r23100: Implement the delete on close semantics I've just tested for
[tprouty/samba.git] / source / smbd / reply.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Main SMB reply routines
4    Copyright (C) Andrew Tridgell 1992-1998
5    Copyright (C) Andrew Bartlett      2001
6    Copyright (C) Jeremy Allison 1992-2007.
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 2 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program; if not, write to the Free Software
20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21 */
22 /*
23    This file handles most of the reply_ calls that the server
24    makes to handle specific protocols
25 */
26
27 #include "includes.h"
28
29 /* look in server.c for some explanation of these variables */
30 extern enum protocol_types Protocol;
31 extern int max_send;
32 extern int max_recv;
33 unsigned int smb_echo_count = 0;
34 extern uint32 global_client_caps;
35
36 extern struct current_user current_user;
37 extern BOOL global_encrypted_passwords_negotiated;
38
39 /****************************************************************************
40  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
41  path or anything including wildcards.
42  We're assuming here that '/' is not the second byte in any multibyte char
43  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
44  set.
45 ****************************************************************************/
46
47 /* Custom version for processing POSIX paths. */
48 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
49
50 NTSTATUS check_path_syntax_internal(pstring destname,
51                                     const pstring srcname,
52                                     BOOL posix_path,
53                                     BOOL *p_last_component_contains_wcard)
54 {
55         char *d = destname;
56         const char *s = srcname;
57         NTSTATUS ret = NT_STATUS_OK;
58         BOOL start_of_name_component = True;
59
60         *p_last_component_contains_wcard = False;
61
62         while (*s) {
63                 if (IS_PATH_SEP(*s,posix_path)) {
64                         /*
65                          * Safe to assume is not the second part of a mb char
66                          * as this is handled below.
67                          */
68                         /* Eat multiple '/' or '\\' */
69                         while (IS_PATH_SEP(*s,posix_path)) {
70                                 s++;
71                         }
72                         if ((d != destname) && (*s != '\0')) {
73                                 /* We only care about non-leading or trailing '/' or '\\' */
74                                 *d++ = '/';
75                         }
76
77                         start_of_name_component = True;
78                         /* New component. */
79                         *p_last_component_contains_wcard = False;
80                         continue;
81                 }
82
83                 if (start_of_name_component) {
84                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
85                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
86
87                                 /*
88                                  * No mb char starts with '.' so we're safe checking the directory separator here.
89                                  */
90
91                                 /* If  we just added a '/' - delete it */
92                                 if ((d > destname) && (*(d-1) == '/')) {
93                                         *(d-1) = '\0';
94                                         d--;
95                                 }
96
97                                 /* Are we at the start ? Can't go back further if so. */
98                                 if (d <= destname) {
99                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
100                                         break;
101                                 }
102                                 /* Go back one level... */
103                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
104                                 /* NOTE - if this assumption is invalid we are not in good shape... */
105                                 /* Decrement d first as d points to the *next* char to write into. */
106                                 for (d--; d > destname; d--) {
107                                         if (*d == '/')
108                                                 break;
109                                 }
110                                 s += 2; /* Else go past the .. */
111                                 /* We're still at the start of a name component, just the previous one. */
112                                 continue;
113
114                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
115                                 if (posix_path) {
116                                         /* Eat the '.' */
117                                         s++;
118                                         continue;
119                                 }
120                         }
121
122                 }
123
124                 if (!(*s & 0x80)) {
125                         if (!posix_path) {
126                                 if (*s <= 0x1f) {
127                                         return NT_STATUS_OBJECT_NAME_INVALID;
128                                 }
129                                 switch (*s) {
130                                         case '*':
131                                         case '?':
132                                         case '<':
133                                         case '>':
134                                         case '"':
135                                                 *p_last_component_contains_wcard = True;
136                                                 break;
137                                         default:
138                                                 break;
139                                 }
140                         }
141                         *d++ = *s++;
142                 } else {
143                         size_t siz;
144                         /* Get the size of the next MB character. */
145                         next_codepoint(s,&siz);
146                         switch(siz) {
147                                 case 5:
148                                         *d++ = *s++;
149                                         /*fall through*/
150                                 case 4:
151                                         *d++ = *s++;
152                                         /*fall through*/
153                                 case 3:
154                                         *d++ = *s++;
155                                         /*fall through*/
156                                 case 2:
157                                         *d++ = *s++;
158                                         /*fall through*/
159                                 case 1:
160                                         *d++ = *s++;
161                                         break;
162                                 default:
163                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
164                                         *d = '\0';
165                                         return NT_STATUS_INVALID_PARAMETER;
166                         }
167                 }
168                 start_of_name_component = False;
169         }
170
171         *d = '\0';
172         return ret;
173 }
174
175 /****************************************************************************
176  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
177  No wildcards allowed.
178 ****************************************************************************/
179
180 NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
181 {
182         BOOL ignore;
183         return check_path_syntax_internal(destname, srcname, False, &ignore);
184 }
185
186 /****************************************************************************
187  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
188  Wildcards allowed - p_contains_wcard returns true if the last component contained
189  a wildcard.
190 ****************************************************************************/
191
192 NTSTATUS check_path_syntax_wcard(pstring destname, const pstring srcname, BOOL *p_contains_wcard)
193 {
194         return check_path_syntax_internal(destname, srcname, False, p_contains_wcard);
195 }
196
197 /****************************************************************************
198  Check the path for a POSIX client.
199  We're assuming here that '/' is not the second byte in any multibyte char
200  set (a safe assumption).
201 ****************************************************************************/
202
203 NTSTATUS check_path_syntax_posix(pstring destname, const pstring srcname)
204 {
205         BOOL ignore;
206         return check_path_syntax_internal(destname, srcname, True, &ignore);
207 }
208
209 /****************************************************************************
210  Pull a string and check the path allowing a wilcard - provide for error return.
211 ****************************************************************************/
212
213 size_t srvstr_get_path_wcard(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags,
214                                 NTSTATUS *err, BOOL *contains_wcard)
215 {
216         pstring tmppath;
217         char *tmppath_ptr = tmppath;
218         size_t ret;
219 #ifdef DEVELOPER
220         SMB_ASSERT(dest_len == sizeof(pstring));
221 #endif
222
223         if (src_len == 0) {
224                 ret = srvstr_pull_buf( inbuf, tmppath_ptr, src, dest_len, flags);
225         } else {
226                 ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
227         }
228
229         *contains_wcard = False;
230
231         if (SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES) {
232                 /* 
233                  * For a DFS path the function parse_dfs_path()
234                  * will do the path processing, just make a copy.
235                  */
236                 pstrcpy(dest, tmppath);
237                 *err = NT_STATUS_OK;
238                 return ret;
239         }
240
241         if (lp_posix_pathnames()) {
242                 *err = check_path_syntax_posix(dest, tmppath);
243         } else {
244                 *err = check_path_syntax_wcard(dest, tmppath, contains_wcard);
245         }
246
247         return ret;
248 }
249
250 /****************************************************************************
251  Pull a string and check the path - provide for error return.
252 ****************************************************************************/
253
254 size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags, NTSTATUS *err)
255 {
256         pstring tmppath;
257         char *tmppath_ptr = tmppath;
258         size_t ret;
259 #ifdef DEVELOPER
260         SMB_ASSERT(dest_len == sizeof(pstring));
261 #endif
262
263         if (src_len == 0) {
264                 ret = srvstr_pull_buf( inbuf, tmppath_ptr, src, dest_len, flags);
265         } else {
266                 ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
267         }
268
269         if (SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES) {
270                 /* 
271                  * For a DFS path the function parse_dfs_path()
272                  * will do the path processing, just make a copy.
273                  */
274                 pstrcpy(dest, tmppath);
275                 *err = NT_STATUS_OK;
276                 return ret;
277         }
278
279         if (lp_posix_pathnames()) {
280                 *err = check_path_syntax_posix(dest, tmppath);
281         } else {
282                 *err = check_path_syntax(dest, tmppath);
283         }
284
285         return ret;
286 }
287
288 /****************************************************************************
289  Reply to a special message.
290 ****************************************************************************/
291
292 int reply_special(char *inbuf,char *outbuf)
293 {
294         int outsize = 4;
295         int msg_type = CVAL(inbuf,0);
296         int msg_flags = CVAL(inbuf,1);
297         fstring name1,name2;
298         char name_type = 0;
299         
300         static BOOL already_got_session = False;
301
302         *name1 = *name2 = 0;
303         
304         memset(outbuf,'\0',smb_size);
305
306         smb_setlen(inbuf,outbuf,0);
307         
308         switch (msg_type) {
309         case 0x81: /* session request */
310                 
311                 if (already_got_session) {
312                         exit_server_cleanly("multiple session request not permitted");
313                 }
314                 
315                 SCVAL(outbuf,0,0x82);
316                 SCVAL(outbuf,3,0);
317                 if (name_len(inbuf+4) > 50 || 
318                     name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
319                         DEBUG(0,("Invalid name length in session request\n"));
320                         return(0);
321                 }
322                 name_extract(inbuf,4,name1);
323                 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
324                 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
325                          name1,name2));      
326
327                 set_local_machine_name(name1, True);
328                 set_remote_machine_name(name2, True);
329
330                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
331                          get_local_machine_name(), get_remote_machine_name(),
332                          name_type));
333
334                 if (name_type == 'R') {
335                         /* We are being asked for a pathworks session --- 
336                            no thanks! */
337                         SCVAL(outbuf, 0,0x83);
338                         break;
339                 }
340
341                 /* only add the client's machine name to the list
342                    of possibly valid usernames if we are operating
343                    in share mode security */
344                 if (lp_security() == SEC_SHARE) {
345                         add_session_user(get_remote_machine_name());
346                 }
347
348                 reload_services(True);
349                 reopen_logs();
350
351                 already_got_session = True;
352                 break;
353                 
354         case 0x89: /* session keepalive request 
355                       (some old clients produce this?) */
356                 SCVAL(outbuf,0,SMBkeepalive);
357                 SCVAL(outbuf,3,0);
358                 break;
359                 
360         case 0x82: /* positive session response */
361         case 0x83: /* negative session response */
362         case 0x84: /* retarget session response */
363                 DEBUG(0,("Unexpected session response\n"));
364                 break;
365                 
366         case SMBkeepalive: /* session keepalive */
367         default:
368                 return(0);
369         }
370         
371         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
372                     msg_type, msg_flags));
373         
374         return(outsize);
375 }
376
377 /****************************************************************************
378  Reply to a tcon.
379  conn POINTER CAN BE NULL HERE !
380 ****************************************************************************/
381
382 int reply_tcon(connection_struct *conn,
383                char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
384 {
385         const char *service;
386         pstring service_buf;
387         pstring password;
388         pstring dev;
389         int outsize = 0;
390         uint16 vuid = SVAL(inbuf,smb_uid);
391         int pwlen=0;
392         NTSTATUS nt_status;
393         char *p;
394         DATA_BLOB password_blob;
395         
396         START_PROFILE(SMBtcon);
397
398         *service_buf = *password = *dev = 0;
399
400         p = smb_buf(inbuf)+1;
401         p += srvstr_pull_buf(inbuf, service_buf, p, sizeof(service_buf), STR_TERMINATE) + 1;
402         pwlen = srvstr_pull_buf(inbuf, password, p, sizeof(password), STR_TERMINATE) + 1;
403         p += pwlen;
404         p += srvstr_pull_buf(inbuf, dev, p, sizeof(dev), STR_TERMINATE) + 1;
405
406         p = strrchr_m(service_buf,'\\');
407         if (p) {
408                 service = p+1;
409         } else {
410                 service = service_buf;
411         }
412
413         password_blob = data_blob(password, pwlen+1);
414
415         conn = make_connection(service,password_blob,dev,vuid,&nt_status);
416
417         data_blob_clear_free(&password_blob);
418   
419         if (!conn) {
420                 END_PROFILE(SMBtcon);
421                 return ERROR_NT(nt_status);
422         }
423   
424         outsize = set_message(inbuf,outbuf,2,0,True);
425         SSVAL(outbuf,smb_vwv0,max_recv);
426         SSVAL(outbuf,smb_vwv1,conn->cnum);
427         SSVAL(outbuf,smb_tid,conn->cnum);
428   
429         DEBUG(3,("tcon service=%s cnum=%d\n", 
430                  service, conn->cnum));
431   
432         END_PROFILE(SMBtcon);
433         return(outsize);
434 }
435
436 /****************************************************************************
437  Reply to a tcon and X.
438  conn POINTER CAN BE NULL HERE !
439 ****************************************************************************/
440
441 int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
442 {
443         fstring service;
444         DATA_BLOB password;
445
446         /* what the cleint thinks the device is */
447         fstring client_devicetype;
448         /* what the server tells the client the share represents */
449         const char *server_devicetype;
450         NTSTATUS nt_status;
451         uint16 vuid = SVAL(inbuf,smb_uid);
452         int passlen = SVAL(inbuf,smb_vwv3);
453         pstring path;
454         char *p, *q;
455         uint16 tcon_flags = SVAL(inbuf,smb_vwv2);
456         
457         START_PROFILE(SMBtconX);        
458
459         *service = *client_devicetype = 0;
460
461         /* we might have to close an old one */
462         if ((SVAL(inbuf,smb_vwv2) & 0x1) && conn) {
463                 close_cnum(conn,vuid);
464         }
465
466         if (passlen > MAX_PASS_LEN) {
467                 return ERROR_DOS(ERRDOS,ERRbuftoosmall);
468         }
469  
470         if (global_encrypted_passwords_negotiated) {
471                 password = data_blob(smb_buf(inbuf),passlen);
472                 if (lp_security() == SEC_SHARE) {
473                         /*
474                          * Security = share always has a pad byte
475                          * after the password.
