMBsetatr);
 858                 return ERROR_NT(status);
 859         }
 860
 861         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
 862         if (!NT_STATUS_IS_OK(status)) {
 863                 END_PROFILE(SMBsetatr);
 864                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
 865                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
 866                 }
 867                 return ERROR_NT(status);
 868         }
 869
 870         status = unix_convert(conn, fname, False, NULL, &sbuf);
 871         if (!NT_STATUS_IS_OK(status)) {
 872                 END_PROFILE(SMBsetatr);
 873                 return ERROR_NT(status);
 874         }
 875
 876         status = check_name(conn, fname);
 877         if (!NT_STATUS_IS_OK(status)) {
 878                 END_PROFILE(SMBsetatr);
 879                 return ERROR_NT(status);
 880         }
 881
 882         if (fname[0] == '.' && fname[1] == '\0') {
 883                 /*
 884                  * Not sure here is the right place to catch this
 885                  * condition. Might be moved to somewhere else later -- vl
 886                  */
 887                 END_PROFILE(SMBsetatr);
 888                 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
 889         }
 890
 891         mode = SVAL(inbuf,smb_vwv0);
 892         mtime = srv_make_unix_date3(inbuf+smb_vwv1);
 893
 894         if (mode != FILE_ATTRIBUTE_NORMAL) {
 895                 if (VALID_STAT_OF_DIR(sbuf))
 896                         mode |= aDIR;
 897                 else
 898                         mode &= ~aDIR;
 899
 900                 if (file_set_dosmode(conn,fname,mode,&sbuf,False) != 0) {
 901                         END_PROFILE(SMBsetatr);
 902                         return UNIXERROR(ERRDOS, ERRnoaccess);
 903                 }
 904         }
 905
 906         if (!set_filetime(conn,fname,convert_time_t_to_timespec(mtime))) {
 907                 END_PROFILE(SMBsetatr);
 908                 return UNIXERROR(ERRDOS, ERRnoaccess);
 909         }
 910
 911         outsize = set_message(inbuf,outbuf,0,0,False);
 912
 913         DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
 914
 915         END_PROFILE(SMBsetatr);
 916         return(outsize);
 917 }
 918
 919 /****************************************************************************
 920  Reply to a dskattr.
 921 ****************************************************************************/
 922
 923 int reply_dskattr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 924 {
 925         int outsize = 0;
 926         SMB_BIG_UINT dfree,dsize,bsize;
 927         START_PROFILE(SMBdskattr);
 928
 929         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
 930                 END_PROFILE(SMBdskattr);
 931                 return(UNIXERROR(ERRHRD,ERRgeneral));
 932         }
 933
 934         outsize = set_message(inbuf,outbuf,5,0,True);
 935
 936         if (Protocol <= PROTOCOL_LANMAN2) {
 937                 double total_space, free_space;
 938                 /* we need to scale this to a number that DOS6 can handle. We
 939                    use floating point so we can handle large drives on systems
 940                    that don't have 64 bit integers
 941
 942                    we end up displaying a maximum of 2G to DOS systems
 943                 */
 944                 total_space = dsize * (double)bsize;
 945                 free_space = dfree * (double)bsize;
 946
 947                 dsize = (total_space+63*512) / (64*512);
 948                 dfree = (free_space+63*512) / (64*512);
 949
 950                 if (dsize > 0xFFFF) dsize = 0xFFFF;
 951                 if (dfree > 0xFFFF) dfree = 0xFFFF;
 952
 953                 SSVAL(outbuf,smb_vwv0,dsize);
 954                 SSVAL(outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
 955                 SSVAL(outbuf,smb_vwv2,512); /* and this must be 512 */
 956                 SSVAL(outbuf,smb_vwv3,dfree);
 957         } else {
 958                 SSVAL(outbuf,smb_vwv0,dsize);
 959                 SSVAL(outbuf,smb_vwv1,bsize/512);
 960                 SSVAL(outbuf,smb_vwv2,512);
 961                 SSVAL(outbuf,smb_vwv3,dfree);
 962         }
 963
 964         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
 965
 966         END_PROFILE(SMBdskattr);
 967         return(outsize);
 968 }
 969
 970 /****************************************************************************
 971  Reply to a search.
 972  Can be called from SMBsearch, SMBffirst or SMBfunique.
 973 ****************************************************************************/
 974
 975 int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 976 {
 977         pstring mask;
 978         pstring directory;
 979         pstring fname;
 980         SMB_OFF_T size;
 981         uint32 mode;
 982         time_t date;
 983         uint32 dirtype;
 984         int outsize = 0;
 985         unsigned int numentries = 0;
 986         unsigned int maxentries = 0;
 987         BOOL finished = False;
 988         char *p;
 989         int status_len;
 990         pstring path;
 991         char status[21];
 992         int dptr_num= -1;
 993         BOOL check_descend = False;
 994         BOOL expect_close = False;
 995         NTSTATUS nt_status;
 996         BOOL mask_contains_wcard = False;
 997         BOOL allow_long_path_components = (SVAL(inbuf,smb_flg2) & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
 998
 999         START_PROFILE(SMBsearch);
1000
1001         if (lp_posix_pathnames()) {
1002                 END_PROFILE(SMBsearch);
1003                 return reply_unknown(inbuf, outbuf);
1004         }
1005
1006         *mask = *directory = *fname = 0;
1007
1008         /* If we were called as SMBffirst then we must expect close. */
1009         if(CVAL(inbuf,smb_com) == SMBffirst) {
1010                 expect_close = True;
1011         }
1012
1013         outsize = set_message(inbuf,outbuf,1,3,True);
1014         maxentries = SVAL(inbuf,smb_vwv0);
1015         dirtype = SVAL(inbuf,smb_vwv1);
1016         p = smb_buf(inbuf) + 1;
1017         p += srvstr_get_path_wcard(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &nt_status, &mask_contains_wcard);
1018         if (!NT_STATUS_IS_OK(nt_status)) {
1019                 END_PROFILE(SMBsearch);
1020                 return ERROR_NT(nt_status);
1021         }
1022
1023         nt_status = resolve_dfspath_wcard(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, path, &mask_contains_wcard);
1024         if (!NT_STATUS_IS_OK(nt_status)) {
1025                 END_PROFILE(SMBsearch);
1026                 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1027                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1028                 }
1029                 return ERROR_NT(nt_status);
1030         }
1031
1032         p++;
1033         status_len = SVAL(p, 0);
1034         p += 2;
1035
1036         /* dirtype &= ~aDIR; */
1037
1038         if (status_len == 0) {
1039                 SMB_STRUCT_STAT sbuf;
1040
1041                 pstrcpy(directory,path);
1042                 nt_status = unix_convert(conn, directory, True, NULL, &sbuf);
1043                 if (!NT_STATUS_IS_OK(nt_status)) {
1044                         END_PROFILE(SMBsearch);
1045                         return ERROR_NT(nt_status);
1046                 }
1047
1048                 nt_status = check_name(conn, directory);
1049                 if (!NT_STATUS_IS_OK(nt_status)) {
1050                         END_PROFILE(SMBsearch);
1051                         return ERROR_NT(nt_status);
1052                 }
1053
1054                 p = strrchr_m(directory,'/');
1055                 if (!p) {
1056                         pstrcpy(mask,directory);
1057                         pstrcpy(directory,".");
1058                 } else {
1059                         *p = 0;
1060                         pstrcpy(mask,p+1);
1061                 }
1062
1063                 if (*directory == '\0') {
1064                         pstrcpy(directory,".");
1065                 }
1066                 memset((char *)status,'\0',21);
1067                 SCVAL(status,0,(dirtype & 0x1F));
1068         } else {
1069                 int status_dirtype;
1070
1071                 memcpy(status,p,21);
1072                 status_dirtype = CVAL(status,0) & 0x1F;
1073                 if (status_dirtype != (dirtype & 0x1F)) {
1074                         dirtype = status_dirtype;
1075                 }
1076
1077                 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1078                 if (!conn->dirptr) {
1079                         goto SearchEmpty;
1080                 }
1081                 string_set(&conn->dirpath,dptr_path(dptr_num));
1082                 pstrcpy(mask, dptr_wcard(dptr_num));
1083                 /*
1084                  * For a 'continue' search we have no string. So
1085                  * check from the initial saved string.
1086                  */
1087                 mask_contains_wcard = ms_has_wild(mask);
1088         }
1089
1090         p = smb_buf(outbuf) + 3;
1091
1092         if (status_len == 0) {
1093                 nt_status = dptr_create(conn,
1094                                         directory,
1095                                         True,
1096                                         expect_close,
1097                                         SVAL(inbuf,smb_pid),
1098                                         mask,
1099                                         mask_contains_wcard,
1100                                         dirtype,
1101                                         &conn->dirptr);
1102                 if (!NT_STATUS_IS_OK(nt_status)) {
1103                         return ERROR_NT(nt_status);
1104                 }
1105                 dptr_num = dptr_dnum(conn->dirptr);
1106         } else {
1107                 dirtype = dptr_attr(dptr_num);
1108         }
1109
1110         DEBUG(4,("dptr_num is %d\n",dptr_num));
1111
1112         if ((dirtype&0x1F) == aVOLID) {
1113                 memcpy(p,status,21);
1114                 make_dir_struct(p,"???????????",volume_label(SNUM(conn)),
1115                                 0,aVOLID,0,!allow_long_path_components);
1116                 dptr_fill(p+12,dptr_num);
1117                 if (dptr_zero(p+12) && (status_len==0)) {
1118                         numentries = 1;
1119                 } else {
1120                         numentries = 0;
1121                 }
1122                 p += DIR_STRUCT_SIZE;
1123         } else {
1124                 unsigned int i;
1125                 maxentries = MIN(maxentries, ((BUFFER_SIZE - (p - outbuf))/DIR_STRUCT_SIZE));
1126
1127                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1128                         conn->dirpath,lp_dontdescend(SNUM(conn))));
1129                 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1130                         check_descend = True;
1131                 }
1132
1133                 for (i=numentries;(i<maxentries) && !finished;i++) {
1134                         finished = !get_dir_entry(conn,mask,dirtype,fname,&size,&mode,&date,check_descend);
1135                         if (!finished) {
1136                                 memcpy(p,status,21);
1137                                 make_dir_struct(p,mask,fname,size, mode,date,
1138                                                 !allow_long_path_components);
1139                                 if (!dptr_fill(p+12,dptr_num)) {
1140                                         break;
1141                                 }
1142                                 numentries++;
1143                                 p += DIR_STRUCT_SIZE;
1144                         }
1145                 }
1146         }
1147
1148   SearchEmpty:
1149
1150         /* If we were called as SMBffirst with smb_search_id == NULL
1151                 and no entries were found then return error and close dirptr
1152                 (X/Open spec) */
1153
1154         if (numentries == 0) {
1155                 dptr_close(&dptr_num);
1156         } else if(expect_close && status_len == 0) {
1157                 /* Close the dptr - we know it's gone */
1158                 dptr_close(&dptr_num);
1159         }
1160
1161         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1162         if(dptr_num >= 0 && CVAL(inbuf,smb_com) == SMBfunique) {
1163                 dptr_close(&dptr_num);
1164         }
1165
1166         if ((numentries == 0) && !mask_contains_wcard) {
1167                 return ERROR_BOTH(STATUS_NO_MORE_FILES,ERRDOS,ERRnofiles);
1168         }
1169
1170         SSVAL(outbuf,smb_vwv0,numentries);
1171         SSVAL(outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1172         SCVAL(smb_buf(outbuf),0,5);
1173         SSVAL(smb_buf(outbuf),1,numentries*DIR_STRUCT_SIZE);
1174
1175         /* The replies here are never long name. */
1176         SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1177         if (!allow_long_path_components) {
1178                 SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) & (~FLAGS2_LONG_PATH_COMPONENTS));
1179         }
1180
1181         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1182         SSVAL(outbuf,smb_flg2, (SVAL(outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1183
1184         outsize += DIR_STRUCT_SIZE*numentries;
1185         smb_setlen(inbuf,outbuf,outsize - 4);
1186
1187         if ((! *directory) && dptr_path(dptr_num))
1188                 slprintf(directory, sizeof(directory)-1, "(%s)",dptr_path(dptr_num));
1189
1190         DEBUG( 4, ( "%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1191                 smb_fn_name(CVAL(inbuf,smb_com)),
1192                 mask, directory, dirtype, numentries, maxentries ) );
1193
1194         END_PROFILE(SMBsearch);
1195         return(outsize);
1196 }
1197
1198 /****************************************************************************
1199  Reply to a fclose (stop directory search).
1200 ****************************************************************************/
1201
1202 int reply_fclose(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1203 {
1204         int outsize = 0;
1205         int status_len;
1206         pstring path;
1207         char status[21];
1208         int dptr_num= -2;
1209         char *p;
1210         NTSTATUS err;
1211         BOOL path_contains_wcard = False;
1212
1213         START_PROFILE(SMBfclose);
1214
1215         if (lp_posix_pathnames()) {
1216                 END_PROFILE(SMBfclose);
1217                 return reply_unknown(inbuf, outbuf);
1218         }
1219
1220         outsize = set_message(inbuf,outbuf,1,0,True);
1221         p = smb_buf(inbuf) + 1;
1222         p += srvstr_get_path_wcard(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &err, &path_contains_wcard);
1223         if (!NT_STATUS_IS_OK(err)) {
1224                 END_PROFILE(SMBfclose);
1225                 return ERROR_NT(err);
1226         }
1227         p++;
1228         status_len = SVAL(p,0);
1229         p += 2;
1230
1231         if (status_len == 0) {
1232                 END_PROFILE(SMBfclose);
1233                 return ERROR_DOS(ERRSRV,ERRsrverror);
1234         }
1235
1236         memcpy(status,p,21);
1237
1238         if(dptr_fetch(status+12,&dptr_num)) {
1239                 /*  Close the dptr - we know it's gone */
1240                 dptr_close(&dptr_num);
1241         }
1242
1243         SSVAL(outbuf,smb_vwv0,0);
1244
1245         DEBUG(3,("search close\n"));
1246
1247         END_PROFILE(SMBfclose);
1248         return(outsize);
1249 }
1250
1251 /****************************************************************************
1252  Reply to an open.
1253 ****************************************************************************/
1254
1255 int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1256 {
1257         pstring fname;
1258         int outsize = 0;
1259         uint32 fattr=0;
1260         SMB_OFF_T size = 0;
1261         time_t mtime=0;
1262         int info;
1263         SMB_STRUCT_STAT sbuf;
1264         files_struct *fsp;
1265         int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1266         int deny_mode;
1267         uint32 dos_attr = SVAL(inbuf,smb_vwv1);
1268         uint32 access_mask;
1269         uint32 share_mode;
1270         uint32 create_disposition;
1271         uint32 create_options = 0;
1272         NTSTATUS status;
1273         START_PROFILE(SMBopen);
1274
1275         deny_mode = SVAL(inbuf,smb_vwv0);
1276
1277         srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
1278         if (!NT_STATUS_IS_OK(status)) {
1279                 END_PROFILE(SMBopen);
1280                 return ERROR_NT(status);
1281         }
1282
1283         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1284         if (!NT_STATUS_IS_OK(status)) {
1285                 END_PROFILE(SMBopen);
1286                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1287                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1288                 }
1289                 return ERROR_NT(status);
1290         }
1291
1292         status = unix_convert(conn, fname, False, NULL, &sbuf);
1293         if (!NT_STATUS_IS_OK(status)) {
1294                 END_PROFILE(SMBopen);
1295                 return ERROR_NT(status);
1296         }
1297
1298         status = check_name(conn, fname);
1299         if (!NT_STATUS_IS_OK(status)) {
1300                 END_PROFILE(SMBopen);
1301                 return ERROR_NT(status);
1302         }
1303
1304         if (!map_open_params_to_ntcreate(fname, deny_mode, OPENX_FILE_EXISTS_OPEN,
1305                         &access_mask, &share_mode, &create_disposition, &create_options)) {
1306                 END_PROFILE(SMBopen);
1307                 return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1308         }
1309
1310         status = open_file_ntcreate(conn,fname,&sbuf,
1311                         access_mask,
1312                         share_mode,
1313                         create_disposition,
1314                         create_options,
1315                         dos_attr,
1316                         oplock_request,
1317                         &info, &fsp);
1318
1319         if (!NT_STATUS_IS_OK(status)) {
1320                 END_PROFILE(SMBopen);
1321                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1322                         /* We have re-scheduled this call. */
1323                         return -1;
1324                 }
1325                 return ERROR_NT(status);
1326         }
1327
1328         size = sbuf.st_size;
1329         fattr = dos_mode(conn,fname,&sbuf);
1330         mtime = sbuf.st_mtime;
1331
1332         if (fattr & aDIR) {
1333                 DEBUG(3,("attempt to open a directory %s\n",fname));
1334                 close_file(fsp,ERROR_CLOSE);
1335                 END_PROFILE(SMBopen);
1336                 return ERROR_DOS(ERRDOS,ERRnoaccess);
1337         }
1338
1339         outsize = set_message(inbuf,outbuf,7,0,True);
1340         SSVAL(outbuf,smb_vwv0,fsp->fnum);
1341         SSVAL(outbuf,smb_vwv1,fattr);
1342         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1343                 srv_put_dos_date3(outbuf,smb_vwv2,mtime & ~1);
1344         } else {
1345                 srv_put_dos_date3(outbuf,smb_vwv2,mtime);
1346         }
1347         SIVAL(outbuf,smb_vwv4,(uint32)size);
1348         SSVAL(outbuf,smb_vwv6,deny_mode);
1349
1350         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1351                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1352         }
1353
1354         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1355                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1356         }
1357         END_PROFILE(SMBopen);
1358         return(outsize);
1359 }
1360
1361 /****************************************************************************
1362  Reply to an open and X.
1363 ****************************************************************************/
1364
1365 int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
1366 {
1367         pstring fname;
1368         uint16 open_flags = SVAL(inbuf,smb_vwv2);
1369         int deny_mode = SVAL(inbuf,smb_vwv3);
1370         uint32 smb_attr = SVAL(inbuf,smb_vwv5);
1371         /* Breakout the oplock request bits so we can set the
1372                 reply bits separately. */
1373         int ex_oplock_request = EXTENDED_OPLOCK_REQUEST(inbuf);
1374         int core_oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1375         int oplock_request = ex_oplock_request | core_oplock_request;
1376 #if 0
1377         int smb_sattr = SVAL(inbuf,smb_vwv4);
1378         uint32 smb_time = make_unix_date3(inbuf+smb_vwv6);
1379 #endif
1380         int smb_ofun = SVAL(inbuf,smb_vwv8);
1381         uint32 fattr=0;
1382         int mtime=0;
1383         SMB_STRUCT_STAT sbuf;
1384         int smb_action = 0;
1385         files_struct *fsp;
1386         NTSTATUS status;
1387         SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv9);
1388         ssize_t retval = -1;
1389         uint32 access_mask;
1390         uint32 share_mode;
1391         uint32 create_disposition;
1392         uint32 create_options = 0;
1393
1394         START_PROFILE(SMBopenX);
1395
1396         /* If it's an IPC, pass off the pipe handler. */
1397         if (IS_IPC(conn)) {
1398                 if (lp_nt_pipe_support()) {
1399                         END_PROFILE(SMBopenX);
1400                         return reply_open_pipe_and_X(conn, inbuf,outbuf,length,bufsize);
1401                 } else {
1402                         END_PROFILE(SMBopenX);
1403                         return ERROR_DOS(ERRSRV,ERRaccess);
1404                 }
1405         }
1406
1407         /* XXXX we need to handle passed times, sattr and flags */
1408         srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
1409         if (!NT_STATUS_IS_OK(status)) {
1410                 END_PROFILE(SMBopenX);
1411                 return ERROR_NT(status);
1412         }
1413
1414         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1415         if (!NT_STATUS_IS_OK(status)) {
1416                 END_PROFILE(SMBopenX);
1417                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1418                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1419                 }
1420                 return ERROR_NT(status);
1421         }
1422
1423         status = unix_convert(conn, fname, False, NULL, &sbuf);
1424         if (!NT_STATUS_IS_OK(status)) {
1425                 END_PROFILE(SMBopenX);
1426                 return ERROR_NT(status);
1427         }
1428
1429         status = check_name(conn, fname);
1430         if (!NT_STATUS_IS_OK(status)) {
1431                 END_PROFILE(SMBopenX);
1432                 return ERROR_NT(status);
1433         }
1434
1435         if (!map_open_params_to_ntcreate(fname, deny_mode, smb_ofun,
1436                                 &access_mask,
1437                                 &share_mode,
1438                                 &create_disposition,
1439                                 &create_options)) {
1440                 END_PROFILE(SMBopenX);
1441                 return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1442         }
1443
1444         status = open_file_ntcreate(conn,fname,&sbuf,
1445                         access_mask,
1446                         share_mode,
1447                         create_disposition,
1448                         create_options,
1449                         smb_attr,
1450                         oplock_request,
1451                         &smb_action, &fsp);
1452
1453         if (!NT_STATUS_IS_OK(status)) {
1454                 END_PROFILE(SMBopenX);
1455                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1456                         /* We have re-scheduled this call. */
1457                         return -1;
1458                 }
1459                 return ERROR_NT(status);
1460         }
1461
1462         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1463            if the file is truncated or created. */
1464         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1465                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1466                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1467                         close_file(fsp,ERROR_CLOSE);
1468                         END_PROFILE(SMBopenX);
1469                         return ERROR_NT(NT_STATUS_DISK_FULL);
1470                 }
1471                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1472                 if (retval < 0) {
1473                         close_file(fsp,ERROR_CLOSE);
1474                         END_PROFILE(SMBopenX);
1475                         return ERROR_NT(NT_STATUS_DISK_FULL);
1476                 }
1477                 sbuf.st_size = get_allocation_size(conn,fsp,&sbuf);
1478         }
1479
1480         fattr = dos_mode(conn,fname,&sbuf);
1481         mtime = sbuf.st_mtime;
1482         if (fattr & aDIR) {
1483                 close_file(fsp,ERROR_CLOSE);
1484                 END_PROFILE(SMBopenX);
1485                 return ERROR_DOS(ERRDOS,ERRnoaccess);
1486         }
1487
1488         /* If the caller set the extended oplock request bit
1489                 and we granted one (by whatever means) - set the
1490                 correct bit for extended oplock reply.
