source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  35 #include "../librpc/gen_ndr/open_files.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "rpc_server/rpc_ncacn_np.h"
  39 #include "libcli/security/security.h"
  40 #include "libsmb/nmblib.h"
  41 #include "auth.h"
  42 #include "smbprofile.h"
  43 #include "../lib/tsocket/tsocket.h"
  44 #include "lib/tevent_wait.h"
  45 #include "libcli/smb/smb_signing.h"
  46 #include "lib/util/sys_rw_data.h"
  47
  48 /****************************************************************************
  49  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  50  path or anything including wildcards.
  51  We're assuming here that '/' is not the second byte in any multibyte char
  52  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  53  set.
  54 ****************************************************************************/
  55
  56 /* Custom version for processing POSIX paths. */
  57 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  58
  59 static NTSTATUS check_path_syntax_internal(char *path,
  60                                            bool posix_path,
  61                                            bool *p_last_component_contains_wcard)
  62 {
  63         char *d = path;
  64         const char *s = path;
  65         NTSTATUS ret = NT_STATUS_OK;
  66         bool start_of_name_component = True;
  67         bool stream_started = false;
  68
  69         *p_last_component_contains_wcard = False;
  70
  71         while (*s) {
  72                 if (stream_started) {
  73                         switch (*s) {
  74                         case '/':
  75                         case '\\':
  76                                 return NT_STATUS_OBJECT_NAME_INVALID;
  77                         case ':':
  78                                 if (s[1] == '\0') {
  79                                         return NT_STATUS_OBJECT_NAME_INVALID;
  80                                 }
  81                                 if (strchr_m(&s[1], ':')) {
  82                                         return NT_STATUS_OBJECT_NAME_INVALID;
  83                                 }
  84                                 break;
  85                         }
  86                 }
  87
  88                 if ((*s == ':') && !posix_path && !stream_started) {
  89                         if (*p_last_component_contains_wcard) {
  90                                 return NT_STATUS_OBJECT_NAME_INVALID;
  91                         }
  92                         /* Stream names allow more characters than file names.
  93                            We're overloading posix_path here to allow a wider
  94                            range of characters. If stream_started is true this
  95                            is still a Windows path even if posix_path is true.
  96                            JRA.
  97                         */
  98                         stream_started = true;
  99                         start_of_name_component = false;
 100                         posix_path = true;
 101
 102                         if (s[1] == '\0') {
 103                                 return NT_STATUS_OBJECT_NAME_INVALID;
 104                         }
 105                 }
 106
 107                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 108                         /*
 109                          * Safe to assume is not the second part of a mb char
 110                          * as this is handled below.
 111                          */
 112                         /* Eat multiple '/' or '\\' */
 113                         while (IS_PATH_SEP(*s,posix_path)) {
 114                                 s++;
 115                         }
 116                         if ((d != path) && (*s != '\0')) {
 117                                 /* We only care about non-leading or trailing '/' or '\\' */
 118                                 *d++ = '/';
 119                         }
 120
 121                         start_of_name_component = True;
 122                         /* New component. */
 123                         *p_last_component_contains_wcard = False;
 124                         continue;
 125                 }
 126
 127                 if (start_of_name_component) {
 128                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 129                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 130
 131                                 /*
 132                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 133                                  */
 134
 135                                 /* If  we just added a '/' - delete it */
 136                                 if ((d > path) && (*(d-1) == '/')) {
 137                                         *(d-1) = '\0';
 138                                         d--;
 139                                 }
 140
 141                                 /* Are we at the start ? Can't go back further if so. */
 142                                 if (d <= path) {
 143                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 144                                         break;
 145                                 }
 146                                 /* Go back one level... */
 147                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 148                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 149                                 /* Decrement d first as d points to the *next* char to write into. */
 150                                 for (d--; d > path; d--) {
 151                                         if (*d == '/')
 152                                                 break;
 153                                 }
 154                                 s += 2; /* Else go past the .. */
 155                                 /* We're still at the start of a name component, just the previous one. */
 156                                 continue;
 157
 158                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 159                                 if (posix_path) {
 160                                         /* Eat the '.' */
 161                                         s++;
 162                                         continue;
 163                                 }
 164                         }
 165
 166                 }
 167
 168                 if (!(*s & 0x80)) {
 169                         if (!posix_path) {
 170                                 if (*s <= 0x1f || *s == '|') {
 171                                         return NT_STATUS_OBJECT_NAME_INVALID;
 172                                 }
 173                                 switch (*s) {
 174                                         case '*':
 175                                         case '?':
 176                                         case '<':
 177                                         case '>':
 178                                         case '"':
 179                                                 *p_last_component_contains_wcard = True;
 180                                                 break;
 181                                         default:
 182                                                 break;
 183                                 }
 184                         }
 185                         *d++ = *s++;
 186                 } else {
 187                         size_t siz;
 188                         /* Get the size of the next MB character. */
 189                         next_codepoint(s,&siz);
 190                         switch(siz) {
 191                                 case 5:
 192                                         *d++ = *s++;
 193                                         /*fall through*/
 194                                 case 4:
 195                                         *d++ = *s++;
 196                                         /*fall through*/
 197                                 case 3:
 198                                         *d++ = *s++;
 199                                         /*fall through*/
 200                                 case 2:
 201                                         *d++ = *s++;
 202                                         /*fall through*/
 203                                 case 1:
 204                                         *d++ = *s++;
 205                                         break;
 206                                 default:
 207                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 208                                         *d = '\0';
 209                                         return NT_STATUS_INVALID_PARAMETER;
 210                         }
 211                 }
 212                 start_of_name_component = False;
 213         }
 214
 215         *d = '\0';
 216
 217         return ret;
 218 }
 219
 220 /****************************************************************************
 221  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 222  No wildcards allowed.
 223 ****************************************************************************/
 224
 225 NTSTATUS check_path_syntax(char *path)
 226 {
 227         bool ignore;
 228         return check_path_syntax_internal(path, False, &ignore);
 229 }
 230
 231 /****************************************************************************
 232  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 233  Wildcards allowed - p_contains_wcard returns true if the last component contained
 234  a wildcard.
 235 ****************************************************************************/
 236
 237 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 238 {
 239         return check_path_syntax_internal(path, False, p_contains_wcard);
 240 }
 241
 242 /****************************************************************************
 243  Check the path for a POSIX client.
 244  We're assuming here that '/' is not the second byte in any multibyte char
 245  set (a safe assumption).
 246 ****************************************************************************/
 247
 248 NTSTATUS check_path_syntax_posix(char *path)
 249 {
 250         bool ignore;
 251         return check_path_syntax_internal(path, True, &ignore);
 252 }
 253
 254 /****************************************************************************
 255  Pull a string and check the path allowing a wilcard - provide for error return.
 256  Passes in posix flag.
 257 ****************************************************************************/
 258
 259 static size_t srvstr_get_path_wcard_internal(TALLOC_CTX *ctx,
 260                         const char *base_ptr,
 261                         uint16_t smb_flags2,
 262                         char **pp_dest,
 263                         const char *src,
 264                         size_t src_len,
 265                         int flags,
 266                         bool posix_pathnames,
 267                         NTSTATUS *err,
 268                         bool *contains_wcard)
 269 {
 270         size_t ret;
 271
 272         *pp_dest = NULL;
 273
 274         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 275                                  src_len, flags);
 276
 277         if (!*pp_dest) {
 278                 *err = NT_STATUS_INVALID_PARAMETER;
 279                 return ret;
 280         }
 281
 282         *contains_wcard = False;
 283
 284         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 285                 /*
 286                  * For a DFS path the function parse_dfs_path()
 287                  * will do the path processing, just make a copy.
 288                  */
 289                 *err = NT_STATUS_OK;
 290                 return ret;
 291         }
 292
 293         if (posix_pathnames) {
 294                 *err = check_path_syntax_posix(*pp_dest);
 295         } else {
 296                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 297         }
 298
 299         return ret;
 300 }
 301
 302 /****************************************************************************
 303  Pull a string and check the path allowing a wilcard - provide for error return.
 304 ****************************************************************************/
 305
 306 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 307                         const char *base_ptr,
 308                         uint16_t smb_flags2,
 309                         char **pp_dest,
 310                         const char *src,
 311                         size_t src_len,
 312                         int flags,
 313                         NTSTATUS *err,
 314                         bool *contains_wcard)
 315 {
 316         return srvstr_get_path_wcard_internal(ctx,
 317                         base_ptr,
 318                         smb_flags2,
 319                         pp_dest,
 320                         src,
 321                         src_len,
 322                         flags,
 323                         false,
 324                         err,
 325                         contains_wcard);
 326 }
 327
 328 /****************************************************************************
 329  Pull a string and check the path allowing a wilcard - provide for error return.
 330  posix_pathnames version.
 331 ****************************************************************************/
 332
 333 size_t srvstr_get_path_wcard_posix(TALLOC_CTX *ctx,
 334                         const char *base_ptr,
 335                         uint16_t smb_flags2,
 336                         char **pp_dest,
 337                         const char *src,
 338                         size_t src_len,
 339                         int flags,
 340                         NTSTATUS *err,
 341                         bool *contains_wcard)
 342 {
 343         return srvstr_get_path_wcard_internal(ctx,
 344                         base_ptr,
 345                         smb_flags2,
 346                         pp_dest,
 347                         src,
 348                         src_len,
 349                         flags,
 350                         true,
 351                         err,
 352                         contains_wcard);
 353 }
 354
 355 /****************************************************************************
 356  Pull a string and check the path - provide for error return.
 357 ****************************************************************************/
 358
 359 size_t srvstr_get_path(TALLOC_CTX *ctx,
 360                         const char *base_ptr,
 361                         uint16_t smb_flags2,
 362                         char **pp_dest,
 363                         const char *src,
 364                         size_t src_len,
 365                         int flags,
 366                         NTSTATUS *err)
 367 {
 368         bool ignore;
 369         return srvstr_get_path_wcard_internal(ctx,
 370                         base_ptr,
 371                         smb_flags2,
 372                         pp_dest,
 373                         src,
 374                         src_len,
 375                         flags,
 376                         false,
 377                         err,
 378                         &ignore);
 379 }
 380
 381 /****************************************************************************
 382  Pull a string and check the path - provide for error return.
 383  posix_pathnames version.
 384 ****************************************************************************/
 385
 386 size_t srvstr_get_path_posix(TALLOC_CTX *ctx,
 387                         const char *base_ptr,
 388                         uint16_t smb_flags2,
 389                         char **pp_dest,
 390                         const char *src,
 391                         size_t src_len,
 392                         int flags,
 393                         NTSTATUS *err)
 394 {
 395         bool ignore;
 396         return srvstr_get_path_wcard_internal(ctx,
 397                         base_ptr,
 398                         smb_flags2,
 399                         pp_dest,
 400                         src,
 401                         src_len,
 402                         flags,
 403                         true,
 404                         err,
 405                         &ignore);
 406 }
 407
 408
 409 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 410                                  char **pp_dest, const char *src, int flags,
 411                                  NTSTATUS *err, bool *contains_wcard)
 412 {
 413         ssize_t bufrem = smbreq_bufrem(req, src);
 414
 415         if (bufrem < 0) {
 416                 *err = NT_STATUS_INVALID_PARAMETER;
 417                 return 0;
 418         }
 419
 420         if (req->posix_pathnames) {
 421                 return srvstr_get_path_wcard_internal(mem_ctx,
 422                                 (const char *)req->inbuf,
 423                                 req->flags2,
 424                                 pp_dest,
 425                                 src,
 426                                 bufrem,
 427                                 flags,
 428                                 true,
 429                                 err,
 430                                 contains_wcard);
 431         } else {
 432                 return srvstr_get_path_wcard_internal(mem_ctx,
 433                                 (const char *)req->inbuf,
 434                                 req->flags2,
 435                                 pp_dest,
 436                                 src,
 437                                 bufrem,
 438                                 flags,
 439                                 false,
 440                                 err,
 441                                 contains_wcard);
 442         }
 443 }
 444
 445 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 446                            char **pp_dest, const char *src, int flags,
 447                            NTSTATUS *err)
 448 {
 449         bool ignore;
 450         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 451                                          flags, err, &ignore);
 452 }
 453
 454 /**
 455  * pull a string from the smb_buf part of a packet. In this case the
 456  * string can either be null terminated or it can be terminated by the
 457  * end of the smbbuf area
 458  */
 459 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
 460                               char **dest, const uint8_t *src, int flags)
 461 {
 462         ssize_t bufrem = smbreq_bufrem(req, src);
 463
 464         if (bufrem < 0) {
 465                 return 0;
 466         }
 467
 468         return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
 469                                   bufrem, flags);
 470 }
 471
 472 /****************************************************************************
 473  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 474 ****************************************************************************/
 475
 476 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 477                     files_struct *fsp)
 478 {
 479         if ((fsp == NULL) || (conn == NULL)) {
 480                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 481                 return False;
 482         }
 483         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 484                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 485                 return False;
 486         }
 487         return True;
 488 }
 489
 490 /****************************************************************************
 491  Check if we have a correct fsp pointing to a file.
 492 ****************************************************************************/
 493
 494 bool check_fsp(connection_struct *conn, struct smb_request *req,
 495                files_struct *fsp)
 496 {
 497         if (!check_fsp_open(conn, req, fsp)) {
 498                 return False;
 499         }
 500         if (fsp->is_directory) {
 501                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 502                 return False;
 503         }
 504         if (fsp->fh->fd == -1) {
 505                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 506                 return False;
 507         }
 508         fsp->num_smb_operations++;
 509         return True;
 510 }
 511
 512 /****************************************************************************
 513  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 514  the CHECK_NTQUOTA_HANDLE_OK macro.