476                          */
477                         p = smb_buf(inbuf) + passlen + 1;
478                 } else {
479                         p = smb_buf(inbuf) + passlen;
480                 }
481         } else {
482                 password = data_blob(smb_buf(inbuf),passlen+1);
483                 /* Ensure correct termination */
484                 password.data[passlen]=0;
485                 p = smb_buf(inbuf) + passlen + 1;
486         }
487
488         p += srvstr_pull_buf(inbuf, path, p, sizeof(path), STR_TERMINATE);
489
490         /*
491          * the service name can be either: \\server\share
492          * or share directly like on the DELL PowerVault 705
493          */
494         if (*path=='\\') {      
495                 q = strchr_m(path+2,'\\');
496                 if (!q) {
497                         END_PROFILE(SMBtconX);
498                         return(ERROR_DOS(ERRDOS,ERRnosuchshare));
499                 }
500                 fstrcpy(service,q+1);
501         }
502         else
503                 fstrcpy(service,path);
504                 
505         p += srvstr_pull(inbuf, client_devicetype, p, sizeof(client_devicetype), 6, STR_ASCII);
506
507         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
508
509         conn = make_connection(service,password,client_devicetype,vuid,&nt_status);
510         
511         data_blob_clear_free(&password);
512
513         if (!conn) {
514                 END_PROFILE(SMBtconX);
515                 return ERROR_NT(nt_status);
516         }
517
518         if ( IS_IPC(conn) )
519                 server_devicetype = "IPC";
520         else if ( IS_PRINT(conn) )
521                 server_devicetype = "LPT1:";
522         else 
523                 server_devicetype = "A:";
524
525         if (Protocol < PROTOCOL_NT1) {
526                 set_message(inbuf,outbuf,2,0,True);
527                 p = smb_buf(outbuf);
528                 p += srvstr_push(outbuf, p, server_devicetype, -1, 
529                                  STR_TERMINATE|STR_ASCII);
530                 set_message_end(inbuf,outbuf,p);
531         } else {
532                 /* NT sets the fstype of IPC$ to the null string */
533                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
534                 
535                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
536                         /* Return permissions. */
537                         uint32 perm1 = 0;
538                         uint32 perm2 = 0;
539
540                         set_message(inbuf,outbuf,7,0,True);
541
542                         if (IS_IPC(conn)) {
543                                 perm1 = FILE_ALL_ACCESS;
544                                 perm2 = FILE_ALL_ACCESS;
545                         } else {
546                                 perm1 = CAN_WRITE(conn) ?
547                                                 SHARE_ALL_ACCESS :
548                                                 SHARE_READ_ONLY;
549                         }
550
551                         SIVAL(outbuf, smb_vwv3, perm1);
552                         SIVAL(outbuf, smb_vwv5, perm2);
553                 } else {
554                         set_message(inbuf,outbuf,3,0,True);
555                 }
556
557                 p = smb_buf(outbuf);
558                 p += srvstr_push(outbuf, p, server_devicetype, -1, 
559                                  STR_TERMINATE|STR_ASCII);
560                 p += srvstr_push(outbuf, p, fstype, -1, 
561                                  STR_TERMINATE);
562                 
563                 set_message_end(inbuf,outbuf,p);
564                 
565                 /* what does setting this bit do? It is set by NT4 and
566                    may affect the ability to autorun mounted cdroms */
567                 SSVAL(outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
568                                 (lp_csc_policy(SNUM(conn)) << 2));
569                 
570                 init_dfsroot(conn, inbuf, outbuf);
571         }
572
573   
574         DEBUG(3,("tconX service=%s \n",
575                  service));
576   
577         /* set the incoming and outgoing tid to the just created one */
578         SSVAL(inbuf,smb_tid,conn->cnum);
579         SSVAL(outbuf,smb_tid,conn->cnum);
580
581         END_PROFILE(SMBtconX);
582         return chain_reply(inbuf,outbuf,length,bufsize);
583 }
584
585 /****************************************************************************
586  Reply to an unknown type.
587 ****************************************************************************/
588
589 int reply_unknown(char *inbuf,char *outbuf)
590 {
591         int type;
592         type = CVAL(inbuf,smb_com);
593   
594         DEBUG(0,("unknown command type (%s): type=%d (0x%X)\n",
595                  smb_fn_name(type), type, type));
596   
597         return(ERROR_DOS(ERRSRV,ERRunknownsmb));
598 }
599
600 /****************************************************************************
601  Reply to an ioctl.
602  conn POINTER CAN BE NULL HERE !
603 ****************************************************************************/
604
605 int reply_ioctl(connection_struct *conn,
606                 char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
607 {
608         uint16 device     = SVAL(inbuf,smb_vwv1);
609         uint16 function   = SVAL(inbuf,smb_vwv2);
610         uint32 ioctl_code = (device << 16) + function;
611         int replysize, outsize;
612         char *p;
613         START_PROFILE(SMBioctl);
614
615         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
616
617         switch (ioctl_code) {
618             case IOCTL_QUERY_JOB_INFO:
619                 replysize = 32;
620                 break;
621             default:
622                 END_PROFILE(SMBioctl);
623                 return(ERROR_DOS(ERRSRV,ERRnosupport));
624         }
625
626         outsize = set_message(inbuf,outbuf,8,replysize+1,True);
627         SSVAL(outbuf,smb_vwv1,replysize); /* Total data bytes returned */
628         SSVAL(outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
629         SSVAL(outbuf,smb_vwv6,52);        /* Offset to data */
630         p = smb_buf(outbuf) + 1;          /* Allow for alignment */
631
632         switch (ioctl_code) {
633                 case IOCTL_QUERY_JOB_INFO:                  
634                 {
635                         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
636                         if (!fsp) {
637                                 END_PROFILE(SMBioctl);
638                                 return(UNIXERROR(ERRDOS,ERRbadfid));
639                         }
640                         SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
641                         srvstr_push(outbuf, p+2, global_myname(), 15, STR_TERMINATE|STR_ASCII);
642                         if (conn) {
643                                 srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII);
644                         }
645                         break;
646                 }
647         }
648
649         END_PROFILE(SMBioctl);
650         return outsize;
651 }
652
653 /****************************************************************************
654  Strange checkpath NTSTATUS mapping.
655 ****************************************************************************/
656
657 static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
658 {
659         /* Strange DOS error code semantics only for checkpath... */
660         if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
661                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
662                         /* We need to map to ERRbadpath */
663                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
664                 }
665         }
666         return status;
667 }
668         
669 /****************************************************************************
670  Reply to a checkpath.
671 ****************************************************************************/
672
673 int reply_checkpath(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
674 {
675         int outsize = 0;
676         pstring name;
677         SMB_STRUCT_STAT sbuf;
678         NTSTATUS status;
679
680         START_PROFILE(SMBcheckpath);
681
682         srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status);
683         if (!NT_STATUS_IS_OK(status)) {
684                 END_PROFILE(SMBcheckpath);
685                 status = map_checkpath_error(inbuf, status);
686                 return ERROR_NT(status);
687         }
688
689         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, name);
690         if (!NT_STATUS_IS_OK(status)) {
691                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
692                         END_PROFILE(SMBcheckpath);
693                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
694                 }
695                 goto path_err;
696         }
697
698         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(inbuf,smb_vwv0)));
699
700         status = unix_convert(conn, name, False, NULL, &sbuf);
701         if (!NT_STATUS_IS_OK(status)) {
702                 goto path_err;
703         }
704
705         status = check_name(conn, name);
706         if (!NT_STATUS_IS_OK(status)) {
707                 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
708                 goto path_err;
709         }
710
711         if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
712                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
713                 status = map_nt_error_from_unix(errno);
714                 goto path_err;
715         }
716
717         if (!S_ISDIR(sbuf.st_mode)) {
718                 END_PROFILE(SMBcheckpath);
719                 return ERROR_BOTH(NT_STATUS_NOT_A_DIRECTORY,ERRDOS,ERRbadpath);
720         }
721
722         outsize = set_message(inbuf,outbuf,0,0,False);
723
724         END_PROFILE(SMBcheckpath);
725         return outsize;
726
727   path_err:
728
729         END_PROFILE(SMBcheckpath);
730
731         /* We special case this - as when a Windows machine
732                 is parsing a path is steps through the components
733                 one at a time - if a component fails it expects
734                 ERRbadpath, not ERRbadfile.
735         */
736         status = map_checkpath_error(inbuf, status);
737         if(NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
738                 /*
739                  * Windows returns different error codes if
740                  * the parent directory is valid but not the
741                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
742                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
743                  * if the path is invalid.
744                  */
745                 return ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpath);
746         }
747
748         return ERROR_NT(status);
749 }
750
751 /****************************************************************************
752  Reply to a getatr.
753 ****************************************************************************/
754
755 int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
756 {
757         pstring fname;
758         int outsize = 0;
759         SMB_STRUCT_STAT sbuf;
760         int mode=0;
761         SMB_OFF_T size=0;
762         time_t mtime=0;
763         char *p;
764         NTSTATUS status;
765
766         START_PROFILE(SMBgetatr);
767
768         p = smb_buf(inbuf) + 1;
769         p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
770         if (!NT_STATUS_IS_OK(status)) {
771                 END_PROFILE(SMBgetatr);
772                 return ERROR_NT(status);
773         }
774
775         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
776         if (!NT_STATUS_IS_OK(status)) {
777                 END_PROFILE(SMBgetatr);
778                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
779                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
780                 }
781                 return ERROR_NT(status);
782         }
783   
784         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
785                 under WfWg - weird! */
786         if (*fname == '\0') {
787                 mode = aHIDDEN | aDIR;
788                 if (!CAN_WRITE(conn)) {
789                         mode |= aRONLY;
790                 }
791                 size = 0;
792                 mtime = 0;
793         } else {
794                 status = unix_convert(conn, fname, False, NULL,&sbuf);
795                 if (!NT_STATUS_IS_OK(status)) {
796                         END_PROFILE(SMBgetatr);
797                         return ERROR_NT(status);
798                 }
799                 status = check_name(conn, fname);
800                 if (!NT_STATUS_IS_OK(status)) {
801                         DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
802                         END_PROFILE(SMBgetatr);
803                         return ERROR_NT(status);
804                 }
805                 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
806                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
807                         return UNIXERROR(ERRDOS,ERRbadfile);
808                 }
809
810                 mode = dos_mode(conn,fname,&sbuf);
811                 size = sbuf.st_size;
812                 mtime = sbuf.st_mtime;
813                 if (mode & aDIR) {
814                         size = 0;
815                 }
816         }
817   
818         outsize = set_message(inbuf,outbuf,10,0,True);
819
820         SSVAL(outbuf,smb_vwv0,mode);
821         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
822                 srv_put_dos_date3(outbuf,smb_vwv1,mtime & ~1);
823         } else {
824                 srv_put_dos_date3(outbuf,smb_vwv1,mtime);
825         }
826         SIVAL(outbuf,smb_vwv3,(uint32)size);
827
828         if (Protocol >= PROTOCOL_NT1) {
829                 SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
830         }
831   
832         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
833   
834         END_PROFILE(SMBgetatr);
835         return(outsize);
836 }
837
838 /****************************************************************************
839  Reply to a setatr.
840 ****************************************************************************/
841
842 int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
843 {
844         pstring fname;
845         int outsize = 0;
846         int mode;
847         time_t mtime;
848         SMB_STRUCT_STAT sbuf;
849         char *p;
850         NTSTATUS status;
851
852         START_PROFILE(SMBsetatr);
853
854         p = smb_buf(inbuf) + 1;
855         p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
856         if (!NT_STATUS_IS_OK(status)) {
857                 END_PROFILE(SMBsetatr);
858                 return ERROR_NT(status);
859         }
860
861         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
862         if (!NT_STATUS_IS_OK(status)) {
863                 END_PROFILE(SMBsetatr);
864                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
865                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
866                 }
867                 return ERROR_NT(status);
868         }
869   
870         status = unix_convert(conn, fname, False, NULL, &sbuf);
871         if (!NT_STATUS_IS_OK(status)) {
872                 END_PROFILE(SMBsetatr);
873                 return ERROR_NT(status);
874         }
875
876         status = check_name(conn, fname);
877         if (!NT_STATUS_IS_OK(status)) {
878                 END_PROFILE(SMBsetatr);
879                 return ERROR_NT(status);
880         }
881
882         if (fname[0] == '.' && fname[1] == '\0') {
883                 /*
884                  * Not sure here is the right place to catch this
885                  * condition. Might be moved to somewhere else later -- vl
886                  */
887                 END_PROFILE(SMBsetatr);
888                 return ERROR_NT(NT_STATUS_ACCESS_DENIED);
889         }
890
891         mode = SVAL(inbuf,smb_vwv0);
892         mtime = srv_make_unix_date3(inbuf+smb_vwv1);
893   
894         if (mode != FILE_ATTRIBUTE_NORMAL) {
895                 if (VALID_STAT_OF_DIR(sbuf))
896                         mode |= aDIR;
897                 else
898                         mode &= ~aDIR;
899
900                 if (file_set_dosmode(conn,fname,mode,&sbuf,False) != 0) {
901                         END_PROFILE(SMBsetatr);
902                         return UNIXERROR(ERRDOS, ERRnoaccess);
903                 }
904         }
905
906         if (!set_filetime(conn,fname,convert_time_t_to_timespec(mtime))) {
907                 END_PROFILE(SMBsetatr);
908                 return UNIXERROR(ERRDOS, ERRnoaccess);
909         }
910  
911         outsize = set_message(inbuf,outbuf,0,0,False);
912   
913         DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
914   
915         END_PROFILE(SMBsetatr);
916         return(outsize);
917 }
918
919 /****************************************************************************