1491         */
1492
1493         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1494                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1495         }
1496
1497         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1498                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1499         }
1500
1501         /* If the caller set the core oplock request bit
1502                 and we granted one (by whatever means) - set the
1503                 correct bit for core oplock reply.
1504         */
1505
1506         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1507                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1508         }
1509
1510         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1511                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1512         }
1513
1514         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1515                 set_message(inbuf,outbuf,19,0,True);
1516         } else {
1517                 set_message(inbuf,outbuf,15,0,True);
1518         }
1519         SSVAL(outbuf,smb_vwv2,fsp->fnum);
1520         SSVAL(outbuf,smb_vwv3,fattr);
1521         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1522                 srv_put_dos_date3(outbuf,smb_vwv4,mtime & ~1);
1523         } else {
1524                 srv_put_dos_date3(outbuf,smb_vwv4,mtime);
1525         }
1526         SIVAL(outbuf,smb_vwv6,(uint32)sbuf.st_size);
1527         SSVAL(outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1528         SSVAL(outbuf,smb_vwv11,smb_action);
1529
1530         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1531                 SIVAL(outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1532         }
1533
1534         END_PROFILE(SMBopenX);
1535         return chain_reply(inbuf,outbuf,length,bufsize);
1536 }
1537
1538 /****************************************************************************
1539  Reply to a SMBulogoffX.
1540  conn POINTER CAN BE NULL HERE !
1541 ****************************************************************************/
1542
1543 int reply_ulogoffX(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
1544 {
1545         uint16 vuid = SVAL(inbuf,smb_uid);
1546         user_struct *vuser = get_valid_user_struct(vuid);
1547         START_PROFILE(SMBulogoffX);
1548
1549         if(vuser == 0)
1550                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n", vuid));
1551
1552         /* in user level security we are supposed to close any files
1553                 open by this user */
1554         if ((vuser != 0) && (lp_security() != SEC_SHARE))
1555                 file_close_user(vuid);
1556
1557         invalidate_vuid(vuid);
1558
1559         set_message(inbuf,outbuf,2,0,True);
1560
1561         DEBUG( 3, ( "ulogoffX vuid=%d\n", vuid ) );
1562
1563         END_PROFILE(SMBulogoffX);
1564         return chain_reply(inbuf,outbuf,length,bufsize);
1565 }
1566
1567 /****************************************************************************
1568  Reply to a mknew or a create.
1569 ****************************************************************************/
1570
1571 int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1572 {
1573         pstring fname;
1574         int com;
1575         int outsize = 0;
1576         uint32 fattr = SVAL(inbuf,smb_vwv0);
1577         struct timespec ts[2];
1578         files_struct *fsp;
1579         int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1580         SMB_STRUCT_STAT sbuf;
1581         NTSTATUS status;
1582         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1583         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1584         uint32 create_disposition;
1585         uint32 create_options = 0;
1586
1587         START_PROFILE(SMBcreate);
1588
1589         com = SVAL(inbuf,smb_com);
1590
1591         ts[1] = convert_time_t_to_timespec(srv_make_unix_date3(inbuf + smb_vwv1)); /* mtime. */
1592
1593         srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), 0, STR_TERMINATE, &status);
1594         if (!NT_STATUS_IS_OK(status)) {
1595                 END_PROFILE(SMBcreate);
1596                 return ERROR_NT(status);
1597         }
1598
1599         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1600         if (!NT_STATUS_IS_OK(status)) {
1601                 END_PROFILE(SMBcreate);
1602                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1603                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1604                 }
1605                 return ERROR_NT(status);
1606         }
1607
1608         status = unix_convert(conn, fname, False, NULL, &sbuf);
1609         if (!NT_STATUS_IS_OK(status)) {
1610                 END_PROFILE(SMBcreate);
1611                 return ERROR_NT(status);
1612         }
1613
1614         status = check_name(conn, fname);
1615         if (!NT_STATUS_IS_OK(status)) {
1616                 END_PROFILE(SMBcreate);
1617                 return ERROR_NT(status);
1618         }
1619
1620         if (fattr & aVOLID) {
1621                 DEBUG(0,("Attempt to create file (%s) with volid set - please report this\n",fname));
1622         }
1623
1624         if(com == SMBmknew) {
1625                 /* We should fail if file exists. */
1626                 create_disposition = FILE_CREATE;
1627         } else {
1628                 /* Create if file doesn't exist, truncate if it does. */
1629                 create_disposition = FILE_OVERWRITE_IF;
1630         }
1631
1632         /* Open file using ntcreate. */
1633         status = open_file_ntcreate(conn,fname,&sbuf,
1634                                 access_mask,
1635                                 share_mode,
1636                                 create_disposition,
1637                                 create_options,
1638                                 fattr,
1639                                 oplock_request,
1640                                 NULL, &fsp);
1641
1642         if (!NT_STATUS_IS_OK(status)) {
1643                 END_PROFILE(SMBcreate);
1644                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1645                         /* We have re-scheduled this call. */
1646                         return -1;
1647                 }
1648                 return ERROR_NT(status);
1649         }
1650
1651         ts[0] = get_atimespec(&sbuf); /* atime. */
1652         file_ntimes(conn, fname, ts);
1653
1654         outsize = set_message(inbuf,outbuf,1,0,True);
1655         SSVAL(outbuf,smb_vwv0,fsp->fnum);
1656
1657         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1658                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1659         }
1660
1661         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1662                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1663         }
1664
1665         DEBUG( 2, ( "reply_mknew: file %s\n", fname ) );
1666         DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n", fname, fsp->fh->fd, (unsigned int)fattr ) );
1667
1668         END_PROFILE(SMBcreate);
1669         return(outsize);
1670 }
1671
1672 /****************************************************************************
1673  Reply to a create temporary file.
1674 ****************************************************************************/
1675
1676 int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1677 {
1678         pstring fname;
1679         int outsize = 0;
1680         uint32 fattr = SVAL(inbuf,smb_vwv0);
1681         files_struct *fsp;
1682         int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1683         int tmpfd;
1684         SMB_STRUCT_STAT sbuf;
1685         char *p, *s;
1686         NTSTATUS status;
1687         unsigned int namelen;
1688
1689         START_PROFILE(SMBctemp);
1690
1691         srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
1692         if (!NT_STATUS_IS_OK(status)) {
1693                 END_PROFILE(SMBctemp);
1694                 return ERROR_NT(status);
1695         }
1696         if (*fname) {
1697                 pstrcat(fname,"/TMXXXXXX");
1698         } else {
1699                 pstrcat(fname,"TMXXXXXX");
1700         }
1701
1702         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1703         if (!NT_STATUS_IS_OK(status)) {
1704                 END_PROFILE(SMBctemp);
1705                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1706                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1707                 }
1708                 return ERROR_NT(status);
1709         }
1710
1711         status = unix_convert(conn, fname, False, NULL, &sbuf);
1712         if (!NT_STATUS_IS_OK(status)) {
1713                 END_PROFILE(SMBctemp);
1714                 return ERROR_NT(status);
1715         }
1716
1717         status = check_name(conn, fname);
1718         if (!NT_STATUS_IS_OK(status)) {
1719                 END_PROFILE(SMBctemp);
1720                 return ERROR_NT(status);
1721         }
1722
1723         tmpfd = smb_mkstemp(fname);
1724         if (tmpfd == -1) {
1725                 END_PROFILE(SMBctemp);
1726                 return(UNIXERROR(ERRDOS,ERRnoaccess));
1727         }
1728
1729         SMB_VFS_STAT(conn,fname,&sbuf);
1730
1731         /* We should fail if file does not exist. */
1732         status = open_file_ntcreate(conn,fname,&sbuf,
1733                                 FILE_GENERIC_READ | FILE_GENERIC_WRITE,
1734                                 FILE_SHARE_READ|FILE_SHARE_WRITE,
1735                                 FILE_OPEN,
1736                                 0,
1737                                 fattr,
1738                                 oplock_request,
1739                                 NULL, &fsp);
1740
1741         /* close fd from smb_mkstemp() */
1742         close(tmpfd);
1743
1744         if (!NT_STATUS_IS_OK(status)) {
1745                 END_PROFILE(SMBctemp);
1746                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1747                         /* We have re-scheduled this call. */
1748                         return -1;
1749                 }
1750                 return ERROR_NT(status);
1751         }
1752
1753         outsize = set_message(inbuf,outbuf,1,0,True);
1754         SSVAL(outbuf,smb_vwv0,fsp->fnum);
1755
1756         /* the returned filename is relative to the directory */
1757         s = strrchr_m(fname, '/');
1758         if (!s) {
1759                 s = fname;
1760         } else {
1761                 s++;
1762         }
1763
1764         p = smb_buf(outbuf);
1765 #if 0
1766         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
1767            thing in the byte section. JRA */
1768         SSVALS(p, 0, -1); /* what is this? not in spec */
1769 #endif
1770         namelen = srvstr_push(outbuf, p, s, -1, STR_ASCII|STR_TERMINATE);
1771         p += namelen;
1772         outsize = set_message_end(inbuf,outbuf, p);
1773
1774         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1775                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1776         }
1777
1778         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1779                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1780         }
1781
1782         DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fname ) );
1783         DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fname, fsp->fh->fd,
1784                         (unsigned int)sbuf.st_mode ) );
1785
1786         END_PROFILE(SMBctemp);
1787         return(outsize);
1788 }
1789
1790 /*******************************************************************
1791  Check if a user is allowed to rename a file.
1792 ********************************************************************/
1793
1794 static NTSTATUS can_rename(connection_struct *conn, char *fname, uint16 dirtype, SMB_STRUCT_STAT *pst)
1795 {
1796         files_struct *fsp;
1797         uint32 fmode;
1798         NTSTATUS status;
1799
1800         if (!CAN_WRITE(conn)) {
1801                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1802         }
1803
1804         fmode = dos_mode(conn,fname,pst);
1805         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
1806                 return NT_STATUS_NO_SUCH_FILE;
1807         }
1808
1809         if (S_ISDIR(pst->st_mode)) {
1810                 return NT_STATUS_OK;
1811         }
1812
1813         status = open_file_ntcreate(conn, fname, pst,
1814                                 DELETE_ACCESS,
1815                                 FILE_SHARE_READ|FILE_SHARE_WRITE,
1816                                 FILE_OPEN,
1817                                 0,
1818                                 FILE_ATTRIBUTE_NORMAL,
1819                                 0,
1820                                 NULL, &fsp);
1821
1822         if (!NT_STATUS_IS_OK(status)) {
1823                 return status;
1824         }
1825         close_file(fsp,NORMAL_CLOSE);
1826         return NT_STATUS_OK;
1827 }
1828
1829 /*******************************************************************
1830  Check if a user is allowed to delete a file.
1831 ********************************************************************/
1832
1833 static NTSTATUS can_delete(connection_struct *conn, char *fname,
1834                            uint32 dirtype, BOOL can_defer)
1835 {
1836         SMB_STRUCT_STAT sbuf;
1837         uint32 fattr;
1838         files_struct *fsp;
1839         uint32 dirtype_orig = dirtype;
1840         NTSTATUS status;
1841
1842         DEBUG(10,("can_delete: %s, dirtype = %d\n", fname, dirtype ));
1843
1844         if (!CAN_WRITE(conn)) {
1845                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1846         }
1847
1848         if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
1849                 return map_nt_error_from_unix(errno);
1850         }
1851
1852         fattr = dos_mode(conn,fname,&sbuf);
1853
1854         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
1855                 dirtype = aDIR|aARCH|aRONLY;
1856         }
1857
1858         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
1859         if (!dirtype) {
1860                 return NT_STATUS_NO_SUCH_FILE;
1861         }
1862
1863         if (!dir_check_ftype(conn, fattr, dirtype)) {
1864                 if (fattr & aDIR) {
1865                         return NT_STATUS_FILE_IS_A_DIRECTORY;
1866                 }
1867                 return NT_STATUS_NO_SUCH_FILE;
1868         }
1869
1870         if (dirtype_orig & 0x8000) {
1871                 /* These will never be set for POSIX. */
1872                 return NT_STATUS_NO_SUCH_FILE;
1873         }
1874
1875 #if 0
1876         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
1877                 return NT_STATUS_FILE_IS_A_DIRECTORY;
1878         }
1879
1880         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
1881                 return NT_STATUS_NO_SUCH_FILE;
1882         }
1883
1884         if (dirtype & 0xFF00) {
1885                 /* These will never be set for POSIX. */
1886                 return NT_STATUS_NO_SUCH_FILE;
1887         }
1888
1889         dirtype &= 0xFF;
1890         if (!dirtype) {
1891                 return NT_STATUS_NO_SUCH_FILE;
1892         }
1893
1894         /* Can't delete a directory. */
1895         if (fattr & aDIR) {
1896                 return NT_STATUS_FILE_IS_A_DIRECTORY;
1897         }
1898 #endif
1899
1900 #if 0 /* JRATEST */
1901         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
1902                 return NT_STATUS_OBJECT_NAME_INVALID;
1903 #endif /* JRATEST */
1904
1905         /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
1906
1907           On a Windows share, a file with read-only dosmode can be opened with
1908           DELETE_ACCESS. But on a Samba share (delete readonly = no), it
1909           fails with NT_STATUS_CANNOT_DELETE error.
1910
1911           This semantic causes a problem that a user can not
1912           rename a file with read-only dosmode on a Samba share
1913           from a Windows command prompt (i.e. cmd.exe, but can rename
1914           from Windows Explorer).
1915         */
1916
1917         if (!lp_delete_readonly(SNUM(conn))) {
1918                 if (fattr & aRONLY) {
1919                         return NT_STATUS_CANNOT_DELETE;
1920                 }
1921         }
1922
1923         /* On open checks the open itself will check the share mode, so
1924            don't do it here as we'll get it wrong. */
1925
1926         status = open_file_ntcreate(conn, fname, &sbuf,
1927                                     DELETE_ACCESS,
1928                                     FILE_SHARE_NONE,
1929                                     FILE_OPEN,
1930                                     0,
1931                                     FILE_ATTRIBUTE_NORMAL,
1932                                     can_defer ? 0 : INTERNAL_OPEN_ONLY,
1933                                     NULL, &fsp);
1934
1935         if (NT_STATUS_IS_OK(status)) {
1936                 close_file(fsp,NORMAL_CLOSE);
1937         }
1938         return status;
1939 }
1940
1941 /****************************************************************************
1942  The guts of the unlink command, split out so it may be called by the NT SMB
1943  code.
1944 ****************************************************************************/
1945
1946 NTSTATUS unlink_internals(connection_struct *conn, uint32 dirtype,
1947                           char *name, BOOL has_wild, BOOL can_defer)
1948 {
1949         pstring directory;
1950         pstring mask;
1951         char *p;
1952         int count=0;
1953         NTSTATUS status = NT_STATUS_OK;
1954         SMB_STRUCT_STAT sbuf;
1955
1956         *directory = *mask = 0;
1957
1958         status = unix_convert(conn, name, has_wild, NULL, &sbuf);
1959         if (!NT_STATUS_IS_OK(status)) {
1960                 return status;
1961         }
1962
1963         p = strrchr_m(name,'/');
1964         if (!p) {
1965                 pstrcpy(directory,".");
1966                 pstrcpy(mask,name);
1967         } else {
1968                 *p = 0;
1969                 pstrcpy(directory,name);
1970                 pstrcpy(mask,p+1);
1971         }
1972
1973         /*
1974          * We should only check the mangled cache
1975          * here if unix_convert failed. This means
1976          * that the path in 'mask' doesn't exist
1977          * on the file system and so we need to look
1978          * for a possible mangle. This patch from
1979          * Tine Smukavec <valentin.smukavec@hermes.si>.
1980          */
1981
1982         if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params))
1983                 mangle_check_cache( mask, sizeof(pstring)-1, conn->params );
1984
1985         if (!has_wild) {
1986                 pstrcat(directory,"/");
1987                 pstrcat(directory,mask);
1988                 if (dirtype == 0) {
1989                         dirtype = FILE_ATTRIBUTE_NORMAL;
1990                 }
1991
1992                 status = check_name(conn, directory);
1993                 if (!NT_STATUS_IS_OK(status)) {
1994                         return status;
1995                 }
1996
1997                 status = can_delete(conn,directory,dirtype,can_defer);
1998                 if (!NT_STATUS_IS_OK(status)) {
1999                         return status;
2000                 }
2001
2002                 if (SMB_VFS_UNLINK(conn,directory) == 0) {
2003                         count++;
2004                         notify_fname(conn, NOTIFY_ACTION_REMOVED,
2005                                      FILE_NOTIFY_CHANGE_FILE_NAME,
2006                                      directory);
2007                 }
2008         } else {
2009                 struct smb_Dir *dir_hnd = NULL;
2010                 long offset = 0;
2011                 const char *dname;
2012
2013                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2014                         return NT_STATUS_OBJECT_NAME_INVALID;
2015                 }
2016
2017                 if (strequal(mask,"????????.???")) {
2018                         pstrcpy(mask,"*");
2019                 }
2020
2021                 status = check_name(conn, directory);
2022                 if (!NT_STATUS_IS_OK(status)) {
2023                         return status;
2024                 }
2025
2026                 dir_hnd = OpenDir(conn, directory, mask, dirtype);
2027                 if (dir_hnd == NULL) {
2028                         return map_nt_error_from_unix(errno);
2029                 }
2030
2031                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2032                    the pattern matches against the long name, otherwise the short name
2033                    We don't implement this yet XXXX
2034                 */
2035
2036                 status = NT_STATUS_NO_SUCH_FILE;
2037
2038                 while ((dname = ReadDirName(dir_hnd, &offset))) {
2039                         SMB_STRUCT_STAT st;
2040                         pstring fname;
2041                         pstrcpy(fname,dname);
2042
2043                         if (!is_visible_file(conn, directory, dname, &st, True)) {
2044                                 continue;
2045                         }
2046
2047                         /* Quick check for "." and ".." */
2048                         if (fname[0] == '.') {
2049                                 if (!fname[1] || (fname[1] == '.' && !fname[2])) {
2050                                         continue;
2051                                 }
2052                         }
2053
2054                         if(!mask_match(fname, mask, conn->case_sensitive)) {
2055                                 continue;
2056                         }
2057
2058                         slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
2059
2060                         status = check_name(conn, fname);
2061                         if (!NT_STATUS_IS_OK(status)) {
2062                                 CloseDir(dir_hnd);
2063                                 return status;
2064                         }
2065
2066                         status = can_delete(conn, fname, dirtype, can_defer);
2067                         if (!NT_STATUS_IS_OK(status)) {
2068                                 continue;
2069                         }
2070                         if (SMB_VFS_UNLINK(conn,fname) == 0) {
2071                                 count++;
2072                                 DEBUG(3,("unlink_internals: succesful unlink "
2073                                          "[%s]\n",fname));
2074                                 notify_fname(conn, NOTIFY_ACTION_REMOVED,
2075                                              FILE_NOTIFY_CHANGE_FILE_NAME,
2076                                              fname);
2077                         }
2078
2079                 }
2080                 CloseDir(dir_hnd);
2081         }
2082
2083         if (count == 0 && NT_STATUS_IS_OK(status)) {
2084                 status = map_nt_error_from_unix(errno);
2085         }
2086
2087         return status;
2088 }
2089
2090 /****************************************************************************
2091  Reply to a unlink
2092 ****************************************************************************/
2093
2094 int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
2095                  int dum_buffsize)
2096 {
2097         int outsize = 0;
2098         pstring name;
2099         uint32 dirtype;
2100         NTSTATUS status;
2101         BOOL path_contains_wcard = False;
2102
2103         START_PROFILE(SMBunlink);
2104
2105         dirtype = SVAL(inbuf,smb_vwv0);
2106
2107         srvstr_get_path_wcard(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, &path_contains_wcard);
2108         if (!NT_STATUS_IS_OK(status)) {
2109                 END_PROFILE(SMBunlink);
2110                 return ERROR_NT(status);
2111         }
2112
2113         status = resolve_dfspath_wcard(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, name, &path_contains_wcard);
2114         if (!NT_STATUS_IS_OK(status)) {
2115                 END_PROFILE(SMBunlink);
2116                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2117                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
2118                 }
2119                 return ERROR_NT(status);
2120         }
2121
2122         DEBUG(3,("reply_unlink : %s\n",name));
2123
2124         status = unlink_internals(conn, dirtype, name, path_contains_wcard,
2125                                   True);
2126         if (!NT_STATUS_IS_OK(status)) {
2127                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
2128                         /* We have re-scheduled this call. */
2129                         return -1;
2130                 }
2131                 return ERROR_NT(status);
2132         }
2133
2134         outsize = set_message(inbuf,outbuf,0,0,False);
2135
2136         END_PROFILE(SMBunlink);
2137         return outsize;
2138 }
2139
2140 /****************************************************************************
2141  Fail for readbraw.
2142 ****************************************************************************/
2143
2144 static void fail_readraw(void)
2145 {
2146         pstring errstr;
2147         slprintf(errstr, sizeof(errstr)-1, "FAIL ! reply_readbraw: socket write fail (%s)",
2148                 strerror(errno) );
2149         exit_server_cleanly(errstr);
2150 }
2151
2152 /****************************************************************************
2153  Fake (read/write) sendfile. Returns -1 on read or write fail.
2154 ****************************************************************************/
2155
2156 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread, char *buf, size_t bufsize)
2157 {
2158         size_t tosend = nread;
2159
2160         while (tosend > 0) {
2161                 ssize_t ret;
2162                 size_t cur_read;
2163
2164                 if (tosend > bufsize) {
2165                         cur_read = bufsize;
2166                 } else {
2167                         cur_read = tosend;
2168                 }
2169                 ret = read_file(fsp,buf,startpos,cur_read);
2170                 if (ret == -1) {
2171                         return -1;
2172                 }
2173
2174                 /* If we had a short read, fill with zeros. */
2175                 if (ret < cur_read) {
2176                         memset(buf, '\0', cur_read - ret);
2177                 }
2178
2179                 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2180                         return -1;
2181                 }
2182                 tosend -= cur_read;
2183                 startpos += cur_read;
2184         }
2185
2186         return (ssize_t)nread;
2187 }
2188
2189 /****************************************************************************
2190  Use sendfile in readbraw.
2191 ****************************************************************************/
2192
2193 void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T startpos, size_t nread,
2194                 ssize_t mincount, char *outbuf, int out_buffsize)
2195 {
2196         ssize_t ret=0;
2197
2198 #if defined(WITH_SENDFILE)
2199         /*
2200          * We can only use sendfile on a non-chained packet
2201          * but we can use on a non-oplocked file. tridge proved this
2202          * on a train in Germany :-). JRA.