 515 ****************************************************************************/
 516
 517 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 518                               files_struct *fsp)
 519 {
 520         if (!check_fsp_open(conn, req, fsp)) {
 521                 return false;
 522         }
 523
 524         if (fsp->is_directory) {
 525                 return false;
 526         }
 527
 528         if (fsp->fake_file_handle == NULL) {
 529                 return false;
 530         }
 531
 532         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 533                 return false;
 534         }
 535
 536         if (fsp->fake_file_handle->private_data == NULL) {
 537                 return false;
 538         }
 539
 540         return true;
 541 }
 542
 543 static bool netbios_session_retarget(struct smbXsrv_connection *xconn,
 544                                      const char *name, int name_type)
 545 {
 546         char *trim_name;
 547         char *trim_name_type;
 548         const char *retarget_parm;
 549         char *retarget;
 550         char *p;
 551         int retarget_type = 0x20;
 552         int retarget_port = NBT_SMB_PORT;
 553         struct sockaddr_storage retarget_addr;
 554         struct sockaddr_in *in_addr;
 555         bool ret = false;
 556         uint8_t outbuf[10];
 557
 558         if (get_socket_port(xconn->transport.sock) != NBT_SMB_PORT) {
 559                 return false;
 560         }
 561
 562         trim_name = talloc_strdup(talloc_tos(), name);
 563         if (trim_name == NULL) {
 564                 goto fail;
 565         }
 566         trim_char(trim_name, ' ', ' ');
 567
 568         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 569                                          name_type);
 570         if (trim_name_type == NULL) {
 571                 goto fail;
 572         }
 573
 574         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 575                                              trim_name_type, NULL);
 576         if (retarget_parm == NULL) {
 577                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 578                                                      trim_name, NULL);
 579         }
 580         if (retarget_parm == NULL) {
 581                 goto fail;
 582         }
 583
 584         retarget = talloc_strdup(trim_name, retarget_parm);
 585         if (retarget == NULL) {
 586                 goto fail;
 587         }
 588
 589         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 590
 591         p = strchr(retarget, ':');
 592         if (p != NULL) {
 593                 *p++ = '\0';
 594                 retarget_port = atoi(p);
 595         }
 596
 597         p = strchr_m(retarget, '#');
 598         if (p != NULL) {
 599                 *p++ = '\0';
 600                 if (sscanf(p, "%x", &retarget_type) != 1) {
 601                         goto fail;
 602                 }
 603         }
 604
 605         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 606         if (!ret) {
 607                 DEBUG(10, ("could not resolve %s\n", retarget));
 608                 goto fail;
 609         }
 610
 611         if (retarget_addr.ss_family != AF_INET) {
 612                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 613                 goto fail;
 614         }
 615
 616         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 617
 618         _smb_setlen(outbuf, 6);
 619         SCVAL(outbuf, 0, 0x84);
 620         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 621         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 622
 623         if (!srv_send_smb(xconn, (char *)outbuf, false, 0, false,
 624                           NULL)) {
 625                 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
 626                                     "failed.");
 627         }
 628
 629         ret = true;
 630  fail:
 631         TALLOC_FREE(trim_name);
 632         return ret;
 633 }
 634
 635 static void reply_called_name_not_present(char *outbuf)
 636 {
 637         smb_setlen(outbuf, 1);
 638         SCVAL(outbuf, 0, 0x83);
 639         SCVAL(outbuf, 4, 0x82);
 640 }
 641
 642 /****************************************************************************
 643  Reply to a (netbios-level) special message.
 644 ****************************************************************************/
 645
 646 void reply_special(struct smbXsrv_connection *xconn, char *inbuf, size_t inbuf_size)
 647 {
 648         struct smbd_server_connection *sconn = xconn->client->sconn;
 649         int msg_type = CVAL(inbuf,0);
 650         int msg_flags = CVAL(inbuf,1);
 651         /*
 652          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 653          * calculation & friends (srv_send_smb uses that) we need the full smb
 654          * header.
 655          */
 656         char outbuf[smb_size];
 657
 658         memset(outbuf, '\0', sizeof(outbuf));
 659
 660         smb_setlen(outbuf,0);
 661
 662         switch (msg_type) {
 663         case NBSSrequest: /* session request */
 664         {
 665                 /* inbuf_size is guarenteed to be at least 4. */
 666                 fstring name1,name2;
 667                 int name_type1, name_type2;
 668                 int name_len1, name_len2;
 669
 670                 *name1 = *name2 = 0;
 671
 672                 if (xconn->transport.nbt.got_session) {
 673                         exit_server_cleanly("multiple session request not permitted");
 674                 }
 675
 676                 SCVAL(outbuf,0,NBSSpositive);
 677                 SCVAL(outbuf,3,0);
 678
 679                 /* inbuf_size is guaranteed to be at least 4. */
 680                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 681                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 682                         DEBUG(0,("Invalid name length in session request\n"));
 683                         reply_called_name_not_present(outbuf);
 684                         break;
 685                 }
 686                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 687                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 688                         DEBUG(0,("Invalid name length in session request\n"));
 689                         reply_called_name_not_present(outbuf);
 690                         break;
 691                 }
 692
 693                 name_type1 = name_extract((unsigned char *)inbuf,
 694                                 inbuf_size,(unsigned int)4,name1);
 695                 name_type2 = name_extract((unsigned char *)inbuf,
 696                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 697
 698                 if (name_type1 == -1 || name_type2 == -1) {
 699                         DEBUG(0,("Invalid name type in session request\n"));
 700                         reply_called_name_not_present(outbuf);
 701                         break;
 702                 }
 703
 704                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 705                          name1, name_type1, name2, name_type2));
 706
 707                 if (netbios_session_retarget(xconn, name1, name_type1)) {
 708                         exit_server_cleanly("retargeted client");
 709                 }
 710
 711                 /*
 712                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 713                  * "*SMBSERV" arrggg!!!
 714                  */
 715                 if (strequal(name1, "*SMBSERVER     ")
 716                     || strequal(name1, "*SMBSERV       "))  {
 717                         char *raddr;
 718
 719                         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
 720                                                                  talloc_tos());
 721                         if (raddr == NULL) {
 722                                 exit_server_cleanly("could not allocate raddr");
 723                         }
 724
 725                         fstrcpy(name1, raddr);
 726                 }
 727
 728                 set_local_machine_name(name1, True);
 729                 set_remote_machine_name(name2, True);
 730
 731                 if (is_ipaddress(sconn->remote_hostname)) {
 732                         char *p = discard_const_p(char, sconn->remote_hostname);
 733
 734                         talloc_free(p);
 735
 736                         sconn->remote_hostname = talloc_strdup(sconn,
 737                                                 get_remote_machine_name());
 738                         if (sconn->remote_hostname == NULL) {
 739                                 exit_server_cleanly("could not copy remote name");
 740                         }
 741                         xconn->remote_hostname = sconn->remote_hostname;
 742                 }
 743
 744                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 745                          get_local_machine_name(), get_remote_machine_name(),
 746                          name_type2));
 747
 748                 if (name_type2 == 'R') {
 749                         /* We are being asked for a pathworks session ---
 750                            no thanks! */
 751                         reply_called_name_not_present(outbuf);
 752                         break;
 753                 }
 754
 755                 reload_services(sconn, conn_snum_used, true);
 756                 reopen_logs();
 757
 758                 xconn->transport.nbt.got_session = true;
 759                 break;
 760         }
 761
 762         case 0x89: /* session keepalive request
 763                       (some old clients produce this?) */
 764                 SCVAL(outbuf,0,NBSSkeepalive);
 765                 SCVAL(outbuf,3,0);
 766                 break;
 767
 768         case NBSSpositive: /* positive session response */
 769         case NBSSnegative: /* negative session response */
 770         case NBSSretarget: /* retarget session response */
 771                 DEBUG(0,("Unexpected session response\n"));
 772                 break;
 773
 774         case NBSSkeepalive: /* session keepalive */
 775         default:
 776                 return;
 777         }
 778
 779         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 780                     msg_type, msg_flags));
 781
 782         if (!srv_send_smb(xconn, outbuf, false, 0, false, NULL)) {
 783                 exit_server_cleanly("reply_special: srv_send_smb failed.");
 784         }
 785
 786         if (CVAL(outbuf, 0) != 0x82) {
 787                 exit_server_cleanly("invalid netbios session");
 788         }
 789         return;
 790 }
 791
 792 /****************************************************************************
 793  Reply to a tcon.
 794  conn POINTER CAN BE NULL HERE !
 795 ****************************************************************************/
 796
 797 void reply_tcon(struct smb_request *req)
 798 {
 799         connection_struct *conn = req->conn;
 800         const char *service;
 801         char *service_buf = NULL;
 802         char *password = NULL;
 803         char *dev = NULL;
 804         int pwlen=0;
 805         NTSTATUS nt_status;
 806         const uint8_t *p;
 807         const char *p2;
 808         TALLOC_CTX *ctx = talloc_tos();
 809         struct smbXsrv_connection *xconn = req->xconn;
 810         NTTIME now = timeval_to_nttime(&req->request_time);
 811
 812         START_PROFILE(SMBtcon);
 813
 814         if (req->buflen < 4) {
 815                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 816                 END_PROFILE(SMBtcon);
 817                 return;
 818         }
 819
 820         p = req->buf + 1;
 821         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 822         p += 1;
 823         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 824         p += pwlen+1;
 825         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 826         p += 1;
 827
 828         if (service_buf == NULL || password == NULL || dev == NULL) {
 829                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 830                 END_PROFILE(SMBtcon);
 831                 return;
 832         }
 833         p2 = strrchr_m(service_buf,'\\');
 834         if (p2) {
 835                 service = p2+1;
 836         } else {
 837                 service = service_buf;
 838         }
 839
 840         conn = make_connection(req, now, service, dev,
 841                                req->vuid,&nt_status);
 842         req->conn = conn;
 843
 844         if (!conn) {
 845                 reply_nterror(req, nt_status);
 846                 END_PROFILE(SMBtcon);
 847                 return;
 848         }
 849
 850         reply_outbuf(req, 2, 0);
 851         SSVAL(req->outbuf,smb_vwv0,xconn->smb1.negprot.max_recv);
 852         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 853         SSVAL(req->outbuf,smb_tid,conn->cnum);
 854
 855         DEBUG(3,("tcon service=%s cnum=%d\n",
 856                  service, conn->cnum));
 857
 858         END_PROFILE(SMBtcon);
 859         return;
 860 }
 861
 862 /****************************************************************************
 863  Reply to a tcon and X.
 864  conn POINTER CAN BE NULL HERE !
 865 ****************************************************************************/
 866
 867 void reply_tcon_and_X(struct smb_request *req)
 868 {
 869         connection_struct *conn = req->conn;
 870         const char *service = NULL;
 871         TALLOC_CTX *ctx = talloc_tos();
 872         /* what the client thinks the device is */
 873         char *client_devicetype = NULL;
 874         /* what the server tells the client the share represents */
 875         const char *server_devicetype;
 876         NTSTATUS nt_status;
 877         int passlen;
 878         char *path = NULL;
 879         const uint8_t *p;
 880         const char *q;
 881         uint16_t tcon_flags;
 882         struct smbXsrv_session *session = NULL;
 883         NTTIME now = timeval_to_nttime(&req->request_time);
 884         bool session_key_updated = false;
 885         uint16_t optional_support = 0;
 886         struct smbXsrv_connection *xconn = req->xconn;
 887
 888         START_PROFILE(SMBtconX);
 889
 890         if (req->wct < 4) {
 891                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 892                 END_PROFILE(SMBtconX);
 893                 return;
 894         }
 895
 896         passlen = SVAL(req->vwv+3, 0);
 897         tcon_flags = SVAL(req->vwv+2, 0);
 898
 899         /* we might have to close an old one */
 900         if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
 901                 struct smbXsrv_tcon *tcon;
 902                 NTSTATUS status;
 903
 904                 tcon = conn->tcon;
 905                 req->conn = NULL;
 906                 conn = NULL;
 907
 908                 /*
 909                  * TODO: cancel all outstanding requests on the tcon
 910                  */
 911                 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
 912                 if (!NT_STATUS_IS_OK(status)) {
 913                         DEBUG(0, ("reply_tcon_and_X: "
 914                                   "smbXsrv_tcon_disconnect() failed: %s\n",
 915                                   nt_errstr(status)));
 916                         /*
 917                          * If we hit this case, there is something completely
 918                          * wrong, so we better disconnect the transport connection.
 919                          */
 920                         END_PROFILE(SMBtconX);
 921                         exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
 922                         return;
 923                 }
 924
 925                 TALLOC_FREE(tcon);
 926                 /*
 927                  * This tree id is gone. Make sure we can't re-use it
 928                  * by accident.
 929                  */
 930                 req->tid = 0;
 931         }
 932
 933         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 934                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 935                 END_PROFILE(SMBtconX);
 936                 return;
 937         }
 938
 939         if (xconn->smb1.negprot.encrypted_passwords) {
 940                 p = req->buf + passlen;
 941         } else {
 942                 p = req->buf + passlen + 1;
 943         }
 944
 945         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 946
 947         if (path == NULL) {
 948                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 949                 END_PROFILE(SMBtconX);
 950                 return;
 951         }
 952
 953         /*
 954          * the service name can be either: \\server\share
 955          * or share directly like on the DELL PowerVault 705
 956          */
 957         if (*path=='\\') {
 958                 q = strchr_m(path+2,'\\');
 959                 if (!q) {
 960                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 961                         END_PROFILE(SMBtconX);
 962                         return;
 963                 }
 964                 service = q+1;
 965         } else {
 966                 service = path;
 967         }
 968
 969         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 970                                 &client_devicetype, p,
 971                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 972
 973         if (client_devicetype == NULL) {
 974                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 975                 END_PROFILE(SMBtconX);
 976                 return;
 977         }
 978
 979         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 980
 981         nt_status = smb1srv_session_lookup(xconn,
 982                                            req->vuid, now, &session);
 983         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
 984                 reply_force_doserror(req, ERRSRV, ERRbaduid);
 985                 END_PROFILE(SMBtconX);
 986                 return;
 987         }
 988         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 989                 reply_nterror(req, nt_status);
 990                 END_PROFILE(SMBtconX);
 991                 return;
 992         }
 993         if (!NT_STATUS_IS_OK(nt_status)) {
 994                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 995                 END_PROFILE(SMBtconX);
 996                 return;
 997         }
 998
 999         if (session->global->auth_session_info == NULL) {
1000                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1001                 END_PROFILE(SMBtconX);
1002                 return;
1003         }
1004
1005         /*
1006          * If there is no application key defined yet
1007          * we create one.