920  Reply to a dskattr.
921 ****************************************************************************/
922
923 int reply_dskattr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
924 {
925         int outsize = 0;
926         SMB_BIG_UINT dfree,dsize,bsize;
927         START_PROFILE(SMBdskattr);
928
929         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
930                 END_PROFILE(SMBdskattr);
931                 return(UNIXERROR(ERRHRD,ERRgeneral));
932         }
933   
934         outsize = set_message(inbuf,outbuf,5,0,True);
935         
936         if (Protocol <= PROTOCOL_LANMAN2) {
937                 double total_space, free_space;
938                 /* we need to scale this to a number that DOS6 can handle. We
939                    use floating point so we can handle large drives on systems
940                    that don't have 64 bit integers 
941
942                    we end up displaying a maximum of 2G to DOS systems
943                 */
944                 total_space = dsize * (double)bsize;
945                 free_space = dfree * (double)bsize;
946
947                 dsize = (total_space+63*512) / (64*512);
948                 dfree = (free_space+63*512) / (64*512);
949                 
950                 if (dsize > 0xFFFF) dsize = 0xFFFF;
951                 if (dfree > 0xFFFF) dfree = 0xFFFF;
952
953                 SSVAL(outbuf,smb_vwv0,dsize);
954                 SSVAL(outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
955                 SSVAL(outbuf,smb_vwv2,512); /* and this must be 512 */
956                 SSVAL(outbuf,smb_vwv3,dfree);
957         } else {
958                 SSVAL(outbuf,smb_vwv0,dsize);
959                 SSVAL(outbuf,smb_vwv1,bsize/512);
960                 SSVAL(outbuf,smb_vwv2,512);
961                 SSVAL(outbuf,smb_vwv3,dfree);
962         }
963
964         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
965
966         END_PROFILE(SMBdskattr);
967         return(outsize);
968 }
969
970 /****************************************************************************
971  Reply to a search.
972  Can be called from SMBsearch, SMBffirst or SMBfunique.
973 ****************************************************************************/
974
975 int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
976 {
977         pstring mask;
978         pstring directory;
979         pstring fname;
980         SMB_OFF_T size;
981         uint32 mode;
982         time_t date;
983         uint32 dirtype;
984         int outsize = 0;
985         unsigned int numentries = 0;
986         unsigned int maxentries = 0;
987         BOOL finished = False;
988         char *p;
989         int status_len;
990         pstring path;
991         char status[21];
992         int dptr_num= -1;
993         BOOL check_descend = False;
994         BOOL expect_close = False;
995         NTSTATUS nt_status;
996         BOOL mask_contains_wcard = False;
997         BOOL allow_long_path_components = (SVAL(inbuf,smb_flg2) & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
998
999         START_PROFILE(SMBsearch);
1000
1001         if (lp_posix_pathnames()) {
1002                 END_PROFILE(SMBsearch);
1003                 return reply_unknown(inbuf, outbuf);
1004         }
1005
1006         *mask = *directory = *fname = 0;
1007
1008         /* If we were called as SMBffirst then we must expect close. */
1009         if(CVAL(inbuf,smb_com) == SMBffirst) {
1010                 expect_close = True;
1011         }
1012   
1013         outsize = set_message(inbuf,outbuf,1,3,True);
1014         maxentries = SVAL(inbuf,smb_vwv0); 
1015         dirtype = SVAL(inbuf,smb_vwv1);
1016         p = smb_buf(inbuf) + 1;
1017         p += srvstr_get_path_wcard(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &nt_status, &mask_contains_wcard);
1018         if (!NT_STATUS_IS_OK(nt_status)) {
1019                 END_PROFILE(SMBsearch);
1020                 return ERROR_NT(nt_status);
1021         }
1022
1023         nt_status = resolve_dfspath_wcard(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, path, &mask_contains_wcard);
1024         if (!NT_STATUS_IS_OK(nt_status)) {
1025                 END_PROFILE(SMBsearch);
1026                 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1027                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1028                 }
1029                 return ERROR_NT(nt_status);
1030         }
1031   
1032         p++;
1033         status_len = SVAL(p, 0);
1034         p += 2;
1035   
1036         /* dirtype &= ~aDIR; */
1037
1038         if (status_len == 0) {
1039                 SMB_STRUCT_STAT sbuf;
1040
1041                 pstrcpy(directory,path);
1042                 nt_status = unix_convert(conn, directory, True, NULL, &sbuf);
1043                 if (!NT_STATUS_IS_OK(nt_status)) {
1044                         END_PROFILE(SMBsearch);
1045                         return ERROR_NT(nt_status);
1046                 }
1047
1048                 nt_status = check_name(conn, directory);
1049                 if (!NT_STATUS_IS_OK(nt_status)) {
1050                         END_PROFILE(SMBsearch);
1051                         return ERROR_NT(nt_status);
1052                 }
1053
1054                 p = strrchr_m(directory,'/');
1055                 if (!p) {
1056                         pstrcpy(mask,directory);
1057                         pstrcpy(directory,".");
1058                 } else {
1059                         *p = 0;
1060                         pstrcpy(mask,p+1);
1061                 }
1062
1063                 if (*directory == '\0') {
1064                         pstrcpy(directory,".");
1065                 }
1066                 memset((char *)status,'\0',21);
1067                 SCVAL(status,0,(dirtype & 0x1F));
1068         } else {
1069                 int status_dirtype;
1070
1071                 memcpy(status,p,21);
1072                 status_dirtype = CVAL(status,0) & 0x1F;
1073                 if (status_dirtype != (dirtype & 0x1F)) {
1074                         dirtype = status_dirtype;
1075                 }
1076
1077                 conn->dirptr = dptr_fetch(status+12,&dptr_num);      
1078                 if (!conn->dirptr) {
1079                         goto SearchEmpty;
1080                 }
1081                 string_set(&conn->dirpath,dptr_path(dptr_num));
1082                 pstrcpy(mask, dptr_wcard(dptr_num));
1083                 /*
1084                  * For a 'continue' search we have no string. So
1085                  * check from the initial saved string.
1086                  */
1087                 mask_contains_wcard = ms_has_wild(mask);
1088         }
1089
1090         p = smb_buf(outbuf) + 3;
1091      
1092         if (status_len == 0) {
1093                 nt_status = dptr_create(conn,
1094                                         directory,
1095                                         True,
1096                                         expect_close,
1097                                         SVAL(inbuf,smb_pid),
1098                                         mask,
1099                                         mask_contains_wcard,
1100                                         dirtype,
1101                                         &conn->dirptr);
1102                 if (!NT_STATUS_IS_OK(nt_status)) {
1103                         return ERROR_NT(nt_status);
1104                 }
1105                 dptr_num = dptr_dnum(conn->dirptr);
1106         } else {
1107                 dirtype = dptr_attr(dptr_num);
1108         }
1109
1110         DEBUG(4,("dptr_num is %d\n",dptr_num));
1111
1112         if ((dirtype&0x1F) == aVOLID) {   
1113                 memcpy(p,status,21);
1114                 make_dir_struct(p,"???????????",volume_label(SNUM(conn)),
1115                                 0,aVOLID,0,!allow_long_path_components);
1116                 dptr_fill(p+12,dptr_num);
1117                 if (dptr_zero(p+12) && (status_len==0)) {
1118                         numentries = 1;
1119                 } else {
1120                         numentries = 0;
1121                 }
1122                 p += DIR_STRUCT_SIZE;
1123         } else {
1124                 unsigned int i;
1125                 maxentries = MIN(maxentries, ((BUFFER_SIZE - (p - outbuf))/DIR_STRUCT_SIZE));
1126
1127                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1128                         conn->dirpath,lp_dontdescend(SNUM(conn))));
1129                 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1130                         check_descend = True;
1131                 }
1132
1133                 for (i=numentries;(i<maxentries) && !finished;i++) {
1134                         finished = !get_dir_entry(conn,mask,dirtype,fname,&size,&mode,&date,check_descend);
1135                         if (!finished) {
1136                                 memcpy(p,status,21);
1137                                 make_dir_struct(p,mask,fname,size, mode,date,
1138                                                 !allow_long_path_components);
1139                                 if (!dptr_fill(p+12,dptr_num)) {
1140                                         break;
1141                                 }
1142                                 numentries++;
1143                                 p += DIR_STRUCT_SIZE;
1144                         }
1145                 }
1146         }
1147
1148   SearchEmpty:
1149
1150         /* If we were called as SMBffirst with smb_search_id == NULL
1151                 and no entries were found then return error and close dirptr 
1152                 (X/Open spec) */
1153
1154         if (numentries == 0) {
1155                 dptr_close(&dptr_num);
1156         } else if(expect_close && status_len == 0) {
1157                 /* Close the dptr - we know it's gone */
1158                 dptr_close(&dptr_num);
1159         }
1160
1161         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1162         if(dptr_num >= 0 && CVAL(inbuf,smb_com) == SMBfunique) {
1163                 dptr_close(&dptr_num);
1164         }
1165
1166         if ((numentries == 0) && !mask_contains_wcard) {
1167                 return ERROR_BOTH(STATUS_NO_MORE_FILES,ERRDOS,ERRnofiles);
1168         }
1169
1170         SSVAL(outbuf,smb_vwv0,numentries);
1171         SSVAL(outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1172         SCVAL(smb_buf(outbuf),0,5);
1173         SSVAL(smb_buf(outbuf),1,numentries*DIR_STRUCT_SIZE);
1174
1175         /* The replies here are never long name. */
1176         SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1177         if (!allow_long_path_components) {
1178                 SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) & (~FLAGS2_LONG_PATH_COMPONENTS));
1179         }
1180
1181         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1182         SSVAL(outbuf,smb_flg2, (SVAL(outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1183           
1184         outsize += DIR_STRUCT_SIZE*numentries;
1185         smb_setlen(inbuf,outbuf,outsize - 4);
1186   
1187         if ((! *directory) && dptr_path(dptr_num))
1188                 slprintf(directory, sizeof(directory)-1, "(%s)",dptr_path(dptr_num));
1189
1190         DEBUG( 4, ( "%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1191                 smb_fn_name(CVAL(inbuf,smb_com)), 
1192                 mask, directory, dirtype, numentries, maxentries ) );
1193
1194         END_PROFILE(SMBsearch);
1195         return(outsize);
1196 }
1197
1198 /****************************************************************************
1199  Reply to a fclose (stop directory search).
1200 ****************************************************************************/
1201
1202 int reply_fclose(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1203 {
1204         int outsize = 0;
1205         int status_len;
1206         pstring path;
1207         char status[21];
1208         int dptr_num= -2;
1209         char *p;
1210         NTSTATUS err;
1211         BOOL path_contains_wcard = False;
1212
1213         START_PROFILE(SMBfclose);
1214
1215         if (lp_posix_pathnames()) {
1216                 END_PROFILE(SMBfclose);
1217                 return reply_unknown(inbuf, outbuf);
1218         }
1219
1220         outsize = set_message(inbuf,outbuf,1,0,True);
1221         p = smb_buf(inbuf) + 1;
1222         p += srvstr_get_path_wcard(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &err, &path_contains_wcard);
1223         if (!NT_STATUS_IS_OK(err)) {
1224                 END_PROFILE(SMBfclose);
1225                 return ERROR_NT(err);
1226         }
1227         p++;
1228         status_len = SVAL(p,0);
1229         p += 2;
1230
1231         if (status_len == 0) {
1232                 END_PROFILE(SMBfclose);
1233                 return ERROR_DOS(ERRSRV,ERRsrverror);
1234         }
1235
1236         memcpy(status,p,21);
1237
1238         if(dptr_fetch(status+12,&dptr_num)) {
1239                 /*  Close the dptr - we know it's gone */
1240                 dptr_close(&dptr_num);
1241         }
1242
1243         SSVAL(outbuf,smb_vwv0,0);
1244
1245         DEBUG(3,("search close\n"));
1246
1247         END_PROFILE(SMBfclose);
1248         return(outsize);
1249 }
1250
1251 /****************************************************************************