2203          * reply_readbraw has already checked the length.
2204          */
2205
2206         if ( (chain_size == 0) && (nread > 0) &&
2207             (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2208                 DATA_BLOB header;
2209
2210                 _smb_setlen(outbuf,nread);
2211                 header.data = (uint8 *)outbuf;
2212                 header.length = 4;
2213                 header.free = NULL;
2214
2215                 if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fh->fd, &header, startpos, nread) == -1) {
2216                         /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
2217                         if (errno == ENOSYS) {
2218                                 goto normal_readbraw;
2219                         }
2220
2221                         /*
2222                          * Special hack for broken Linux with no working sendfile. If we
2223                          * return EINTR we sent the header but not the rest of the data.
2224                          * Fake this up by doing read/write calls.
2225                          */
2226                         if (errno == EINTR) {
2227                                 /* Ensure we don't do this again. */
2228                                 set_use_sendfile(SNUM(conn), False);
2229                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2230
2231                                 if (fake_sendfile(fsp, startpos, nread, outbuf + 4, out_buffsize - 4) == -1) {
2232                                         DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2233                                                 fsp->fsp_name, strerror(errno) ));
2234                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2235                                 }
2236                                 return;
2237                         }
2238
2239                         DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2240                                 fsp->fsp_name, strerror(errno) ));
2241                         exit_server_cleanly("send_file_readbraw sendfile failed");
2242                 }
2243
2244                 return;
2245         }
2246
2247   normal_readbraw:
2248
2249 #endif
2250
2251         if (nread > 0) {
2252                 ret = read_file(fsp,outbuf+4,startpos,nread);
2253 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2254                 if (ret < mincount)
2255                         ret = 0;
2256 #else
2257                 if (ret < nread)
2258                         ret = 0;
2259 #endif
2260         }
2261
2262         _smb_setlen(outbuf,ret);
2263         if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2264                 fail_readraw();
2265 }
2266
2267 /****************************************************************************
2268  Reply to a readbraw (core+ protocol).
2269 ****************************************************************************/
2270
2271 int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int out_buffsize)
2272 {
2273         ssize_t maxcount,mincount;
2274         size_t nread = 0;
2275         SMB_OFF_T startpos;
2276         char *header = outbuf;
2277         files_struct *fsp;
2278         START_PROFILE(SMBreadbraw);
2279
2280         if (srv_is_signing_active()) {
2281                 exit_server_cleanly("reply_readbraw: SMB signing is active - raw reads/writes are disallowed.");
2282         }
2283
2284         /*
2285          * Special check if an oplock break has been issued
2286          * and the readraw request croses on the wire, we must
2287          * return a zero length response here.
2288          */
2289
2290         fsp = file_fsp(inbuf,smb_vwv0);
2291
2292         if (!FNUM_OK(fsp,conn) || !fsp->can_read) {
2293                 /*
2294                  * fsp could be NULL here so use the value from the packet. JRA.
2295                  */
2296                 DEBUG(3,("fnum %d not open in readbraw - cache prime?\n",(int)SVAL(inbuf,smb_vwv0)));
2297                 _smb_setlen(header,0);
2298                 if (write_data(smbd_server_fd(),header,4) != 4)
2299                         fail_readraw();
2300                 END_PROFILE(SMBreadbraw);
2301                 return(-1);
2302         }
2303
2304         CHECK_FSP(fsp,conn);
2305
2306         flush_write_cache(fsp, READRAW_FLUSH);
2307
2308         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv1);
2309         if(CVAL(inbuf,smb_wct) == 10) {
2310                 /*
2311                  * This is a large offset (64 bit) read.
2312                  */
2313 #ifdef LARGE_SMB_OFF_T
2314
2315                 startpos |= (((SMB_OFF_T)IVAL(inbuf,smb_vwv8)) << 32);
2316
2317 #else /* !LARGE_SMB_OFF_T */
2318
2319                 /*
2320                  * Ensure we haven't been sent a >32 bit offset.
2321                  */
2322
2323                 if(IVAL(inbuf,smb_vwv8) != 0) {
2324                         DEBUG(0,("readbraw - large offset (%x << 32) used and we don't support \
2325 64 bit offsets.\n", (unsigned int)IVAL(inbuf,smb_vwv8) ));
2326                         _smb_setlen(header,0);
2327                         if (write_data(smbd_server_fd(),header,4) != 4)
2328                                 fail_readraw();
2329                         END_PROFILE(SMBreadbraw);
2330                         return(-1);
2331                 }
2332
2333 #endif /* LARGE_SMB_OFF_T */
2334
2335                 if(startpos < 0) {
2336                         DEBUG(0,("readbraw - negative 64 bit readraw offset (%.0f) !\n", (double)startpos ));
2337                         _smb_setlen(header,0);
2338                         if (write_data(smbd_server_fd(),header,4) != 4)
2339                                 fail_readraw();
2340                         END_PROFILE(SMBreadbraw);
2341                         return(-1);
2342                 }
2343         }
2344         maxcount = (SVAL(inbuf,smb_vwv3) & 0xFFFF);
2345         mincount = (SVAL(inbuf,smb_vwv4) & 0xFFFF);
2346
2347         /* ensure we don't overrun the packet size */
2348         maxcount = MIN(65535,maxcount);
2349
2350         if (!is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
2351                 SMB_STRUCT_STAT st;
2352                 SMB_OFF_T size = 0;
2353
2354                 if (SMB_VFS_FSTAT(fsp,fsp->fh->fd,&st) == 0) {
2355                         size = st.st_size;
2356                 }
2357
2358                 if (startpos >= size) {
2359                         nread = 0;
2360                 } else {
2361                         nread = MIN(maxcount,(size - startpos));
2362                 }
2363         }
2364
2365 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2366         if (nread < mincount)
2367                 nread = 0;
2368 #endif
2369
2370         DEBUG( 3, ( "readbraw fnum=%d start=%.0f max=%lu min=%lu nread=%lu\n", fsp->fnum, (double)startpos,
2371                                 (unsigned long)maxcount, (unsigned long)mincount, (unsigned long)nread ) );
2372
2373         send_file_readbraw(conn, fsp, startpos, nread, mincount, outbuf, out_buffsize);
2374
2375         DEBUG(5,("readbraw finished\n"));
2376         END_PROFILE(SMBreadbraw);
2377         return -1;
2378 }
2379
2380 #undef DBGC_CLASS
2381 #define DBGC_CLASS DBGC_LOCKING
2382
2383 /****************************************************************************
2384  Reply to a lockread (core+ protocol).
2385 ****************************************************************************/
2386
2387 int reply_lockread(connection_struct *conn, char *inbuf,char *outbuf, int length, int dum_buffsiz)
2388 {
2389         ssize_t nread = -1;
2390         char *data;
2391         int outsize = 0;
2392         SMB_OFF_T startpos;
2393         size_t numtoread;
2394         NTSTATUS status;
2395         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2396         struct byte_range_lock *br_lck = NULL;
2397         START_PROFILE(SMBlockread);
2398
2399         CHECK_FSP(fsp,conn);
2400         if (!CHECK_READ(fsp,inbuf)) {
2401                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2402         }
2403
2404         release_level_2_oplocks_on_change(fsp);
2405
2406         numtoread = SVAL(inbuf,smb_vwv1);
2407         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
2408
2409         outsize = set_message(inbuf,outbuf,5,3,True);
2410         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
2411         data = smb_buf(outbuf) + 3;
2412
2413         /*
2414          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
2415          * protocol request that predates the read/write lock concept.
2416          * Thus instead of asking for a read lock here we need to ask
2417          * for a write lock. JRA.
2418          * Note that the requested lock size is unaffected by max_recv.
2419          */
2420
2421         br_lck = do_lock(smbd_messaging_context(),
2422                         fsp,
2423                         (uint32)SVAL(inbuf,smb_pid),
2424                         (SMB_BIG_UINT)numtoread,
2425                         (SMB_BIG_UINT)startpos,
2426                         WRITE_LOCK,
2427                         WINDOWS_LOCK,
2428                         False, /* Non-blocking lock. */
2429                         &status);
2430         TALLOC_FREE(br_lck);
2431
2432         if (NT_STATUS_V(status)) {
2433                 END_PROFILE(SMBlockread);
2434                 return ERROR_NT(status);
2435         }
2436
2437         /*
2438          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
2439          */
2440
2441         if (numtoread > max_recv) {
2442                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
2443 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
2444                         (unsigned int)numtoread, (unsigned int)max_recv ));
2445                 numtoread = MIN(numtoread,max_recv);
2446         }
2447         nread = read_file(fsp,data,startpos,numtoread);
2448
2449         if (nread < 0) {
2450                 END_PROFILE(SMBlockread);
2451                 return(UNIXERROR(ERRDOS,ERRnoaccess));
2452         }
2453
2454         outsize += nread;
2455         SSVAL(outbuf,smb_vwv0,nread);
2456         SSVAL(outbuf,smb_vwv5,nread+3);
2457         SSVAL(smb_buf(outbuf),1,nread);
2458
2459         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
2460                  fsp->fnum, (int)numtoread, (int)nread));
2461
2462         END_PROFILE(SMBlockread);
2463         return(outsize);
2464 }
2465
2466 #undef DBGC_CLASS
2467 #define DBGC_CLASS DBGC_ALL
2468
2469 /****************************************************************************
2470  Reply to a read.
2471 ****************************************************************************/
2472
2473 int reply_read(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
2474 {
2475         size_t numtoread;
2476         ssize_t nread = 0;
2477         char *data;
2478         SMB_OFF_T startpos;
2479         int outsize = 0;
2480         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2481         START_PROFILE(SMBread);
2482
2483         CHECK_FSP(fsp,conn);
2484         if (!CHECK_READ(fsp,inbuf)) {
2485                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2486         }
2487
2488         numtoread = SVAL(inbuf,smb_vwv1);
2489         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
2490
2491         outsize = set_message(inbuf,outbuf,5,3,True);
2492         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
2493         /*
2494          * The requested read size cannot be greater than max_recv. JRA.
2495          */
2496         if (numtoread > max_recv) {
2497                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
2498 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
2499                         (unsigned int)numtoread, (unsigned int)max_recv ));
2500                 numtoread = MIN(numtoread,max_recv);
2501         }
2502
2503         data = smb_buf(outbuf) + 3;
2504
2505         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK)) {
2506                 END_PROFILE(SMBread);
2507                 return ERROR_DOS(ERRDOS,ERRlock);
2508         }
2509
2510         if (numtoread > 0)
2511                 nread = read_file(fsp,data,startpos,numtoread);
2512
2513         if (nread < 0) {
2514                 END_PROFILE(SMBread);
2515                 return(UNIXERROR(ERRDOS,ERRnoaccess));
2516         }
2517
2518         outsize += nread;
2519         SSVAL(outbuf,smb_vwv0,nread);
2520         SSVAL(outbuf,smb_vwv5,nread+3);
2521         SCVAL(smb_buf(outbuf),0,1);
2522         SSVAL(smb_buf(outbuf),1,nread);
2523
2524         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
2525                 fsp->fnum, (int)numtoread, (int)nread ) );
2526
2527         END_PROFILE(SMBread);
2528         return(outsize);
2529 }
2530
2531 /****************************************************************************
2532  Setup readX header.
2533 ****************************************************************************/
2534
2535 static int setup_readX_header(char *inbuf, char *outbuf, size_t smb_maxcnt)
2536 {
2537         int outsize;
2538         char *data = smb_buf(outbuf);
2539
2540         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
2541         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
2542         SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
2543         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
2544         SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
2545         SCVAL(outbuf,smb_vwv0,0xFF);
2546         outsize = set_message(inbuf, outbuf,12,smb_maxcnt,False);
2547         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
2548         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
2549         return outsize;
2550 }
2551
2552 /****************************************************************************
2553  Reply to a read and X - possibly using sendfile.
2554 ****************************************************************************/
2555
2556 int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length, int len_outbuf,
2557                 files_struct *fsp, SMB_OFF_T startpos, size_t smb_maxcnt)
2558 {
2559         SMB_STRUCT_STAT sbuf;
2560         int outsize = 0;
2561         ssize_t nread = -1;
2562         char *data = smb_buf(outbuf);
2563
2564         if(SMB_VFS_FSTAT(fsp,fsp->fh->fd, &sbuf) == -1) {
2565                 return(UNIXERROR(ERRDOS,ERRnoaccess));
2566         }
2567
2568         if (startpos > sbuf.st_size) {
2569                 smb_maxcnt = 0;
2570         }
2571
2572         if (smb_maxcnt > (sbuf.st_size - startpos)) {
2573                 smb_maxcnt = (sbuf.st_size - startpos);
2574         }
2575
2576         if (smb_maxcnt == 0) {
2577                 goto normal_read;
2578         }
2579
2580 #if defined(WITH_SENDFILE)
2581         /*
2582          * We can only use sendfile on a non-chained packet
2583          * but we can use on a non-oplocked file. tridge proved this
2584          * on a train in Germany :-). JRA.
2585          */
2586
2587         if ((chain_size == 0) && (CVAL(inbuf,smb_vwv0) == 0xFF) &&
2588             lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
2589                 DATA_BLOB header;
2590
2591                 /*
2592                  * Set up the packet header before send. We
2593                  * assume here the sendfile will work (get the
2594                  * correct amount of data).
2595                  */
2596
2597                 setup_readX_header(inbuf,outbuf,smb_maxcnt);
2598                 set_message(inbuf,outbuf,12,smb_maxcnt,False);
2599                 header.data = (uint8 *)outbuf;
2600                 header.length = data - outbuf;
2601                 header.free = NULL;
2602
2603                 if ((nread = SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fh->fd, &header, startpos, smb_maxcnt)) == -1) {
2604                         /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
2605                         if (errno == ENOSYS) {
2606                                 goto normal_read;
2607                         }
2608
2609                         /*
2610                          * Special hack for broken Linux with no working sendfile. If we
2611                          * return EINTR we sent the header but not the rest of the data.
2612                          * Fake this up by doing read/write calls.
2613                          */
2614
2615                         if (errno == EINTR) {
2616                                 /* Ensure we don't do this again. */
2617                                 set_use_sendfile(SNUM(conn), False);
2618                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
2619
2620                                 if ((nread = fake_sendfile(fsp, startpos, smb_maxcnt, data,
2621                                                         len_outbuf - (data-outbuf))) == -1) {
2622                                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
2623                                                 fsp->fsp_name, strerror(errno) ));
2624                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
2625                                 }
2626                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
2627                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
2628                                 /* Returning -1 here means successful sendfile. */
2629                                 return -1;
2630                         }
2631
2632                         DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
2633                                 fsp->fsp_name, strerror(errno) ));
2634                         exit_server_cleanly("send_file_readX sendfile failed");
2635                 }
2636
2637                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
2638                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
2639                 /* Returning -1 here means successful sendfile. */
2640                 return -1;
2641         }
2642
2643 #endif
2644
2645   normal_read:
2646
2647         if ((smb_maxcnt && 0xFF0000) > 0x10000) {
2648                 int sendlen = setup_readX_header(inbuf,outbuf,smb_maxcnt) - smb_maxcnt;
2649                 /* Send out the header. */
2650                 if (write_data(smbd_server_fd(),outbuf,sendlen) != sendlen) {
2651                         DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
2652                                 fsp->fsp_name, strerror(errno) ));
2653                         exit_server_cleanly("send_file_readX sendfile failed");
2654                 }
2655                 if ((nread = fake_sendfile(fsp, startpos, smb_maxcnt, data,
2656                                         len_outbuf - (data-outbuf))) == -1) {
2657                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
2658                                 fsp->fsp_name, strerror(errno) ));
2659                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
2660                 }
2661                 return -1;
2662         } else {
2663                 nread = read_file(fsp,data,startpos,smb_maxcnt);
2664
2665                 if (nread < 0) {
2666                         return(UNIXERROR(ERRDOS,ERRnoaccess));
2667                 }
2668
2669                 outsize = setup_readX_header(inbuf, outbuf,nread);
2670
2671                 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
2672                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
2673
2674                 /* Returning the number of bytes we want to send back - including header. */
2675                 return outsize;
2676         }
2677 }
2678
2679 /****************************************************************************
2680  Reply to a read and X.
2681 ****************************************************************************/
2682
2683 int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
2684 {
2685         files_struct *fsp = file_fsp(inbuf,smb_vwv2);
2686         SMB_OFF_T startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
2687         ssize_t nread = -1;
2688         size_t smb_maxcnt = SVAL(inbuf,smb_vwv5);
2689         BOOL big_readX = False;
2690 #if 0
2691         size_t smb_mincnt = SVAL(inbuf,smb_vwv6);
2692 #endif
2693
2694         START_PROFILE(SMBreadX);
2695
2696         /* If it's an IPC, pass off the pipe handler. */
2697         if (IS_IPC(conn)) {
2698                 END_PROFILE(SMBreadX);
2699                 return reply_pipe_read_and_X(inbuf,outbuf,length,bufsize);
2700         }
2701
2702         CHECK_FSP(fsp,conn);
2703         if (!CHECK_READ(fsp,inbuf)) {
2704                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2705         }
2706
2707         set_message(inbuf,outbuf,12,0,True);
2708
2709         if (global_client_caps & CAP_LARGE_READX) {
2710                 size_t upper_size = SVAL(inbuf,smb_vwv7);
2711                 smb_maxcnt |= (upper_size<<16);
2712                 if (upper_size > 1) {
2713                         /* Can't do this on a chained packet. */
2714                         if ((CVAL(inbuf,smb_vwv0) != 0xFF)) {
2715                                 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2716                         }
2717                         /* We currently don't do this on signed or sealed data. */
2718                         if (srv_is_signing_active() || srv_encryption_on()) {
2719                                 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2720                         }
2721                         big_readX = True;
2722                 }
2723         }
2724
2725         if(CVAL(inbuf,smb_wct) == 12) {
2726 #ifdef LARGE_SMB_OFF_T
2727                 /*
2728                  * This is a large offset (64 bit) read.
2729                  */
2730                 startpos |= (((SMB_OFF_T)IVAL(inbuf,smb_vwv10)) << 32);
2731
2732 #else /* !LARGE_SMB_OFF_T */
2733
2734                 /*
2735                  * Ensure we haven't been sent a >32 bit offset.