1008          *
1009          * This means we setup the application key on the
1010          * first tcon that happens via the given session.
1011          *
1012          * Once the application key is defined, it does not
1013          * change any more.
1014          */
1015         if (session->global->application_key.length == 0 &&
1016             session->global->signing_key.length > 0)
1017         {
1018                 struct smbXsrv_session *x = session;
1019                 struct auth_session_info *session_info =
1020                         session->global->auth_session_info;
1021                 uint8_t session_key[16];
1022
1023                 ZERO_STRUCT(session_key);
1024                 memcpy(session_key, x->global->signing_key.data,
1025                        MIN(x->global->signing_key.length, sizeof(session_key)));
1026
1027                 /*
1028                  * The application key is truncated/padded to 16 bytes
1029                  */
1030                 x->global->application_key = data_blob_talloc(x->global,
1031                                                              session_key,
1032                                                              sizeof(session_key));
1033                 ZERO_STRUCT(session_key);
1034                 if (x->global->application_key.data == NULL) {
1035                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1036                         END_PROFILE(SMBtconX);
1037                         return;
1038                 }
1039
1040                 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
1041                         smb_key_derivation(x->global->application_key.data,
1042                                            x->global->application_key.length,
1043                                            x->global->application_key.data);
1044                         optional_support |= SMB_EXTENDED_SIGNATURES;
1045                 }
1046
1047                 /*
1048                  * Place the application key into the session_info
1049                  */
1050                 data_blob_clear_free(&session_info->session_key);
1051                 session_info->session_key = data_blob_dup_talloc(session_info,
1052                                                 x->global->application_key);
1053                 if (session_info->session_key.data == NULL) {
1054                         data_blob_clear_free(&x->global->application_key);
1055                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1056                         END_PROFILE(SMBtconX);
1057                         return;
1058                 }
1059                 session_key_updated = true;
1060         }
1061
1062         conn = make_connection(req, now, service, client_devicetype,
1063                                req->vuid, &nt_status);
1064         req->conn =conn;
1065
1066         if (!conn) {
1067                 if (session_key_updated) {
1068                         struct smbXsrv_session *x = session;
1069                         struct auth_session_info *session_info =
1070                                 session->global->auth_session_info;
1071                         data_blob_clear_free(&x->global->application_key);
1072                         data_blob_clear_free(&session_info->session_key);
1073                 }
1074                 reply_nterror(req, nt_status);
1075                 END_PROFILE(SMBtconX);
1076                 return;
1077         }
1078
1079         if ( IS_IPC(conn) )
1080                 server_devicetype = "IPC";
1081         else if ( IS_PRINT(conn) )
1082                 server_devicetype = "LPT1:";
1083         else
1084                 server_devicetype = "A:";
1085
1086         if (get_Protocol() < PROTOCOL_NT1) {
1087                 reply_outbuf(req, 2, 0);
1088                 if (message_push_string(&req->outbuf, server_devicetype,
1089                                         STR_TERMINATE|STR_ASCII) == -1) {
1090                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1091                         END_PROFILE(SMBtconX);
1092                         return;
1093                 }
1094         } else {
1095                 /* NT sets the fstype of IPC$ to the null string */
1096                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
1097
1098                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
1099                         /* Return permissions. */
1100                         uint32_t perm1 = 0;
1101                         uint32_t perm2 = 0;
1102
1103                         reply_outbuf(req, 7, 0);
1104
1105                         if (IS_IPC(conn)) {
1106                                 perm1 = FILE_ALL_ACCESS;
1107                                 perm2 = FILE_ALL_ACCESS;
1108                         } else {
1109                                 perm1 = conn->share_access;
1110                         }
1111
1112                         SIVAL(req->outbuf, smb_vwv3, perm1);
1113                         SIVAL(req->outbuf, smb_vwv5, perm2);
1114                 } else {
1115                         reply_outbuf(req, 3, 0);
1116                 }
1117
1118                 if ((message_push_string(&req->outbuf, server_devicetype,
1119                                          STR_TERMINATE|STR_ASCII) == -1)
1120                     || (message_push_string(&req->outbuf, fstype,
1121                                             STR_TERMINATE) == -1)) {
1122                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1123                         END_PROFILE(SMBtconX);
1124                         return;
1125                 }
1126
1127                 /* what does setting this bit do? It is set by NT4 and
1128                    may affect the ability to autorun mounted cdroms */
1129                 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1130                 optional_support |=
1131                         (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1132
1133                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1134                         DEBUG(2,("Serving %s as a Dfs root\n",
1135                                  lp_servicename(ctx, SNUM(conn)) ));
1136                         optional_support |= SMB_SHARE_IN_DFS;
1137                 }
1138
1139                 SSVAL(req->outbuf, smb_vwv2, optional_support);
1140         }
1141
1142         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1143         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
1144
1145         DEBUG(3,("tconX service=%s \n",
1146                  service));
1147
1148         /* set the incoming and outgoing tid to the just created one */
1149         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1150         SSVAL(req->outbuf,smb_tid,conn->cnum);
1151
1152         END_PROFILE(SMBtconX);
1153
1154         req->tid = conn->cnum;
1155 }
1156
1157 /****************************************************************************
1158  Reply to an unknown type.
1159 ****************************************************************************/
1160
1161 void reply_unknown_new(struct smb_request *req, uint8_t type)
1162 {
1163         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1164                   smb_fn_name(type), type, type));
1165         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1166         return;
1167 }
1168
1169 /****************************************************************************
1170  Reply to an ioctl.
1171  conn POINTER CAN BE NULL HERE !
1172 ****************************************************************************/
1173
1174 void reply_ioctl(struct smb_request *req)
1175 {
1176         connection_struct *conn = req->conn;
1177         uint16_t device;
1178         uint16_t function;
1179         uint32_t ioctl_code;
1180         int replysize;
1181         char *p;
1182
1183         START_PROFILE(SMBioctl);
1184
1185         if (req->wct < 3) {
1186                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1187                 END_PROFILE(SMBioctl);
1188                 return;
1189         }
1190
1191         device     = SVAL(req->vwv+1, 0);
1192         function   = SVAL(req->vwv+2, 0);
1193         ioctl_code = (device << 16) + function;
1194
1195         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1196
1197         switch (ioctl_code) {
1198             case IOCTL_QUERY_JOB_INFO:
1199                     replysize = 32;
1200                     break;
1201             default:
1202                     reply_force_doserror(req, ERRSRV, ERRnosupport);
1203                     END_PROFILE(SMBioctl);
1204                     return;
1205         }
1206
1207         reply_outbuf(req, 8, replysize+1);
1208         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1209         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1210         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
1211         p = smb_buf(req->outbuf);
1212         memset(p, '\0', replysize+1); /* valgrind-safe. */
1213         p += 1;          /* Allow for alignment */
1214
1215         switch (ioctl_code) {
1216                 case IOCTL_QUERY_JOB_INFO:
1217                 {
1218                         NTSTATUS status;
1219                         size_t len = 0;
1220                         files_struct *fsp = file_fsp(
1221                                 req, SVAL(req->vwv+0, 0));
1222                         if (!fsp) {
1223                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1224                                 END_PROFILE(SMBioctl);
1225                                 return;
1226                         }
1227                         /* Job number */
1228                         SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1229
1230                         status = srvstr_push((char *)req->outbuf, req->flags2, p+2,
1231                                     lp_netbios_name(), 15,
1232                                     STR_TERMINATE|STR_ASCII, &len);
1233                         if (!NT_STATUS_IS_OK(status)) {
1234                                 reply_nterror(req, status);
1235                                 END_PROFILE(SMBioctl);
1236                                 return;
1237                         }
1238                         if (conn) {
1239                                 status = srvstr_push((char *)req->outbuf, req->flags2,
1240                                             p+18,
1241                                             lp_servicename(talloc_tos(),
1242                                                            SNUM(conn)),
1243                                             13, STR_TERMINATE|STR_ASCII, &len);
1244                                 if (!NT_STATUS_IS_OK(status)) {
1245                                         reply_nterror(req, status);
1246                                         END_PROFILE(SMBioctl);
1247                                         return;
1248                                 }
1249                         } else {
1250                                 memset(p+18, 0, 13);
1251                         }
1252                         break;
1253                 }
1254         }
1255
1256         END_PROFILE(SMBioctl);
1257         return;
1258 }
1259
1260 /****************************************************************************
1261  Strange checkpath NTSTATUS mapping.
1262 ****************************************************************************/
1263
1264 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1265 {
1266         /* Strange DOS error code semantics only for checkpath... */
1267         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1268                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1269                         /* We need to map to ERRbadpath */
1270                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1271                 }
1272         }
1273         return status;
1274 }
1275
1276 /****************************************************************************
1277  Reply to a checkpath.
1278 ****************************************************************************/
1279
1280 void reply_checkpath(struct smb_request *req)
1281 {
1282         connection_struct *conn = req->conn;
1283         struct smb_filename *smb_fname = NULL;
1284         char *name = NULL;
1285         NTSTATUS status;
1286         uint32_t ucf_flags = ucf_flags_from_smb_request(req);
1287         TALLOC_CTX *ctx = talloc_tos();
1288
1289         START_PROFILE(SMBcheckpath);
1290
1291         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1292                             STR_TERMINATE, &status);
1293
1294         if (!NT_STATUS_IS_OK(status)) {
1295                 status = map_checkpath_error(req->flags2, status);
1296                 reply_nterror(req, status);
1297                 END_PROFILE(SMBcheckpath);
1298                 return;
1299         }
1300
1301         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1302
1303         status = filename_convert(ctx,
1304                                 conn,
1305                                 name,
1306                                 ucf_flags,
1307                                 NULL,
1308                                 &smb_fname);
1309
1310         if (!NT_STATUS_IS_OK(status)) {
1311                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1312                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1313                                         ERRSRV, ERRbadpath);
1314                         END_PROFILE(SMBcheckpath);
1315                         return;
1316                 }
1317                 goto path_err;
1318         }
1319
1320         if (!VALID_STAT(smb_fname->st) &&
1321             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1322                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1323                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1324                 status = map_nt_error_from_unix(errno);
1325                 goto path_err;
1326         }
1327
1328         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1329                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1330                                 ERRDOS, ERRbadpath);
1331                 goto out;
1332         }
1333
1334         reply_outbuf(req, 0, 0);
1335
1336  path_err:
1337         /* We special case this - as when a Windows machine
1338                 is parsing a path is steps through the components
1339                 one at a time - if a component fails it expects
1340                 ERRbadpath, not ERRbadfile.
1341         */
1342         status = map_checkpath_error(req->flags2, status);
1343         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1344                 /*
1345                  * Windows returns different error codes if
1346                  * the parent directory is valid but not the
1347                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1348                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1349                  * if the path is invalid.
1350                  */
1351                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1352                                 ERRDOS, ERRbadpath);
1353                 goto out;
1354         }
1355
1356         reply_nterror(req, status);
1357
1358  out:
1359         TALLOC_FREE(smb_fname);
1360         END_PROFILE(SMBcheckpath);
1361         return;
1362 }
1363
1364 /****************************************************************************
1365  Reply to a getatr.
1366 ****************************************************************************/
1367
1368 void reply_getatr(struct smb_request *req)
1369 {
1370         connection_struct *conn = req->conn;
1371         struct smb_filename *smb_fname = NULL;
1372         char *fname = NULL;
1373         int mode=0;
1374         off_t size=0;
1375         time_t mtime=0;
1376         const char *p;
1377         NTSTATUS status;
1378         TALLOC_CTX *ctx = talloc_tos();
1379         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1380
1381         START_PROFILE(SMBgetatr);
1382
1383         p = (const char *)req->buf + 1;
1384         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1385         if (!NT_STATUS_IS_OK(status)) {
1386                 reply_nterror(req, status);
1387                 goto out;
1388         }
1389
1390         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1391                 under WfWg - weird! */
1392         if (*fname == '\0') {
1393                 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1394                 if (!CAN_WRITE(conn)) {
1395                         mode |= FILE_ATTRIBUTE_READONLY;
1396                 }
1397                 size = 0;
1398                 mtime = 0;
1399         } else {
1400                 uint32_t ucf_flags = ucf_flags_from_smb_request(req);
1401                 status = filename_convert(ctx,
1402                                 conn,
1403                                 fname,
1404                                 ucf_flags,
1405                                 NULL,
1406                                 &smb_fname);
1407                 if (!NT_STATUS_IS_OK(status)) {
1408                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1409                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1410                                                 ERRSRV, ERRbadpath);
1411                                 goto out;
1412                         }
1413                         reply_nterror(req, status);
1414                         goto out;
1415                 }
1416                 if (!VALID_STAT(smb_fname->st) &&
1417                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1418                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1419                                  smb_fname_str_dbg(smb_fname),
1420                                  strerror(errno)));
1421                         reply_nterror(req,  map_nt_error_from_unix(errno));
1422                         goto out;
1423                 }
1424
1425                 mode = dos_mode(conn, smb_fname);
1426                 size = smb_fname->st.st_ex_size;
1427
1428                 if (ask_sharemode) {
1429                         struct timespec write_time_ts;
1430                         struct file_id fileid;
1431
1432                         ZERO_STRUCT(write_time_ts);
1433                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1434                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1435                         if (!null_timespec(write_time_ts)) {
1436                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1437                         }
1438                 }
1439
1440                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1441                 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1442                         size = 0;
1443                 }
1444         }
1445
1446         reply_outbuf(req, 10, 0);
1447
1448         SSVAL(req->outbuf,smb_vwv0,mode);
1449         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1450                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1451         } else {
1452                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1453         }
1454         SIVAL(req->outbuf,smb_vwv3,(uint32_t)size);
1455
1456         if (get_Protocol() >= PROTOCOL_NT1) {
1457                 SSVAL(req->outbuf, smb_flg2,
1458                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1459         }
1460
1461         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1462                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1463
1464  out:
1465         TALLOC_FREE(smb_fname);
1466         TALLOC_FREE(fname);
1467         END_PROFILE(SMBgetatr);
1468         return;
1469 }
1470
1471 /****************************************************************************