1252  Reply to an open.
1253 ****************************************************************************/
1254
1255 int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1256 {
1257         pstring fname;
1258         int outsize = 0;
1259         uint32 fattr=0;
1260         SMB_OFF_T size = 0;
1261         time_t mtime=0;
1262         int info;
1263         SMB_STRUCT_STAT sbuf;
1264         files_struct *fsp;
1265         int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1266         int deny_mode;
1267         uint32 dos_attr = SVAL(inbuf,smb_vwv1);
1268         uint32 access_mask;
1269         uint32 share_mode;
1270         uint32 create_disposition;
1271         uint32 create_options = 0;
1272         NTSTATUS status;
1273         START_PROFILE(SMBopen);
1274  
1275         deny_mode = SVAL(inbuf,smb_vwv0);
1276
1277         srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
1278         if (!NT_STATUS_IS_OK(status)) {
1279                 END_PROFILE(SMBopen);
1280                 return ERROR_NT(status);
1281         }
1282
1283         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1284         if (!NT_STATUS_IS_OK(status)) {
1285                 END_PROFILE(SMBopen);
1286                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1287                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1288                 }
1289                 return ERROR_NT(status);
1290         }
1291
1292         status = unix_convert(conn, fname, False, NULL, &sbuf);
1293         if (!NT_STATUS_IS_OK(status)) {
1294                 END_PROFILE(SMBopen);
1295                 return ERROR_NT(status);
1296         }
1297     
1298         status = check_name(conn, fname);
1299         if (!NT_STATUS_IS_OK(status)) {
1300                 END_PROFILE(SMBopen);
1301                 return ERROR_NT(status);
1302         }
1303
1304         if (!map_open_params_to_ntcreate(fname, deny_mode, OPENX_FILE_EXISTS_OPEN,
1305                         &access_mask, &share_mode, &create_disposition, &create_options)) {
1306                 END_PROFILE(SMBopen);
1307                 return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1308         }
1309
1310         status = open_file_ntcreate(conn,fname,&sbuf,
1311                         access_mask,
1312                         share_mode,
1313                         create_disposition,
1314                         create_options,
1315                         dos_attr,
1316                         oplock_request,
1317                         &info, &fsp);
1318
1319         if (!NT_STATUS_IS_OK(status)) {
1320                 END_PROFILE(SMBopen);
1321                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1322                         /* We have re-scheduled this call. */
1323                         return -1;
1324                 }
1325                 return ERROR_NT(status);
1326         }
1327
1328         size = sbuf.st_size;
1329         fattr = dos_mode(conn,fname,&sbuf);
1330         mtime = sbuf.st_mtime;
1331
1332         if (fattr & aDIR) {
1333                 DEBUG(3,("attempt to open a directory %s\n",fname));
1334                 close_file(fsp,ERROR_CLOSE);
1335                 END_PROFILE(SMBopen);
1336                 return ERROR_DOS(ERRDOS,ERRnoaccess);
1337         }
1338   
1339         outsize = set_message(inbuf,outbuf,7,0,True);
1340         SSVAL(outbuf,smb_vwv0,fsp->fnum);
1341         SSVAL(outbuf,smb_vwv1,fattr);
1342         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1343                 srv_put_dos_date3(outbuf,smb_vwv2,mtime & ~1);
1344         } else {
1345                 srv_put_dos_date3(outbuf,smb_vwv2,mtime);
1346         }
1347         SIVAL(outbuf,smb_vwv4,(uint32)size);
1348         SSVAL(outbuf,smb_vwv6,deny_mode);
1349
1350         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1351                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1352         }
1353     
1354         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1355                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1356         }
1357         END_PROFILE(SMBopen);
1358         return(outsize);
1359 }
1360
1361 /****************************************************************************
1362  Reply to an open and X.
1363 ****************************************************************************/
1364
1365 int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
1366 {
1367         pstring fname;
1368         uint16 open_flags = SVAL(inbuf,smb_vwv2);
1369         int deny_mode = SVAL(inbuf,smb_vwv3);
1370         uint32 smb_attr = SVAL(inbuf,smb_vwv5);
1371         /* Breakout the oplock request bits so we can set the
1372                 reply bits separately. */
1373         int ex_oplock_request = EXTENDED_OPLOCK_REQUEST(inbuf);
1374         int core_oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1375         int oplock_request = ex_oplock_request | core_oplock_request;
1376 #if 0
1377         int smb_sattr = SVAL(inbuf,smb_vwv4); 
1378         uint32 smb_time = make_unix_date3(inbuf+smb_vwv6);
1379 #endif
1380         int smb_ofun = SVAL(inbuf,smb_vwv8);
1381         uint32 fattr=0;
1382         int mtime=0;
1383         SMB_STRUCT_STAT sbuf;
1384         int smb_action = 0;
1385         files_struct *fsp;
1386         NTSTATUS status;
1387         SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv9);
1388         ssize_t retval = -1;
1389         uint32 access_mask;
1390         uint32 share_mode;
1391         uint32 create_disposition;
1392         uint32 create_options = 0;
1393
1394         START_PROFILE(SMBopenX);
1395
1396         /* If it's an IPC, pass off the pipe handler. */
1397         if (IS_IPC(conn)) {
1398                 if (lp_nt_pipe_support()) {
1399                         END_PROFILE(SMBopenX);
1400                         return reply_open_pipe_and_X(conn, inbuf,outbuf,length,bufsize);
1401                 } else {
1402                         END_PROFILE(SMBopenX);
1403                         return ERROR_DOS(ERRSRV,ERRaccess);
1404                 }
1405         }
1406
1407         /* XXXX we need to handle passed times, sattr and flags */
1408         srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
1409         if (!NT_STATUS_IS_OK(status)) {
1410                 END_PROFILE(SMBopenX);
1411                 return ERROR_NT(status);
1412         }
1413
1414         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1415         if (!NT_STATUS_IS_OK(status)) {
1416                 END_PROFILE(SMBopenX);
1417                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1418                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1419                 }
1420                 return ERROR_NT(status);
1421         }
1422
1423         status = unix_convert(conn, fname, False, NULL, &sbuf);
1424         if (!NT_STATUS_IS_OK(status)) {
1425                 END_PROFILE(SMBopenX);
1426                 return ERROR_NT(status);
1427         }
1428
1429         status = check_name(conn, fname);
1430         if (!NT_STATUS_IS_OK(status)) {
1431                 END_PROFILE(SMBopenX);
1432                 return ERROR_NT(status);
1433         }
1434
1435         if (!map_open_params_to_ntcreate(fname, deny_mode, smb_ofun,
1436                                 &access_mask,
1437                                 &share_mode,
1438                                 &create_disposition,
1439                                 &create_options)) {
1440                 END_PROFILE(SMBopenX);
1441                 return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1442         }
1443
1444         status = open_file_ntcreate(conn,fname,&sbuf,
1445                         access_mask,
1446                         share_mode,
1447                         create_disposition,
1448                         create_options,
1449                         smb_attr,
1450                         oplock_request,
1451                         &smb_action, &fsp);
1452       
1453         if (!NT_STATUS_IS_OK(status)) {
1454                 END_PROFILE(SMBopenX);
1455                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1456                         /* We have re-scheduled this call. */
1457                         return -1;
1458                 }
1459                 return ERROR_NT(status);
1460         }
1461
1462         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1463            if the file is truncated or created. */
1464         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1465                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1466                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1467                         close_file(fsp,ERROR_CLOSE);
1468                         END_PROFILE(SMBopenX);
1469                         return ERROR_NT(NT_STATUS_DISK_FULL);
1470                 }
1471                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1472                 if (retval < 0) {
1473                         close_file(fsp,ERROR_CLOSE);
1474                         END_PROFILE(SMBopenX);
1475                         return ERROR_NT(NT_STATUS_DISK_FULL);
1476                 }
1477                 sbuf.st_size = get_allocation_size(conn,fsp,&sbuf);
1478         }
1479
1480         fattr = dos_mode(conn,fname,&sbuf);
1481         mtime = sbuf.st_mtime;
1482         if (fattr & aDIR) {
1483                 close_file(fsp,ERROR_CLOSE);
1484                 END_PROFILE(SMBopenX);
1485                 return ERROR_DOS(ERRDOS,ERRnoaccess);
1486         }
1487
1488         /* If the caller set the extended oplock request bit
1489                 and we granted one (by whatever means) - set the
1490                 correct bit for extended oplock reply.
1491         */
1492
1493         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1494                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1495         }
1496
1497         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1498                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1499         }
1500
1501         /* If the caller set the core oplock request bit
1502                 and we granted one (by whatever means) - set the
1503                 correct bit for core oplock reply.
1504         */
1505
1506         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1507                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1508         }
1509
1510         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1511                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1512         }
1513
1514         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1515                 set_message(inbuf,outbuf,19,0,True);
1516         } else {
1517                 set_message(inbuf,outbuf,15,0,True);
1518         }
1519         SSVAL(outbuf,smb_vwv2,fsp->fnum);
1520         SSVAL(outbuf,smb_vwv3,fattr);
1521         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1522                 srv_put_dos_date3(outbuf,smb_vwv4,mtime & ~1);
1523         } else {
1524                 srv_put_dos_date3(outbuf,smb_vwv4,mtime);
1525         }
1526         SIVAL(outbuf,smb_vwv6,(uint32)sbuf.st_size);
1527         SSVAL(outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1528         SSVAL(outbuf,smb_vwv11,smb_action);
1529
1530         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1531                 SIVAL(outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1532         }
1533
1534         END_PROFILE(SMBopenX);
1535         return chain_reply(inbuf,outbuf,length,bufsize);
1536 }
1537
1538 /****************************************************************************
1539  Reply to a SMBulogoffX.
1540  conn POINTER CAN BE NULL HERE !
1541 ****************************************************************************/
1542
1543 int reply_ulogoffX(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
1544 {
1545         uint16 vuid = SVAL(inbuf,smb_uid);
1546         user_struct *vuser = get_valid_user_struct(vuid);
1547         START_PROFILE(SMBulogoffX);
1548
1549         if(vuser == 0)
1550                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n", vuid));
1551
1552         /* in user level security we are supposed to close any files
1553                 open by this user */
1554         if ((vuser != 0) && (lp_security() != SEC_SHARE))
1555                 file_close_user(vuid);
1556
1557         invalidate_vuid(vuid);
1558
1559         set_message(inbuf,outbuf,2,0,True);
1560
1561         DEBUG( 3, ( "ulogoffX vuid=%d\n", vuid ) );
1562
1563         END_PROFILE(SMBulogoffX);
1564         return chain_reply(inbuf,outbuf,length,bufsize);
1565 }
1566
1567 /****************************************************************************
1568  Reply to a mknew or a create.
1569 ****************************************************************************/
1570
1571 int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1572 {
1573         pstring fname;
1574         int com;
1575         int outsize = 0;
1576         uint32 fattr = SVAL(inbuf,smb_vwv0);
1577         struct timespec ts[2];
1578         files_struct *fsp;
1579         int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1580         SMB_STRUCT_STAT sbuf;
1581         NTSTATUS status;
1582         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1583         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1584         uint32 create_disposition;
1585         uint32 create_options = 0;
1586
1587         START_PROFILE(SMBcreate);
1588  
1589         com = SVAL(inbuf,smb_com);
1590
1591         ts[1] = convert_time_t_to_timespec(srv_make_unix_date3(inbuf + smb_vwv1)); /* mtime. */
1592
1593         srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), 0, STR_TERMINATE, &status);
1594         if (!NT_STATUS_IS_OK(status)) {
1595                 END_PROFILE(SMBcreate);
1596                 return ERROR_NT(status);
1597         }
1598
1599         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1600         if (!NT_STATUS_IS_OK(status)) {
1601                 END_PROFILE(SMBcreate);
1602                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1603                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1604                 }
1605                 return ERROR_NT(status);
1606         }
1607
1608         status = unix_convert(conn, fname, False, NULL, &sbuf);
1609         if (!NT_STATUS_IS_OK(status)) {
1610                 END_PROFILE(SMBcreate);
1611                 return ERROR_NT(status);
1612         }
1613
1614         status = check_name(conn, fname);
1615         if (!NT_STATUS_IS_OK(status)) {
1616                 END_PROFILE(SMBcreate);
1617                 return ERROR_NT(status);
1618         }
1619
1620         if (fattr & aVOLID) {
1621                 DEBUG(0,("Attempt to create file (%s) with volid set - please report this\n",fname));
1622         }
1623
1624         if(com == SMBmknew) {
1625                 /* We should fail if file exists. */
1626                 create_disposition = FILE_CREATE;
1627         } else {
1628                 /* Create if file doesn't exist, truncate if it does. */
1629                 create_disposition = FILE_OVERWRITE_IF;
1630         }
1631
1632         /* Open file using ntcreate. */
1633         status = open_file_ntcreate(conn,fname,&sbuf,
1634                                 access_mask,
1635                                 share_mode,
1636                                 create_disposition,
1637                                 create_options,
1638                                 fattr,
1639                                 oplock_request,
1640                                 NULL, &fsp);
1641   
1642         if (!NT_STATUS_IS_OK(status)) {
1643                 END_PROFILE(SMBcreate);
1644                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1645                         /* We have re-scheduled this call. */
1646                         return -1;
1647                 }
1648                 return ERROR_NT(status);
1649         }
1650  
1651         ts[0] = get_atimespec(&sbuf); /* atime. */
1652         file_ntimes(conn, fname, ts);
1653
1654         outsize = set_message(inbuf,outbuf,1,0,True);
1655         SSVAL(outbuf,smb_vwv0,fsp->fnum);
1656
1657         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1658                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1659         }
1660  
1661         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1662                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1663         }
1664  
1665         DEBUG( 2, ( "reply_mknew: file %s\n", fname ) );
1666         DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n", fname, fsp->fh->fd, (unsigned int)fattr ) );
1667
1668         END_PROFILE(SMBcreate);
1669         return(outsize);
1670 }
1671
1672 /****************************************************************************