2736                  */
2737
2738                 if(IVAL(inbuf,smb_vwv10) != 0) {
2739                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) used and we don't support \
2740 64 bit offsets.\n", (unsigned int)IVAL(inbuf,smb_vwv10) ));
2741                         END_PROFILE(SMBreadX);
2742                         return ERROR_DOS(ERRDOS,ERRbadaccess);
2743                 }
2744
2745 #endif /* LARGE_SMB_OFF_T */
2746
2747         }
2748
2749         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK)) {
2750                 END_PROFILE(SMBreadX);
2751                 return ERROR_DOS(ERRDOS,ERRlock);
2752         }
2753
2754         if (!big_readX && schedule_aio_read_and_X(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt)) {
2755                 END_PROFILE(SMBreadX);
2756                 return -1;
2757         }
2758
2759         nread = send_file_readX(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt);
2760         /* Only call chain_reply if not an error. */
2761         if (nread != -1 && SVAL(outbuf,smb_rcls) == 0) {
2762                 nread = chain_reply(inbuf,outbuf,length,bufsize);
2763         }
2764
2765         END_PROFILE(SMBreadX);
2766         return nread;
2767 }
2768
2769 /****************************************************************************
2770  Reply to a writebraw (core+ or LANMAN1.0 protocol).
2771 ****************************************************************************/
2772
2773 int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
2774 {
2775         ssize_t nwritten=0;
2776         ssize_t total_written=0;
2777         size_t numtowrite=0;
2778         size_t tcount;
2779         SMB_OFF_T startpos;
2780         char *data=NULL;
2781         BOOL write_through;
2782         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2783         int outsize = 0;
2784         START_PROFILE(SMBwritebraw);
2785
2786         if (srv_is_signing_active()) {
2787                 exit_server_cleanly("reply_writebraw: SMB signing is active - raw reads/writes are disallowed.");
2788         }
2789
2790         CHECK_FSP(fsp,conn);
2791         if (!CHECK_WRITE(fsp)) {
2792                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2793         }
2794
2795         tcount = IVAL(inbuf,smb_vwv1);
2796         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
2797         write_through = BITSETW(inbuf+smb_vwv7,0);
2798
2799         /* We have to deal with slightly different formats depending
2800                 on whether we are using the core+ or lanman1.0 protocol */
2801
2802         if(Protocol <= PROTOCOL_COREPLUS) {
2803                 numtowrite = SVAL(smb_buf(inbuf),-2);
2804                 data = smb_buf(inbuf);
2805         } else {
2806                 numtowrite = SVAL(inbuf,smb_vwv10);
2807                 data = smb_base(inbuf) + SVAL(inbuf, smb_vwv11);
2808         }
2809
2810         /* force the error type */
2811         SCVAL(inbuf,smb_com,SMBwritec);
2812         SCVAL(outbuf,smb_com,SMBwritec);
2813
2814         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
2815                 END_PROFILE(SMBwritebraw);
2816                 return(ERROR_DOS(ERRDOS,ERRlock));
2817         }
2818
2819         if (numtowrite>0)
2820                 nwritten = write_file(fsp,data,startpos,numtowrite);
2821
2822         DEBUG(3,("writebraw1 fnum=%d start=%.0f num=%d wrote=%d sync=%d\n",
2823                 fsp->fnum, (double)startpos, (int)numtowrite, (int)nwritten, (int)write_through));
2824
2825         if (nwritten < (ssize_t)numtowrite)  {
2826                 END_PROFILE(SMBwritebraw);
2827                 return(UNIXERROR(ERRHRD,ERRdiskfull));
2828         }
2829
2830         total_written = nwritten;
2831
2832         /* Return a message to the redirector to tell it to send more bytes */
2833         SCVAL(outbuf,smb_com,SMBwritebraw);
2834         SSVALS(outbuf,smb_vwv0,-1);
2835         outsize = set_message(inbuf,outbuf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
2836         show_msg(outbuf);
2837         if (!send_smb(smbd_server_fd(),outbuf))
2838                 exit_server_cleanly("reply_writebraw: send_smb failed.");
2839
2840         /* Now read the raw data into the buffer and write it */
2841         if (read_smb_length(smbd_server_fd(),inbuf,SMB_SECONDARY_WAIT) == -1) {
2842                 exit_server_cleanly("secondary writebraw failed");
2843         }
2844
2845         /* Even though this is not an smb message, smb_len returns the generic length of an smb message */
2846         numtowrite = smb_len(inbuf);
2847
2848         /* Set up outbuf to return the correct return */
2849         outsize = set_message(inbuf,outbuf,1,0,True);
2850         SCVAL(outbuf,smb_com,SMBwritec);
2851
2852         if (numtowrite != 0) {
2853
2854                 if (numtowrite > BUFFER_SIZE) {
2855                         DEBUG(0,("reply_writebraw: Oversize secondary write raw requested (%u). Terminating\n",
2856                                 (unsigned int)numtowrite ));
2857                         exit_server_cleanly("secondary writebraw failed");
2858                 }
2859
2860                 if (tcount > nwritten+numtowrite) {
2861                         DEBUG(3,("Client overestimated the write %d %d %d\n",
2862                                 (int)tcount,(int)nwritten,(int)numtowrite));
2863                 }
2864
2865                 if (read_data( smbd_server_fd(), inbuf+4, numtowrite) != numtowrite ) {
2866                         DEBUG(0,("reply_writebraw: Oversize secondary write raw read failed (%s). Terminating\n",
2867                                 strerror(errno) ));
2868                         exit_server_cleanly("secondary writebraw failed");
2869                 }
2870
2871                 nwritten = write_file(fsp,inbuf+4,startpos+nwritten,numtowrite);
2872                 if (nwritten == -1) {
2873                         END_PROFILE(SMBwritebraw);
2874                         return(UNIXERROR(ERRHRD,ERRdiskfull));
2875                 }
2876
2877                 if (nwritten < (ssize_t)numtowrite) {
2878                         SCVAL(outbuf,smb_rcls,ERRHRD);
2879                         SSVAL(outbuf,smb_err,ERRdiskfull);
2880                 }
2881
2882                 if (nwritten > 0)
2883                         total_written += nwritten;
2884         }
2885
2886         SSVAL(outbuf,smb_vwv0,total_written);
2887
2888         sync_file(conn, fsp, write_through);
2889
2890         DEBUG(3,("writebraw2 fnum=%d start=%.0f num=%d wrote=%d\n",
2891                 fsp->fnum, (double)startpos, (int)numtowrite,(int)total_written));
2892
2893         /* we won't return a status if write through is not selected - this follows what WfWg does */
2894         END_PROFILE(SMBwritebraw);
2895         if (!write_through && total_written==tcount) {
2896
2897 #if RABBIT_PELLET_FIX
2898                 /*
2899                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
2900                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this. JRA.
2901                  */
2902                 if (!send_keepalive(smbd_server_fd()))
2903                         exit_server_cleanly("reply_writebraw: send of keepalive failed");
2904 #endif
2905                 return(-1);
2906         }
2907
2908         return(outsize);
2909 }
2910
2911 #undef DBGC_CLASS
2912 #define DBGC_CLASS DBGC_LOCKING
2913
2914 /****************************************************************************
2915  Reply to a writeunlock (core+).
2916 ****************************************************************************/
2917
2918 int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
2919                       int size, int dum_buffsize)
2920 {
2921         ssize_t nwritten = -1;
2922         size_t numtowrite;
2923         SMB_OFF_T startpos;
2924         char *data;
2925         NTSTATUS status = NT_STATUS_OK;
2926         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2927         int outsize = 0;
2928         START_PROFILE(SMBwriteunlock);
2929
2930         CHECK_FSP(fsp,conn);
2931         if (!CHECK_WRITE(fsp)) {
2932                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2933         }
2934
2935         numtowrite = SVAL(inbuf,smb_vwv1);
2936         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
2937         data = smb_buf(inbuf) + 3;
2938
2939         if (numtowrite && is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
2940                 END_PROFILE(SMBwriteunlock);
2941                 return ERROR_DOS(ERRDOS,ERRlock);
2942         }
2943
2944         /* The special X/Open SMB protocol handling of
2945            zero length writes is *NOT* done for
2946            this call */
2947         if(numtowrite == 0) {
2948                 nwritten = 0;
2949         } else {
2950                 nwritten = write_file(fsp,data,startpos,numtowrite);
2951         }
2952
2953         sync_file(conn, fsp, False /* write through */);
2954
2955         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
2956                 END_PROFILE(SMBwriteunlock);
2957                 return(UNIXERROR(ERRHRD,ERRdiskfull));
2958         }
2959
2960         if (numtowrite) {
2961                 status = do_unlock(smbd_messaging_context(),
2962                                 fsp,
2963                                 (uint32)SVAL(inbuf,smb_pid),
2964                                 (SMB_BIG_UINT)numtowrite,
2965                                 (SMB_BIG_UINT)startpos,
2966                                 WINDOWS_LOCK);
2967
2968                 if (NT_STATUS_V(status)) {
2969                         END_PROFILE(SMBwriteunlock);
2970                         return ERROR_NT(status);
2971                 }
2972         }
2973
2974         outsize = set_message(inbuf,outbuf,1,0,True);
2975
2976         SSVAL(outbuf,smb_vwv0,nwritten);
2977
2978         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
2979                  fsp->fnum, (int)numtowrite, (int)nwritten));
2980
2981         END_PROFILE(SMBwriteunlock);
2982         return outsize;
2983 }
2984
2985 #undef DBGC_CLASS
2986 #define DBGC_CLASS DBGC_ALL
2987
2988 /****************************************************************************
2989  Reply to a write.
2990 ****************************************************************************/
2991
2992 int reply_write(connection_struct *conn, char *inbuf,char *outbuf,int size,int dum_buffsize)
2993 {
2994         size_t numtowrite;
2995         ssize_t nwritten = -1;
2996         SMB_OFF_T startpos;
2997         char *data;
2998         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2999         int outsize = 0;
3000         START_PROFILE(SMBwrite);
3001
3002         /* If it's an IPC, pass off the pipe handler. */
3003         if (IS_IPC(conn)) {
3004                 END_PROFILE(SMBwrite);
3005                 return reply_pipe_write(inbuf,outbuf,size,dum_buffsize);
3006         }
3007
3008         CHECK_FSP(fsp,conn);
3009         if (!CHECK_WRITE(fsp)) {
3010                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
3011         }
3012
3013         numtowrite = SVAL(inbuf,smb_vwv1);
3014         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
3015         data = smb_buf(inbuf) + 3;
3016
3017         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3018                 END_PROFILE(SMBwrite);
3019                 return ERROR_DOS(ERRDOS,ERRlock);
3020         }
3021
3022         /*
3023          * X/Open SMB protocol says that if smb_vwv1 is
3024          * zero then the file size should be extended or
3025          * truncated to the size given in smb_vwv[2-3].
3026          */
3027
3028         if(numtowrite == 0) {
3029                 /*
3030                  * This is actually an allocate call, and set EOF. JRA.
3031                  */
3032                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3033                 if (nwritten < 0) {
3034                         END_PROFILE(SMBwrite);
3035                         return ERROR_NT(NT_STATUS_DISK_FULL);
3036                 }
3037                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3038                 if (nwritten < 0) {
3039                         END_PROFILE(SMBwrite);
3040                         return ERROR_NT(NT_STATUS_DISK_FULL);
3041                 }
3042         } else
3043                 nwritten = write_file(fsp,data,startpos,numtowrite);
3044
3045         sync_file(conn, fsp, False);
3046
3047         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3048                 END_PROFILE(SMBwrite);
3049                 return(UNIXERROR(ERRHRD,ERRdiskfull));
3050         }
3051
3052         outsize = set_message(inbuf,outbuf,1,0,True);
3053
3054         SSVAL(outbuf,smb_vwv0,nwritten);
3055
3056         if (nwritten < (ssize_t)numtowrite) {
3057                 SCVAL(outbuf,smb_rcls,ERRHRD);
3058                 SSVAL(outbuf,smb_err,ERRdiskfull);
3059         }
3060
3061         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3062
3063         END_PROFILE(SMBwrite);
3064         return(outsize);
3065 }
3066
3067 /****************************************************************************
3068  Reply to a write and X.
3069 ****************************************************************************/
3070
3071 int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
3072 {
3073         files_struct *fsp = file_fsp(inbuf,smb_vwv2);
3074         SMB_OFF_T startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
3075         size_t numtowrite = SVAL(inbuf,smb_vwv10);
3076         BOOL write_through = BITSETW(inbuf+smb_vwv7,0);
3077         ssize_t nwritten = -1;
3078         unsigned int smb_doff = SVAL(inbuf,smb_vwv11);
3079         unsigned int smblen = smb_len(inbuf);
3080         char *data;
3081         BOOL large_writeX = ((CVAL(inbuf,smb_wct) == 14) && (smblen > 0xFFFF));
3082         START_PROFILE(SMBwriteX);
3083
3084         /* If it's an IPC, pass off the pipe handler. */
3085         if (IS_IPC(conn)) {
3086                 END_PROFILE(SMBwriteX);
3087                 return reply_pipe_write_and_X(inbuf,outbuf,length,bufsize);
3088         }
3089
3090         CHECK_FSP(fsp,conn);
3091         if (!CHECK_WRITE(fsp)) {
3092                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
3093         }
3094
3095         set_message(inbuf,outbuf,6,0,True);
3096
3097         /* Deal with possible LARGE_WRITEX */
3098         if (large_writeX) {
3099                 numtowrite |= ((((size_t)SVAL(inbuf,smb_vwv9)) & 1 )<<16);
3100         }
3101
3102         if(smb_doff > smblen || (smb_doff + numtowrite > smblen)) {
3103                 END_PROFILE(SMBwriteX);
3104                 return ERROR_DOS(ERRDOS,ERRbadmem);
3105         }
3106
3107         data = smb_base(inbuf) + smb_doff;
3108
3109         if(CVAL(inbuf,smb_wct) == 14) {
3110 #ifdef LARGE_SMB_OFF_T
3111                 /*
3112                  * This is a large offset (64 bit) write.
3113                  */
3114                 startpos |= (((SMB_OFF_T)IVAL(inbuf,smb_vwv12)) << 32);
3115
3116 #else /* !LARGE_SMB_OFF_T */
3117
3118                 /*
3119                  * Ensure we haven't been sent a >32 bit offset.
3120                  */
3121
3122                 if(IVAL(inbuf,smb_vwv12) != 0) {
3123                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) used and we don't support \
3124 64 bit offsets.\n", (unsigned int)IVAL(inbuf,smb_vwv12) ));
3125                         END_PROFILE(SMBwriteX);
3126                         return ERROR_DOS(ERRDOS,ERRbadaccess);
3127                 }
3128
3129 #endif /* LARGE_SMB_OFF_T */
3130         }
3131
3132         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3133                 END_PROFILE(SMBwriteX);
3134                 return ERROR_DOS(ERRDOS,ERRlock);
3135         }
3136
3137         /* X/Open SMB protocol says that, unlike SMBwrite
3138         if the length is zero then NO truncation is
3139         done, just a write of zero. To truncate a file,
3140         use SMBwrite. */
3141
3142         if(numtowrite == 0) {
3143                 nwritten = 0;
3144         } else {
3145
3146                 if (schedule_aio_write_and_X(conn, inbuf, outbuf, length, bufsize,
3147                                         fsp,data,startpos,numtowrite)) {
3148                         END_PROFILE(SMBwriteX);
3149                         return -1;
3150                 }
3151
3152                 nwritten = write_file(fsp,data,startpos,numtowrite);
3153         }
3154
3155         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3156                 END_PROFILE(SMBwriteX);
3157                 return(UNIXERROR(ERRHRD,ERRdiskfull));
3158         }
3159
3160         SSVAL(outbuf,smb_vwv2,nwritten);
3161         if (large_writeX)
3162                 SSVAL(outbuf,smb_vwv4,(nwritten>>16)&1);
3163
3164         if (nwritten < (ssize_t)numtowrite) {
3165                 SCVAL(outbuf,smb_rcls,ERRHRD);
3166                 SSVAL(outbuf,smb_err,ERRdiskfull);
3167         }
3168
3169         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
3170                 fsp->fnum, (int)numtowrite, (int)nwritten));
3171
3172         sync_file(conn, fsp, write_through);
3173
3174         END_PROFILE(SMBwriteX);
3175         return chain_reply(inbuf,outbuf,length,bufsize);
3176 }
3177
3178 /****************************************************************************
3179  Reply to a lseek.
3180 ****************************************************************************/
3181
3182 int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
3183 {
3184         SMB_OFF_T startpos;
3185         SMB_OFF_T res= -1;
3186         int mode,umode;
3187         int outsize = 0;
3188         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3189         START_PROFILE(SMBlseek);
3190
3191         CHECK_FSP(fsp,conn);
3192
3193         flush_write_cache(fsp, SEEK_FLUSH);
3194
3195         mode = SVAL(inbuf,smb_vwv1) & 3;
3196         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
3197         startpos = (SMB_OFF_T)IVALS(inbuf,smb_vwv2);
3198
3199         switch (mode) {
3200                 case 0:
3201                         umode = SEEK_SET;
3202                         res = startpos;
3203                         break;
3204                 case 1:
3205                         umode = SEEK_CUR;
3206                         res = fsp->fh->pos + startpos;
3207                         break;
3208                 case 2:
3209                         umode = SEEK_END;
3210                         break;
3211                 default:
3212                         umode = SEEK_SET;
3213                         res = startpos;
3214                         break;
3215         }
3216
3217         if (umode == SEEK_END) {
3218                 if((res = SMB_VFS_LSEEK(fsp,fsp->fh->fd,startpos,umode)) == -1) {
3219                         if(errno == EINVAL) {
3220                                 SMB_OFF_T current_pos = startpos;
3221                                 SMB_STRUCT_STAT sbuf;
3222
3223                                 if(SMB_VFS_FSTAT(fsp,fsp->fh->fd, &sbuf) == -1) {
3224                                         END_PROFILE(SMBlseek);
3225                                         return(UNIXERROR(ERRDOS,ERRnoaccess));
3226                                 }
3227
3228                                 current_pos += sbuf.st_size;
3229                                 if(current_pos < 0)
3230                                         res = SMB_VFS_LSEEK(fsp,fsp->fh->fd,0,SEEK_SET);
3231                         }
3232                 }
3233
3234                 if(res == -1) {
3235                         END_PROFILE(SMBlseek);
3236                         return(UNIXERROR(ERRDOS,ERRnoaccess));
3237                 }
3238         }
3239
3240         fsp->fh->pos = res;
3241
3242         outsize = set_message(inbuf,outbuf,2,0,True);
3243         SIVAL(outbuf,smb_vwv0,res);
3244
3245         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
3246                 fsp->fnum, (double)startpos, (double)res, mode));
3247
3248         END_PROFILE(SMBlseek);
3249         return(outsize);
3250 }
3251
3252 /****************************************************************************
3253  Reply to a flush.
3254 ****************************************************************************/
3255
3256 int reply_flush(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
3257 {
3258         int outsize = set_message(inbuf,outbuf,0,0,False);
3259         uint16 fnum = SVAL(inbuf,smb_vwv0);
3260         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3261         START_PROFILE(SMBflush);
3262
3263         if (fnum != 0xFFFF)
3264                 CHECK_FSP(fsp,conn);
3265
3266         if (!fsp) {
3267                 file_sync_all(conn);
3268         } else {
3269                 sync_file(conn,fsp, True);
3270         }
3271
3272         DEBUG(3,("flush\n"));
3273         END_PROFILE(SMBflush);
3274         return(outsize);
3275 }
3276
3277 /****************************************************************************
3278  Reply to a exit.
3279  conn POINTER CAN BE NULL HERE !
3280 ****************************************************************************/
3281
3282 int reply_exit(connection_struct *conn,
3283                char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3284 {
3285         int outsize;
3286         START_PROFILE(SMBexit);
3287
3288         file_close_pid(SVAL(inbuf,smb_pid),SVAL(inbuf,smb_uid));
3289
3290         outsize = set_message(inbuf,outbuf,0,0,False);
3291
3292         DEBUG(3,("exit\n"));
3293
3294         END_PROFILE(SMBexit);
3295         return(outsize);
3296 }
3297
3298 /****************************************************************************
3299  Reply to a close - has to deal with closing a directory opened by NT SMB's.
3300 ****************************************************************************/
3301
3302 int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
3303                 int dum_buffsize)
3304 {
3305         NTSTATUS status = NT_STATUS_OK;
3306         int outsize = 0;
3307         files_struct *fsp = NULL;
3308         START_PROFILE(SMBclose);
3309
3310         outsize = set_message(inbuf,outbuf,0,0,False);
3311
3312         /* If it's an IPC, pass off to the pipe handler. */
3313         if (IS_IPC(conn)) {
3314                 END_PROFILE(SMBclose);
3315                 return reply_pipe_close(conn, inbuf,outbuf);
3316         }
3317
3318         fsp = file_fsp(inbuf,smb_vwv0);
3319
3320         /*
3321          * We can only use CHECK_FSP if we know it's not a directory.
3322          */
3323
3324         if(!fsp || (fsp->conn != conn) || (fsp->vuid != current_user.vuid)) {
3325                 END_PROFILE(SMBclose);
3326                 return ERROR_DOS(ERRDOS,ERRbadfid);
3327         }
3328
3329         if(fsp->is_directory) {
3330                 /*
3331                  * Special case - close NT SMB directory handle.
3332                  */
3333                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
3334                 status = close_file(fsp,NORMAL_CLOSE);
3335         } else {
3336                 /*
3337                  * Close ordinary file.
3338                  */
3339
3340                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
3341                          fsp->fh->fd, fsp->fnum,
3342                          conn->num_files_open));
3343
3344                 /*
3345                  * Take care of any time sent in the close.
3346                  */
3347
3348                 fsp_set_pending_modtime(fsp,
3349                                 convert_time_t_to_timespec(srv_make_unix_date3(inbuf+smb_vwv1)));
3350
3351                 /*
3352                  * close_file() returns the unix errno if an error
3353                  * was detected on close - normally this is due to
3354                  * a disk full error. If not then it was probably an I/O error.
3355                  */
3356
3357                 status = close_file(fsp,NORMAL_CLOSE);
3358         }
3359
3360         if(!NT_STATUS_IS_OK(status)) {
3361                 END_PROFILE(SMBclose);
3362                 return ERROR_NT(status);
3363         }
3364
3365         END_PROFILE(SMBclose);
3366         return(outsize);
3367 }
3368
3369 /****************************************************************************
3370  Reply to a writeclose (Core+ protocol).
3371 ****************************************************************************/
3372
3373 int reply_writeclose(connection_struct *conn,
3374                      char *inbuf,char *outbuf, int size, int dum_buffsize)
3375 {
3376         size_t numtowrite;
3377         ssize_t nwritten = -1;
3378         int outsize = 0;
3379         NTSTATUS close_status = NT_STATUS_OK;
3380         SMB_OFF_T startpos;
3381         char *data;
3382         struct timespec mtime;
3383         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3384         START_PROFILE(SMBwriteclose);
3385
3386         CHECK_FSP(fsp,conn);
3387         if (!CHECK_WRITE(fsp)) {
3388                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
3389         }
3390
3391         numtowrite = SVAL(inbuf,smb_vwv1);
3392         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
3393         mtime = convert_time_t_to_timespec(srv_make_unix_date3(inbuf+smb_vwv4));
3394         data = smb_buf(inbuf) + 1;
3395
3396         if (numtowrite && is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3397                 END_PROFILE(SMBwriteclose);
3398                 return ERROR_DOS(ERRDOS,ERRlock);
3399         }
3400
3401         nwritten = write_file(fsp,data,startpos,numtowrite);
3402
3403         set_filetime(conn, fsp->fsp_name, mtime);
3404
3405         /*
3406          * More insanity. W2K only closes the file if writelen > 0.
3407          * JRA.