1472  Reply to a setatr.
1473 ****************************************************************************/
1474
1475 void reply_setatr(struct smb_request *req)
1476 {
1477         struct smb_file_time ft;
1478         connection_struct *conn = req->conn;
1479         struct smb_filename *smb_fname = NULL;
1480         char *fname = NULL;
1481         int mode;
1482         time_t mtime;
1483         const char *p;
1484         NTSTATUS status;
1485         uint32_t ucf_flags = ucf_flags_from_smb_request(req);
1486         TALLOC_CTX *ctx = talloc_tos();
1487
1488         START_PROFILE(SMBsetatr);
1489
1490         ZERO_STRUCT(ft);
1491
1492         if (req->wct < 2) {
1493                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1494                 goto out;
1495         }
1496
1497         p = (const char *)req->buf + 1;
1498         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1499         if (!NT_STATUS_IS_OK(status)) {
1500                 reply_nterror(req, status);
1501                 goto out;
1502         }
1503
1504         status = filename_convert(ctx,
1505                                 conn,
1506                                 fname,
1507                                 ucf_flags,
1508                                 NULL,
1509                                 &smb_fname);
1510         if (!NT_STATUS_IS_OK(status)) {
1511                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1512                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1513                                         ERRSRV, ERRbadpath);
1514                         goto out;
1515                 }
1516                 reply_nterror(req, status);
1517                 goto out;
1518         }
1519
1520         if (smb_fname->base_name[0] == '.' &&
1521             smb_fname->base_name[1] == '\0') {
1522                 /*
1523                  * Not sure here is the right place to catch this
1524                  * condition. Might be moved to somewhere else later -- vl
1525                  */
1526                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1527                 goto out;
1528         }
1529
1530         mode = SVAL(req->vwv+0, 0);
1531         mtime = srv_make_unix_date3(req->vwv+1);
1532
1533         if (mode != FILE_ATTRIBUTE_NORMAL) {
1534                 if (VALID_STAT_OF_DIR(smb_fname->st))
1535                         mode |= FILE_ATTRIBUTE_DIRECTORY;
1536                 else
1537                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1538
1539                 status = check_access(conn, NULL, smb_fname,
1540                                         FILE_WRITE_ATTRIBUTES);
1541                 if (!NT_STATUS_IS_OK(status)) {
1542                         reply_nterror(req, status);
1543                         goto out;
1544                 }
1545
1546                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1547                                      false) != 0) {
1548                         reply_nterror(req, map_nt_error_from_unix(errno));
1549                         goto out;
1550                 }
1551         }
1552
1553         ft.mtime = convert_time_t_to_timespec(mtime);
1554         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1555         if (!NT_STATUS_IS_OK(status)) {
1556                 reply_nterror(req, status);
1557                 goto out;
1558         }
1559
1560         reply_outbuf(req, 0, 0);
1561
1562         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1563                  mode));
1564  out:
1565         TALLOC_FREE(smb_fname);
1566         END_PROFILE(SMBsetatr);
1567         return;
1568 }
1569
1570 /****************************************************************************
1571  Reply to a dskattr.
1572 ****************************************************************************/
1573
1574 void reply_dskattr(struct smb_request *req)
1575 {
1576         connection_struct *conn = req->conn;
1577         uint64_t ret;
1578         uint64_t dfree,dsize,bsize;
1579         struct smb_filename smb_fname;
1580         START_PROFILE(SMBdskattr);
1581
1582         ZERO_STRUCT(smb_fname);
1583         smb_fname.base_name = discard_const_p(char, ".");
1584
1585         if (SMB_VFS_STAT(conn, &smb_fname) != 0) {
1586                 reply_nterror(req, map_nt_error_from_unix(errno));
1587                 DBG_WARNING("stat of . failed (%s)\n", strerror(errno));
1588                 END_PROFILE(SMBdskattr);
1589                 return;
1590         }
1591
1592         ret = get_dfree_info(conn, &smb_fname, &bsize, &dfree, &dsize);
1593         if (ret == (uint64_t)-1) {
1594                 reply_nterror(req, map_nt_error_from_unix(errno));
1595                 END_PROFILE(SMBdskattr);
1596                 return;
1597         }
1598
1599         /*
1600          * Force max to fit in 16 bit fields.
1601          */
1602         while (dfree > WORDMAX || dsize > WORDMAX || bsize < 512) {
1603                 dfree /= 2;
1604                 dsize /= 2;
1605                 bsize *= 2;
1606                 if (bsize > (WORDMAX*512)) {
1607                         bsize = (WORDMAX*512);
1608                         if (dsize > WORDMAX)
1609                                 dsize = WORDMAX;
1610                         if (dfree >  WORDMAX)
1611                                 dfree = WORDMAX;
1612                         break;
1613                 }
1614         }
1615
1616         reply_outbuf(req, 5, 0);
1617
1618         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1619                 double total_space, free_space;
1620                 /* we need to scale this to a number that DOS6 can handle. We
1621                    use floating point so we can handle large drives on systems
1622                    that don't have 64 bit integers
1623
1624                    we end up displaying a maximum of 2G to DOS systems
1625                 */
1626                 total_space = dsize * (double)bsize;
1627                 free_space = dfree * (double)bsize;
1628
1629                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1630                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1631
1632                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1633                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1634
1635                 SSVAL(req->outbuf,smb_vwv0,dsize);
1636                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1637                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1638                 SSVAL(req->outbuf,smb_vwv3,dfree);
1639         } else {
1640                 SSVAL(req->outbuf,smb_vwv0,dsize);
1641                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1642                 SSVAL(req->outbuf,smb_vwv2,512);
1643                 SSVAL(req->outbuf,smb_vwv3,dfree);
1644         }
1645
1646         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1647
1648         END_PROFILE(SMBdskattr);
1649         return;
1650 }
1651
1652 /*
1653  * Utility function to split the filename from the directory.
1654  */
1655 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1656                                      char **fname_dir_out,
1657                                      char **fname_mask_out)
1658 {
1659         const char *p = NULL;
1660         char *fname_dir = NULL;
1661         char *fname_mask = NULL;
1662
1663         p = strrchr_m(fname_in, '/');
1664         if (!p) {
1665                 fname_dir = talloc_strdup(ctx, ".");
1666                 fname_mask = talloc_strdup(ctx, fname_in);
1667         } else {
1668                 fname_dir = talloc_strndup(ctx, fname_in,
1669                     PTR_DIFF(p, fname_in));
1670                 fname_mask = talloc_strdup(ctx, p+1);
1671         }
1672
1673         if (!fname_dir || !fname_mask) {
1674                 TALLOC_FREE(fname_dir);
1675                 TALLOC_FREE(fname_mask);
1676                 return NT_STATUS_NO_MEMORY;
1677         }
1678
1679         *fname_dir_out = fname_dir;
1680         *fname_mask_out = fname_mask;
1681         return NT_STATUS_OK;
1682 }
1683
1684 /****************************************************************************
1685  Make a dir struct.
1686 ****************************************************************************/
1687
1688 static bool make_dir_struct(TALLOC_CTX *ctx,
1689                             char *buf,
1690                             const char *mask,
1691                             const char *fname,
1692                             off_t size,
1693                             uint32_t mode,
1694                             time_t date,
1695                             bool uc)
1696 {
1697         char *p;
1698         char *mask2 = talloc_strdup(ctx, mask);
1699
1700         if (!mask2) {
1701                 return False;
1702         }
1703
1704         if ((mode & FILE_ATTRIBUTE_DIRECTORY) != 0) {
1705                 size = 0;
1706         }
1707
1708         memset(buf+1,' ',11);
1709         if ((p = strchr_m(mask2,'.')) != NULL) {
1710                 *p = 0;
1711                 push_ascii(buf+1,mask2,8, 0);
1712                 push_ascii(buf+9,p+1,3, 0);
1713                 *p = '.';
1714         } else {
1715                 push_ascii(buf+1,mask2,11, 0);
1716         }
1717
1718         memset(buf+21,'\0',DIR_STRUCT_SIZE-21);
1719         SCVAL(buf,21,mode);
1720         srv_put_dos_date(buf,22,date);
1721         SSVAL(buf,26,size & 0xFFFF);
1722         SSVAL(buf,28,(size >> 16)&0xFFFF);
1723         /* We only uppercase if FLAGS2_LONG_PATH_COMPONENTS is zero in the input buf.
1724            Strange, but verified on W2K3. Needed for OS/2. JRA. */
1725         push_ascii(buf+30,fname,12, uc ? STR_UPPER : 0);
1726         DEBUG(8,("put name [%s] from [%s] into dir struct\n",buf+30, fname));
1727         return True;
1728 }
1729
1730 /****************************************************************************
1731  Reply to a search.
1732  Can be called from SMBsearch, SMBffirst or SMBfunique.
1733 ****************************************************************************/
1734
1735 void reply_search(struct smb_request *req)
1736 {
1737         connection_struct *conn = req->conn;
1738         char *path = NULL;
1739         char *mask = NULL;
1740         char *directory = NULL;
1741         struct smb_filename *smb_fname = NULL;
1742         char *fname = NULL;
1743         off_t size;
1744         uint32_t mode;
1745         struct timespec date;
1746         uint32_t dirtype;
1747         unsigned int numentries = 0;
1748         unsigned int maxentries = 0;
1749         bool finished = False;
1750         const char *p;
1751         int status_len;
1752         char status[21];
1753         int dptr_num= -1;
1754         bool check_descend = False;
1755         bool expect_close = False;
1756         NTSTATUS nt_status;
1757         bool mask_contains_wcard = False;
1758         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1759         TALLOC_CTX *ctx = talloc_tos();
1760         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1761         struct dptr_struct *dirptr = NULL;
1762         struct smbXsrv_connection *xconn = req->xconn;
1763         struct smbd_server_connection *sconn = req->sconn;
1764
1765         START_PROFILE(SMBsearch);
1766
1767         if (req->wct < 2) {
1768                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1769                 goto out;
1770         }
1771
1772         if (req->posix_pathnames) {
1773                 reply_unknown_new(req, req->cmd);
1774                 goto out;
1775         }
1776
1777         /* If we were called as SMBffirst then we must expect close. */
1778         if(req->cmd == SMBffirst) {
1779                 expect_close = True;
1780         }
1781
1782         reply_outbuf(req, 1, 3);
1783         maxentries = SVAL(req->vwv+0, 0);
1784         dirtype = SVAL(req->vwv+1, 0);
1785         p = (const char *)req->buf + 1;
1786         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1787                                        &nt_status, &mask_contains_wcard);
1788         if (!NT_STATUS_IS_OK(nt_status)) {
1789                 reply_nterror(req, nt_status);
1790                 goto out;
1791         }
1792
1793         p++;
1794         status_len = SVAL(p, 0);
1795         p += 2;
1796
1797         /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1798
1799         if (status_len == 0) {
1800                 struct smb_filename *smb_dname = NULL;
1801                 uint32_t ucf_flags = UCF_ALWAYS_ALLOW_WCARD_LCOMP |
1802                         ucf_flags_from_smb_request(req);
1803                 nt_status = filename_convert(ctx, conn,
1804                                              path,
1805                                              ucf_flags,
1806                                              &mask_contains_wcard,
1807                                              &smb_fname);
1808                 if (!NT_STATUS_IS_OK(nt_status)) {
1809                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1810                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1811                                                 ERRSRV, ERRbadpath);
1812                                 goto out;
1813                         }
1814                         reply_nterror(req, nt_status);
1815                         goto out;
1816                 }
1817
1818                 directory = smb_fname->base_name;
1819
1820                 p = strrchr_m(directory,'/');
1821                 if ((p != NULL) && (*directory != '/')) {
1822                         mask = talloc_strdup(ctx, p + 1);
1823                         directory = talloc_strndup(ctx, directory,
1824                                                    PTR_DIFF(p, directory));
1825                 } else {
1826                         mask = talloc_strdup(ctx, directory);
1827                         directory = talloc_strdup(ctx,".");
1828                 }
1829
1830                 if (!directory) {
1831                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1832                         goto out;
1833                 }
1834
1835                 memset((char *)status,'\0',21);
1836                 SCVAL(status,0,(dirtype & 0x1F));
1837
1838                 smb_dname = synthetic_smb_fname(talloc_tos(),
1839                                         directory,
1840                                         NULL,
1841                                         NULL,
1842                                         smb_fname->flags);
1843                 if (smb_dname == NULL) {
1844                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1845                         goto out;
1846                 }
1847
1848                 nt_status = dptr_create(conn,
1849                                         NULL, /* req */
1850                                         NULL, /* fsp */
1851                                         smb_dname,
1852                                         True,
1853                                         expect_close,
1854                                         req->smbpid,
1855                                         mask,
1856                                         mask_contains_wcard,
1857                                         dirtype,
1858                                         &dirptr);
1859
1860                 TALLOC_FREE(smb_dname);
1861
1862                 if (!NT_STATUS_IS_OK(nt_status)) {
1863                         reply_nterror(req, nt_status);
1864                         goto out;
1865                 }
1866                 dptr_num = dptr_dnum(dirptr);
1867         } else {
1868                 int status_dirtype;
1869                 const char *dirpath;
1870
1871                 memcpy(status,p,21);
1872                 status_dirtype = CVAL(status,0) & 0x1F;
1873                 if (status_dirtype != (dirtype & 0x1F)) {
1874                         dirtype = status_dirtype;
1875                 }
1876
1877                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1878                 if (!dirptr) {
1879                         goto SearchEmpty;
1880                 }
1881                 dirpath = dptr_path(sconn, dptr_num);
1882                 directory = talloc_strdup(ctx, dirpath);
1883                 if (!directory) {
1884                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1885                         goto out;
1886                 }
1887
1888                 mask = talloc_strdup(ctx, dptr_wcard(sconn, dptr_num));
1889                 if (!mask) {
1890                         goto SearchEmpty;
1891                 }
1892                 /*
1893                  * For a 'continue' search we have no string. So
1894                  * check from the initial saved string.