1673  Reply to a create temporary file.
1674 ****************************************************************************/
1675
1676 int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
1677 {
1678         pstring fname;
1679         int outsize = 0;
1680         uint32 fattr = SVAL(inbuf,smb_vwv0);
1681         files_struct *fsp;
1682         int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
1683         int tmpfd;
1684         SMB_STRUCT_STAT sbuf;
1685         char *p, *s;
1686         NTSTATUS status;
1687         unsigned int namelen;
1688
1689         START_PROFILE(SMBctemp);
1690
1691         srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
1692         if (!NT_STATUS_IS_OK(status)) {
1693                 END_PROFILE(SMBctemp);
1694                 return ERROR_NT(status);
1695         }
1696         if (*fname) {
1697                 pstrcat(fname,"/TMXXXXXX");
1698         } else {
1699                 pstrcat(fname,"TMXXXXXX");
1700         }
1701
1702         status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
1703         if (!NT_STATUS_IS_OK(status)) {
1704                 END_PROFILE(SMBctemp);
1705                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1706                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
1707                 }
1708                 return ERROR_NT(status);
1709         }
1710
1711         status = unix_convert(conn, fname, False, NULL, &sbuf);
1712         if (!NT_STATUS_IS_OK(status)) {
1713                 END_PROFILE(SMBctemp);
1714                 return ERROR_NT(status);
1715         }
1716
1717         status = check_name(conn, fname);
1718         if (!NT_STATUS_IS_OK(status)) {
1719                 END_PROFILE(SMBctemp);
1720                 return ERROR_NT(status);
1721         }
1722   
1723         tmpfd = smb_mkstemp(fname);
1724         if (tmpfd == -1) {
1725                 END_PROFILE(SMBctemp);
1726                 return(UNIXERROR(ERRDOS,ERRnoaccess));
1727         }
1728
1729         SMB_VFS_STAT(conn,fname,&sbuf);
1730
1731         /* We should fail if file does not exist. */
1732         status = open_file_ntcreate(conn,fname,&sbuf,
1733                                 FILE_GENERIC_READ | FILE_GENERIC_WRITE,
1734                                 FILE_SHARE_READ|FILE_SHARE_WRITE,
1735                                 FILE_OPEN,
1736                                 0,
1737                                 fattr,
1738                                 oplock_request,
1739                                 NULL, &fsp);
1740
1741         /* close fd from smb_mkstemp() */
1742         close(tmpfd);
1743
1744         if (!NT_STATUS_IS_OK(status)) {
1745                 END_PROFILE(SMBctemp);
1746                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
1747                         /* We have re-scheduled this call. */
1748                         return -1;
1749                 }
1750                 return ERROR_NT(status);
1751         }
1752
1753         outsize = set_message(inbuf,outbuf,1,0,True);
1754         SSVAL(outbuf,smb_vwv0,fsp->fnum);
1755
1756         /* the returned filename is relative to the directory */
1757         s = strrchr_m(fname, '/');
1758         if (!s) {
1759                 s = fname;
1760         } else {
1761                 s++;
1762         }
1763
1764         p = smb_buf(outbuf);
1765 #if 0
1766         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
1767            thing in the byte section. JRA */
1768         SSVALS(p, 0, -1); /* what is this? not in spec */
1769 #endif
1770         namelen = srvstr_push(outbuf, p, s, -1, STR_ASCII|STR_TERMINATE);
1771         p += namelen;
1772         outsize = set_message_end(inbuf,outbuf, p);
1773
1774         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1775                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1776         }
1777   
1778         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1779                 SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1780         }
1781
1782         DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fname ) );
1783         DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fname, fsp->fh->fd,
1784                         (unsigned int)sbuf.st_mode ) );
1785
1786         END_PROFILE(SMBctemp);
1787         return(outsize);
1788 }
1789
1790 /*******************************************************************
1791  Check if a user is allowed to rename a file.
1792 ********************************************************************/
1793
1794 static NTSTATUS can_rename(connection_struct *conn, char *fname, uint16 dirtype, SMB_STRUCT_STAT *pst, BOOL self_open)
1795 {
1796         files_struct *fsp;
1797         uint32 fmode;
1798         NTSTATUS status;
1799
1800         if (!CAN_WRITE(conn)) {
1801                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1802         }
1803
1804         fmode = dos_mode(conn,fname,pst);
1805         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
1806                 return NT_STATUS_NO_SUCH_FILE;
1807         }
1808
1809         if (S_ISDIR(pst->st_mode)) {
1810                 return NT_STATUS_OK;
1811         }
1812
1813         status = open_file_ntcreate(conn, fname, pst,
1814                                 DELETE_ACCESS,
1815                                 /* If we're checking our fsp don't deny for delete. */
1816                                 self_open ?
1817                                         FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE :
1818                                         FILE_SHARE_READ|FILE_SHARE_WRITE,
1819                                 FILE_OPEN,
1820                                 0,
1821                                 FILE_ATTRIBUTE_NORMAL,
1822                                 0,
1823                                 NULL, &fsp);
1824
1825         if (!NT_STATUS_IS_OK(status)) {
1826                 return status;
1827         }
1828         close_file(fsp,NORMAL_CLOSE);
1829         return NT_STATUS_OK;
1830 }
1831
1832 /*******************************************************************
1833  Check if a user is allowed to delete a file.
1834 ********************************************************************/
1835
1836 static NTSTATUS can_delete(connection_struct *conn, char *fname,
1837                            uint32 dirtype, BOOL can_defer)
1838 {
1839         SMB_STRUCT_STAT sbuf;
1840         uint32 fattr;
1841         files_struct *fsp;
1842         uint32 dirtype_orig = dirtype;
1843         NTSTATUS status;
1844
1845         DEBUG(10,("can_delete: %s, dirtype = %d\n", fname, dirtype ));
1846
1847         if (!CAN_WRITE(conn)) {
1848                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
1849         }
1850
1851         if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
1852                 return map_nt_error_from_unix(errno);
1853         }
1854
1855         fattr = dos_mode(conn,fname,&sbuf);
1856
1857         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
1858                 dirtype = aDIR|aARCH|aRONLY;
1859         }
1860
1861         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
1862         if (!dirtype) {
1863                 return NT_STATUS_NO_SUCH_FILE;
1864         }
1865
1866         if (!dir_check_ftype(conn, fattr, dirtype)) {
1867                 if (fattr & aDIR) {
1868                         return NT_STATUS_FILE_IS_A_DIRECTORY;
1869                 }
1870                 return NT_STATUS_NO_SUCH_FILE;
1871         }
1872
1873         if (dirtype_orig & 0x8000) {
1874                 /* These will never be set for POSIX. */
1875                 return NT_STATUS_NO_SUCH_FILE;
1876         }
1877
1878 #if 0
1879         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
1880                 return NT_STATUS_FILE_IS_A_DIRECTORY;
1881         }
1882
1883         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
1884                 return NT_STATUS_NO_SUCH_FILE;
1885         }
1886
1887         if (dirtype & 0xFF00) {
1888                 /* These will never be set for POSIX. */
1889                 return NT_STATUS_NO_SUCH_FILE;
1890         }
1891
1892         dirtype &= 0xFF;
1893         if (!dirtype) {
1894                 return NT_STATUS_NO_SUCH_FILE;
1895         }
1896
1897         /* Can't delete a directory. */
1898         if (fattr & aDIR) {
1899                 return NT_STATUS_FILE_IS_A_DIRECTORY;
1900         }
1901 #endif
1902
1903 #if 0 /* JRATEST */
1904         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
1905                 return NT_STATUS_OBJECT_NAME_INVALID;
1906 #endif /* JRATEST */
1907
1908         /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
1909
1910           On a Windows share, a file with read-only dosmode can be opened with
1911           DELETE_ACCESS. But on a Samba share (delete readonly = no), it
1912           fails with NT_STATUS_CANNOT_DELETE error.
1913
1914           This semantic causes a problem that a user can not
1915           rename a file with read-only dosmode on a Samba share
1916           from a Windows command prompt (i.e. cmd.exe, but can rename
1917           from Windows Explorer).
1918         */
1919
1920         if (!lp_delete_readonly(SNUM(conn))) {
1921                 if (fattr & aRONLY) {
1922                         return NT_STATUS_CANNOT_DELETE;
1923                 }
1924         }
1925
1926         /* On open checks the open itself will check the share mode, so
1927            don't do it here as we'll get it wrong. */
1928
1929         status = open_file_ntcreate(conn, fname, &sbuf,
1930                                     DELETE_ACCESS,
1931                                     FILE_SHARE_NONE,
1932                                     FILE_OPEN,
1933                                     0,
1934                                     FILE_ATTRIBUTE_NORMAL,
1935                                     can_defer ? 0 : INTERNAL_OPEN_ONLY,
1936                                     NULL, &fsp);
1937
1938         if (NT_STATUS_IS_OK(status)) {
1939                 close_file(fsp,NORMAL_CLOSE);
1940         }
1941         return status;
1942 }
1943
1944 /****************************************************************************
1945  The guts of the unlink command, split out so it may be called by the NT SMB
1946  code.
1947 ****************************************************************************/
1948
1949 NTSTATUS unlink_internals(connection_struct *conn, uint32 dirtype,
1950                           char *name, BOOL has_wild, BOOL can_defer)
1951 {
1952         pstring directory;
1953         pstring mask;
1954         char *p;
1955         int count=0;
1956         NTSTATUS status = NT_STATUS_OK;
1957         SMB_STRUCT_STAT sbuf;
1958         
1959         *directory = *mask = 0;
1960         
1961         status = unix_convert(conn, name, has_wild, NULL, &sbuf);
1962         if (!NT_STATUS_IS_OK(status)) {
1963                 return status;
1964         }
1965         
1966         p = strrchr_m(name,'/');
1967         if (!p) {
1968                 pstrcpy(directory,".");
1969                 pstrcpy(mask,name);
1970         } else {
1971                 *p = 0;
1972                 pstrcpy(directory,name);
1973                 pstrcpy(mask,p+1);
1974         }
1975         
1976         /*
1977          * We should only check the mangled cache
1978          * here if unix_convert failed. This means
1979          * that the path in 'mask' doesn't exist
1980          * on the file system and so we need to look
1981          * for a possible mangle. This patch from
1982          * Tine Smukavec <valentin.smukavec@hermes.si>.
1983          */
1984         
1985         if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params))
1986                 mangle_check_cache( mask, sizeof(pstring)-1, conn->params );
1987         
1988         if (!has_wild) {
1989                 pstrcat(directory,"/");
1990                 pstrcat(directory,mask);
1991                 if (dirtype == 0) {
1992                         dirtype = FILE_ATTRIBUTE_NORMAL;
1993                 }
1994
1995                 status = check_name(conn, directory);
1996                 if (!NT_STATUS_IS_OK(status)) {
1997                         return status;
1998                 }
1999
2000                 status = can_delete(conn,directory,dirtype,can_defer);
2001                 if (!NT_STATUS_IS_OK(status)) {
2002                         return status;
2003                 }
2004
2005                 if (SMB_VFS_UNLINK(conn,directory) == 0) {
2006                         count++;
2007                         notify_fname(conn, NOTIFY_ACTION_REMOVED,
2008                                      FILE_NOTIFY_CHANGE_FILE_NAME,
2009                                      directory);
2010                 }
2011         } else {
2012                 struct smb_Dir *dir_hnd = NULL;
2013                 long offset = 0;
2014                 const char *dname;
2015                 
2016                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2017                         return NT_STATUS_OBJECT_NAME_INVALID;
2018                 }
2019
2020                 if (strequal(mask,"????????.???")) {
2021                         pstrcpy(mask,"*");
2022                 }
2023
2024                 status = check_name(conn, directory);
2025                 if (!NT_STATUS_IS_OK(status)) {
2026                         return status;
2027                 }
2028
2029                 dir_hnd = OpenDir(conn, directory, mask, dirtype);
2030                 if (dir_hnd == NULL) {
2031                         return map_nt_error_from_unix(errno);
2032                 }
2033                 
2034                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2035                    the pattern matches against the long name, otherwise the short name 
2036                    We don't implement this yet XXXX
2037                 */
2038                 
2039                 status = NT_STATUS_NO_SUCH_FILE;
2040
2041                 while ((dname = ReadDirName(dir_hnd, &offset))) {
2042                         SMB_STRUCT_STAT st;
2043                         pstring fname;
2044                         pstrcpy(fname,dname);
2045
2046                         if (!is_visible_file(conn, directory, dname, &st, True)) {
2047                                 continue;
2048                         }
2049
2050                         /* Quick check for "." and ".." */
2051                         if (fname[0] == '.') {
2052                                 if (!fname[1] || (fname[1] == '.' && !fname[2])) {
2053                                         continue;
2054                                 }
2055                         }
2056
2057                         if(!mask_match(fname, mask, conn->case_sensitive)) {
2058                                 continue;
2059                         }
2060                                 
2061                         slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
2062
2063                         status = check_name(conn, fname);
2064                         if (!NT_STATUS_IS_OK(status)) {
2065                                 CloseDir(dir_hnd);
2066                                 return status;
2067                         }
2068
2069                         status = can_delete(conn, fname, dirtype, can_defer);
2070                         if (!NT_STATUS_IS_OK(status)) {
2071                                 continue;
2072                         }
2073                         if (SMB_VFS_UNLINK(conn,fname) == 0) {
2074                                 count++;
2075                                 DEBUG(3,("unlink_internals: succesful unlink "
2076                                          "[%s]\n",fname));
2077                                 notify_fname(conn, NOTIFY_ACTION_REMOVED,
2078                                              FILE_NOTIFY_CHANGE_FILE_NAME,
2079                                              fname);
2080                         }
2081                                 
2082                 }
2083                 CloseDir(dir_hnd);
2084         }
2085         
2086         if (count == 0 && NT_STATUS_IS_OK(status)) {
2087                 status = map_nt_error_from_unix(errno);
2088         }
2089
2090         return status;
2091 }
2092
2093 /****************************************************************************
2094  Reply to a unlink
2095 ****************************************************************************/
2096
2097 int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, 
2098                  int dum_buffsize)
2099 {
2100         int outsize = 0;
2101         pstring name;
2102         uint32 dirtype;
2103         NTSTATUS status;
2104         BOOL path_contains_wcard = False;
2105
2106         START_PROFILE(SMBunlink);
2107
2108         dirtype = SVAL(inbuf,smb_vwv0);
2109         
2110         srvstr_get_path_wcard(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, &path_contains_wcard);
2111         if (!NT_STATUS_IS_OK(status)) {
2112                 END_PROFILE(SMBunlink);
2113                 return ERROR_NT(status);
2114         }
2115
2116         status = resolve_dfspath_wcard(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, name, &path_contains_wcard);
2117         if (!NT_STATUS_IS_OK(status)) {
2118                 END_PROFILE(SMBunlink);
2119                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2120                         return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
2121                 }
2122                 return ERROR_NT(status);
2123         }
2124         
2125         DEBUG(3,("reply_unlink : %s\n",name));
2126         
2127         status = unlink_internals(conn, dirtype, name, path_contains_wcard,
2128                                   True);
2129         if (!NT_STATUS_IS_OK(status)) {
2130                 if (open_was_deferred(SVAL(inbuf,smb_mid))) {
2131                         /* We have re-scheduled this call. */
2132                         return -1;
2133                 }
2134                 return ERROR_NT(status);
2135         }
2136
2137         outsize = set_message(inbuf,outbuf,0,0,False);
2138   
2139         END_PROFILE(SMBunlink);
2140         return outsize;
2141 }
2142
2143 /****************************************************************************