3408          */
3409
3410         if (numtowrite) {
3411                 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
3412                         fsp->fsp_name ));
3413                 close_status = close_file(fsp,NORMAL_CLOSE);
3414         }
3415
3416         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
3417                  fsp->fnum, (int)numtowrite, (int)nwritten,
3418                  conn->num_files_open));
3419
3420         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3421                 END_PROFILE(SMBwriteclose);
3422                 return(UNIXERROR(ERRHRD,ERRdiskfull));
3423         }
3424
3425         if(!NT_STATUS_IS_OK(close_status)) {
3426                 END_PROFILE(SMBwriteclose);
3427                 return ERROR_NT(close_status);
3428         }
3429
3430         outsize = set_message(inbuf,outbuf,1,0,True);
3431
3432         SSVAL(outbuf,smb_vwv0,nwritten);
3433         END_PROFILE(SMBwriteclose);
3434         return(outsize);
3435 }
3436
3437 #undef DBGC_CLASS
3438 #define DBGC_CLASS DBGC_LOCKING
3439
3440 /****************************************************************************
3441  Reply to a lock.
3442 ****************************************************************************/
3443
3444 int reply_lock(connection_struct *conn,
3445                char *inbuf,char *outbuf, int length, int dum_buffsize)
3446 {
3447         int outsize = set_message(inbuf,outbuf,0,0,False);
3448         SMB_BIG_UINT count,offset;
3449         NTSTATUS status;
3450         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3451         struct byte_range_lock *br_lck = NULL;
3452
3453         START_PROFILE(SMBlock);
3454
3455         CHECK_FSP(fsp,conn);
3456
3457         release_level_2_oplocks_on_change(fsp);
3458
3459         count = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv1);
3460         offset = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv3);
3461
3462         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
3463                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
3464
3465         br_lck = do_lock(smbd_messaging_context(),
3466                         fsp,
3467                         (uint32)SVAL(inbuf,smb_pid),
3468                         count,
3469                         offset,
3470                         WRITE_LOCK,
3471                         WINDOWS_LOCK,
3472                         False, /* Non-blocking lock. */
3473                         &status);
3474
3475         TALLOC_FREE(br_lck);
3476
3477         if (NT_STATUS_V(status)) {
3478                 END_PROFILE(SMBlock);
3479                 return ERROR_NT(status);
3480         }
3481
3482         END_PROFILE(SMBlock);
3483         return(outsize);
3484 }
3485
3486 /****************************************************************************
3487  Reply to a unlock.
3488 ****************************************************************************/
3489
3490 int reply_unlock(connection_struct *conn, char *inbuf,char *outbuf, int size,
3491                  int dum_buffsize)
3492 {
3493         int outsize = set_message(inbuf,outbuf,0,0,False);
3494         SMB_BIG_UINT count,offset;
3495         NTSTATUS status;
3496         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3497         START_PROFILE(SMBunlock);
3498
3499         CHECK_FSP(fsp,conn);
3500
3501         count = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv1);
3502         offset = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv3);
3503
3504         status = do_unlock(smbd_messaging_context(),
3505                         fsp,
3506                         (uint32)SVAL(inbuf,smb_pid),
3507                         count,
3508                         offset,
3509                         WINDOWS_LOCK);
3510
3511         if (NT_STATUS_V(status)) {
3512                 END_PROFILE(SMBunlock);
3513                 return ERROR_NT(status);
3514         }
3515
3516         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
3517                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
3518
3519         END_PROFILE(SMBunlock);
3520         return(outsize);
3521 }
3522
3523 #undef DBGC_CLASS
3524 #define DBGC_CLASS DBGC_ALL
3525
3526 /****************************************************************************
3527  Reply to a tdis.
3528  conn POINTER CAN BE NULL HERE !
3529 ****************************************************************************/
3530
3531 int reply_tdis(connection_struct *conn,
3532                char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3533 {
3534         int outsize = set_message(inbuf,outbuf,0,0,False);
3535         uint16 vuid;
3536         START_PROFILE(SMBtdis);
3537
3538         vuid = SVAL(inbuf,smb_uid);
3539
3540         if (!conn) {
3541                 DEBUG(4,("Invalid connection in tdis\n"));
3542                 END_PROFILE(SMBtdis);
3543                 return ERROR_DOS(ERRSRV,ERRinvnid);
3544         }
3545
3546         conn->used = False;
3547
3548         close_cnum(conn,vuid);
3549
3550         END_PROFILE(SMBtdis);
3551         return outsize;
3552 }
3553
3554 /****************************************************************************
3555  Reply to a echo.
3556  conn POINTER CAN BE NULL HERE !
3557 ****************************************************************************/
3558
3559 int reply_echo(connection_struct *conn,
3560                char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3561 {
3562         int smb_reverb = SVAL(inbuf,smb_vwv0);
3563         int seq_num;
3564         unsigned int data_len = smb_buflen(inbuf);
3565         int outsize = set_message(inbuf,outbuf,1,data_len,True);
3566         START_PROFILE(SMBecho);
3567
3568         if (data_len > BUFFER_SIZE) {
3569                 DEBUG(0,("reply_echo: data_len too large.\n"));
3570                 END_PROFILE(SMBecho);
3571                 return -1;
3572         }
3573
3574         /* copy any incoming data back out */
3575         if (data_len > 0)
3576                 memcpy(smb_buf(outbuf),smb_buf(inbuf),data_len);
3577
3578         if (smb_reverb > 100) {
3579                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
3580                 smb_reverb = 100;
3581         }
3582
3583         for (seq_num =1 ; seq_num <= smb_reverb ; seq_num++) {
3584                 SSVAL(outbuf,smb_vwv0,seq_num);
3585
3586                 smb_setlen(inbuf,outbuf,outsize - 4);
3587
3588                 show_msg(outbuf);
3589                 if (!send_smb(smbd_server_fd(),outbuf))
3590                         exit_server_cleanly("reply_echo: send_smb failed.");
3591         }
3592
3593         DEBUG(3,("echo %d times\n", smb_reverb));
3594
3595         smb_echo_count++;
3596
3597         END_PROFILE(SMBecho);
3598         return -1;
3599 }
3600
3601 /****************************************************************************
3602  Reply to a printopen.
3603 ****************************************************************************/
3604
3605 int reply_printopen(connection_struct *conn,
3606                     char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3607 {
3608         int outsize = 0;
3609         files_struct *fsp;
3610         NTSTATUS status;
3611
3612         START_PROFILE(SMBsplopen);
3613
3614         if (!CAN_PRINT(conn)) {
3615                 END_PROFILE(SMBsplopen);
3616                 return ERROR_DOS(ERRDOS,ERRnoaccess);
3617         }
3618
3619         /* Open for exclusive use, write only. */
3620         status = print_fsp_open(conn, NULL, &fsp);
3621
3622         if (!NT_STATUS_IS_OK(status)) {
3623                 END_PROFILE(SMBsplopen);
3624                 return(ERROR_NT(status));
3625         }
3626
3627         outsize = set_message(inbuf,outbuf,1,0,True);
3628         SSVAL(outbuf,smb_vwv0,fsp->fnum);
3629
3630         DEBUG(3,("openprint fd=%d fnum=%d\n",
3631                  fsp->fh->fd, fsp->fnum));
3632
3633         END_PROFILE(SMBsplopen);
3634         return(outsize);
3635 }
3636
3637 /****************************************************************************
3638  Reply to a printclose.
3639 ****************************************************************************/
3640
3641 int reply_printclose(connection_struct *conn,
3642                      char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3643 {
3644         int outsize = set_message(inbuf,outbuf,0,0,False);
3645         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3646         NTSTATUS status;
3647         START_PROFILE(SMBsplclose);
3648
3649         CHECK_FSP(fsp,conn);
3650
3651         if (!CAN_PRINT(conn)) {
3652                 END_PROFILE(SMBsplclose);
3653                 return ERROR_NT(NT_STATUS_DOS(ERRSRV, ERRerror));
3654         }
3655
3656         DEBUG(3,("printclose fd=%d fnum=%d\n",
3657                  fsp->fh->fd,fsp->fnum));
3658
3659         status = close_file(fsp,NORMAL_CLOSE);
3660
3661         if(!NT_STATUS_IS_OK(status)) {
3662                 END_PROFILE(SMBsplclose);
3663                 return ERROR_NT(status);
3664         }
3665
3666         END_PROFILE(SMBsplclose);
3667         return(outsize);
3668 }
3669
3670 /****************************************************************************
3671  Reply to a printqueue.
3672 ****************************************************************************/
3673
3674 int reply_printqueue(connection_struct *conn,
3675                      char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3676 {
3677         int outsize = set_message(inbuf,outbuf,2,3,True);
3678         int max_count = SVAL(inbuf,smb_vwv0);
3679         int start_index = SVAL(inbuf,smb_vwv1);
3680         START_PROFILE(SMBsplretq);
3681
3682         /* we used to allow the client to get the cnum wrong, but that
3683            is really quite gross and only worked when there was only
3684            one printer - I think we should now only accept it if they
3685            get it right (tridge) */
3686         if (!CAN_PRINT(conn)) {
3687                 END_PROFILE(SMBsplretq);
3688                 return ERROR_DOS(ERRDOS,ERRnoaccess);
3689         }
3690
3691         SSVAL(outbuf,smb_vwv0,0);
3692         SSVAL(outbuf,smb_vwv1,0);
3693         SCVAL(smb_buf(outbuf),0,1);
3694         SSVAL(smb_buf(outbuf),1,0);
3695
3696         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
3697                  start_index, max_count));
3698
3699         {
3700                 print_queue_struct *queue = NULL;
3701                 print_status_struct status;
3702                 char *p = smb_buf(outbuf) + 3;
3703                 int count = print_queue_status(SNUM(conn), &queue, &status);
3704                 int num_to_get = ABS(max_count);
3705                 int first = (max_count>0?start_index:start_index+max_count+1);
3706                 int i;
3707
3708                 if (first >= count)
3709                         num_to_get = 0;
3710                 else
3711                         num_to_get = MIN(num_to_get,count-first);
3712
3713
3714                 for (i=first;i<first+num_to_get;i++) {
3715                         srv_put_dos_date2(p,0,queue[i].time);
3716                         SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
3717                         SSVAL(p,5, queue[i].job);
3718                         SIVAL(p,7,queue[i].size);
3719                         SCVAL(p,11,0);
3720                         srvstr_push(outbuf, p+12, queue[i].fs_user, 16, STR_ASCII);
3721                         p += 28;
3722                 }
3723
3724                 if (count > 0) {
3725                         outsize = set_message(inbuf,outbuf,2,28*count+3,False);
3726                         SSVAL(outbuf,smb_vwv0,count);
3727                         SSVAL(outbuf,smb_vwv1,(max_count>0?first+count:first-1));
3728                         SCVAL(smb_buf(outbuf),0,1);
3729                         SSVAL(smb_buf(outbuf),1,28*count);
3730                 }
3731
3732                 SAFE_FREE(queue);
3733
3734                 DEBUG(3,("%d entries returned in queue\n",count));
3735         }
3736
3737         END_PROFILE(SMBsplretq);
3738         return(outsize);
3739 }
3740
3741 /****************************************************************************
3742  Reply to a printwrite.
3743 ****************************************************************************/
3744
3745 int reply_printwrite(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3746 {
3747         int numtowrite;
3748         int outsize = set_message(inbuf,outbuf,0,0,False);
3749         char *data;
3750         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3751
3752         START_PROFILE(SMBsplwr);
3753
3754         if (!CAN_PRINT(conn)) {
3755                 END_PROFILE(SMBsplwr);
3756                 return ERROR_DOS(ERRDOS,ERRnoaccess);
3757         }
3758
3759         CHECK_FSP(fsp,conn);
3760         if (!CHECK_WRITE(fsp)) {
3761                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
3762         }
3763
3764         numtowrite = SVAL(smb_buf(inbuf),1);
3765         data = smb_buf(inbuf) + 3;
3766
3767         if (write_file(fsp,data,-1,numtowrite) != numtowrite) {
3768                 END_PROFILE(SMBsplwr);
3769                 return(UNIXERROR(ERRHRD,ERRdiskfull));
3770         }
3771
3772         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
3773
3774         END_PROFILE(SMBsplwr);
3775         return(outsize);
3776 }
3777
3778 /****************************************************************************
3779  Reply to a mkdir.
3780 ****************************************************************************/
3781
3782 int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
3783 {
3784         pstring directory;
3785         int outsize;
3786         NTSTATUS status;
3787         SMB_STRUCT_STAT sbuf;
3788
3789         START_PROFILE(SMBmkdir);
3790
3791         srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status);
3792         if (!NT_STATUS_IS_OK(status)) {
3793                 END_PROFILE(SMBmkdir);
3794                 return ERROR_NT(status);
3795         }
3796
3797         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, directory);
3798         if (!NT_STATUS_IS_OK(status)) {
3799                 END_PROFILE(SMBmkdir);
3800                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
3801                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
3802                 }
3803                 return ERROR_NT(status);
3804         }
3805
3806         status = unix_convert(conn, directory, False, NULL, &sbuf);
3807         if (!NT_STATUS_IS_OK(status)) {
3808                 END_PROFILE(SMBmkdir);
3809                 return ERROR_NT(status);
3810         }
3811
3812         status = check_name(conn, directory);
3813         if (!NT_STATUS_IS_OK(status)) {
3814                 END_PROFILE(SMBmkdir);
3815                 return ERROR_NT(status);
3816         }
3817
3818         status = create_directory(conn, directory);
3819
3820         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
3821
3822         if (!NT_STATUS_IS_OK(status)) {
3823
3824                 if (!use_nt_status()
3825                     && NT_STATUS_EQUAL(status,
3826                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
3827                         /*
3828                          * Yes, in the DOS error code case we get a
3829                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
3830                          * samba4 torture test.
3831                          */
3832                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
3833                 }
3834
3835                 END_PROFILE(SMBmkdir);
3836                 return ERROR_NT(status);
3837         }
3838
3839         outsize = set_message(inbuf,outbuf,0,0,False);
3840
3841         DEBUG( 3, ( "mkdir %s ret=%d\n", directory, outsize ) );
3842
3843         END_PROFILE(SMBmkdir);
3844         return(outsize);
3845 }
3846
3847 /****************************************************************************
3848  Static function used by reply_rmdir to delete an entire directory
3849  tree recursively. Return True on ok, False on fail.
3850 ****************************************************************************/
3851
3852 static BOOL recursive_rmdir(connection_struct *conn, char *directory)
3853 {
3854         const char *dname = NULL;
3855         BOOL ret = True;
3856         long offset = 0;
3857         struct smb_Dir *dir_hnd = OpenDir(conn, directory, NULL, 0);
3858
3859         if(dir_hnd == NULL)
3860                 return False;
3861
3862         while((dname = ReadDirName(dir_hnd, &offset))) {
3863                 pstring fullname;
3864                 SMB_STRUCT_STAT st;
3865
3866                 if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
3867                         continue;
3868
3869                 if (!is_visible_file(conn, directory, dname, &st, False))
3870                         continue;
3871
3872                 /* Construct the full name. */
3873                 if(strlen(directory) + strlen(dname) + 1 >= sizeof(fullname)) {
3874                         errno = ENOMEM;
3875                         ret = False;
3876                         break;
3877                 }
3878
3879                 pstrcpy(fullname, directory);
3880                 pstrcat(fullname, "/");
3881                 pstrcat(fullname, dname);
3882
3883                 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
3884                         ret = False;
3885                         break;
3886                 }
3887
3888                 if(st.st_mode & S_IFDIR) {
3889                         if(!recursive_rmdir(conn, fullname)) {
3890                                 ret = False;
3891                                 break;
3892                         }
3893                         if(SMB_VFS_RMDIR(conn,fullname) != 0) {
3894                                 ret = False;
3895                                 break;
3896                         }
3897                 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
3898                         ret = False;
3899                         break;
3900                 }
3901         }
3902         CloseDir(dir_hnd);
3903         return ret;
3904 }
3905
3906 /****************************************************************************
3907  The internals of the rmdir code - called elsewhere.
3908 ****************************************************************************/
3909
3910 NTSTATUS rmdir_internals(connection_struct *conn, const char *directory)
3911 {
3912         int ret;
3913         SMB_STRUCT_STAT st;
3914
3915         /* Might be a symlink. */
3916         if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
3917                 return map_nt_error_from_unix(errno);
3918         }
3919
3920         if (S_ISLNK(st.st_mode)) {
3921                 /* Is what it points to a directory ? */
3922                 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
3923                         return map_nt_error_from_unix(errno);
3924                 }
3925                 if (!(S_ISDIR(st.st_mode))) {
3926                         return NT_STATUS_NOT_A_DIRECTORY;
3927                 }
3928                 ret = SMB_VFS_UNLINK(conn,directory);
3929         } else {
3930                 ret = SMB_VFS_RMDIR(conn,directory);
3931         }
3932         if (ret == 0) {
3933                 notify_fname(conn, NOTIFY_ACTION_REMOVED,
3934                              FILE_NOTIFY_CHANGE_DIR_NAME,
3935                              directory);
3936                 return NT_STATUS_OK;
3937         }
3938
3939         if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
3940                 /*
3941                  * Check to see if the only thing in this directory are
3942                  * vetoed files/directories. If so then delete them and
3943                  * retry. If we fail to delete any of them (and we *don't*
3944                  * do a recursive delete) then fail the rmdir.
3945                  */
3946                 const char *dname;
3947                 long dirpos = 0;
3948                 struct smb_Dir *dir_hnd = OpenDir(conn, directory, NULL, 0);
3949
3950                 if(dir_hnd == NULL) {
3951                         errno = ENOTEMPTY;
3952                         goto err;
3953                 }
3954
3955                 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
3956                         if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
3957                                 continue;
3958                         if (!is_visible_file(conn, directory, dname, &st, False))
3959                                 continue;
3960                         if(!IS_VETO_PATH(conn, dname)) {
3961                                 CloseDir(dir_hnd);
3962                                 errno = ENOTEMPTY;
3963                                 goto err;
3964                         }
3965                 }
3966
3967                 /* We only have veto files/directories. Recursive delete. */
3968
3969                 RewindDir(dir_hnd,&dirpos);
3970                 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
3971                         pstring fullname;
3972
3973                         if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
3974                                 continue;
3975                         if (!is_visible_file(conn, directory, dname, &st, False))
3976                                 continue;
3977
3978                         /* Construct the full name. */
3979                         if(strlen(directory) + strlen(dname) + 1 >= sizeof(fullname)) {
3980                                 errno = ENOMEM;
3981                                 break;
3982                         }
3983
3984                         pstrcpy(fullname, directory);
3985                         pstrcat(fullname, "/");
3986                         pstrcat(fullname, dname);
3987
3988                         if(SMB_VFS_LSTAT(conn,fullname, &st) != 0)
3989                                 break;
3990                         if(st.st_mode & S_IFDIR) {
3991                                 if(lp_recursive_veto_delete(SNUM(conn))) {
3992                                         if(!recursive_rmdir(conn, fullname))
3993                                                 break;
3994                                 }
3995                                 if(SMB_VFS_RMDIR(conn,fullname) != 0)
3996                                         break;
3997                         } else if(SMB_VFS_UNLINK(conn,fullname) != 0)
3998                                 break;
3999                 }
4000                 CloseDir(dir_hnd);
4001                 /* Retry the rmdir */
4002                 ret = SMB_VFS_RMDIR(conn,directory);
4003         }
4004
4005   err:
4006
4007         if (ret != 0) {
4008                 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
4009                          "%s\n", directory,strerror(errno)));
4010                 return map_nt_error_from_unix(errno);
4011         }
4012
4013         notify_fname(conn, NOTIFY_ACTION_REMOVED,
4014                      FILE_NOTIFY_CHANGE_DIR_NAME,
4015                      directory);
4016
4017         return NT_STATUS_OK;
4018 }
4019
4020 /****************************************************************************
4021  Reply to a rmdir.
4022 ****************************************************************************/
4023
4024 int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
4025 {
4026         pstring directory;
4027         int outsize = 0;
4028         SMB_STRUCT_STAT sbuf;
4029         NTSTATUS status;
4030         START_PROFILE(SMBrmdir);
4031
4032         srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status);
4033         if (!NT_STATUS_IS_OK(status)) {
4034                 END_PROFILE(SMBrmdir);
4035                 return ERROR_NT(status);
4036         }
4037
4038         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, directory);
4039         if (!NT_STATUS_IS_OK(status)) {
4040                 END_PROFILE(SMBrmdir);
4041                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4042                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
4043                 }
4044                 return ERROR_NT(status);
4045         }
4046
4047         status = unix_convert(conn, directory, False, NULL, &sbuf);
4048         if (!NT_STATUS_IS_OK(status)) {
4049                 END_PROFILE(SMBrmdir);
4050                 return ERROR_NT(status);
4051         }
4052
4053         status = check_name(conn, directory);
4054         if (!NT_STATUS_IS_OK(status)) {
4055                 END_PROFILE(SMBrmdir);
4056                 return ERROR_NT(status);
4057         }
4058
4059         dptr_closepath(directory,SVAL(inbuf,smb_pid));
4060         status = rmdir_internals(conn, directory);
4061         if (!NT_STATUS_IS_OK(status)) {
4062                 END_PROFILE(SMBrmdir);
4063                 return ERROR_NT(status);
4064         }
4065
4066         outsize = set_message(inbuf,outbuf,0,0,False);
4067
4068         DEBUG( 3, ( "rmdir %s\n", directory ) );
4069
4070         END_PROFILE(SMBrmdir);
4071         return(outsize);
4072 }
4073
4074 /*******************************************************************
4075  Resolve wildcards in a filename rename.
4076  Note that name is in UNIX charset and thus potentially can be more
4077  than fstring buffer (255 bytes) especially in default UTF-8 case.
4078  Therefore, we use pstring inside and all calls should ensure that
4079  name2 is at least pstring-long (they do already)
4080 ********************************************************************/
4081
4082 static BOOL resolve_wildcards(const char *name1, char *name2)
4083 {
4084         pstring root1,root2;
4085         pstring ext1,ext2;
4086         char *p,*p2, *pname1, *pname2;
4087         int available_space, actual_space;
4088
4089         pname1 = strrchr_m(name1,'/');
4090         pname2 = strrchr_m(name2,'/');
4091
4092         if (!pname1 || !pname2)
4093                 return(False);
4094
4095         pstrcpy(root1,pname1);
4096         pstrcpy(root2,pname2);
4097         p = strrchr_m(root1,'.');
4098         if (p) {
4099                 *p = 0;
4100                 pstrcpy(ext1,p+1);
4101         } else {
4102                 pstrcpy(ext1,"");
4103         }
4104         p = strrchr_m(root2,'.');
4105         if (p) {
4106                 *p = 0;
4107                 pstrcpy(ext2,p+1);
4108         } else {
4109                 pstrcpy(ext2,"");
4110         }
4111
4112         p = root1;
4113         p2 = root2;
4114         while (*p2) {
4115                 if (*p2 == '?') {
4116                         *p2 = *p;
4117                         p2++;
4118                 } else if (*p2 == '*') {
4119                         pstrcpy(p2, p);
4120                         break;
4121                 } else {
4122                         p2++;
4123                 }
4124                 if (*p)
4125                         p++;
4126         }
4127
4128         p = ext1;
4129         p2 = ext2;
4130         while (*p2) {
4131                 if (*p2 == '?') {
4132                         *p2 = *p;
4133                         p2++;
4134                 } else if (*p2 == '*') {
4135                         pstrcpy(p2, p);
4136                         break;
4137                 } else {
4138                         p2++;
4139                 }
4140                 if (*p)
4141                         p++;
4142         }
4143
4144         available_space = sizeof(pstring) - PTR_DIFF(pname2, name2);
4145
4146         if (ext2[0]) {
4147                 actual_space = snprintf(pname2, available_space - 1, "%s.%s", root2, ext2);
4148                 if (actual_space >= available_space - 1) {
4149                         DEBUG(1,("resolve_wildcards: can't fit resolved name into specified buffer (overrun by %d bytes)\n",
4150                                 actual_space - available_space));
4151                 }
4152         } else {
4153                 pstrcpy_base(pname2, root2, name2);
4154         }
4155
4156         return(True);
4157 }
4158
4159 /****************************************************************************
4160  Ensure open files have their names updated. Updated to notify other smbd's
4161  asynchronously.