1895                  */
1896                 if (!req->posix_pathnames) {
1897                         mask_contains_wcard = ms_has_wild(mask);
1898                 }
1899                 dirtype = dptr_attr(sconn, dptr_num);
1900         }
1901
1902         DEBUG(4,("dptr_num is %d\n",dptr_num));
1903
1904         if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1905                 char buf[DIR_STRUCT_SIZE];
1906                 memcpy(buf,status,21);
1907                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1908                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1909                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1910                         goto out;
1911                 }
1912                 dptr_fill(sconn, buf+12,dptr_num);
1913                 if (dptr_zero(buf+12) && (status_len==0)) {
1914                         numentries = 1;
1915                 } else {
1916                         numentries = 0;
1917                 }
1918                 if (message_push_blob(&req->outbuf,
1919                                       data_blob_const(buf, sizeof(buf)))
1920                     == -1) {
1921                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1922                         goto out;
1923                 }
1924         } else {
1925                 unsigned int i;
1926                 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1927                 size_t available_space = xconn->smb1.sessions.max_send - hdr_size;
1928
1929                 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1930
1931                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1932                          directory,lp_dont_descend(ctx, SNUM(conn))));
1933                 if (in_list(directory, lp_dont_descend(ctx, SNUM(conn)),True)) {
1934                         check_descend = True;
1935                 }
1936
1937                 for (i=numentries;(i<maxentries) && !finished;i++) {
1938                         finished = !get_dir_entry(ctx,
1939                                                   dirptr,
1940                                                   mask,
1941                                                   dirtype,
1942                                                   &fname,
1943                                                   &size,
1944                                                   &mode,
1945                                                   &date,
1946                                                   check_descend,
1947                                                   ask_sharemode);
1948                         if (!finished) {
1949                                 char buf[DIR_STRUCT_SIZE];
1950                                 memcpy(buf,status,21);
1951                                 if (!make_dir_struct(ctx,
1952                                                 buf,
1953                                                 mask,
1954                                                 fname,
1955                                                 size,
1956                                                 mode,
1957                                                 convert_timespec_to_time_t(date),
1958                                                 !allow_long_path_components)) {
1959                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1960                                         goto out;
1961                                 }
1962                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1963                                         break;
1964                                 }
1965                                 if (message_push_blob(&req->outbuf,
1966                                                       data_blob_const(buf, sizeof(buf)))
1967                                     == -1) {
1968                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1969                                         goto out;
1970                                 }
1971                                 numentries++;
1972                         }
1973                 }
1974         }
1975
1976   SearchEmpty:
1977
1978         /* If we were called as SMBffirst with smb_search_id == NULL
1979                 and no entries were found then return error and close dirptr
1980                 (X/Open spec) */
1981
1982         if (numentries == 0) {
1983                 dptr_close(sconn, &dptr_num);
1984         } else if(expect_close && status_len == 0) {
1985                 /* Close the dptr - we know it's gone */
1986                 dptr_close(sconn, &dptr_num);
1987         }
1988
1989         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1990         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1991                 dptr_close(sconn, &dptr_num);
1992         }
1993
1994         if ((numentries == 0) && !mask_contains_wcard) {
1995                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1996                 goto out;
1997         }
1998
1999         SSVAL(req->outbuf,smb_vwv0,numentries);
2000         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
2001         SCVAL(smb_buf(req->outbuf),0,5);
2002         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
2003
2004         /* The replies here are never long name. */
2005         SSVAL(req->outbuf, smb_flg2,
2006               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
2007         if (!allow_long_path_components) {
2008                 SSVAL(req->outbuf, smb_flg2,
2009                       SVAL(req->outbuf, smb_flg2)
2010                       & (~FLAGS2_LONG_PATH_COMPONENTS));
2011         }
2012
2013         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
2014         SSVAL(req->outbuf, smb_flg2,
2015               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
2016
2017         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
2018                 smb_fn_name(req->cmd),
2019                 mask,
2020                 directory,
2021                 dirtype,
2022                 numentries,
2023                 maxentries ));
2024  out:
2025         TALLOC_FREE(directory);
2026         TALLOC_FREE(mask);
2027         TALLOC_FREE(smb_fname);
2028         END_PROFILE(SMBsearch);
2029         return;
2030 }
2031
2032 /****************************************************************************
2033  Reply to a fclose (stop directory search).
2034 ****************************************************************************/
2035
2036 void reply_fclose(struct smb_request *req)
2037 {
2038         int status_len;
2039         char status[21];
2040         int dptr_num= -2;
2041         const char *p;
2042         char *path = NULL;
2043         NTSTATUS err;
2044         bool path_contains_wcard = False;
2045         TALLOC_CTX *ctx = talloc_tos();
2046         struct smbd_server_connection *sconn = req->sconn;
2047
2048         START_PROFILE(SMBfclose);
2049
2050         if (req->posix_pathnames) {
2051                 reply_unknown_new(req, req->cmd);
2052                 END_PROFILE(SMBfclose);
2053                 return;
2054         }
2055
2056         p = (const char *)req->buf + 1;
2057         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
2058                                        &err, &path_contains_wcard);
2059         if (!NT_STATUS_IS_OK(err)) {
2060                 reply_nterror(req, err);
2061                 END_PROFILE(SMBfclose);
2062                 return;
2063         }
2064         p++;
2065         status_len = SVAL(p,0);
2066         p += 2;
2067
2068         if (status_len == 0) {
2069                 reply_force_doserror(req, ERRSRV, ERRsrverror);
2070                 END_PROFILE(SMBfclose);
2071                 return;
2072         }
2073
2074         memcpy(status,p,21);
2075
2076         if(dptr_fetch(sconn, status+12,&dptr_num)) {
2077                 /*  Close the dptr - we know it's gone */
2078                 dptr_close(sconn, &dptr_num);
2079         }
2080
2081         reply_outbuf(req, 1, 0);
2082         SSVAL(req->outbuf,smb_vwv0,0);
2083
2084         DEBUG(3,("search close\n"));
2085
2086         END_PROFILE(SMBfclose);
2087         return;
2088 }
2089
2090 /****************************************************************************
2091  Reply to an open.
2092 ****************************************************************************/
2093
2094 void reply_open(struct smb_request *req)
2095 {
2096         connection_struct *conn = req->conn;
2097         struct smb_filename *smb_fname = NULL;
2098         char *fname = NULL;
2099         uint32_t fattr=0;
2100         off_t size = 0;
2101         time_t mtime=0;
2102         int info;
2103         files_struct *fsp;
2104         int oplock_request;
2105         int deny_mode;
2106         uint32_t dos_attr;
2107         uint32_t access_mask;
2108         uint32_t share_mode;
2109         uint32_t create_disposition;
2110         uint32_t create_options = 0;
2111         uint32_t private_flags = 0;
2112         NTSTATUS status;
2113         uint32_t ucf_flags;
2114         TALLOC_CTX *ctx = talloc_tos();
2115
2116         START_PROFILE(SMBopen);
2117
2118         if (req->wct < 2) {
2119                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2120                 goto out;
2121         }
2122
2123         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2124         deny_mode = SVAL(req->vwv+0, 0);
2125         dos_attr = SVAL(req->vwv+1, 0);
2126
2127         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2128                             STR_TERMINATE, &status);
2129         if (!NT_STATUS_IS_OK(status)) {
2130                 reply_nterror(req, status);
2131                 goto out;
2132         }
2133
2134         if (!map_open_params_to_ntcreate(fname, deny_mode,
2135                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
2136                                          &share_mode, &create_disposition,
2137                                          &create_options, &private_flags)) {
2138                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2139                 goto out;
2140         }
2141
2142         ucf_flags = filename_create_ucf_flags(req, create_disposition);
2143
2144         status = filename_convert(ctx,
2145                                 conn,
2146                                 fname,
2147                                 ucf_flags,
2148                                 NULL,
2149                                 &smb_fname);
2150         if (!NT_STATUS_IS_OK(status)) {
2151                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2152                         reply_botherror(req,
2153                                         NT_STATUS_PATH_NOT_COVERED,
2154                                         ERRSRV, ERRbadpath);
2155                         goto out;
2156                 }
2157                 reply_nterror(req, status);
2158                 goto out;
2159         }
2160
2161         status = SMB_VFS_CREATE_FILE(
2162                 conn,                                   /* conn */
2163                 req,                                    /* req */
2164                 0,                                      /* root_dir_fid */
2165                 smb_fname,                              /* fname */
2166                 access_mask,                            /* access_mask */
2167                 share_mode,                             /* share_access */
2168                 create_disposition,                     /* create_disposition*/
2169                 create_options,                         /* create_options */
2170                 dos_attr,                               /* file_attributes */
2171                 oplock_request,                         /* oplock_request */
2172                 NULL,                                   /* lease */
2173                 0,                                      /* allocation_size */
2174                 private_flags,
2175                 NULL,                                   /* sd */
2176                 NULL,                                   /* ea_list */
2177                 &fsp,                                   /* result */
2178                 &info,                                  /* pinfo */
2179                 NULL, NULL);                            /* create context */
2180
2181         if (!NT_STATUS_IS_OK(status)) {
2182                 if (open_was_deferred(req->xconn, req->mid)) {
2183                         /* We have re-scheduled this call. */
2184                         goto out;
2185                 }
2186                 reply_openerror(req, status);
2187                 goto out;
2188         }
2189
2190         /* Ensure we're pointing at the correct stat struct. */
2191         TALLOC_FREE(smb_fname);
2192         smb_fname = fsp->fsp_name;
2193
2194         size = smb_fname->st.st_ex_size;
2195         fattr = dos_mode(conn, smb_fname);
2196
2197         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
2198
2199         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2200                 DEBUG(3,("attempt to open a directory %s\n",
2201                          fsp_str_dbg(fsp)));
2202                 close_file(req, fsp, ERROR_CLOSE);
2203                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
2204                         ERRDOS, ERRnoaccess);
2205                 goto out;
2206         }
2207
2208         reply_outbuf(req, 7, 0);
2209         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2210         SSVAL(req->outbuf,smb_vwv1,fattr);
2211         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2212                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
2213         } else {
2214                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
2215         }
2216         SIVAL(req->outbuf,smb_vwv4,(uint32_t)size);
2217         SSVAL(req->outbuf,smb_vwv6,deny_mode);
2218
2219         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2220                 SCVAL(req->outbuf,smb_flg,
2221                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2222         }
2223
2224         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2225                 SCVAL(req->outbuf,smb_flg,
2226                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2227         }
2228  out:
2229         END_PROFILE(SMBopen);
2230         return;
2231 }
2232
2233 /****************************************************************************