2144  Fail for readbraw.
2145 ****************************************************************************/
2146
2147 static void fail_readraw(void)
2148 {
2149         pstring errstr;
2150         slprintf(errstr, sizeof(errstr)-1, "FAIL ! reply_readbraw: socket write fail (%s)",
2151                 strerror(errno) );
2152         exit_server_cleanly(errstr);
2153 }
2154
2155 /****************************************************************************
2156  Fake (read/write) sendfile. Returns -1 on read or write fail.
2157 ****************************************************************************/
2158
2159 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread, char *buf, size_t bufsize)
2160 {
2161         size_t tosend = nread;
2162
2163         while (tosend > 0) {
2164                 ssize_t ret;
2165                 size_t cur_read;
2166
2167                 if (tosend > bufsize) {
2168                         cur_read = bufsize;
2169                 } else {
2170                         cur_read = tosend;
2171                 }
2172                 ret = read_file(fsp,buf,startpos,cur_read);
2173                 if (ret == -1) {
2174                         return -1;
2175                 }
2176
2177                 /* If we had a short read, fill with zeros. */
2178                 if (ret < cur_read) {
2179                         memset(buf, '\0', cur_read - ret);
2180                 }
2181
2182                 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2183                         return -1;
2184                 }
2185                 tosend -= cur_read;
2186                 startpos += cur_read;
2187         }
2188
2189         return (ssize_t)nread;
2190 }
2191
2192 /****************************************************************************
2193  Use sendfile in readbraw.
2194 ****************************************************************************/
2195
2196 void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T startpos, size_t nread,
2197                 ssize_t mincount, char *outbuf, int out_buffsize)
2198 {
2199         ssize_t ret=0;
2200
2201 #if defined(WITH_SENDFILE)
2202         /*
2203          * We can only use sendfile on a non-chained packet 
2204          * but we can use on a non-oplocked file. tridge proved this
2205          * on a train in Germany :-). JRA.
2206          * reply_readbraw has already checked the length.
2207          */
2208
2209         if ( (chain_size == 0) && (nread > 0) &&
2210             (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2211                 DATA_BLOB header;
2212
2213                 _smb_setlen(outbuf,nread);
2214                 header.data = (uint8 *)outbuf;
2215                 header.length = 4;
2216                 header.free = NULL;
2217
2218                 if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fh->fd, &header, startpos, nread) == -1) {
2219                         /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
2220                         if (errno == ENOSYS) {
2221                                 goto normal_readbraw;
2222                         }
2223
2224                         /*
2225                          * Special hack for broken Linux with no working sendfile. If we
2226                          * return EINTR we sent the header but not the rest of the data.
2227                          * Fake this up by doing read/write calls.
2228                          */
2229                         if (errno == EINTR) {
2230                                 /* Ensure we don't do this again. */
2231                                 set_use_sendfile(SNUM(conn), False);
2232                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2233
2234                                 if (fake_sendfile(fsp, startpos, nread, outbuf + 4, out_buffsize - 4) == -1) {
2235                                         DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2236                                                 fsp->fsp_name, strerror(errno) ));
2237                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2238                                 }
2239                                 return;
2240                         }
2241
2242                         DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2243                                 fsp->fsp_name, strerror(errno) ));
2244                         exit_server_cleanly("send_file_readbraw sendfile failed");
2245                 }
2246
2247                 return;
2248         }
2249
2250   normal_readbraw:
2251
2252 #endif
2253
2254         if (nread > 0) {
2255                 ret = read_file(fsp,outbuf+4,startpos,nread);
2256 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2257                 if (ret < mincount)
2258                         ret = 0;
2259 #else
2260                 if (ret < nread)
2261                         ret = 0;
2262 #endif
2263         }
2264
2265         _smb_setlen(outbuf,ret);
2266         if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2267                 fail_readraw();
2268 }
2269
2270 /****************************************************************************
2271  Reply to a readbraw (core+ protocol).
2272 ****************************************************************************/
2273
2274 int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int out_buffsize)
2275 {
2276         ssize_t maxcount,mincount;
2277         size_t nread = 0;
2278         SMB_OFF_T startpos;
2279         char *header = outbuf;
2280         files_struct *fsp;
2281         START_PROFILE(SMBreadbraw);
2282
2283         if (srv_is_signing_active()) {
2284                 exit_server_cleanly("reply_readbraw: SMB signing is active - raw reads/writes are disallowed.");
2285         }
2286
2287         /*
2288          * Special check if an oplock break has been issued
2289          * and the readraw request croses on the wire, we must
2290          * return a zero length response here.
2291          */
2292
2293         fsp = file_fsp(inbuf,smb_vwv0);
2294
2295         if (!FNUM_OK(fsp,conn) || !fsp->can_read) {
2296                 /*
2297                  * fsp could be NULL here so use the value from the packet. JRA.
2298                  */
2299                 DEBUG(3,("fnum %d not open in readbraw - cache prime?\n",(int)SVAL(inbuf,smb_vwv0)));
2300                 _smb_setlen(header,0);
2301                 if (write_data(smbd_server_fd(),header,4) != 4)
2302                         fail_readraw();
2303                 END_PROFILE(SMBreadbraw);
2304                 return(-1);
2305         }
2306
2307         CHECK_FSP(fsp,conn);
2308
2309         flush_write_cache(fsp, READRAW_FLUSH);
2310
2311         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv1);
2312         if(CVAL(inbuf,smb_wct) == 10) {
2313                 /*
2314                  * This is a large offset (64 bit) read.
2315                  */
2316 #ifdef LARGE_SMB_OFF_T
2317
2318                 startpos |= (((SMB_OFF_T)IVAL(inbuf,smb_vwv8)) << 32);
2319
2320 #else /* !LARGE_SMB_OFF_T */
2321
2322                 /*
2323                  * Ensure we haven't been sent a >32 bit offset.
2324                  */
2325
2326                 if(IVAL(inbuf,smb_vwv8) != 0) {
2327                         DEBUG(0,("readbraw - large offset (%x << 32) used and we don't support \
2328 64 bit offsets.\n", (unsigned int)IVAL(inbuf,smb_vwv8) ));
2329                         _smb_setlen(header,0);
2330                         if (write_data(smbd_server_fd(),header,4) != 4)
2331                                 fail_readraw();
2332                         END_PROFILE(SMBreadbraw);
2333                         return(-1);
2334                 }
2335
2336 #endif /* LARGE_SMB_OFF_T */
2337
2338                 if(startpos < 0) {
2339                         DEBUG(0,("readbraw - negative 64 bit readraw offset (%.0f) !\n", (double)startpos ));
2340                         _smb_setlen(header,0);
2341                         if (write_data(smbd_server_fd(),header,4) != 4)
2342                                 fail_readraw();
2343                         END_PROFILE(SMBreadbraw);
2344                         return(-1);
2345                 }      
2346         }
2347         maxcount = (SVAL(inbuf,smb_vwv3) & 0xFFFF);
2348         mincount = (SVAL(inbuf,smb_vwv4) & 0xFFFF);
2349
2350         /* ensure we don't overrun the packet size */
2351         maxcount = MIN(65535,maxcount);
2352
2353         if (!is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
2354                 SMB_STRUCT_STAT st;
2355                 SMB_OFF_T size = 0;
2356   
2357                 if (SMB_VFS_FSTAT(fsp,fsp->fh->fd,&st) == 0) {
2358                         size = st.st_size;
2359                 }
2360
2361                 if (startpos >= size) {
2362                         nread = 0;
2363                 } else {
2364                         nread = MIN(maxcount,(size - startpos));          
2365                 }
2366         }
2367
2368 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2369         if (nread < mincount)
2370                 nread = 0;
2371 #endif
2372   
2373         DEBUG( 3, ( "readbraw fnum=%d start=%.0f max=%lu min=%lu nread=%lu\n", fsp->fnum, (double)startpos,
2374                                 (unsigned long)maxcount, (unsigned long)mincount, (unsigned long)nread ) );
2375   
2376         send_file_readbraw(conn, fsp, startpos, nread, mincount, outbuf, out_buffsize);
2377
2378         DEBUG(5,("readbraw finished\n"));
2379         END_PROFILE(SMBreadbraw);
2380         return -1;
2381 }
2382
2383 #undef DBGC_CLASS
2384 #define DBGC_CLASS DBGC_LOCKING
2385
2386 /****************************************************************************
2387  Reply to a lockread (core+ protocol).
2388 ****************************************************************************/
2389
2390 int reply_lockread(connection_struct *conn, char *inbuf,char *outbuf, int length, int dum_buffsiz)
2391 {
2392         ssize_t nread = -1;
2393         char *data;
2394         int outsize = 0;
2395         SMB_OFF_T startpos;
2396         size_t numtoread;
2397         NTSTATUS status;
2398         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2399         struct byte_range_lock *br_lck = NULL;
2400         START_PROFILE(SMBlockread);
2401
2402         CHECK_FSP(fsp,conn);
2403         if (!CHECK_READ(fsp,inbuf)) {
2404                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2405         }
2406
2407         release_level_2_oplocks_on_change(fsp);
2408
2409         numtoread = SVAL(inbuf,smb_vwv1);
2410         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
2411   
2412         outsize = set_message(inbuf,outbuf,5,3,True);
2413         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
2414         data = smb_buf(outbuf) + 3;
2415         
2416         /*
2417          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
2418          * protocol request that predates the read/write lock concept. 
2419          * Thus instead of asking for a read lock here we need to ask
2420          * for a write lock. JRA.
2421          * Note that the requested lock size is unaffected by max_recv.
2422          */
2423         
2424         br_lck = do_lock(smbd_messaging_context(),
2425                         fsp,
2426                         (uint32)SVAL(inbuf,smb_pid), 
2427                         (SMB_BIG_UINT)numtoread,
2428                         (SMB_BIG_UINT)startpos,
2429                         WRITE_LOCK,
2430                         WINDOWS_LOCK,
2431                         False, /* Non-blocking lock. */
2432                         &status,
2433                         NULL);
2434         TALLOC_FREE(br_lck);
2435
2436         if (NT_STATUS_V(status)) {
2437                 END_PROFILE(SMBlockread);
2438                 return ERROR_NT(status);
2439         }
2440
2441         /*
2442          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
2443          */
2444
2445         if (numtoread > max_recv) {
2446                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
2447 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
2448                         (unsigned int)numtoread, (unsigned int)max_recv ));
2449                 numtoread = MIN(numtoread,max_recv);
2450         }
2451         nread = read_file(fsp,data,startpos,numtoread);
2452
2453         if (nread < 0) {
2454                 END_PROFILE(SMBlockread);
2455                 return(UNIXERROR(ERRDOS,ERRnoaccess));
2456         }
2457         
2458         outsize += nread;
2459         SSVAL(outbuf,smb_vwv0,nread);
2460         SSVAL(outbuf,smb_vwv5,nread+3);
2461         SSVAL(smb_buf(outbuf),1,nread);
2462         
2463         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
2464                  fsp->fnum, (int)numtoread, (int)nread));
2465
2466         END_PROFILE(SMBlockread);
2467         return(outsize);
2468 }
2469
2470 #undef DBGC_CLASS
2471 #define DBGC_CLASS DBGC_ALL
2472
2473 /****************************************************************************
2474  Reply to a read.
2475 ****************************************************************************/
2476
2477 int reply_read(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
2478 {
2479         size_t numtoread;
2480         ssize_t nread = 0;
2481         char *data;
2482         SMB_OFF_T startpos;
2483         int outsize = 0;
2484         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2485         START_PROFILE(SMBread);
2486
2487         CHECK_FSP(fsp,conn);
2488         if (!CHECK_READ(fsp,inbuf)) {
2489                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2490         }
2491
2492         numtoread = SVAL(inbuf,smb_vwv1);
2493         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
2494
2495         outsize = set_message(inbuf,outbuf,5,3,True);
2496         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
2497         /*
2498          * The requested read size cannot be greater than max_recv. JRA.