4162 ****************************************************************************/
4163
4164 static void rename_open_files(connection_struct *conn, struct share_mode_lock *lck,
4165                                 SMB_DEV_T dev, SMB_INO_T inode, const char *newname)
4166 {
4167         files_struct *fsp;
4168         BOOL did_rename = False;
4169
4170         for(fsp = file_find_di_first(dev, inode); fsp; fsp = file_find_di_next(fsp)) {
4171                 /* fsp_name is a relative path under the fsp. To change this for other
4172                    sharepaths we need to manipulate relative paths. */
4173                 /* TODO - create the absolute path and manipulate the newname
4174                    relative to the sharepath. */
4175                 if (fsp->conn != conn) {
4176                         continue;
4177                 }
4178                 DEBUG(10,("rename_open_files: renaming file fnum %d (dev = %x, inode = %.0f) from %s -> %s\n",
4179                         fsp->fnum, (unsigned int)fsp->dev, (double)fsp->inode,
4180                         fsp->fsp_name, newname ));
4181                 string_set(&fsp->fsp_name, newname);
4182                 did_rename = True;
4183         }
4184
4185         if (!did_rename) {
4186                 DEBUG(10,("rename_open_files: no open files on dev %x, inode %.0f for %s\n",
4187                         (unsigned int)dev, (double)inode, newname ));
4188         }
4189
4190         /* Send messages to all smbd's (not ourself) that the name has changed. */
4191         rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
4192                               newname);
4193 }
4194
4195 /****************************************************************************
4196  We need to check if the source path is a parent directory of the destination
4197  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
4198  refuse the rename with a sharing violation. Under UNIX the above call can
4199  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
4200  probably need to check that the client is a Windows one before disallowing
4201  this as a UNIX client (one with UNIX extensions) can know the source is a
4202  symlink and make this decision intelligently. Found by an excellent bug
4203  report from <AndyLiebman@aol.com>.
4204 ****************************************************************************/
4205
4206 static BOOL rename_path_prefix_equal(const char *src, const char *dest)
4207 {
4208         const char *psrc = src;
4209         const char *pdst = dest;
4210         size_t slen;
4211
4212         if (psrc[0] == '.' && psrc[1] == '/') {
4213                 psrc += 2;
4214         }
4215         if (pdst[0] == '.' && pdst[1] == '/') {
4216                 pdst += 2;
4217         }
4218         if ((slen = strlen(psrc)) > strlen(pdst)) {
4219                 return False;
4220         }
4221         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
4222 }
4223
4224 /****************************************************************************
4225  Rename an open file - given an fsp.
4226 ****************************************************************************/
4227
4228 NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, pstring newname, uint32 attrs, BOOL replace_if_exists)
4229 {
4230         SMB_STRUCT_STAT sbuf;
4231         pstring newname_last_component;
4232         NTSTATUS status = NT_STATUS_OK;
4233         BOOL dest_exists;
4234         struct share_mode_lock *lck = NULL;
4235
4236         ZERO_STRUCT(sbuf);
4237
4238         status = unix_convert(conn, newname, False, newname_last_component, &sbuf);
4239         if (!NT_STATUS_IS_OK(status)) {
4240                 return status;
4241         }
4242
4243         status = check_name(conn, newname);
4244         if (!NT_STATUS_IS_OK(status)) {
4245                 return status;
4246         }
4247
4248         /* Ensure newname contains a '/' */
4249         if(strrchr_m(newname,'/') == 0) {
4250                 pstring tmpstr;
4251
4252                 pstrcpy(tmpstr, "./");
4253                 pstrcat(tmpstr, newname);
4254                 pstrcpy(newname, tmpstr);
4255         }
4256
4257         /*
4258          * Check for special case with case preserving and not
4259          * case sensitive. If the old last component differs from the original
4260          * last component only by case, then we should allow
4261          * the rename (user is trying to change the case of the
4262          * filename).
4263          */
4264
4265         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
4266                         strequal(newname, fsp->fsp_name)) {
4267                 char *p;
4268                 pstring newname_modified_last_component;
4269
4270                 /*
4271                  * Get the last component of the modified name.
4272                  * Note that we guarantee that newname contains a '/'
4273                  * character above.
4274                  */
4275                 p = strrchr_m(newname,'/');
4276                 pstrcpy(newname_modified_last_component,p+1);
4277
4278                 if(strcsequal(newname_modified_last_component,
4279                               newname_last_component) == False) {
4280                         /*
4281                          * Replace the modified last component with
4282                          * the original.
4283                          */
4284                         pstrcpy(p+1, newname_last_component);
4285                 }
4286         }
4287
4288         /*
4289          * If the src and dest names are identical - including case,
4290          * don't do the rename, just return success.
4291          */
4292
4293         if (strcsequal(fsp->fsp_name, newname)) {
4294                 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
4295                         newname));
4296                 return NT_STATUS_OK;
4297         }
4298
4299         dest_exists = vfs_object_exist(conn,newname,NULL);
4300
4301         if(!replace_if_exists && dest_exists) {
4302                 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
4303                         fsp->fsp_name,newname));
4304                 return NT_STATUS_OBJECT_NAME_COLLISION;
4305         }
4306
4307         status = can_rename(conn,newname,attrs,&sbuf);
4308
4309         if (dest_exists && !NT_STATUS_IS_OK(status)) {
4310                 DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
4311                         nt_errstr(status), fsp->fsp_name,newname));
4312                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
4313                         status = NT_STATUS_ACCESS_DENIED;
4314                 return status;
4315         }
4316
4317         if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
4318                 return NT_STATUS_ACCESS_DENIED;
4319         }
4320
4321         lck = get_share_mode_lock(NULL, fsp->dev, fsp->inode, NULL, NULL);
4322
4323         if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
4324                 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
4325                         fsp->fsp_name,newname));
4326                 rename_open_files(conn, lck, fsp->dev, fsp->inode, newname);
4327                 TALLOC_FREE(lck);
4328                 return NT_STATUS_OK;
4329         }
4330
4331         TALLOC_FREE(lck);
4332
4333         if (errno == ENOTDIR || errno == EISDIR) {
4334                 status = NT_STATUS_OBJECT_NAME_COLLISION;
4335         } else {
4336                 status = map_nt_error_from_unix(errno);
4337         }
4338
4339         DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
4340                 nt_errstr(status), fsp->fsp_name,newname));
4341
4342         return status;
4343 }
4344
4345 /*
4346  * Do the notify calls from a rename
4347  */
4348
4349 static void notify_rename(connection_struct *conn, BOOL is_dir,
4350                           const char *oldpath, const char *newpath)
4351 {
4352         char *olddir, *newdir;
4353         const char *oldname, *newname;
4354         uint32 mask;
4355
4356         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
4357                 : FILE_NOTIFY_CHANGE_FILE_NAME;
4358
4359         if (!parent_dirname_talloc(NULL, oldpath, &olddir, &oldname)
4360             || !parent_dirname_talloc(NULL, newpath, &newdir, &newname)) {
4361                 TALLOC_FREE(olddir);
4362                 return;
4363         }
4364
4365         if (strcmp(olddir, newdir) == 0) {
4366                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
4367                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
4368         }
4369         else {
4370                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
4371                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
4372         }
4373         TALLOC_FREE(olddir);
4374         TALLOC_FREE(newdir);
4375
4376         /* this is a strange one. w2k3 gives an additional event for
4377            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
4378            files, but not directories */
4379         if (!is_dir) {
4380                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
4381                              FILE_NOTIFY_CHANGE_ATTRIBUTES
4382                              |FILE_NOTIFY_CHANGE_CREATION,
4383                              newpath);
4384         }
4385 }
4386
4387 /****************************************************************************
4388  The guts of the rename command, split out so it may be called by the NT SMB
4389  code.
4390 ****************************************************************************/
4391
4392 NTSTATUS rename_internals(connection_struct *conn,
4393                                 pstring name,
4394                                 pstring newname,
4395                                 uint32 attrs,
4396                                 BOOL replace_if_exists,
4397                                 BOOL src_has_wild,
4398                                 BOOL dest_has_wild)
4399 {
4400         pstring directory;
4401         pstring mask;
4402         pstring last_component_src;
4403         pstring last_component_dest;
4404         char *p;
4405         int count=0;
4406         NTSTATUS status = NT_STATUS_OK;
4407         SMB_STRUCT_STAT sbuf1, sbuf2;
4408         struct share_mode_lock *lck = NULL;
4409         struct smb_Dir *dir_hnd = NULL;
4410         const char *dname;
4411         long offset = 0;
4412         pstring destname;
4413
4414         *directory = *mask = 0;
4415
4416         ZERO_STRUCT(sbuf1);
4417         ZERO_STRUCT(sbuf2);
4418
4419         status = unix_convert(conn, name, src_has_wild, last_component_src, &sbuf1);
4420         if (!NT_STATUS_IS_OK(status)) {
4421                 return status;
4422         }
4423
4424         status = unix_convert(conn, newname, dest_has_wild, last_component_dest, &sbuf2);
4425         if (!NT_STATUS_IS_OK(status)) {
4426                 return status;
4427         }
4428
4429         /*
4430          * Split the old name into directory and last component
4431          * strings. Note that unix_convert may have stripped off a
4432          * leading ./ from both name and newname if the rename is
4433          * at the root of the share. We need to make sure either both
4434          * name and newname contain a / character or neither of them do
4435          * as this is checked in resolve_wildcards().
4436          */
4437
4438         p = strrchr_m(name,'/');
4439         if (!p) {
4440                 pstrcpy(directory,".");
4441                 pstrcpy(mask,name);
4442         } else {
4443                 *p = 0;
4444                 pstrcpy(directory,name);
4445                 pstrcpy(mask,p+1);
4446                 *p = '/'; /* Replace needed for exceptional test below. */
4447         }
4448
4449         /*
4450          * We should only check the mangled cache
4451          * here if unix_convert failed. This means
4452          * that the path in 'mask' doesn't exist
4453          * on the file system and so we need to look
4454          * for a possible mangle. This patch from
4455          * Tine Smukavec <valentin.smukavec@hermes.si>.
4456          */
4457
4458         if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
4459                 mangle_check_cache( mask, sizeof(pstring)-1, conn->params );
4460         }
4461
4462         if (!src_has_wild) {
4463                 /*
4464                  * No wildcards - just process the one file.
4465                  */
4466                 BOOL is_short_name = mangle_is_8_3(name, True, conn->params);
4467
4468                 /* Add a terminating '/' to the directory name. */
4469                 pstrcat(directory,"/");
4470                 pstrcat(directory,mask);
4471
4472                 /* Ensure newname contains a '/' also */
4473                 if(strrchr_m(newname,'/') == 0) {
4474                         pstring tmpstr;
4475
4476                         pstrcpy(tmpstr, "./");
4477                         pstrcat(tmpstr, newname);
4478                         pstrcpy(newname, tmpstr);
4479                 }
4480
4481                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
4482                           "case_preserve = %d, short case preserve = %d, "
4483                           "directory = %s, newname = %s, "
4484                           "last_component_dest = %s, is_8_3 = %d\n",
4485                           conn->case_sensitive, conn->case_preserve,
4486                           conn->short_case_preserve, directory,
4487                           newname, last_component_dest, is_short_name));
4488
4489                 /* Ensure the source name is valid for us to access. */
4490                 status = check_name(conn, directory);
4491                 if (!NT_STATUS_IS_OK(status)) {
4492                         return status;
4493                 }
4494
4495                 /* The dest name still may have wildcards. */
4496                 if (dest_has_wild) {
4497                         if (!resolve_wildcards(directory,newname)) {
4498                                 DEBUG(6, ("rename_internals: resolve_wildcards %s %s failed\n",
4499                                           directory,newname));
4500                                 return NT_STATUS_NO_MEMORY;
4501                         }
4502                 }
4503
4504                 /*
4505                  * Check for special case with case preserving and not
4506                  * case sensitive, if directory and newname are identical,
4507                  * and the old last component differs from the original
4508                  * last component only by case, then we should allow
4509                  * the rename (user is trying to change the case of the
4510                  * filename).
4511                  */
4512                 if((conn->case_sensitive == False) &&
4513                    (((conn->case_preserve == True) &&
4514                      (is_short_name == False)) ||
4515                     ((conn->short_case_preserve == True) &&
4516                      (is_short_name == True))) &&
4517                    strcsequal(directory, newname)) {
4518                         pstring modified_last_component;
4519
4520                         /*
4521                          * Get the last component of the modified name.
4522                          * Note that we guarantee that newname contains a '/'
4523                          * character above.
4524                          */
4525                         p = strrchr_m(newname,'/');
4526                         pstrcpy(modified_last_component,p+1);
4527
4528                         if(strcsequal(modified_last_component,
4529                                       last_component_dest) == False) {
4530                                 /*
4531                                  * Replace the modified last component with
4532                                  * the original.
4533                                  */
4534                                 pstrcpy(p+1, last_component_dest);
4535                         }
4536                 }
4537
4538                 /* Ensure the dest name is valid for us to access. */
4539                 status = check_name(conn, newname);
4540                 if (!NT_STATUS_IS_OK(status)) {
4541                         return status;
4542                 }
4543
4544                 /*
4545                  * The source object must exist.
4546                  */
4547
4548                 if (!vfs_object_exist(conn, directory, &sbuf1)) {
4549                         DEBUG(3, ("rename_internals: source doesn't exist "
4550                                   "doing rename %s -> %s\n",
4551                                 directory,newname));
4552
4553                         if (errno == ENOTDIR || errno == EISDIR
4554                             || errno == ENOENT) {
4555                                 /*
4556                                  * Must return different errors depending on
4557                                  * whether the parent directory existed or
4558                                  * not.
4559                                  */
4560
4561                                 p = strrchr_m(directory, '/');
4562                                 if (!p)
4563                                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4564                                 *p = '\0';
4565                                 if (vfs_object_exist(conn, directory, NULL))
4566                                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4567                                 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
4568                         }
4569                         status = map_nt_error_from_unix(errno);
4570                         DEBUG(3, ("rename_internals: Error %s rename %s -> "
4571                                   "%s\n", nt_errstr(status), directory,
4572                                   newname));
4573
4574                         return status;
4575                 }
4576
4577                 status = can_rename(conn,directory,attrs,&sbuf1);
4578
4579                 if (!NT_STATUS_IS_OK(status)) {
4580                         DEBUG(3,("rename_internals: Error %s rename %s -> "
4581                                  "%s\n", nt_errstr(status), directory,
4582                                  newname));
4583                         return status;
4584                 }
4585
4586                 /*
4587                  * If the src and dest names are identical - including case,
4588                  * don't do the rename, just return success.
4589                  */
4590
4591                 if (strcsequal(directory, newname)) {
4592                         rename_open_files(conn, NULL, sbuf1.st_dev,
4593                                           sbuf1.st_ino, newname);
4594                         DEBUG(3, ("rename_internals: identical names in "
4595                                   "rename %s - returning success\n",
4596                                   directory));
4597                         return NT_STATUS_OK;
4598                 }
4599
4600                 if(!replace_if_exists && vfs_object_exist(conn,newname,NULL)) {
4601                         DEBUG(3,("rename_internals: dest exists doing "
4602                                  "rename %s -> %s\n", directory, newname));
4603                         return NT_STATUS_OBJECT_NAME_COLLISION;
4604                 }
4605
4606                 if (rename_path_prefix_equal(directory, newname)) {
4607                         return NT_STATUS_SHARING_VIOLATION;
4608                 }
4609
4610                 lck = get_share_mode_lock(NULL, sbuf1.st_dev, sbuf1.st_ino,
4611                                           NULL, NULL);
4612
4613                 if(SMB_VFS_RENAME(conn,directory, newname) == 0) {
4614                         DEBUG(3,("rename_internals: succeeded doing rename "
4615                                  "on %s -> %s\n", directory, newname));
4616                         rename_open_files(conn, lck, sbuf1.st_dev,
4617                                           sbuf1.st_ino, newname);
4618                         TALLOC_FREE(lck);
4619                         notify_rename(conn, S_ISDIR(sbuf1.st_mode),
4620                                       directory, newname);
4621                         return NT_STATUS_OK;
4622                 }
4623
4624                 TALLOC_FREE(lck);
4625                 if (errno == ENOTDIR || errno == EISDIR) {
4626                         status = NT_STATUS_OBJECT_NAME_COLLISION;
4627                 } else {
4628                         status = map_nt_error_from_unix(errno);
4629                 }
4630
4631                 DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
4632                         nt_errstr(status), directory,newname));
4633
4634                 return status;
4635         }
4636
4637         /*
4638          * Wildcards - process each file that matches.
4639          */
4640         if (strequal(mask,"????????.???")) {
4641                 pstrcpy(mask,"*");
4642         }
4643
4644         status = check_name(conn, directory);
4645         if (!NT_STATUS_IS_OK(status)) {
4646                 return status;
4647         }
4648
4649         dir_hnd = OpenDir(conn, directory, mask, attrs);
4650         if (dir_hnd == NULL) {
4651                 return map_nt_error_from_unix(errno);
4652         }
4653
4654         status = NT_STATUS_NO_SUCH_FILE;
4655         /*
4656          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
4657          * - gentest fix. JRA
4658          */
4659
4660         while ((dname = ReadDirName(dir_hnd, &offset))) {
4661                 pstring fname;
4662                 BOOL sysdir_entry = False;
4663
4664                 pstrcpy(fname,dname);
4665
4666                 /* Quick check for "." and ".." */
4667                 if (fname[0] == '.') {
4668                         if (!fname[1] || (fname[1] == '.' && !fname[2])) {
4669                                 if (attrs & aDIR) {
4670                                         sysdir_entry = True;
4671                                 } else {
4672                                         continue;
4673                                 }
4674                         }
4675                 }
4676
4677                 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
4678                         continue;
4679                 }
4680
4681                 if(!mask_match(fname, mask, conn->case_sensitive)) {
4682                         continue;
4683                 }
4684
4685                 if (sysdir_entry) {
4686                         status = NT_STATUS_OBJECT_NAME_INVALID;
4687                         break;
4688                 }
4689
4690                 status = NT_STATUS_ACCESS_DENIED;
4691                 slprintf(fname, sizeof(fname)-1, "%s/%s", directory, dname);
4692
4693                 /* Ensure the source name is valid for us to access. */
4694                 status = check_name(conn, fname);
4695                 if (!NT_STATUS_IS_OK(status)) {
4696                         return status;
4697                 }
4698
4699                 if (!vfs_object_exist(conn, fname, &sbuf1)) {
4700                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
4701                         DEBUG(6, ("rename %s failed. Error %s\n",
4702                                   fname, nt_errstr(status)));
4703                         continue;
4704                 }
4705                 status = can_rename(conn,fname,attrs,&sbuf1);
4706                 if (!NT_STATUS_IS_OK(status)) {
4707                         DEBUG(6, ("rename %s refused\n", fname));
4708                         continue;
4709                 }
4710                 pstrcpy(destname,newname);
4711
4712                 if (!resolve_wildcards(fname,destname)) {
4713                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
4714                                   fname, destname));
4715                         continue;
4716                 }
4717
4718                 /* Ensure the dest name is valid for us to access. */
4719                 status = check_name(conn, destname);
4720                 if (!NT_STATUS_IS_OK(status)) {
4721                         return status;
4722                 }
4723
4724                 if (strcsequal(fname,destname)) {
4725                         rename_open_files(conn, NULL, sbuf1.st_dev,
4726                                           sbuf1.st_ino, newname);
4727                         DEBUG(3,("rename_internals: identical names "
4728                                  "in wildcard rename %s - success\n",
4729                                  fname));
4730                         count++;
4731                         status = NT_STATUS_OK;
4732                         continue;
4733                 }
4734
4735                 if (!replace_if_exists && vfs_file_exist(conn,destname, NULL)) {
4736                         DEBUG(6,("file_exist %s\n", destname));
4737                         status = NT_STATUS_OBJECT_NAME_COLLISION;
4738                         continue;
4739                 }
4740
4741                 if (rename_path_prefix_equal(fname, destname)) {
4742                         return NT_STATUS_SHARING_VIOLATION;
4743                 }
4744
4745                 lck = get_share_mode_lock(NULL, sbuf1.st_dev,
4746                                           sbuf1.st_ino, NULL, NULL);
4747
4748                 if (!SMB_VFS_RENAME(conn,fname,destname)) {
4749                         rename_open_files(conn, lck, sbuf1.st_dev,
4750                                           sbuf1.st_ino, newname);
4751                         count++;
4752                         status = NT_STATUS_OK;
4753                 }
4754                 TALLOC_FREE(lck);
4755                 DEBUG(3,("rename_internals: doing rename on %s -> "
4756                          "%s\n",fname,destname));
4757         }
4758         CloseDir(dir_hnd);
4759
4760         if (count == 0 && NT_STATUS_IS_OK(status)) {
4761                 status = map_nt_error_from_unix(errno);
4762         }
4763
4764         return status;
4765 }
4766
4767 /****************************************************************************