2234  Reply to an open and X.
2235 ****************************************************************************/
2236
2237 void reply_open_and_X(struct smb_request *req)
2238 {
2239         connection_struct *conn = req->conn;
2240         struct smb_filename *smb_fname = NULL;
2241         char *fname = NULL;
2242         uint16_t open_flags;
2243         int deny_mode;
2244         uint32_t smb_attr;
2245         /* Breakout the oplock request bits so we can set the
2246                 reply bits separately. */
2247         int ex_oplock_request;
2248         int core_oplock_request;
2249         int oplock_request;
2250 #if 0
2251         int smb_sattr = SVAL(req->vwv+4, 0);
2252         uint32_t smb_time = make_unix_date3(req->vwv+6);
2253 #endif
2254         int smb_ofun;
2255         uint32_t fattr=0;
2256         int mtime=0;
2257         int smb_action = 0;
2258         files_struct *fsp;
2259         NTSTATUS status;
2260         uint64_t allocation_size;
2261         ssize_t retval = -1;
2262         uint32_t access_mask;
2263         uint32_t share_mode;
2264         uint32_t create_disposition;
2265         uint32_t create_options = 0;
2266         uint32_t private_flags = 0;
2267         uint32_t ucf_flags;
2268         TALLOC_CTX *ctx = talloc_tos();
2269
2270         START_PROFILE(SMBopenX);
2271
2272         if (req->wct < 15) {
2273                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2274                 goto out;
2275         }
2276
2277         open_flags = SVAL(req->vwv+2, 0);
2278         deny_mode = SVAL(req->vwv+3, 0);
2279         smb_attr = SVAL(req->vwv+5, 0);
2280         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2281         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2282         oplock_request = ex_oplock_request | core_oplock_request;
2283         smb_ofun = SVAL(req->vwv+8, 0);
2284         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2285
2286         /* If it's an IPC, pass off the pipe handler. */
2287         if (IS_IPC(conn)) {
2288                 if (lp_nt_pipe_support()) {
2289                         reply_open_pipe_and_X(conn, req);
2290                 } else {
2291                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2292                 }
2293                 goto out;
2294         }
2295
2296         /* XXXX we need to handle passed times, sattr and flags */
2297         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2298                         STR_TERMINATE, &status);
2299         if (!NT_STATUS_IS_OK(status)) {
2300                 reply_nterror(req, status);
2301                 goto out;
2302         }
2303
2304         if (!map_open_params_to_ntcreate(fname, deny_mode,
2305                                          smb_ofun,
2306                                          &access_mask, &share_mode,
2307                                          &create_disposition,
2308                                          &create_options,
2309                                          &private_flags)) {
2310                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2311                 goto out;
2312         }
2313
2314         ucf_flags = filename_create_ucf_flags(req, create_disposition);
2315
2316         status = filename_convert(ctx,
2317                                 conn,
2318                                 fname,
2319                                 ucf_flags,
2320                                 NULL,
2321                                 &smb_fname);
2322         if (!NT_STATUS_IS_OK(status)) {
2323                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2324                         reply_botherror(req,
2325                                         NT_STATUS_PATH_NOT_COVERED,
2326                                         ERRSRV, ERRbadpath);
2327                         goto out;
2328                 }
2329                 reply_nterror(req, status);
2330                 goto out;
2331         }
2332
2333         status = SMB_VFS_CREATE_FILE(
2334                 conn,                                   /* conn */
2335                 req,                                    /* req */
2336                 0,                                      /* root_dir_fid */
2337                 smb_fname,                              /* fname */
2338                 access_mask,                            /* access_mask */
2339                 share_mode,                             /* share_access */
2340                 create_disposition,                     /* create_disposition*/
2341                 create_options,                         /* create_options */
2342                 smb_attr,                               /* file_attributes */
2343                 oplock_request,                         /* oplock_request */
2344                 NULL,                                   /* lease */
2345                 0,                                      /* allocation_size */
2346                 private_flags,
2347                 NULL,                                   /* sd */
2348                 NULL,                                   /* ea_list */
2349                 &fsp,                                   /* result */
2350                 &smb_action,                            /* pinfo */
2351                 NULL, NULL);                            /* create context */
2352
2353         if (!NT_STATUS_IS_OK(status)) {
2354                 if (open_was_deferred(req->xconn, req->mid)) {
2355                         /* We have re-scheduled this call. */
2356                         goto out;
2357                 }
2358                 reply_openerror(req, status);
2359                 goto out;
2360         }
2361
2362         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2363            if the file is truncated or created. */
2364         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2365                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2366                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2367                         close_file(req, fsp, ERROR_CLOSE);
2368                         reply_nterror(req, NT_STATUS_DISK_FULL);
2369                         goto out;
2370                 }
2371                 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2372                 if (retval < 0) {
2373                         close_file(req, fsp, ERROR_CLOSE);
2374                         reply_nterror(req, NT_STATUS_DISK_FULL);
2375                         goto out;
2376                 }
2377                 status = vfs_stat_fsp(fsp);
2378                 if (!NT_STATUS_IS_OK(status)) {
2379                         close_file(req, fsp, ERROR_CLOSE);
2380                         reply_nterror(req, status);
2381                         goto out;
2382                 }
2383         }
2384
2385         fattr = dos_mode(conn, fsp->fsp_name);
2386         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2387         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2388                 close_file(req, fsp, ERROR_CLOSE);
2389                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2390                 goto out;
2391         }
2392
2393         /* If the caller set the extended oplock request bit
2394                 and we granted one (by whatever means) - set the
2395                 correct bit for extended oplock reply.
2396         */
2397
2398         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2399                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2400         }
2401
2402         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2403                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2404         }
2405
2406         /* If the caller set the core oplock request bit
2407                 and we granted one (by whatever means) - set the
2408                 correct bit for core oplock reply.
2409         */
2410
2411         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2412                 reply_outbuf(req, 19, 0);
2413         } else {
2414                 reply_outbuf(req, 15, 0);
2415         }
2416
2417         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2418         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2419
2420         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2421                 SCVAL(req->outbuf, smb_flg,
2422                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2423         }
2424
2425         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2426                 SCVAL(req->outbuf, smb_flg,
2427                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2428         }
2429
2430         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2431         SSVAL(req->outbuf,smb_vwv3,fattr);
2432         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2433                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2434         } else {
2435                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2436         }
2437         SIVAL(req->outbuf,smb_vwv6,(uint32_t)fsp->fsp_name->st.st_ex_size);
2438         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2439         SSVAL(req->outbuf,smb_vwv11,smb_action);
2440
2441         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2442                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2443         }
2444
2445  out:
2446         TALLOC_FREE(smb_fname);
2447         END_PROFILE(SMBopenX);
2448         return;
2449 }
2450
2451 /****************************************************************************
2452  Reply to a SMBulogoffX.
2453 ****************************************************************************/
2454
2455 void reply_ulogoffX(struct smb_request *req)
2456 {
2457         struct smbd_server_connection *sconn = req->sconn;
2458         struct user_struct *vuser;
2459         struct smbXsrv_session *session = NULL;
2460         NTSTATUS status;
2461
2462         START_PROFILE(SMBulogoffX);
2463
2464         vuser = get_valid_user_struct(sconn, req->vuid);
2465
2466         if(vuser == NULL) {
2467                 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2468                          (unsigned long long)req->vuid));
2469
2470                 req->vuid = UID_FIELD_INVALID;
2471                 reply_force_doserror(req, ERRSRV, ERRbaduid);
2472                 END_PROFILE(SMBulogoffX);
2473                 return;
2474         }
2475
2476         session = vuser->session;
2477         vuser = NULL;
2478
2479         /*
2480          * TODO: cancel all outstanding requests on the session
2481          */
2482         status = smbXsrv_session_logoff(session);
2483         if (!NT_STATUS_IS_OK(status)) {
2484                 DEBUG(0, ("reply_ulogoff: "
2485                           "smbXsrv_session_logoff() failed: %s\n",
2486                           nt_errstr(status)));
2487                 /*
2488                  * If we hit this case, there is something completely
2489                  * wrong, so we better disconnect the transport connection.
2490                  */
2491                 END_PROFILE(SMBulogoffX);
2492                 exit_server(__location__ ": smbXsrv_session_logoff failed");
2493                 return;
2494         }
2495
2496         TALLOC_FREE(session);
2497
2498         reply_outbuf(req, 2, 0);
2499         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2500         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2501
2502         DEBUG(3, ("ulogoffX vuid=%llu\n",
2503                   (unsigned long long)req->vuid));
2504
2505         END_PROFILE(SMBulogoffX);
2506         req->vuid = UID_FIELD_INVALID;
2507 }
2508
2509 /****************************************************************************
2510  Reply to a mknew or a create.
2511 ****************************************************************************/
2512
2513 void reply_mknew(struct smb_request *req)
2514 {
2515         connection_struct *conn = req->conn;
2516         struct smb_filename *smb_fname = NULL;
2517         char *fname = NULL;
2518         uint32_t fattr = 0;
2519         struct smb_file_time ft;
2520         files_struct *fsp;
2521         int oplock_request = 0;
2522         NTSTATUS status;
2523         uint32_t access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2524         uint32_t share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2525         uint32_t create_disposition;
2526         uint32_t create_options = 0;
2527         uint32_t ucf_flags;
2528         TALLOC_CTX *ctx = talloc_tos();
2529
2530         START_PROFILE(SMBcreate);
2531         ZERO_STRUCT(ft);
2532
2533         if (req->wct < 3) {
2534                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2535                 goto out;
2536         }
2537
2538         fattr = SVAL(req->vwv+0, 0);
2539         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2540
2541         if (req->cmd == SMBmknew) {
2542                 /* We should fail if file exists. */
2543                 create_disposition = FILE_CREATE;
2544         } else {
2545                 /* Create if file doesn't exist, truncate if it does. */
2546                 create_disposition = FILE_OVERWRITE_IF;
2547         }
2548
2549         /* mtime. */
2550         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2551
2552         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2553                             STR_TERMINATE, &status);
2554         if (!NT_STATUS_IS_OK(status)) {
2555                 reply_nterror(req, status);
2556                 goto out;
2557         }
2558
2559         ucf_flags = filename_create_ucf_flags(req, create_disposition);
2560         status = filename_convert(ctx,
2561                                 conn,
2562                                 fname,
2563                                 ucf_flags,
2564                                 NULL,
2565                                 &smb_fname);
2566         if (!NT_STATUS_IS_OK(status)) {
2567                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2568                         reply_botherror(req,
2569                                         NT_STATUS_PATH_NOT_COVERED,
2570                                         ERRSRV, ERRbadpath);
2571                         goto out;
2572                 }
2573                 reply_nterror(req, status);
2574                 goto out;
2575         }
2576
2577         if (fattr & FILE_ATTRIBUTE_VOLUME) {
2578                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2579                          "please report this\n",
2580                          smb_fname_str_dbg(smb_fname)));
2581         }
2582
2583         status = SMB_VFS_CREATE_FILE(
2584                 conn,                                   /* conn */
2585                 req,                                    /* req */
2586                 0,                                      /* root_dir_fid */
2587                 smb_fname,                              /* fname */
2588                 access_mask,                            /* access_mask */
2589                 share_mode,                             /* share_access */
2590                 create_disposition,                     /* create_disposition*/
2591                 create_options,                         /* create_options */
2592                 fattr,                                  /* file_attributes */
2593                 oplock_request,                         /* oplock_request */
2594                 NULL,                                   /* lease */
2595                 0,                                      /* allocation_size */
2596                 0,                                      /* private_flags */
2597                 NULL,                                   /* sd */
2598                 NULL,                                   /* ea_list */
2599                 &fsp,                                   /* result */
2600                 NULL,                                   /* pinfo */
2601                 NULL, NULL);                            /* create context */
2602
2603         if (!NT_STATUS_IS_OK(status)) {
2604                 if (open_was_deferred(req->xconn, req->mid)) {
2605                         /* We have re-scheduled this call. */
2606                         goto out;
2607                 }
2608                 reply_openerror(req, status);
2609                 goto out;
2610         }
2611
2612         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2613         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2614         if (!NT_STATUS_IS_OK(status)) {
2615                 END_PROFILE(SMBcreate);
2616                 goto out;
2617         }
2618
2619         reply_outbuf(req, 1, 0);
2620         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2621
2622         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2623                 SCVAL(req->outbuf,smb_flg,
2624                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2625         }
2626
2627         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2628                 SCVAL(req->outbuf,smb_flg,
2629                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2630         }
2631
2632         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2633         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2634                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2635                   (unsigned int)fattr));
2636
2637  out:
2638         TALLOC_FREE(smb_fname);
2639         END_PROFILE(SMBcreate);
2640         return;
2641 }
2642
2643 /****************************************************************************
2644  Reply to a create temporary file.
2645 ****************************************************************************/
2646
2647 void reply_ctemp(struct smb_request *req)
2648 {
2649         connection_struct *conn = req->conn;
2650         struct smb_filename *smb_fname = NULL;
2651         char *wire_name = NULL;
2652         char *fname = NULL;
2653         uint32_t fattr;
2654         files_struct *fsp;
2655         int oplock_request;
2656         char *s;
2657         NTSTATUS status;
2658         int i;
2659         uint32_t ucf_flags;
2660         TALLOC_CTX *ctx = talloc_tos();
2661
2662         START_PROFILE(SMBctemp);
2663
2664         if (req->wct < 3) {
2665                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2666                 goto out;
2667         }
2668
2669         fattr = SVAL(req->vwv+0, 0);
2670         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2671
2672         srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2673                             STR_TERMINATE, &status);
2674         if (!NT_STATUS_IS_OK(status)) {
2675                 reply_nterror(req, status);
2676                 goto out;
2677         }
2678
2679         for (i = 0; i < 10; i++) {
2680                 if (*wire_name) {
2681                         fname = talloc_asprintf(ctx,
2682                                         "%s/TMP%s",
2683                                         wire_name,
2684                                         generate_random_str_list(ctx, 5, "0123456789"));
2685                 } else {
2686                         fname = talloc_asprintf(ctx,
2687                                         "TMP%s",
2688                                         generate_random_str_list(ctx, 5, "0123456789"));
2689                 }
2690
2691                 if (!fname) {
2692                         reply_nterror(req, NT_STATUS_NO_MEMORY);
2693                         goto out;
2694                 }
2695
2696                 ucf_flags = filename_create_ucf_flags(req, FILE_CREATE);
2697                 status = filename_convert(ctx, conn,
2698                                 fname,
2699                                 ucf_flags,
2700                                 NULL,
2701                                 &smb_fname);
2702                 if (!NT_STATUS_IS_OK(status)) {
2703                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2704                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2705                                         ERRSRV, ERRbadpath);
2706                                 goto out;
2707                         }
2708                         reply_nterror(req, status);
2709                         goto out;
2710                 }
2711
2712                 /* Create the file. */
2713                 status = SMB_VFS_CREATE_FILE(
2714                         conn,                                   /* conn */
2715                         req,                                    /* req */
2716                         0,                                      /* root_dir_fid */
2717                         smb_fname,                              /* fname */
2718                         FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2719                         FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2720                         FILE_CREATE,                            /* create_disposition*/
2721                         0,                                      /* create_options */
2722                         fattr,                                  /* file_attributes */
2723                         oplock_request,                         /* oplock_request */
2724                         NULL,                                   /* lease */
2725                         0,                                      /* allocation_size */
2726                         0,                                      /* private_flags */
2727                         NULL,                                   /* sd */
2728                         NULL,                                   /* ea_list */
2729                         &fsp,                                   /* result */
2730                         NULL,                                   /* pinfo */
2731                         NULL, NULL);                            /* create context */
2732
2733                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2734                         TALLOC_FREE(fname);
2735                         TALLOC_FREE(smb_fname);
2736                         continue;
2737                 }
2738
2739                 if (!NT_STATUS_IS_OK(status)) {
2740                         if (open_was_deferred(req->xconn, req->mid)) {
2741                                 /* We have re-scheduled this call. */
2742                                 goto out;
2743                         }
2744                         reply_openerror(req, status);
2745                         goto out;
2746                 }
2747
2748                 break;
2749         }
2750
2751         if (i == 10) {
2752                 /* Collision after 10 times... */
2753                 reply_nterror(req, status);
2754                 goto out;
2755         }
2756
2757         reply_outbuf(req, 1, 0);
2758         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2759
2760         /* the returned filename is relative to the directory */
2761         s = strrchr_m(fsp->fsp_name->base_name, '/');
2762         if (!s) {
2763                 s = fsp->fsp_name->base_name;
2764         } else {
2765                 s++;
2766         }
2767
2768 #if 0
2769         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2770            thing in the byte section. JRA */
2771         SSVALS(p, 0, -1); /* what is this? not in spec */
2772 #endif
2773         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2774             == -1) {
2775                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2776                 goto out;
2777         }
2778
2779         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2780                 SCVAL(req->outbuf, smb_flg,
2781                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2782         }
2783
2784         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2785                 SCVAL(req->outbuf, smb_flg,
2786                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2787         }
2788
2789         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2790         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2791                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2792  out:
2793         TALLOC_FREE(smb_fname);
2794         TALLOC_FREE(wire_name);
2795         END_PROFILE(SMBctemp);
2796         return;
2797 }
2798
2799 /*******************************************************************
2800  Check if a user is allowed to rename a file.
2801 ********************************************************************/
2802
2803 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2804                         uint16_t dirtype)
2805 {
2806         if (!CAN_WRITE(conn)) {
2807                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2808         }
2809
2810         if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2811                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2812                 /* Only bother to read the DOS attribute if we might deny the
2813                    rename on the grounds of attribute mismatch. */
2814                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2815                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2816                         return NT_STATUS_NO_SUCH_FILE;
2817                 }
2818         }
2819
2820         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2821                 if (fsp->posix_flags & FSP_POSIX_FLAGS_RENAME) {
2822                         return NT_STATUS_OK;
2823                 }
2824
2825                 /* If no pathnames are open below this
2826                    directory, allow the rename. */
2827
2828                 if (lp_strict_rename(SNUM(conn))) {
2829                         /*
2830                          * Strict rename, check open file db.