2499          */
2500         if (numtoread > max_recv) {
2501                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
2502 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
2503                         (unsigned int)numtoread, (unsigned int)max_recv ));
2504                 numtoread = MIN(numtoread,max_recv);
2505         }
2506
2507         data = smb_buf(outbuf) + 3;
2508   
2509         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK)) {
2510                 END_PROFILE(SMBread);
2511                 return ERROR_DOS(ERRDOS,ERRlock);
2512         }
2513
2514         if (numtoread > 0)
2515                 nread = read_file(fsp,data,startpos,numtoread);
2516
2517         if (nread < 0) {
2518                 END_PROFILE(SMBread);
2519                 return(UNIXERROR(ERRDOS,ERRnoaccess));
2520         }
2521   
2522         outsize += nread;
2523         SSVAL(outbuf,smb_vwv0,nread);
2524         SSVAL(outbuf,smb_vwv5,nread+3);
2525         SCVAL(smb_buf(outbuf),0,1);
2526         SSVAL(smb_buf(outbuf),1,nread);
2527   
2528         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
2529                 fsp->fnum, (int)numtoread, (int)nread ) );
2530
2531         END_PROFILE(SMBread);
2532         return(outsize);
2533 }
2534
2535 /****************************************************************************
2536  Setup readX header.
2537 ****************************************************************************/
2538
2539 static int setup_readX_header(char *inbuf, char *outbuf, size_t smb_maxcnt)
2540 {
2541         int outsize;
2542         char *data = smb_buf(outbuf);
2543
2544         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
2545         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
2546         SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
2547         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
2548         SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
2549         SCVAL(outbuf,smb_vwv0,0xFF);
2550         outsize = set_message(inbuf, outbuf,12,smb_maxcnt,False);
2551         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
2552         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
2553         return outsize;
2554 }
2555
2556 /****************************************************************************
2557  Reply to a read and X - possibly using sendfile.
2558 ****************************************************************************/
2559
2560 int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length, int len_outbuf,
2561                 files_struct *fsp, SMB_OFF_T startpos, size_t smb_maxcnt)
2562 {
2563         SMB_STRUCT_STAT sbuf;
2564         int outsize = 0;
2565         ssize_t nread = -1;
2566         char *data = smb_buf(outbuf);
2567
2568         if(SMB_VFS_FSTAT(fsp,fsp->fh->fd, &sbuf) == -1) {
2569                 return(UNIXERROR(ERRDOS,ERRnoaccess));
2570         }
2571
2572         if (startpos > sbuf.st_size) {
2573                 smb_maxcnt = 0;
2574         }
2575
2576         if (smb_maxcnt > (sbuf.st_size - startpos)) {
2577                 smb_maxcnt = (sbuf.st_size - startpos);
2578         }
2579
2580         if (smb_maxcnt == 0) {
2581                 goto normal_read;
2582         }
2583
2584 #if defined(WITH_SENDFILE)
2585         /*
2586          * We can only use sendfile on a non-chained packet 
2587          * but we can use on a non-oplocked file. tridge proved this
2588          * on a train in Germany :-). JRA.
2589          */
2590
2591         if ((chain_size == 0) && (CVAL(inbuf,smb_vwv0) == 0xFF) &&
2592             lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
2593                 DATA_BLOB header;
2594
2595                 /* 
2596                  * Set up the packet header before send. We
2597                  * assume here the sendfile will work (get the
2598                  * correct amount of data).
2599                  */
2600
2601                 setup_readX_header(inbuf,outbuf,smb_maxcnt);
2602                 set_message(inbuf,outbuf,12,smb_maxcnt,False);
2603                 header.data = (uint8 *)outbuf;
2604                 header.length = data - outbuf;
2605                 header.free = NULL;
2606
2607                 if ((nread = SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fh->fd, &header, startpos, smb_maxcnt)) == -1) {
2608                         /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
2609                         if (errno == ENOSYS) {
2610                                 goto normal_read;
2611                         }
2612
2613                         /*
2614                          * Special hack for broken Linux with no working sendfile. If we
2615                          * return EINTR we sent the header but not the rest of the data.
2616                          * Fake this up by doing read/write calls.
2617                          */
2618
2619                         if (errno == EINTR) {
2620                                 /* Ensure we don't do this again. */
2621                                 set_use_sendfile(SNUM(conn), False);
2622                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
2623
2624                                 if ((nread = fake_sendfile(fsp, startpos, smb_maxcnt, data,
2625                                                         len_outbuf - (data-outbuf))) == -1) {
2626                                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
2627                                                 fsp->fsp_name, strerror(errno) ));
2628                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
2629                                 }
2630                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
2631                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
2632                                 /* Returning -1 here means successful sendfile. */
2633                                 return -1;
2634                         }
2635
2636                         DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
2637                                 fsp->fsp_name, strerror(errno) ));
2638                         exit_server_cleanly("send_file_readX sendfile failed");
2639                 }
2640
2641                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
2642                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
2643                 /* Returning -1 here means successful sendfile. */
2644                 return -1;
2645         }
2646
2647 #endif
2648
2649   normal_read:
2650
2651         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
2652                 int sendlen = setup_readX_header(inbuf,outbuf,smb_maxcnt) - smb_maxcnt;
2653                 /* Send out the header. */
2654                 if (write_data(smbd_server_fd(),outbuf,sendlen) != sendlen) {
2655                         DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
2656                                 fsp->fsp_name, strerror(errno) ));
2657                         exit_server_cleanly("send_file_readX sendfile failed");
2658                 }
2659                 if ((nread = fake_sendfile(fsp, startpos, smb_maxcnt, data,
2660                                         len_outbuf - (data-outbuf))) == -1) {
2661                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
2662                                 fsp->fsp_name, strerror(errno) ));
2663                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
2664                 }
2665                 return -1;
2666         } else {
2667                 nread = read_file(fsp,data,startpos,smb_maxcnt);
2668
2669                 if (nread < 0) {
2670                         return(UNIXERROR(ERRDOS,ERRnoaccess));
2671                 }
2672
2673                 outsize = setup_readX_header(inbuf, outbuf,nread);
2674
2675                 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
2676                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
2677
2678                 /* Returning the number of bytes we want to send back - including header. */
2679                 return outsize;
2680         }
2681 }
2682
2683 /****************************************************************************
2684  Reply to a read and X.
2685 ****************************************************************************/
2686
2687 int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
2688 {
2689         files_struct *fsp = file_fsp(inbuf,smb_vwv2);
2690         SMB_OFF_T startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
2691         ssize_t nread = -1;
2692         size_t smb_maxcnt = SVAL(inbuf,smb_vwv5);
2693         BOOL big_readX = False;
2694 #if 0
2695         size_t smb_mincnt = SVAL(inbuf,smb_vwv6);
2696 #endif
2697
2698         START_PROFILE(SMBreadX);
2699
2700         /* If it's an IPC, pass off the pipe handler. */
2701         if (IS_IPC(conn)) {
2702                 END_PROFILE(SMBreadX);
2703                 return reply_pipe_read_and_X(inbuf,outbuf,length,bufsize);
2704         }
2705
2706         CHECK_FSP(fsp,conn);
2707         if (!CHECK_READ(fsp,inbuf)) {
2708                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2709         }
2710
2711         set_message(inbuf,outbuf,12,0,True);
2712
2713         if (global_client_caps & CAP_LARGE_READX) {
2714                 size_t upper_size = SVAL(inbuf,smb_vwv7);
2715                 smb_maxcnt |= (upper_size<<16);
2716                 if (upper_size > 1) {
2717                         /* Can't do this on a chained packet. */
2718                         if ((CVAL(inbuf,smb_vwv0) != 0xFF)) {
2719                                 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2720                         }
2721                         /* We currently don't do this on signed or sealed data. */
2722                         if (srv_is_signing_active() || srv_encryption_on()) {
2723                                 return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
2724                         }
2725                         /* Is there room in the reply for this data ? */
2726                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
2727                                 return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
2728                         }
2729                         big_readX = True;
2730                 }
2731         }
2732
2733         if(CVAL(inbuf,smb_wct) == 12) {
2734 #ifdef LARGE_SMB_OFF_T
2735                 /*
2736                  * This is a large offset (64 bit) read.
2737                  */
2738                 startpos |= (((SMB_OFF_T)IVAL(inbuf,smb_vwv10)) << 32);
2739
2740 #else /* !LARGE_SMB_OFF_T */
2741
2742                 /*
2743                  * Ensure we haven't been sent a >32 bit offset.
2744                  */
2745
2746                 if(IVAL(inbuf,smb_vwv10) != 0) {
2747                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) used and we don't support \
2748 64 bit offsets.\n", (unsigned int)IVAL(inbuf,smb_vwv10) ));
2749                         END_PROFILE(SMBreadX);
2750                         return ERROR_DOS(ERRDOS,ERRbadaccess);
2751                 }
2752
2753 #endif /* LARGE_SMB_OFF_T */
2754
2755         }
2756
2757         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK)) {
2758                 END_PROFILE(SMBreadX);
2759                 return ERROR_DOS(ERRDOS,ERRlock);
2760         }
2761
2762         if (!big_readX && schedule_aio_read_and_X(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt)) {
2763                 END_PROFILE(SMBreadX);
2764                 return -1;
2765         }
2766
2767         nread = send_file_readX(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt);
2768         /* Only call chain_reply if not an error. */
2769         if (nread != -1 && SVAL(outbuf,smb_rcls) == 0) {
2770                 nread = chain_reply(inbuf,outbuf,length,bufsize);
2771         }
2772
2773         END_PROFILE(SMBreadX);
2774         return nread;
2775 }
2776
2777 /****************************************************************************
2778  Reply to a writebraw (core+ or LANMAN1.0 protocol).
2779 ****************************************************************************/
2780
2781 int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
2782 {
2783         ssize_t nwritten=0;
2784         ssize_t total_written=0;
2785         size_t numtowrite=0;
2786         size_t tcount;
2787         SMB_OFF_T startpos;
2788         char *data=NULL;
2789         BOOL write_through;
2790         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2791         int outsize = 0;
2792         START_PROFILE(SMBwritebraw);
2793
2794         if (srv_is_signing_active()) {
2795                 exit_server_cleanly("reply_writebraw: SMB signing is active - raw reads/writes are disallowed.");
2796         }
2797
2798         CHECK_FSP(fsp,conn);
2799         if (!CHECK_WRITE(fsp)) {
2800                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2801         }
2802   
2803         tcount = IVAL(inbuf,smb_vwv1);
2804         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
2805         write_through = BITSETW(inbuf+smb_vwv7,0);
2806
2807         /* We have to deal with slightly different formats depending
2808                 on whether we are using the core+ or lanman1.0 protocol */
2809
2810         if(Protocol <= PROTOCOL_COREPLUS) {
2811                 numtowrite = SVAL(smb_buf(inbuf),-2);
2812                 data = smb_buf(inbuf);
2813         } else {
2814                 numtowrite = SVAL(inbuf,smb_vwv10);
2815                 data = smb_base(inbuf) + SVAL(inbuf, smb_vwv11);
2816         }
2817
2818         /* force the error type */
2819         SCVAL(inbuf,smb_com,SMBwritec);
2820         SCVAL(outbuf,smb_com,SMBwritec);
2821
2822         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
2823                 END_PROFILE(SMBwritebraw);
2824                 return(ERROR_DOS(ERRDOS,ERRlock));
2825         }
2826
2827         if (numtowrite>0)
2828                 nwritten = write_file(fsp,data,startpos,numtowrite);
2829   
2830         DEBUG(3,("writebraw1 fnum=%d start=%.0f num=%d wrote=%d sync=%d\n",
2831                 fsp->fnum, (double)startpos, (int)numtowrite, (int)nwritten, (int)write_through));
2832
2833         if (nwritten < (ssize_t)numtowrite)  {
2834                 END_PROFILE(SMBwritebraw);
2835                 return(UNIXERROR(ERRHRD,ERRdiskfull));
2836         }
2837
2838         total_written = nwritten;
2839
2840         /* Return a message to the redirector to tell it to send more bytes */
2841         SCVAL(outbuf,smb_com,SMBwritebraw);
2842         SSVALS(outbuf,smb_vwv0,-1);
2843         outsize = set_message(inbuf,outbuf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
2844         show_msg(outbuf);
2845         if (!send_smb(smbd_server_fd(),outbuf))
2846                 exit_server_cleanly("reply_writebraw: send_smb failed.");
2847   
2848         /* Now read the raw data into the buffer and write it */
2849         if (read_smb_length(smbd_server_fd(),inbuf,SMB_SECONDARY_WAIT) == -1) {
2850                 exit_server_cleanly("secondary writebraw failed");
2851         }
2852   
2853         /* Even though this is not an smb message, smb_len returns the generic length of an smb message */
2854         numtowrite = smb_len(inbuf);
2855
2856         /* Set up outbuf to return the correct return */
2857         outsize = set_message(inbuf,outbuf,1,0,True);
2858         SCVAL(outbuf,smb_com,SMBwritec);
2859
2860         if (numtowrite != 0) {
2861
2862                 if (numtowrite > BUFFER_SIZE) {
2863                         DEBUG(0,("reply_writebraw: Oversize secondary write raw requested (%u). Terminating\n",
2864                                 (unsigned int)numtowrite ));
2865                         exit_server_cleanly("secondary writebraw failed");
2866                 }
2867
2868                 if (tcount > nwritten+numtowrite) {
2869                         DEBUG(3,("Client overestimated the write %d %d %d\n",
2870                                 (int)tcount,(int)nwritten,(int)numtowrite));
2871                 }
2872
2873                 if (read_data( smbd_server_fd(), inbuf+4, numtowrite) != numtowrite ) {
2874                         DEBUG(0,("reply_writebraw: Oversize secondary write raw read failed (%s). Terminating\n",
2875                                 strerror(errno) ));
2876                         exit_server_cleanly("secondary writebraw failed");
2877                 }
2878
2879                 nwritten = write_file(fsp,inbuf+4,startpos+nwritten,numtowrite);
2880                 if (nwritten == -1) {
2881                         END_PROFILE(SMBwritebraw);
2882                         return(UNIXERROR(ERRHRD,ERRdiskfull));
2883                 }
2884
2885                 if (nwritten < (ssize_t)numtowrite) {
2886                         SCVAL(outbuf,smb_rcls,ERRHRD);
2887                         SSVAL(outbuf,smb_err,ERRdiskfull);      
2888                 }
2889
2890                 if (nwritten > 0)
2891                         total_written += nwritten;
2892         }
2893  
2894         SSVAL(outbuf,smb_vwv0,total_written);
2895
2896         sync_file(conn, fsp, write_through);
2897
2898         DEBUG(3,("writebraw2 fnum=%d start=%.0f num=%d wrote=%d\n",
2899                 fsp->fnum, (double)startpos, (int)numtowrite,(int)total_written));
2900
2901         /* we won't return a status if write through is not selected - this follows what WfWg does */
2902         END_PROFILE(SMBwritebraw);
2903         if (!write_through && total_written==tcount) {
2904
2905 #if RABBIT_PELLET_FIX
2906                 /*
2907                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
2908                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this. JRA.