4768  Reply to a mv.
4769 ****************************************************************************/
4770
4771 int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
4772              int dum_buffsize)
4773 {
4774         int outsize = 0;
4775         pstring name;
4776         pstring newname;
4777         char *p;
4778         uint32 attrs = SVAL(inbuf,smb_vwv0);
4779         NTSTATUS status;
4780         BOOL src_has_wcard = False;
4781         BOOL dest_has_wcard = False;
4782
4783         START_PROFILE(SMBmv);
4784
4785         p = smb_buf(inbuf) + 1;
4786         p += srvstr_get_path_wcard(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, &src_has_wcard);
4787         if (!NT_STATUS_IS_OK(status)) {
4788                 END_PROFILE(SMBmv);
4789                 return ERROR_NT(status);
4790         }
4791         p++;
4792         p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &dest_has_wcard);
4793         if (!NT_STATUS_IS_OK(status)) {
4794                 END_PROFILE(SMBmv);
4795                 return ERROR_NT(status);
4796         }
4797
4798         status = resolve_dfspath_wcard(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, name, &src_has_wcard);
4799         if (!NT_STATUS_IS_OK(status)) {
4800                 END_PROFILE(SMBmv);
4801                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4802                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
4803                 }
4804                 return ERROR_NT(status);
4805         }
4806
4807         status = resolve_dfspath_wcard(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, newname, &dest_has_wcard);
4808         if (!NT_STATUS_IS_OK(status)) {
4809                 END_PROFILE(SMBmv);
4810                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4811                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
4812                 }
4813                 return ERROR_NT(status);
4814         }
4815
4816         DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
4817
4818         status = rename_internals(conn, name, newname, attrs, False, src_has_wcard, dest_has_wcard);
4819         if (!NT_STATUS_IS_OK(status)) {
4820                 END_PROFILE(SMBmv);
4821                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
4822                         /* We have re-scheduled this call. */
4823                         return -1;
4824                 }
4825                 return ERROR_NT(status);
4826         }
4827
4828         outsize = set_message(inbuf,outbuf,0,0,False);
4829
4830         END_PROFILE(SMBmv);
4831         return(outsize);
4832 }
4833
4834 /*******************************************************************
4835  Copy a file as part of a reply_copy.
4836 ******************************************************************/
4837
4838 /*
4839  * TODO: check error codes on all callers
4840  */
4841
4842 NTSTATUS copy_file(connection_struct *conn,
4843                         char *src,
4844                         char *dest1,
4845                         int ofun,
4846                         int count,
4847                         BOOL target_is_directory)
4848 {
4849         SMB_STRUCT_STAT src_sbuf, sbuf2;
4850         SMB_OFF_T ret=-1;
4851         files_struct *fsp1,*fsp2;
4852         pstring dest;
4853         uint32 dosattrs;
4854         uint32 new_create_disposition;
4855         NTSTATUS status;
4856
4857         pstrcpy(dest,dest1);
4858         if (target_is_directory) {
4859                 char *p = strrchr_m(src,'/');
4860                 if (p) {
4861                         p++;
4862                 } else {
4863                         p = src;
4864                 }
4865                 pstrcat(dest,"/");
4866                 pstrcat(dest,p);
4867         }
4868
4869         if (!vfs_file_exist(conn,src,&src_sbuf)) {
4870                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4871         }
4872
4873         if (!target_is_directory && count) {
4874                 new_create_disposition = FILE_OPEN;
4875         } else {
4876                 if (!map_open_params_to_ntcreate(dest1,0,ofun,
4877                                 NULL, NULL, &new_create_disposition, NULL)) {
4878                         return NT_STATUS_INVALID_PARAMETER;
4879                 }
4880         }
4881
4882         status = open_file_ntcreate(conn,src,&src_sbuf,
4883                         FILE_GENERIC_READ,
4884                         FILE_SHARE_READ|FILE_SHARE_WRITE,
4885                         FILE_OPEN,
4886                         0,
4887                         FILE_ATTRIBUTE_NORMAL,
4888                         INTERNAL_OPEN_ONLY,
4889                         NULL, &fsp1);
4890
4891         if (!NT_STATUS_IS_OK(status)) {
4892                 return status;
4893         }
4894
4895         dosattrs = dos_mode(conn, src, &src_sbuf);
4896         if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
4897                 ZERO_STRUCTP(&sbuf2);
4898         }
4899
4900         status = open_file_ntcreate(conn,dest,&sbuf2,
4901                         FILE_GENERIC_WRITE,
4902                         FILE_SHARE_READ|FILE_SHARE_WRITE,
4903                         new_create_disposition,
4904                         0,
4905                         dosattrs,
4906                         INTERNAL_OPEN_ONLY,
4907                         NULL, &fsp2);
4908
4909         if (!NT_STATUS_IS_OK(status)) {
4910                 close_file(fsp1,ERROR_CLOSE);
4911                 return status;
4912         }
4913
4914         if ((ofun&3) == 1) {
4915                 if(SMB_VFS_LSEEK(fsp2,fsp2->fh->fd,0,SEEK_END) == -1) {
4916                         DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
4917                         /*
4918                          * Stop the copy from occurring.
4919                          */
4920                         ret = -1;
4921                         src_sbuf.st_size = 0;
4922                 }
4923         }
4924
4925         if (src_sbuf.st_size) {
4926                 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
4927         }
4928
4929         close_file(fsp1,NORMAL_CLOSE);
4930
4931         /* Ensure the modtime is set correctly on the destination file. */
4932         fsp_set_pending_modtime( fsp2, get_mtimespec(&src_sbuf));
4933
4934         /*
4935          * As we are opening fsp1 read-only we only expect
4936          * an error on close on fsp2 if we are out of space.
4937          * Thus we don't look at the error return from the
4938          * close of fsp1.
4939          */
4940         status = close_file(fsp2,NORMAL_CLOSE);
4941
4942         if (!NT_STATUS_IS_OK(status)) {
4943                 return status;
4944         }
4945
4946         if (ret != (SMB_OFF_T)src_sbuf.st_size) {
4947                 return NT_STATUS_DISK_FULL;
4948         }
4949
4950         return NT_STATUS_OK;
4951 }
4952
4953 /****************************************************************************
4954  Reply to a file copy.
4955 ****************************************************************************/
4956
4957 int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
4958 {
4959         int outsize = 0;
4960         pstring name;
4961         pstring directory;
4962         pstring mask,newname;
4963         char *p;
4964         int count=0;
4965         int error = ERRnoaccess;
4966         int err = 0;
4967         int tid2 = SVAL(inbuf,smb_vwv0);
4968         int ofun = SVAL(inbuf,smb_vwv1);
4969         int flags = SVAL(inbuf,smb_vwv2);
4970         BOOL target_is_directory=False;
4971         BOOL source_has_wild = False;
4972         BOOL dest_has_wild = False;
4973         SMB_STRUCT_STAT sbuf1, sbuf2;
4974         NTSTATUS status;
4975         START_PROFILE(SMBcopy);
4976
4977         *directory = *mask = 0;
4978
4979         p = smb_buf(inbuf);
4980         p += srvstr_get_path_wcard(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, &source_has_wild);
4981         if (!NT_STATUS_IS_OK(status)) {
4982                 END_PROFILE(SMBcopy);
4983                 return ERROR_NT(status);
4984         }
4985         p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &dest_has_wild);
4986         if (!NT_STATUS_IS_OK(status)) {
4987                 END_PROFILE(SMBcopy);
4988                 return ERROR_NT(status);
4989         }
4990
4991         DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
4992
4993         if (tid2 != conn->cnum) {
4994                 /* can't currently handle inter share copies XXXX */
4995                 DEBUG(3,("Rejecting inter-share copy\n"));
4996                 END_PROFILE(SMBcopy);
4997                 return ERROR_DOS(ERRSRV,ERRinvdevice);
4998         }
4999
5000         status = resolve_dfspath_wcard(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, name, &source_has_wild);
5001         if (!NT_STATUS_IS_OK(status)) {
5002                 END_PROFILE(SMBcopy);
5003                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5004                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
5005                 }
5006                 return ERROR_NT(status);
5007         }
5008
5009         status = resolve_dfspath_wcard(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, newname, &dest_has_wild);
5010         if (!NT_STATUS_IS_OK(status)) {
5011                 END_PROFILE(SMBcopy);
5012                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5013                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
5014                 }
5015                 return ERROR_NT(status);
5016         }
5017
5018         status = unix_convert(conn, name, source_has_wild, NULL, &sbuf1);
5019         if (!NT_STATUS_IS_OK(status)) {
5020                 END_PROFILE(SMBcopy);
5021                 return ERROR_NT(status);
5022         }
5023
5024         status = unix_convert(conn, newname, dest_has_wild, NULL, &sbuf2);
5025         if (!NT_STATUS_IS_OK(status)) {
5026                 END_PROFILE(SMBcopy);
5027                 return ERROR_NT(status);
5028         }
5029
5030         target_is_directory = VALID_STAT_OF_DIR(sbuf2);
5031
5032         if ((flags&1) && target_is_directory) {
5033                 END_PROFILE(SMBcopy);
5034                 return ERROR_DOS(ERRDOS,ERRbadfile);
5035         }
5036
5037         if ((flags&2) && !target_is_directory) {
5038                 END_PROFILE(SMBcopy);
5039                 return ERROR_DOS(ERRDOS,ERRbadpath);
5040         }
5041
5042         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
5043                 /* wants a tree copy! XXXX */
5044                 DEBUG(3,("Rejecting tree copy\n"));
5045                 END_PROFILE(SMBcopy);
5046                 return ERROR_DOS(ERRSRV,ERRerror);
5047         }
5048
5049         p = strrchr_m(name,'/');
5050         if (!p) {
5051                 pstrcpy(directory,"./");
5052                 pstrcpy(mask,name);
5053         } else {
5054                 *p = 0;
5055                 pstrcpy(directory,name);
5056                 pstrcpy(mask,p+1);
5057         }
5058
5059         /*
5060          * We should only check the mangled cache
5061          * here if unix_convert failed. This means
5062          * that the path in 'mask' doesn't exist
5063          * on the file system and so we need to look
5064          * for a possible mangle. This patch from
5065          * Tine Smukavec <valentin.smukavec@hermes.si>.
5066          */
5067
5068         if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5069                 mangle_check_cache( mask, sizeof(pstring)-1, conn->params );
5070         }
5071
5072         if (!source_has_wild) {
5073                 pstrcat(directory,"/");
5074                 pstrcat(directory,mask);
5075                 if (dest_has_wild) {
5076                         if (!resolve_wildcards(directory,newname)) {
5077                                 END_PROFILE(SMBcopy);
5078                                 return ERROR_NT(NT_STATUS_NO_MEMORY);
5079                         }
5080                 }
5081
5082                 status = check_name(conn, directory);
5083                 if (!NT_STATUS_IS_OK(status)) {
5084                         return ERROR_NT(status);
5085                 }
5086
5087                 status = check_name(conn, newname);
5088                 if (!NT_STATUS_IS_OK(status)) {
5089                         return ERROR_NT(status);
5090                 }
5091
5092                 status = copy_file(conn,directory,newname,ofun,
5093                                         count,target_is_directory);
5094
5095                 if(!NT_STATUS_IS_OK(status)) {
5096                         END_PROFILE(SMBcopy);
5097                         return ERROR_NT(status);
5098                 } else {
5099                         count++;
5100                 }
5101         } else {
5102                 struct smb_Dir *dir_hnd = NULL;
5103                 const char *dname;
5104                 long offset = 0;
5105                 pstring destname;
5106
5107                 if (strequal(mask,"????????.???"))
5108                         pstrcpy(mask,"*");
5109
5110                 status = check_name(conn, directory);
5111                 if (!NT_STATUS_IS_OK(status)) {
5112                         return ERROR_NT(status);
5113                 }
5114
5115                 dir_hnd = OpenDir(conn, directory, mask, 0);
5116                 if (dir_hnd == NULL) {
5117                         status = map_nt_error_from_unix(errno);
5118                         return ERROR_NT(status);
5119                 }
5120
5121                 error = ERRbadfile;
5122
5123                 while ((dname = ReadDirName(dir_hnd, &offset))) {
5124                         pstring fname;
5125                         pstrcpy(fname,dname);
5126
5127                         if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
5128                                 continue;
5129                         }
5130
5131                         if(!mask_match(fname, mask, conn->case_sensitive)) {
5132                                 continue;
5133                         }
5134
5135                         error = ERRnoaccess;
5136                         slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
5137                         pstrcpy(destname,newname);
5138                         if (!resolve_wildcards(fname,destname)) {
5139                                 continue;
5140                         }
5141
5142                         status = check_name(conn, fname);
5143                         if (!NT_STATUS_IS_OK(status)) {
5144                                 return ERROR_NT(status);
5145                         }
5146
5147                         status = check_name(conn, destname);
5148                         if (!NT_STATUS_IS_OK(status)) {
5149                                 return ERROR_NT(status);
5150                         }
5151
5152                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
5153
5154                         status = copy_file(conn,fname,destname,ofun,
5155                                         count,target_is_directory);
5156                         if (NT_STATUS_IS_OK(status)) {
5157                                 count++;
5158                         }
5159                 }
5160                 CloseDir(dir_hnd);
5161         }
5162
5163         if (count == 0) {
5164                 if(err) {
5165                         /* Error on close... */
5166                         errno = err;
5167                         END_PROFILE(SMBcopy);
5168                         return(UNIXERROR(ERRHRD,ERRgeneral));
5169                 }
5170
5171                 END_PROFILE(SMBcopy);
5172                 return ERROR_DOS(ERRDOS,error);
5173         }
5174
5175         outsize = set_message(inbuf,outbuf,1,0,True);
5176         SSVAL(outbuf,smb_vwv0,count);
5177
5178         END_PROFILE(SMBcopy);
5179         return(outsize);
5180 }
5181
5182 /****************************************************************************
5183  Reply to a setdir.
5184 ****************************************************************************/
5185
5186 int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
5187 {
5188         int snum;
5189         int outsize = 0;
5190         pstring newdir;
5191         NTSTATUS status;
5192
5193         START_PROFILE(pathworks_setdir);
5194
5195         snum = SNUM(conn);
5196         if (!CAN_SETDIR(snum)) {
5197                 END_PROFILE(pathworks_setdir);
5198                 return ERROR_DOS(ERRDOS,ERRnoaccess);
5199         }
5200
5201         srvstr_get_path(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), 0, STR_TERMINATE, &status);
5202         if (!NT_STATUS_IS_OK(status)) {
5203                 END_PROFILE(pathworks_setdir);
5204                 return ERROR_NT(status);
5205         }
5206
5207         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, newdir);
5208         if (!NT_STATUS_IS_OK(status)) {
5209                 END_PROFILE(pathworks_setdir);
5210                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5211                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
5212                 }
5213                 return ERROR_NT(status);
5214         }
5215
5216         if (strlen(newdir) != 0) {
5217                 if (!vfs_directory_exist(conn,newdir,NULL)) {
5218                         END_PROFILE(pathworks_setdir);
5219                         return ERROR_DOS(ERRDOS,ERRbadpath);
5220                 }
5221                 set_conn_connectpath(conn,newdir);
5222         }
5223
5224         outsize = set_message(inbuf,outbuf,0,0,False);
5225         SCVAL(outbuf,smb_reh,CVAL(inbuf,smb_reh));
5226
5227         DEBUG(3,("setdir %s\n", newdir));
5228
5229         END_PROFILE(pathworks_setdir);
5230         return(outsize);
5231 }
5232
5233 #undef DBGC_CLASS
5234 #define DBGC_CLASS DBGC_LOCKING
5235
5236 /****************************************************************************
5237  Get a lock pid, dealing with large count requests.
5238 ****************************************************************************/
5239
5240 uint32 get_lock_pid( char *data, int data_offset, BOOL large_file_format)
5241 {
5242         if(!large_file_format)
5243                 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
5244         else
5245                 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
5246 }
5247
5248 /****************************************************************************
5249  Get a lock count, dealing with large count requests.
5250 ****************************************************************************/
5251
5252 SMB_BIG_UINT get_lock_count( char *data, int data_offset, BOOL large_file_format)
5253 {
5254         SMB_BIG_UINT count = 0;
5255
5256         if(!large_file_format) {
5257                 count = (SMB_BIG_UINT)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
5258         } else {
5259
5260 #if defined(HAVE_LONGLONG)
5261                 count = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
5262                         ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
5263 #else /* HAVE_LONGLONG */
5264
5265                 /*
5266                  * NT4.x seems to be broken in that it sends large file (64 bit)
5267                  * lockingX calls even if the CAP_LARGE_FILES was *not*
5268                  * negotiated. For boxes without large unsigned ints truncate the
5269                  * lock count by dropping the top 32 bits.
5270                  */
5271
5272                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
5273                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
5274                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
5275                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
5276                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
5277                 }
5278
5279                 count = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
5280 #endif /* HAVE_LONGLONG */
5281         }
5282
5283         return count;
5284 }
5285
5286 #if !defined(HAVE_LONGLONG)
5287 /****************************************************************************
5288  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
5289 ****************************************************************************/
5290
5291 static uint32 map_lock_offset(uint32 high, uint32 low)
5292 {
5293         unsigned int i;
5294         uint32 mask = 0;
5295         uint32 highcopy = high;
5296
5297         /*
5298          * Try and find out how many significant bits there are in high.
5299          */
5300
5301         for(i = 0; highcopy; i++)
5302                 highcopy >>= 1;
5303
5304         /*
5305          * We use 31 bits not 32 here as POSIX
5306          * lock offsets may not be negative.
5307          */
5308
5309         mask = (~0) << (31 - i);
5310
5311         if(low & mask)
5312                 return 0; /* Fail. */
5313
5314         high <<= (31 - i);
5315
5316         return (high|low);
5317 }
5318 #endif /* !defined(HAVE_LONGLONG) */
5319
5320 /****************************************************************************
5321  Get a lock offset, dealing with large offset requests.
5322 ****************************************************************************/
5323
5324 SMB_BIG_UINT get_lock_offset( char *data, int data_offset, BOOL large_file_format, BOOL *err)
5325 {
5326         SMB_BIG_UINT offset = 0;
5327
5328         *err = False;
5329
5330         if(!large_file_format) {
5331                 offset = (SMB_BIG_UINT)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
5332         } else {
5333
5334 #if defined(HAVE_LONGLONG)
5335                 offset = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
5336                                 ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
5337 #else /* HAVE_LONGLONG */
5338
5339                 /*
5340                  * NT4.x seems to be broken in that it sends large file (64 bit)
5341                  * lockingX calls even if the CAP_LARGE_FILES was *not*
5342                  * negotiated. For boxes without large unsigned ints mangle the
5343                  * lock offset by mapping the top 32 bits onto the lower 32.
5344                  */
5345
5346                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
5347                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
5348                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
5349                         uint32 new_low = 0;
5350
5351                         if((new_low = map_lock_offset(high, low)) == 0) {
5352                                 *err = True;
5353                                 return (SMB_BIG_UINT)-1;
5354                         }
5355
5356                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
5357                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
5358                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
5359                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
5360                 }
5361
5362                 offset = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
5363 #endif /* HAVE_LONGLONG */
5364         }
5365
5366         return offset;
5367 }
5368
5369 /****************************************************************************
5370  Reply to a lockingX request.
5371 ****************************************************************************/
5372
5373 int reply_lockingX(connection_struct *conn, char *inbuf, char *outbuf,
5374                    int length, int bufsize)
5375 {
5376         files_struct *fsp = file_fsp(inbuf,smb_vwv2);
5377         unsigned char locktype = CVAL(inbuf,smb_vwv3);
5378         unsigned char oplocklevel = CVAL(inbuf,smb_vwv3+1);
5379         uint16 num_ulocks = SVAL(inbuf,smb_vwv6);
5380         uint16 num_locks = SVAL(inbuf,smb_vwv7);
5381         SMB_BIG_UINT count = 0, offset = 0;
5382         uint32 lock_pid;
5383         int32 lock_timeout = IVAL(inbuf,smb_vwv4);
5384         int i;
5385         char *data;
5386         BOOL large_file_format =
5387                 (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
5388         BOOL err;
5389         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5390
5391         START_PROFILE(SMBlockingX);
5392
5393         CHECK_FSP(fsp,conn);
5394
5395         data = smb_buf(inbuf);
5396
5397         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
5398                 /* we don't support these - and CANCEL_LOCK makes w2k
5399                    and XP reboot so I don't really want to be
5400                    compatible! (tridge) */
5401                 return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
5402         }
5403
5404         /* Check if this is an oplock break on a file
5405            we have granted an oplock on.
5406         */
5407         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
5408                 /* Client can insist on breaking to none. */
5409                 BOOL break_to_none = (oplocklevel == 0);
5410                 BOOL result;
5411
5412                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
5413                          "for fnum = %d\n", (unsigned int)oplocklevel,
5414                          fsp->fnum ));
5415
5416                 /*
5417                  * Make sure we have granted an exclusive or batch oplock on
5418                  * this file.
5419                  */
5420
5421                 if (fsp->oplock_type == 0) {
5422
5423                         /* The Samba4 nbench simulator doesn't understand
5424                            the difference between break to level2 and break
5425                            to none from level2 - it sends oplock break
5426                            replies in both cases. Don't keep logging an error
5427                            message here - just ignore it. JRA. */
5428
5429                         DEBUG(5,("reply_lockingX: Error : oplock break from "
5430                                  "client for fnum = %d (oplock=%d) and no "
5431                                  "oplock granted on this file (%s).\n",
5432                                  fsp->fnum, fsp->oplock_type, fsp->fsp_name));
5433
5434                         /* if this is a pure oplock break request then don't
5435                          * send a reply */
5436                         if (num_locks == 0 && num_ulocks == 0) {
5437                                 END_PROFILE(SMBlockingX);
5438                                 return -1;
5439                         } else {
5440                                 END_PROFILE(SMBlockingX);
5441                                 return ERROR_DOS(ERRDOS,ERRlock);
5442                         }
5443                 }
5444
5445                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
5446                     (break_to_none)) {
5447                         result = remove_oplock(fsp);
5448                 } else {
5449                         result = downgrade_oplock(fsp);
5450                 }
5451
5452                 if (!result) {
5453                         DEBUG(0, ("reply_lockingX: error in removing "
5454                                   "oplock on file %s\n", fsp->fsp_name));
5455                         /* Hmmm. Is this panic justified? */
5456                         smb_panic("internal tdb error");
5457                 }
5458
5459                 reply_to_oplock_break_requests(fsp);
5460
5461                 /* if this is a pure oplock break request then don't send a
5462                  * reply */
5463                 if (num_locks == 0 && num_ulocks == 0) {
5464                         /* Sanity check - ensure a pure oplock break is not a
5465                            chained request. */
5466                         if(CVAL(inbuf,smb_vwv0) != 0xff)
5467                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
5468                                          "break is a chained %d request !\n",
5469                                          (unsigned int)CVAL(inbuf,smb_vwv0) ));
5470                         END_PROFILE(SMBlockingX);
5471                         return -1;
5472                 }
5473         }
5474
5475         /*
5476          * We do this check *after* we have checked this is not a oplock break
5477          * response message. JRA.