2831                          */
2832                         if (have_file_open_below(fsp->conn, fsp->fsp_name)) {
2833                                 return NT_STATUS_ACCESS_DENIED;
2834                         }
2835                 } else if (file_find_subpath(fsp)) {
2836                         /*
2837                          * No strict rename, just look in local process.
2838                          */
2839                         return NT_STATUS_ACCESS_DENIED;
2840                 }
2841                 return NT_STATUS_OK;
2842         }
2843
2844         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2845                 return NT_STATUS_OK;
2846         }
2847
2848         return NT_STATUS_ACCESS_DENIED;
2849 }
2850
2851 /*******************************************************************
2852  * unlink a file with all relevant access checks
2853  *******************************************************************/
2854
2855 static NTSTATUS do_unlink(connection_struct *conn,
2856                         struct smb_request *req,
2857                         struct smb_filename *smb_fname,
2858                         uint32_t dirtype)
2859 {
2860         uint32_t fattr;
2861         files_struct *fsp;
2862         uint32_t dirtype_orig = dirtype;
2863         NTSTATUS status;
2864         int ret;
2865         bool posix_paths = (req != NULL && req->posix_pathnames);
2866
2867         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2868                   smb_fname_str_dbg(smb_fname),
2869                   dirtype));
2870
2871         if (!CAN_WRITE(conn)) {
2872                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2873         }
2874
2875         if (posix_paths) {
2876                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2877         } else {
2878                 ret = SMB_VFS_STAT(conn, smb_fname);
2879         }
2880         if (ret != 0) {
2881                 return map_nt_error_from_unix(errno);
2882         }
2883
2884         fattr = dos_mode(conn, smb_fname);
2885
2886         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2887                 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2888         }
2889
2890         dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2891         if (!dirtype) {
2892                 return NT_STATUS_NO_SUCH_FILE;
2893         }
2894
2895         if (!dir_check_ftype(fattr, dirtype)) {
2896                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2897                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2898                 }
2899                 return NT_STATUS_NO_SUCH_FILE;
2900         }
2901
2902         if (dirtype_orig & 0x8000) {
2903                 /* These will never be set for POSIX. */
2904                 return NT_STATUS_NO_SUCH_FILE;
2905         }
2906
2907 #if 0
2908         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2909                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2910         }
2911
2912         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2913                 return NT_STATUS_NO_SUCH_FILE;
2914         }
2915
2916         if (dirtype & 0xFF00) {
2917                 /* These will never be set for POSIX. */
2918                 return NT_STATUS_NO_SUCH_FILE;
2919         }
2920
2921         dirtype &= 0xFF;
2922         if (!dirtype) {
2923                 return NT_STATUS_NO_SUCH_FILE;
2924         }
2925
2926         /* Can't delete a directory. */
2927         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2928                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2929         }
2930 #endif
2931
2932 #if 0 /* JRATEST */
2933         else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2934                 return NT_STATUS_OBJECT_NAME_INVALID;
2935 #endif /* JRATEST */
2936
2937         /* On open checks the open itself will check the share mode, so
2938            don't do it here as we'll get it wrong. */
2939
2940         status = SMB_VFS_CREATE_FILE
2941                 (conn,                  /* conn */
2942                  req,                   /* req */
2943                  0,                     /* root_dir_fid */
2944                  smb_fname,             /* fname */
2945                  DELETE_ACCESS,         /* access_mask */
2946                  FILE_SHARE_NONE,       /* share_access */
2947                  FILE_OPEN,             /* create_disposition*/
2948                  FILE_NON_DIRECTORY_FILE, /* create_options */
2949                                         /* file_attributes */
2950                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2951                                 FILE_ATTRIBUTE_NORMAL,
2952                  0,                     /* oplock_request */
2953                  NULL,                  /* lease */
2954                  0,                     /* allocation_size */
2955                  0,                     /* private_flags */
2956                  NULL,                  /* sd */
2957                  NULL,                  /* ea_list */
2958                  &fsp,                  /* result */
2959                  NULL,                  /* pinfo */
2960                  NULL, NULL);           /* create context */
2961
2962         if (!NT_STATUS_IS_OK(status)) {
2963                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2964                            nt_errstr(status)));
2965                 return status;
2966         }
2967
2968         status = can_set_delete_on_close(fsp, fattr);
2969         if (!NT_STATUS_IS_OK(status)) {
2970                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2971                         "(%s)\n",
2972                         smb_fname_str_dbg(smb_fname),
2973                         nt_errstr(status)));
2974                 close_file(req, fsp, NORMAL_CLOSE);
2975                 return status;
2976         }
2977
2978         /* The set is across all open files on this dev/inode pair. */
2979         if (!set_delete_on_close(fsp, True,
2980                                 conn->session_info->security_token,
2981                                 conn->session_info->unix_token)) {
2982                 close_file(req, fsp, NORMAL_CLOSE);
2983                 return NT_STATUS_ACCESS_DENIED;
2984         }
2985
2986         return close_file(req, fsp, NORMAL_CLOSE);
2987 }
2988
2989 /****************************************************************************
2990  The guts of the unlink command, split out so it may be called by the NT SMB
2991  code.
2992 ****************************************************************************/
2993
2994 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2995                           uint32_t dirtype, struct smb_filename *smb_fname,
2996                           bool has_wild)
2997 {
2998         char *fname_dir = NULL;
2999         char *fname_mask = NULL;
3000         int count=0;
3001         NTSTATUS status = NT_STATUS_OK;
3002         struct smb_filename *smb_fname_dir = NULL;
3003         TALLOC_CTX *ctx = talloc_tos();
3004
3005         /* Split up the directory from the filename/mask. */
3006         status = split_fname_dir_mask(ctx, smb_fname->base_name,
3007                                       &fname_dir, &fname_mask);
3008         if (!NT_STATUS_IS_OK(status)) {
3009                 goto out;
3010         }
3011
3012         /*
3013          * We should only check the mangled cache
3014          * here if unix_convert failed. This means
3015          * that the path in 'mask' doesn't exist
3016          * on the file system and so we need to look
3017          * for a possible mangle. This patch from
3018          * Tine Smukavec <valentin.smukavec@hermes.si>.
3019          */
3020
3021         if (!VALID_STAT(smb_fname->st) &&
3022             mangle_is_mangled(fname_mask, conn->params)) {
3023                 char *new_mask = NULL;
3024                 mangle_lookup_name_from_8_3(ctx, fname_mask,
3025                                             &new_mask, conn->params);
3026                 if (new_mask) {
3027                         TALLOC_FREE(fname_mask);
3028                         fname_mask = new_mask;
3029                 }
3030         }
3031
3032         if (!has_wild) {
3033
3034                 /*
3035                  * Only one file needs to be unlinked. Append the mask back
3036                  * onto the directory.
3037                  */
3038                 TALLOC_FREE(smb_fname->base_name);
3039                 if (ISDOT(fname_dir)) {
3040                         /* Ensure we use canonical names on open. */
3041                         smb_fname->base_name = talloc_asprintf(smb_fname,
3042                                                         "%s",
3043                                                         fname_mask);
3044                 } else {
3045                         smb_fname->base_name = talloc_asprintf(smb_fname,
3046                                                         "%s/%s",
3047                                                         fname_dir,
3048                                                         fname_mask);
3049                 }
3050                 if (!smb_fname->base_name) {
3051                         status = NT_STATUS_NO_MEMORY;
3052                         goto out;
3053                 }
3054                 if (dirtype == 0) {
3055                         dirtype = FILE_ATTRIBUTE_NORMAL;
3056                 }
3057
3058                 status = check_name(conn, smb_fname);
3059                 if (!NT_STATUS_IS_OK(status)) {
3060                         goto out;
3061                 }
3062
3063                 status = do_unlink(conn, req, smb_fname, dirtype);
3064                 if (!NT_STATUS_IS_OK(status)) {
3065                         goto out;
3066                 }
3067
3068                 count++;
3069         } else {
3070                 struct smb_Dir *dir_hnd = NULL;
3071                 long offset = 0;
3072                 const char *dname = NULL;
3073                 char *talloced = NULL;
3074
3075                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
3076                         status = NT_STATUS_OBJECT_NAME_INVALID;
3077                         goto out;
3078                 }
3079                 if (dirtype == 0) {
3080                         dirtype = FILE_ATTRIBUTE_NORMAL;
3081                 }
3082
3083                 if (strequal(fname_mask,"????????.???")) {
3084                         TALLOC_FREE(fname_mask);
3085                         fname_mask = talloc_strdup(ctx, "*");
3086                         if (!fname_mask) {
3087                                 status = NT_STATUS_NO_MEMORY;
3088                                 goto out;
3089                         }
3090                 }
3091
3092                 smb_fname_dir = synthetic_smb_fname(talloc_tos(),
3093                                         fname_dir,
3094                                         NULL,
3095                                         NULL,
3096                                         smb_fname->flags);
3097                 if (smb_fname_dir == NULL) {
3098                         status = NT_STATUS_NO_MEMORY;
3099                         goto out;
3100                 }
3101
3102                 status = check_name(conn, smb_fname_dir);
3103                 if (!NT_STATUS_IS_OK(status)) {
3104                         goto out;
3105                 }
3106
3107                 dir_hnd = OpenDir(talloc_tos(), conn, smb_fname_dir, fname_mask,
3108                                   dirtype);
3109                 if (dir_hnd == NULL) {
3110                         status = map_nt_error_from_unix(errno);
3111                         goto out;
3112                 }
3113
3114                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
3115                    the pattern matches against the long name, otherwise the short name
3116                    We don't implement this yet XXXX
3117                 */
3118
3119                 status = NT_STATUS_NO_SUCH_FILE;
3120
3121                 while ((dname = ReadDirName(dir_hnd, &offset,
3122                                             &smb_fname->st, &talloced))) {
3123                         TALLOC_CTX *frame = talloc_stackframe();
3124
3125                         if (!is_visible_file(conn, fname_dir, dname,
3126                                              &smb_fname->st, true)) {
3127                                 TALLOC_FREE(frame);
3128                                 TALLOC_FREE(talloced);
3129                                 continue;
3130                         }
3131
3132                         /* Quick check for "." and ".." */
3133                         if (ISDOT(dname) || ISDOTDOT(dname)) {
3134                                 TALLOC_FREE(frame);
3135                                 TALLOC_FREE(talloced);
3136                                 continue;
3137                         }
3138
3139                         if(!mask_match(dname, fname_mask,
3140                                        conn->case_sensitive)) {
3141                                 TALLOC_FREE(frame);
3142                                 TALLOC_FREE(talloced);
3143                                 continue;
3144                         }
3145
3146                         TALLOC_FREE(smb_fname->base_name);
3147                         if (ISDOT(fname_dir)) {
3148                                 /* Ensure we use canonical names on open. */
3149                                 smb_fname->base_name =
3150                                         talloc_asprintf(smb_fname, "%s",
3151                                                 dname);
3152                         } else {
3153                                 smb_fname->base_name =
3154                                         talloc_asprintf(smb_fname, "%s/%s",
3155                                                 fname_dir, dname);
3156                         }
3157
3158                         if (!smb_fname->base_name) {
3159                                 TALLOC_FREE(dir_hnd);
3160                                 status = NT_STATUS_NO_MEMORY;
3161                                 TALLOC_FREE(frame);
3162                                 TALLOC_FREE(talloced);
3163                                 goto out;
3164                         }
3165
3166                         status = check_name(conn, smb_fname);
3167                         if (!NT_STATUS_IS_OK(status)) {
3168                                 TALLOC_FREE(dir_hnd);
3169                                 TALLOC_FREE(frame);
3170                                 TALLOC_FREE(talloced);
3171                                 goto out;
3172                         }
3173
3174                         status = do_unlink(conn, req, smb_fname, dirtype);
3175                         if (!NT_STATUS_IS_OK(status)) {
3176                                 TALLOC_FREE(dir_hnd);
3177                                 TALLOC_FREE(frame);
3178                                 TALLOC_FREE(talloced);
3179                                 goto out;
3180                         }
3181
3182                         count++;
3183                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
3184                                  smb_fname->base_name));
3185
3186                         TALLOC_FREE(frame);
3187                         TALLOC_FREE(talloced);
3188                 }
3189                 TALLOC_FREE(dir_hnd);
3190         }
3191
3192         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
3193                 status = map_nt_error_from_unix(errno);
3194         }
3195
3196  out:
3197         TALLOC_FREE(smb_fname_dir);
3198         TALLOC_FREE(fname_dir);
3199         TALLOC_FREE(fname_mask);
3200         return status;
3201 }
3202
3203 /****************************************************************************
3204  Reply to a unlink
3205 ****************************************************************************/
3206
3207 void reply_unlink(struct smb_request *req)
3208 {
3209         connection_struct *conn = req->conn;
3210         char *name = NULL;
3211         struct smb_filename *smb_fname = NULL;
3212         uint32_t dirtype;
3213         NTSTATUS status;
3214         bool path_contains_wcard = False;
3215         uint32_t ucf_flags = UCF_COND_ALLOW_WCARD_LCOMP |
3216                         ucf_flags_from_smb_request(req);
3217         TALLOC_CTX *ctx = talloc_tos();
3218
3219         START_PROFILE(SMBunlink);
3220
3221         if (req->wct < 1) {
3222                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3223                 goto out;
3224         }
3225
3226         dirtype = SVAL(req->vwv+0, 0);
3227
3228         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
3229                                   STR_TERMINATE, &status,
3230                                   &path_contains_wcard);
3231         if (!NT_STATUS_IS_OK(status)) {
3232                 reply_nterror(req, status);
3233                 goto out;
3234         }
3235
3236         status = filename_convert(ctx, conn,
3237                                   name,
3238                                   ucf_flags,
3239                                   &path_contains_wcard,
3240                                   &smb_fname);
3241         if (!NT_STATUS_IS_OK(status)) {
3242                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
3243                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
3244                                         ERRSRV, ERRbadpath);
3245                         goto out;
3246                 }
3247                 reply_nterror(req, status);
3248                 goto out;
3249         }
3250
3251         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
3252
3253         status = unlink_internals(conn, req, dirtype, smb_fname,
3254                                   path_contains_wcard);
3255         if (!NT_STATUS_IS_OK(status)) {
3256                 if (open_was_deferred(req->xconn, req->mid)) {
3257                         /* We have re-scheduled this call. */
3258                         goto out;
3259                 }
3260                 reply_nterror(req, status);
3261                 goto out;
3262         }
3263
3264         reply_outbuf(req, 0, 0);
3265  out:
3266         TALLOC_FREE(smb_fname);
3267         END_PROFILE(SMBunlink);
3268         return;
3269 }
3270
3271 /****************************************************************************