2909                  */
2910                 if (!send_keepalive(smbd_server_fd()))
2911                         exit_server_cleanly("reply_writebraw: send of keepalive failed");
2912 #endif
2913                 return(-1);
2914         }
2915
2916         return(outsize);
2917 }
2918
2919 #undef DBGC_CLASS
2920 #define DBGC_CLASS DBGC_LOCKING
2921
2922 /****************************************************************************
2923  Reply to a writeunlock (core+).
2924 ****************************************************************************/
2925
2926 int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf, 
2927                       int size, int dum_buffsize)
2928 {
2929         ssize_t nwritten = -1;
2930         size_t numtowrite;
2931         SMB_OFF_T startpos;
2932         char *data;
2933         NTSTATUS status = NT_STATUS_OK;
2934         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
2935         int outsize = 0;
2936         START_PROFILE(SMBwriteunlock);
2937         
2938         CHECK_FSP(fsp,conn);
2939         if (!CHECK_WRITE(fsp)) {
2940                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
2941         }
2942
2943         numtowrite = SVAL(inbuf,smb_vwv1);
2944         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
2945         data = smb_buf(inbuf) + 3;
2946   
2947         if (numtowrite && is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
2948                 END_PROFILE(SMBwriteunlock);
2949                 return ERROR_DOS(ERRDOS,ERRlock);
2950         }
2951
2952         /* The special X/Open SMB protocol handling of
2953            zero length writes is *NOT* done for
2954            this call */
2955         if(numtowrite == 0) {
2956                 nwritten = 0;
2957         } else {
2958                 nwritten = write_file(fsp,data,startpos,numtowrite);
2959         }
2960   
2961         sync_file(conn, fsp, False /* write through */);
2962
2963         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
2964                 END_PROFILE(SMBwriteunlock);
2965                 return(UNIXERROR(ERRHRD,ERRdiskfull));
2966         }
2967
2968         if (numtowrite) {
2969                 status = do_unlock(smbd_messaging_context(),
2970                                 fsp,
2971                                 (uint32)SVAL(inbuf,smb_pid),
2972                                 (SMB_BIG_UINT)numtowrite, 
2973                                 (SMB_BIG_UINT)startpos,
2974                                 WINDOWS_LOCK);
2975
2976                 if (NT_STATUS_V(status)) {
2977                         END_PROFILE(SMBwriteunlock);
2978                         return ERROR_NT(status);
2979                 }
2980         }
2981         
2982         outsize = set_message(inbuf,outbuf,1,0,True);
2983         
2984         SSVAL(outbuf,smb_vwv0,nwritten);
2985         
2986         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
2987                  fsp->fnum, (int)numtowrite, (int)nwritten));
2988         
2989         END_PROFILE(SMBwriteunlock);
2990         return outsize;
2991 }
2992
2993 #undef DBGC_CLASS
2994 #define DBGC_CLASS DBGC_ALL
2995
2996 /****************************************************************************
2997  Reply to a write.
2998 ****************************************************************************/
2999
3000 int reply_write(connection_struct *conn, char *inbuf,char *outbuf,int size,int dum_buffsize)
3001 {
3002         size_t numtowrite;
3003         ssize_t nwritten = -1;
3004         SMB_OFF_T startpos;
3005         char *data;
3006         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3007         int outsize = 0;
3008         START_PROFILE(SMBwrite);
3009
3010         /* If it's an IPC, pass off the pipe handler. */
3011         if (IS_IPC(conn)) {
3012                 END_PROFILE(SMBwrite);
3013                 return reply_pipe_write(inbuf,outbuf,size,dum_buffsize);
3014         }
3015
3016         CHECK_FSP(fsp,conn);
3017         if (!CHECK_WRITE(fsp)) {
3018                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
3019         }
3020
3021         numtowrite = SVAL(inbuf,smb_vwv1);
3022         startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
3023         data = smb_buf(inbuf) + 3;
3024   
3025         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3026                 END_PROFILE(SMBwrite);
3027                 return ERROR_DOS(ERRDOS,ERRlock);
3028         }
3029
3030         /*
3031          * X/Open SMB protocol says that if smb_vwv1 is
3032          * zero then the file size should be extended or
3033          * truncated to the size given in smb_vwv[2-3].
3034          */
3035
3036         if(numtowrite == 0) {
3037                 /*
3038                  * This is actually an allocate call, and set EOF. JRA.
3039                  */
3040                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3041                 if (nwritten < 0) {
3042                         END_PROFILE(SMBwrite);
3043                         return ERROR_NT(NT_STATUS_DISK_FULL);
3044                 }
3045                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3046                 if (nwritten < 0) {
3047                         END_PROFILE(SMBwrite);
3048                         return ERROR_NT(NT_STATUS_DISK_FULL);
3049                 }
3050         } else
3051                 nwritten = write_file(fsp,data,startpos,numtowrite);
3052   
3053         sync_file(conn, fsp, False);
3054
3055         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3056                 END_PROFILE(SMBwrite);
3057                 return(UNIXERROR(ERRHRD,ERRdiskfull));
3058         }
3059
3060         outsize = set_message(inbuf,outbuf,1,0,True);
3061   
3062         SSVAL(outbuf,smb_vwv0,nwritten);
3063
3064         if (nwritten < (ssize_t)numtowrite) {
3065                 SCVAL(outbuf,smb_rcls,ERRHRD);
3066                 SSVAL(outbuf,smb_err,ERRdiskfull);      
3067         }
3068   
3069         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3070
3071         END_PROFILE(SMBwrite);
3072         return(outsize);
3073 }
3074
3075 /****************************************************************************
3076  Reply to a write and X.
3077 ****************************************************************************/
3078
3079 int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
3080 {
3081         files_struct *fsp = file_fsp(inbuf,smb_vwv2);
3082         SMB_OFF_T startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
3083         size_t numtowrite = SVAL(inbuf,smb_vwv10);
3084         BOOL write_through = BITSETW(inbuf+smb_vwv7,0);
3085         ssize_t nwritten = -1;
3086         unsigned int smb_doff = SVAL(inbuf,smb_vwv11);
3087         unsigned int smblen = smb_len(inbuf);
3088         char *data;
3089         BOOL large_writeX = ((CVAL(inbuf,smb_wct) == 14) && (smblen > 0xFFFF));
3090         START_PROFILE(SMBwriteX);
3091
3092         /* If it's an IPC, pass off the pipe handler. */
3093         if (IS_IPC(conn)) {
3094                 END_PROFILE(SMBwriteX);
3095                 return reply_pipe_write_and_X(inbuf,outbuf,length,bufsize);
3096         }
3097
3098         CHECK_FSP(fsp,conn);
3099         if (!CHECK_WRITE(fsp)) {
3100                 return(ERROR_DOS(ERRDOS,ERRbadaccess));
3101         }
3102
3103         set_message(inbuf,outbuf,6,0,True);
3104   
3105         /* Deal with possible LARGE_WRITEX */
3106         if (large_writeX) {
3107                 numtowrite |= ((((size_t)SVAL(inbuf,smb_vwv9)) & 1 )<<16);
3108         }
3109
3110         if(smb_doff > smblen || (smb_doff + numtowrite > smblen)) {
3111                 END_PROFILE(SMBwriteX);
3112                 return ERROR_DOS(ERRDOS,ERRbadmem);
3113         }
3114
3115         data = smb_base(inbuf) + smb_doff;
3116
3117         if(CVAL(inbuf,smb_wct) == 14) {
3118 #ifdef LARGE_SMB_OFF_T
3119                 /*
3120                  * This is a large offset (64 bit) write.
3121                  */
3122                 startpos |= (((SMB_OFF_T)IVAL(inbuf,smb_vwv12)) << 32);
3123
3124 #else /* !LARGE_SMB_OFF_T */
3125
3126                 /*
3127                  * Ensure we haven't been sent a >32 bit offset.
3128                  */
3129
3130                 if(IVAL(inbuf,smb_vwv12) != 0) {
3131                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) used and we don't support \
3132 64 bit offsets.\n", (unsigned int)IVAL(inbuf,smb_vwv12) ));
3133                         END_PROFILE(SMBwriteX);
3134                         return ERROR_DOS(ERRDOS,ERRbadaccess);
3135                 }
3136
3137 #endif /* LARGE_SMB_OFF_T */
3138         }
3139
3140         if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3141                 END_PROFILE(SMBwriteX);
3142                 return ERROR_DOS(ERRDOS,ERRlock);
3143         }
3144
3145         /* X/Open SMB protocol says that, unlike SMBwrite
3146         if the length is zero then NO truncation is
3147         done, just a write of zero. To truncate a file,
3148         use SMBwrite. */
3149
3150         if(numtowrite == 0) {
3151                 nwritten = 0;
3152         } else {
3153
3154                 if (schedule_aio_write_and_X(conn, inbuf, outbuf, length, bufsize,
3155                                         fsp,data,startpos,numtowrite)) {
3156                         END_PROFILE(SMBwriteX);
3157                         return -1;
3158                 }
3159
3160                 nwritten = write_file(fsp,data,startpos,numtowrite);
3161         }
3162   
3163         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3164                 END_PROFILE(SMBwriteX);
3165                 return(UNIXERROR(ERRHRD,ERRdiskfull));
3166         }
3167
3168         SSVAL(outbuf,smb_vwv2,nwritten);
3169         if (large_writeX)
3170                 SSVAL(outbuf,smb_vwv4,(nwritten>>16)&1);
3171
3172         if (nwritten < (ssize_t)numtowrite) {
3173                 SCVAL(outbuf,smb_rcls,ERRHRD);
3174                 SSVAL(outbuf,smb_err,ERRdiskfull);      
3175         }
3176
3177         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
3178                 fsp->fnum, (int)numtowrite, (int)nwritten));
3179
3180         sync_file(conn, fsp, write_through);
3181
3182         END_PROFILE(SMBwriteX);
3183         return chain_reply(inbuf,outbuf,length,bufsize);
3184 }
3185
3186 /****************************************************************************
3187  Reply to a lseek.
3188 ****************************************************************************/
3189
3190 int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
3191 {
3192         SMB_OFF_T startpos;
3193         SMB_OFF_T res= -1;
3194         int mode,umode;
3195         int outsize = 0;
3196         files_struct *fsp = file_fsp(inbuf,smb_vwv0);
3197         START_PROFILE(SMBlseek);
3198
3199         CHECK_FSP(fsp,conn);
3200
3201         flush_write_cache(fsp, SEEK_FLUSH);
3202
3203         mode = SVAL(inbuf,smb_vwv1) & 3;
3204         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
3205         startpos = (SMB_OFF_T)IVALS(inbuf,smb_vwv2);
3206
3207         switch (mode) {
3208                 case 0:
3209                         umode = SEEK_SET;
3210                         res = startpos;
3211                         break;
3212                 case 1:
3213                         umode = SEEK_CUR;
3214                         res = fsp->fh->pos + startpos;
3215                         break;
3216                 case 2:
3217                         umode = SEEK_END;
3218                         break;
3219                 default:
3220                         umode = SEEK_SET;
3221                         res = startpos;
3222                         break;
3223         }
3224
3225         if (umode == SEEK_END) {
3226                 if((res = SMB_VFS_LSEEK(fsp,fsp->fh->fd,startpos,umode)) == -1) {
3227                         if(errno == EINVAL) {
3228                                 SMB_OFF_T current_pos = startpos;
3229                                 SMB_STRUCT_STAT sbuf;
3230</