5478          */
5479
5480         release_level_2_oplocks_on_change(fsp);
5481
5482         /* Data now points at the beginning of the list
5483            of smb_unlkrng structs */
5484         for(i = 0; i < (int)num_ulocks; i++) {
5485                 lock_pid = get_lock_pid( data, i, large_file_format);
5486                 count = get_lock_count( data, i, large_file_format);
5487                 offset = get_lock_offset( data, i, large_file_format, &err);
5488
5489                 /*
5490                  * There is no error code marked "stupid client bug".... :-).
5491                  */
5492                 if(err) {
5493                         END_PROFILE(SMBlockingX);
5494                         return ERROR_DOS(ERRDOS,ERRnoaccess);
5495                 }
5496
5497                 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
5498                           "pid %u, file %s\n", (double)offset, (double)count,
5499                           (unsigned int)lock_pid, fsp->fsp_name ));
5500
5501                 status = do_unlock(smbd_messaging_context(),
5502                                 fsp,
5503                                 lock_pid,
5504                                 count,
5505                                 offset,
5506                                 WINDOWS_LOCK);
5507
5508                 if (NT_STATUS_V(status)) {
5509                         END_PROFILE(SMBlockingX);
5510                         return ERROR_NT(status);
5511                 }
5512         }
5513
5514         /* Setup the timeout in seconds. */
5515
5516         if (!lp_blocking_locks(SNUM(conn))) {
5517                 lock_timeout = 0;
5518         }
5519
5520         /* Now do any requested locks */
5521         data += ((large_file_format ? 20 : 10)*num_ulocks);
5522
5523         /* Data now points at the beginning of the list
5524            of smb_lkrng structs */
5525
5526         for(i = 0; i < (int)num_locks; i++) {
5527                 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
5528                                 READ_LOCK:WRITE_LOCK);
5529                 lock_pid = get_lock_pid( data, i, large_file_format);
5530                 count = get_lock_count( data, i, large_file_format);
5531                 offset = get_lock_offset( data, i, large_file_format, &err);
5532
5533                 /*
5534                  * There is no error code marked "stupid client bug".... :-).
5535                  */
5536                 if(err) {
5537                         END_PROFILE(SMBlockingX);
5538                         return ERROR_DOS(ERRDOS,ERRnoaccess);
5539                 }
5540
5541                 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
5542                           "%u, file %s timeout = %d\n", (double)offset,
5543                           (double)count, (unsigned int)lock_pid,
5544                           fsp->fsp_name, (int)lock_timeout ));
5545
5546                 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
5547                         if (lp_blocking_locks(SNUM(conn))) {
5548
5549                                 /* Schedule a message to ourselves to
5550                                    remove the blocking lock record and
5551                                    return the right error. */
5552
5553                                 if (!blocking_lock_cancel(fsp,
5554                                                 lock_pid,
5555                                                 offset,
5556                                                 count,
5557                                                 WINDOWS_LOCK,
5558                                                 locktype,
5559                                                 NT_STATUS_FILE_LOCK_CONFLICT)) {
5560                                         END_PROFILE(SMBlockingX);
5561                                         return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRcancelviolation));
5562                                 }
5563                         }
5564                         /* Remove a matching pending lock. */
5565                         status = do_lock_cancel(fsp,
5566                                                 lock_pid,
5567                                                 count,
5568                                                 offset,
5569                                                 WINDOWS_LOCK);
5570                 } else {
5571                         BOOL blocking_lock = lock_timeout ? True : False;
5572                         BOOL defer_lock = False;
5573                         struct byte_range_lock *br_lck;
5574
5575                         br_lck = do_lock(smbd_messaging_context(),
5576                                         fsp,
5577                                         lock_pid,
5578                                         count,
5579                                         offset,
5580                                         lock_type,
5581                                         WINDOWS_LOCK,
5582                                         blocking_lock,
5583                                         &status);
5584
5585                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
5586                                 /* Windows internal resolution for blocking locks seems
5587                                    to be about 200ms... Don't wait for less than that. JRA. */
5588                                 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
5589                                         lock_timeout = lp_lock_spin_time();
5590                                 }
5591                                 defer_lock = True;
5592                         }
5593
5594                         /* This heuristic seems to match W2K3 very well. If a
5595                            lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
5596                            it pretends we asked for a timeout of between 150 - 300 milliseconds as
5597                            far as I can tell. Replacement for do_lock_spin(). JRA. */
5598
5599                         if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
5600                                         NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
5601                                 defer_lock = True;
5602                                 lock_timeout = lp_lock_spin_time();
5603                         }
5604
5605                         if (br_lck && defer_lock) {
5606                                 /*
5607                                  * A blocking lock was requested. Package up
5608                                  * this smb into a queued request and push it
5609                                  * onto the blocking lock queue.
5610                                  */
5611                                 if(push_blocking_lock_request(br_lck,
5612                                                         inbuf, length,
5613                                                         fsp,
5614                                                         lock_timeout,
5615                                                         i,
5616                                                         lock_pid,
5617                                                         lock_type,
5618                                                         WINDOWS_LOCK,
5619                                                         offset,
5620                                                         count)) {
5621                                         TALLOC_FREE(br_lck);
5622                                         END_PROFILE(SMBlockingX);
5623                                         return -1;
5624                                 }
5625                         }
5626
5627                         TALLOC_FREE(br_lck);
5628                 }
5629
5630                 if (NT_STATUS_V(status)) {
5631                         END_PROFILE(SMBlockingX);
5632                         return ERROR_NT(status);
5633                 }
5634         }
5635
5636         /* If any of the above locks failed, then we must unlock
5637            all of the previous locks (X/Open spec). */
5638
5639         if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
5640                         (i != num_locks) &&
5641                         (num_locks != 0)) {
5642                 /*
5643                  * Ensure we don't do a remove on the lock that just failed,
5644                  * as under POSIX rules, if we have a lock already there, we
5645                  * will delete it (and we shouldn't) .....
5646                  */
5647                 for(i--; i >= 0; i--) {
5648                         lock_pid = get_lock_pid( data, i, large_file_format);
5649                         count = get_lock_count( data, i, large_file_format);
5650                         offset = get_lock_offset( data, i, large_file_format,
5651                                                   &err);
5652
5653                         /*
5654                          * There is no error code marked "stupid client
5655                          * bug".... :-).
5656                          */
5657                         if(err) {
5658                                 END_PROFILE(SMBlockingX);
5659                                 return ERROR_DOS(ERRDOS,ERRnoaccess);
5660                         }
5661
5662                         do_unlock(smbd_messaging_context(),
5663                                 fsp,
5664                                 lock_pid,
5665                                 count,
5666                                 offset,
5667                                 WINDOWS_LOCK);
5668                 }
5669                 END_PROFILE(SMBlockingX);
5670                 return ERROR_NT(status);
5671         }
5672
5673         set_message(inbuf,outbuf,2,0,True);
5674
5675         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
5676                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
5677
5678         END_PROFILE(SMBlockingX);
5679         return chain_reply(inbuf,outbuf,length,bufsize);
5680 }
5681
5682 #undef DBGC_CLASS
5683 #define DBGC_CLASS DBGC_ALL
5684
5685 /****************************************************************************
5686  Reply to a SMBreadbmpx (read block multiplex) request.
5687 ****************************************************************************/
5688
5689 int reply_readbmpx(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
5690 {
5691         ssize_t nread = -1;
5692         ssize_t total_read;
5693         char *data;
5694         SMB_OFF_T startpos;
5695         int outsize;
5696         size_t maxcount;
5697         int max_per_packet;
5698         size_t tcount;
5699         int pad;
5700         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
5701         START_PROFILE(SMBreadBmpx);
5702
5703         /* this function doesn't seem to work - disable by default */
5704         if (!lp_readbmpx()) {
5705                 END_PROFILE(SMBreadBmpx);
5706                 return ERROR_DOS(ERRSRV,ERRuseSTD);
5707         }
5708
5709         outsize = set_message(inbuf,outbuf,8,0,True);
5710
5711         CHECK_FSP(fsp,conn);
5712         if (!CHECK_READ(fsp,inbuf)) {
5713                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
5714         }
5715
5716         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv1);
5717         maxcount = SVAL(inbuf,smb_vwv3);
5718
5719         data = smb_buf(outbuf);
5720         pad = ((long)data)%4;
5721         if (pad)
5722                 pad = 4 - pad;
5723         data += pad;
5724
5725         max_per_packet = bufsize-(outsize+pad);
5726         tcount = maxcount;
5727         total_read = 0;
5728
5729         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
5730                 END_PROFILE(SMBreadBmpx);
5731                 return ERROR_DOS(ERRDOS,ERRlock);
5732         }
5733
5734         do {
5735                 size_t N = MIN(max_per_packet,tcount-total_read);
5736
5737                 nread = read_file(fsp,data,startpos,N);
5738
5739                 if (nread <= 0)
5740                         nread = 0;
5741
5742                 if (nread < (ssize_t)N)
5743                         tcount = total_read + nread;
5744
5745                 set_message(inbuf,outbuf,8,nread+pad,False);
5746                 SIVAL(outbuf,smb_vwv0,startpos);
5747                 SSVAL(outbuf,smb_vwv2,tcount);
5748                 SSVAL(outbuf,smb_vwv6,nread);
5749                 SSVAL(outbuf,smb_vwv7,smb_offset(data,outbuf));
5750
5751                 show_msg(outbuf);
5752                 if (!send_smb(smbd_server_fd(),outbuf))
5753                         exit_server_cleanly("reply_readbmpx: send_smb failed.");
5754
5755                 total_read += nread;
5756                 startpos += nread;
5757         } while (total_read < (ssize_t)tcount);
5758
5759         END_PROFILE(SMBreadBmpx);
5760         return(-1);
5761 }
5762
5763 /****************************************************************************
5764  Reply to a SMBsetattrE.
5765 ****************************************************************************/
5766
5767 int reply_setattrE(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
5768 {
5769         struct timespec ts[2];
5770         int outsize = 0;
5771         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
5772         START_PROFILE(SMBsetattrE);
5773
5774         outsize = set_message(inbuf,outbuf,0,0,False);
5775
5776         if(!fsp || (fsp->conn != conn)) {
5777                 END_PROFILE(SMBsetattrE);
5778                 return ERROR_DOS(ERRDOS,ERRbadfid);
5779         }
5780
5781         /*
5782          * Convert the DOS times into unix times. Ignore create
5783          * time as UNIX can't set this.
5784          */
5785
5786         ts[0] = convert_time_t_to_timespec(srv_make_unix_date2(inbuf+smb_vwv3)); /* atime. */
5787         ts[1] = convert_time_t_to_timespec(srv_make_unix_date2(inbuf+smb_vwv5)); /* mtime. */
5788
5789         /*
5790          * Patch from Ray Frush <frush@engr.colostate.edu>
5791          * Sometimes times are sent as zero - ignore them.
5792          */
5793
5794         if (null_timespec(ts[0]) && null_timespec(ts[1])) {
5795                 /* Ignore request */
5796                 if( DEBUGLVL( 3 ) ) {
5797                         dbgtext( "reply_setattrE fnum=%d ", fsp->fnum);
5798                         dbgtext( "ignoring zero request - not setting timestamps of 0\n" );
5799                 }
5800                 END_PROFILE(SMBsetattrE);
5801                 return(outsize);
5802         } else if (!null_timespec(ts[0]) && null_timespec(ts[1])) {
5803                 /* set modify time = to access time if modify time was unset */
5804                 ts[1] = ts[0];
5805         }
5806
5807         /* Set the date on this file */
5808         /* Should we set pending modtime here ? JRA */
5809         if(file_ntimes(conn, fsp->fsp_name, ts)) {
5810                 END_PROFILE(SMBsetattrE);
5811                 return ERROR_DOS(ERRDOS,ERRnoaccess);
5812         }
5813
5814         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u\n",
5815                 fsp->fnum,
5816                 (unsigned int)ts[0].tv_sec,
5817                 (unsigned int)ts[1].tv_sec));
5818
5819         END_PROFILE(SMBsetattrE);
5820         return(outsize);
5821 }
5822
5823
5824 /* Back from the dead for OS/2..... JRA. */
5825
5826 /****************************************************************************
5827  Reply to a SMBwritebmpx (write block multiplex primary) request.
5828 ****************************************************************************/
5829
5830 int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
5831 {
5832         size_t numtowrite;
5833         ssize_t nwritten = -1;
5834         int outsize = 0;
5835         SMB_OFF_T startpos;
5836         size_t tcount;
5837         BOOL write_through;
5838         int smb_doff;
5839         char *data;
5840         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
5841         START_PROFILE(SMBwriteBmpx);
5842
5843         CHECK_FSP(fsp,conn);
5844         if (!CHECK_WRITE(fsp)) {
5845                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
5846         }
5847         if (HAS_CACHED_ERROR(fsp)) {
5848                 return(CACHED_ERROR(fsp));
5849         }
5850
5851         tcount = SVAL(inbuf,smb_vwv1);
5852         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
5853         write_through = BITSETW(inbuf+smb_vwv7,0);
5854         numtowrite = SVAL(inbuf,smb_vwv10);
5855         smb_doff = SVAL(inbuf,smb_vwv11);
5856
5857         data = smb_base(inbuf) + smb_doff;
5858
5859         /* If this fails we need to send an SMBwriteC response,
5860                 not an SMBwritebmpx - set this up now so we don't forget */
5861         SCVAL(outbuf,smb_com,SMBwritec);
5862
5863         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos,WRITE_LOCK)) {
5864                 END_PROFILE(SMBwriteBmpx);
5865                 return(ERROR_DOS(ERRDOS,ERRlock));
5866         }
5867
5868         nwritten = write_file(fsp,data,startpos,numtowrite);
5869
5870         sync_file(conn, fsp, write_through);
5871
5872         if(nwritten < (ssize_t)numtowrite) {
5873                 END_PROFILE(SMBwriteBmpx);
5874                 return(UNIXERROR(ERRHRD,ERRdiskfull));
5875         }
5876
5877         /* If the maximum to be written to this file
5878                 is greater than what we just wrote then set
5879                 up a secondary struct to be attached to this
5880                 fd, we will use this to cache error messages etc. */
5881
5882         if((ssize_t)tcount > nwritten) {
5883                 write_bmpx_struct *wbms;
5884                 if(fsp->wbmpx_ptr != NULL)
5885                         wbms = fsp->wbmpx_ptr; /* Use an existing struct */
5886                 else
5887                         wbms = SMB_MALLOC_P(write_bmpx_struct);
5888                 if(!wbms) {
5889                         DEBUG(0,("Out of memory in reply_readmpx\n"));
5890                         END_PROFILE(SMBwriteBmpx);
5891                         return(ERROR_DOS(ERRSRV,ERRnoresource));
5892                 }
5893                 wbms->wr_mode = write_through;
5894                 wbms->wr_discard = False; /* No errors yet */
5895                 wbms->wr_total_written = nwritten;
5896                 wbms->wr_errclass = 0;
5897                 wbms->wr_error = 0;
5898                 fsp->wbmpx_ptr = wbms;
5899         }
5900
5901         /* We are returning successfully, set the message type back to
5902                 SMBwritebmpx */
5903         SCVAL(outbuf,smb_com,SMBwriteBmpx);
5904
5905         outsize = set_message(inbuf,outbuf,1,0,True);
5906
5907         SSVALS(outbuf,smb_vwv0,-1); /* We don't support smb_remaining */
5908
5909         DEBUG( 3, ( "writebmpx fnum=%d num=%d wrote=%d\n",
5910                         fsp->fnum, (int)numtowrite, (int)nwritten ) );
5911
5912         if (write_through && tcount==nwritten) {
5913                 /* We need to send both a primary and a secondary response */
5914                 smb_setlen(inbuf,outbuf,outsize - 4);
5915                 show_msg(outbuf);
5916                 if (!send_smb(smbd_server_fd(),outbuf))
5917                         exit_server_cleanly("reply_writebmpx: send_smb failed.");
5918
5919                 /* Now the secondary */
5920                 outsize = set_message(inbuf,outbuf,1,0,True);
5921                 SCVAL(outbuf,smb_com,SMBwritec);
5922                 SSVAL(outbuf,smb_vwv0,nwritten);
5923         }
5924
5925         END_PROFILE(SMBwriteBmpx);
5926         return(outsize);
5927 }
5928
5929 /****************************************************************************
5930  Reply to a SMBwritebs (write block multiplex secondary) request.
5931 ****************************************************************************/
5932
5933 int reply_writebs(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
5934 {
5935         size_t numtowrite;
5936         ssize_t nwritten = -1;
5937         int outsize = 0;
5938         SMB_OFF_T startpos;
5939         size_t tcount;
5940         BOOL write_through;
5941         int smb_doff;
5942         char *data;
5943         write_bmpx_struct *wbms;
5944         BOOL send_response = False;
5945         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
5946         START_PROFILE(SMBwriteBs);
5947
5948         CHECK_FSP(fsp,conn);
5949         if (!CHECK_WRITE(fsp)) {
5950                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
5951         }
5952
5953         tcount = SVAL(inbuf,smb_vwv1);
5954         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
5955         numtowrite = SVAL(inbuf,smb_vwv6);
5956         smb_doff = SVAL(inbuf,smb_vwv7);
5957
5958         data = smb_base(inbuf) + smb_doff;
5959
5960         /* We need to send an SMBwriteC response, not an SMBwritebs */
5961         SCVAL(outbuf,smb_com,SMBwritec);
5962
5963         /* This fd should have an auxiliary struct attached,
5964                 check that it does */
5965         wbms = fsp->wbmpx_ptr;
5966         if(!wbms) {
5967                 END_PROFILE(SMBwriteBs);
5968                 return(-1);
5969         }
5970
5971         /* If write through is set we can return errors, else we must cache them */
5972         write_through = wbms->wr_mode;
5973
5974         /* Check for an earlier error */
5975         if(wbms->wr_discard) {
5976                 END_PROFILE(SMBwriteBs);
5977                 return -1; /* Just discard the packet */
5978         }
5979
5980         nwritten = write_file(fsp,data,startpos,numtowrite);
5981
5982         sync_file(conn, fsp, write_through);
5983
5984         if (nwritten < (ssize_t)numtowrite) {
5985                 if(write_through) {
5986                         /* We are returning an error - we can delete the aux struct */
5987                         if (wbms)
5988                                 free((char *)wbms);
5989                         fsp->wbmpx_ptr = NULL;
5990                         END_PROFILE(SMBwriteBs);
5991                         return(ERROR_DOS(ERRHRD,ERRdiskfull));
5992                 }
5993                 wbms->wr_errclass = ERRHRD;
5994                 wbms->wr_error = ERRdiskfull;
5995                 wbms->wr_status = NT_STATUS_DISK_FULL;
5996                 wbms->wr_discard = True;
5997                 END_PROFILE(SMBwriteBs);
5998                 return -1;
5999         }
6000
6001         /* Increment the total written, if this matches tcount
6002                 we can discard the auxiliary struct (hurrah !) and return a writeC */
6003         wbms->wr_total_written += nwritten;
6004         if(wbms->wr_total_written >= tcount) {
6005                 if (write_through) {
6006                         outsize = set_message(inbuf,outbuf,1,0,True);
6007                         SSVAL(outbuf,smb_vwv0,wbms->wr_total_written);
6008                         send_response = True;
6009                 }
6010
6011                 free((char *)wbms);
6012                 fsp->wbmpx_ptr = NULL;
6013         }
6014
6015         if(send_response) {
6016                 END_PROFILE(SMBwriteBs);
6017                 return(outsize);
6018         }
6019
6020         END_PROFILE(SMBwriteBs);
6021         return(-1);
6022 }
6023
6024 /****************************************************************************
6025  Reply to a SMBgetattrE.
6026 ****************************************************************************/
6027
6028 int reply_getattrE(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
6029 {
6030         SMB_STRUCT_STAT sbuf;
6031         int outsize = 0;
6032         int mode;
6033         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
6034         START_PROFILE(SMBgetattrE);
6035
6036         outsize = set_message(inbuf,outbuf,11,0,True);
6037
6038         if(!fsp || (fsp->conn != conn)) {
6039                 END_PROFILE(SMBgetattrE);
6040                 return ERROR_DOS(ERRDOS,ERRbadfid);
6041         }
6042
6043         /* Do an fstat on this file */
6044         if(fsp_stat(fsp, &sbuf)) {
6045                 END_PROFILE(SMBgetattrE);
6046                 return(UNIXERROR(ERRDOS,ERRnoaccess));
6047         }
6048
6049         mode = dos_mode(conn,fsp->fsp_name,&sbuf);
6050
6051         /*
6052          * Convert the times into dos times. Set create
6053          * date to be last modify date as UNIX doesn't save
6054          * this.
6055          */
6056
6057         srv_put_dos_date2(outbuf,smb_vwv0,get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn))));
6058         srv_put_dos_date2(outbuf,smb_vwv2,sbuf.st_atime);
6059         /* Should we check pending modtime here ? JRA */
6060         srv_put_dos_date2(outbuf,smb_vwv4,sbuf.st_mtime);
6061
6062         if (mode & aDIR) {
6063                 SIVAL(outbuf,smb_vwv6,0);
6064                 SIVAL(outbuf,smb_vwv8,0);
6065         } else {
6066                 uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
6067                 SIVAL(outbuf,smb_vwv6,(uint32)sbuf.st_size);
6068                 SIVAL(outbuf,smb_vwv8,allocation_size);
6069         }
6070         SSVAL(outbuf,smb_vwv10, mode);
6071
6072         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
6073
6074         END_PROFILE(SMBgetattrE);
6075         return(outsize);
6076 }