3272  Fail for readbraw.
3273 ****************************************************************************/
3274
3275 static void fail_readraw(void)
3276 {
3277         const char *errstr = talloc_asprintf(talloc_tos(),
3278                         "FAIL ! reply_readbraw: socket write fail (%s)",
3279                         strerror(errno));
3280         if (!errstr) {
3281                 errstr = "";
3282         }
3283         exit_server_cleanly(errstr);
3284 }
3285
3286 /****************************************************************************
3287  Fake (read/write) sendfile. Returns -1 on read or write fail.
3288 ****************************************************************************/
3289
3290 ssize_t fake_sendfile(struct smbXsrv_connection *xconn, files_struct *fsp,
3291                       off_t startpos, size_t nread)
3292 {
3293         size_t bufsize;
3294         size_t tosend = nread;
3295         char *buf;
3296
3297         if (nread == 0) {
3298                 return 0;
3299         }
3300
3301         bufsize = MIN(nread, 65536);
3302
3303         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3304                 return -1;
3305         }
3306
3307         while (tosend > 0) {
3308                 ssize_t ret;
3309                 size_t cur_read;
3310
3311                 cur_read = MIN(tosend, bufsize);
3312                 ret = read_file(fsp,buf,startpos,cur_read);
3313                 if (ret == -1) {
3314                         SAFE_FREE(buf);
3315                         return -1;
3316                 }
3317
3318                 /* If we had a short read, fill with zeros. */
3319                 if (ret < cur_read) {
3320                         memset(buf + ret, '\0', cur_read - ret);
3321                 }
3322
3323                 ret = write_data(xconn->transport.sock, buf, cur_read);
3324                 if (ret != cur_read) {
3325                         int saved_errno = errno;
3326                         /*
3327                          * Try and give an error message saying what
3328                          * client failed.
3329                          */
3330                         DEBUG(0, ("write_data failed for client %s. "
3331                                   "Error %s\n",
3332                                   smbXsrv_connection_dbg(xconn),
3333                                   strerror(saved_errno)));
3334                         SAFE_FREE(buf);
3335                         errno = saved_errno;
3336                         return -1;
3337                 }
3338                 tosend -= cur_read;
3339                 startpos += cur_read;
3340         }
3341
3342         SAFE_FREE(buf);
3343         return (ssize_t)nread;
3344 }
3345
3346 /****************************************************************************
3347  Deal with the case of sendfile reading less bytes from the file than
3348  requested. Fill with zeros (all we can do). Returns 0 on success
3349 ****************************************************************************/
3350
3351 ssize_t sendfile_short_send(struct smbXsrv_connection *xconn,
3352                             files_struct *fsp,
3353                             ssize_t nread,
3354                             size_t headersize,
3355                             size_t smb_maxcnt)
3356 {
3357 #define SHORT_SEND_BUFSIZE 1024
3358         if (nread < headersize) {
3359                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3360                         "header for file %s (%s). Terminating\n",
3361                         fsp_str_dbg(fsp), strerror(errno)));
3362                 return -1;
3363         }
3364
3365         nread -= headersize;
3366
3367         if (nread < smb_maxcnt) {
3368                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3369                 if (!buf) {
3370                         DEBUG(0,("sendfile_short_send: malloc failed "
3371                                 "for file %s (%s). Terminating\n",
3372                                 fsp_str_dbg(fsp), strerror(errno)));
3373                         return -1;
3374                 }
3375
3376                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3377                         "with zeros !\n", fsp_str_dbg(fsp)));
3378
3379                 while (nread < smb_maxcnt) {
3380                         /*
3381                          * We asked for the real file size and told sendfile
3382                          * to not go beyond the end of the file. But it can
3383                          * happen that in between our fstat call and the
3384                          * sendfile call the file was truncated. This is very
3385                          * bad because we have already announced the larger
3386                          * number of bytes to the client.
3387                          *
3388                          * The best we can do now is to send 0-bytes, just as
3389                          * a read from a hole in a sparse file would do.
3390                          *
3391                          * This should happen rarely enough that I don't care
3392                          * about efficiency here :-)
3393                          */
3394                         size_t to_write;
3395                         ssize_t ret;
3396
3397                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3398                         ret = write_data(xconn->transport.sock, buf, to_write);
3399                         if (ret != to_write) {
3400                                 int saved_errno = errno;
3401                                 /*
3402                                  * Try and give an error message saying what
3403                                  * client failed.
3404                                  */
3405                                 DEBUG(0, ("write_data failed for client %s. "
3406                                           "Error %s\n",
3407                                           smbXsrv_connection_dbg(xconn),
3408                                           strerror(saved_errno)));
3409                                 errno = saved_errno;
3410                                 return -1;
3411                         }
3412                         nread += to_write;
3413                 }
3414                 SAFE_FREE(buf);
3415         }
3416
3417         return 0;
3418 }
3419
3420 /****************************************************************************
3421  Return a readbraw error (4 bytes of zero).
3422 ****************************************************************************/
3423
3424 static void reply_readbraw_error(struct smbXsrv_connection *xconn)
3425 {
3426         char header[4];
3427
3428         SIVAL(header,0,0);
3429
3430         smbd_lock_socket(xconn);
3431         if (write_data(xconn->transport.sock,header,4) != 4) {
3432                 int saved_errno = errno;
3433                 /*
3434                  * Try and give an error message saying what
3435                  * client failed.
3436                  */
3437                 DEBUG(0, ("write_data failed for client %s. "
3438                           "Error %s\n",
3439                           smbXsrv_connection_dbg(xconn),
3440                           strerror(saved_errno)));
3441                 errno = saved_errno;
3442
3443                 fail_readraw();
3444         }
3445         smbd_unlock_socket(xconn);
3446 }
3447
3448 /****************************************************************************
3449  Use sendfile in readbraw.
3450 ****************************************************************************/
3451
3452 static void send_file_readbraw(connection_struct *conn,
3453                                struct smb_request *req,
3454                                files_struct *fsp,
3455                                off_t startpos,
3456                                size_t nread,
3457                                ssize_t mincount)
3458 {
3459         struct smbXsrv_connection *xconn = req->xconn;
3460         char *outbuf = NULL;
3461         ssize_t ret=0;
3462
3463         /*
3464          * We can only use sendfile on a non-chained packet
3465          * but we can use on a non-oplocked file. tridge proved this
3466          * on a train in Germany :-). JRA.
3467          * reply_readbraw has already checked the length.
3468          */
3469
3470         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3471             (fsp->wcp == NULL) &&
3472             lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3473                 ssize_t sendfile_read = -1;
3474                 char header[4];
3475                 DATA_BLOB header_blob;
3476
3477                 _smb_setlen(header,nread);
3478                 header_blob = data_blob_const(header, 4);
3479
3480                 sendfile_read = SMB_VFS_SENDFILE(xconn->transport.sock, fsp,
3481                                                  &header_blob, startpos,
3482                                                  nread);
3483                 if (sendfile_read == -1) {
3484                         /* Returning ENOSYS means no data at all was sent.
3485                          * Do this as a normal read. */
3486                         if (errno == ENOSYS) {
3487                                 goto normal_readbraw;
3488                         }
3489
3490                         /*
3491                          * Special hack for broken Linux with no working sendfile. If we
3492                          * return EINTR we sent the header but not the rest of the data.
3493                          * Fake this up by doing read/write calls.
3494                          */
3495                         if (errno == EINTR) {
3496                                 /* Ensure we don't do this again. */
3497                                 set_use_sendfile(SNUM(conn), False);
3498                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3499
3500                                 if (fake_sendfile(xconn, fsp, startpos, nread) == -1) {
3501                                         DEBUG(0,("send_file_readbraw: "
3502                                                  "fake_sendfile failed for "
3503                                                  "file %s (%s).\n",
3504                                                  fsp_str_dbg(fsp),
3505                                                  strerror(errno)));
3506                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3507                                 }
3508                                 return;
3509                         }
3510
3511                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3512                                  "file %s (%s). Terminating\n",
3513                                  fsp_str_dbg(fsp), strerror(errno)));
3514                         exit_server_cleanly("send_file_readbraw sendfile failed");
3515                 } else if (sendfile_read == 0) {
3516                         /*
3517                          * Some sendfile implementations return 0 to indicate
3518                          * that there was a short read, but nothing was
3519                          * actually written to the socket.  In this case,
3520                          * fallback to the normal read path so the header gets
3521                          * the correct byte count.
3522                          */
3523                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3524                                   "bytes falling back to the normal read: "
3525                                   "%s\n", fsp_str_dbg(fsp)));
3526                         goto normal_readbraw;
3527                 }
3528
3529                 /* Deal with possible short send. */
3530                 if (sendfile_read != 4+nread) {
3531                         ret = sendfile_short_send(xconn, fsp,
3532                                                   sendfile_read, 4, nread);
3533                         if (ret == -1) {
3534                                 fail_readraw();
3535                         }
3536                 }
3537                 return;
3538         }
3539
3540 normal_readbraw:
3541
3542         outbuf = talloc_array(NULL, char, nread+4);
3543         if (!outbuf) {
3544                 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3545                         (unsigned)(nread+4)));
3546                 reply_readbraw_error(xconn);
3547                 return;
3548         }
3549
3550         if (nread > 0) {
3551                 ret = read_file(fsp,outbuf+4,startpos,nread);
3552 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3553                 if (ret < mincount)
3554                         ret = 0;
3555 #else
3556                 if (ret < nread)
3557                         ret = 0;
3558 #endif
3559         }
3560
3561         _smb_setlen(outbuf,ret);
3562         if (write_data(xconn->transport.sock, outbuf, 4+ret) != 4+ret) {
3563                 int saved_errno = errno;
3564                 /*
3565                  * Try and give an error message saying what
3566                  * client failed.
3567                  */
3568                 DEBUG(0, ("write_data failed for client %s. Error %s\n",
3569                           smbXsrv_connection_dbg(xconn),
3570                           strerror(saved_errno)));
3571                 errno = saved_errno;
3572
3573                 fail_readraw();
3574         }
3575
3576         TALLOC_FREE(outbuf);
3577 }
3578
3579 /****************************************************************************
3580  Reply to a readbraw (core+ protocol).
3581 ****************************************************************************/
3582
3583 void reply_readbraw(struct smb_request *req)
3584 {
3585         connection_struct *conn = req->conn;
3586         struct smbXsrv_connection *xconn = req->xconn;
3587         ssize_t maxcount,mincount;
3588         size_t nread = 0;
3589         off_t startpos;
3590         files_struct *fsp;
3591         struct lock_struct lock;
3592         off_t size = 0;
3593
3594         START_PROFILE(SMBreadbraw);
3595
3596         if (srv_is_signing_active(xconn) || req->encrypted) {
3597                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3598                         "raw reads/writes are disallowed.");
3599         }
3600
3601         if (req->wct < 8) {
3602                 reply_readbraw_error(xconn);
3603                 END_PROFILE(SMBreadbraw);
3604                 return;
3605         }
3606
3607         if (xconn->smb1.echo_handler.trusted_fde) {
3608                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3609                          "'async smb echo handler = yes'\n"));
3610                 reply_readbraw_error(xconn);
3611                 END_PROFILE(SMBreadbraw);
3612                 return;
3613         }
3614
3615         /*
3616          * Special check if an oplock break has been issued
3617          * and the readraw request croses on the wire, we must
3618          * return a zero length response here.
3619          */
3620
3621         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3622
3623         /*
3624          * We have to do a check_fsp by hand here, as
3625          * we must always return 4 zero bytes on error,
3626          * not a NTSTATUS.
3627          */
3628
3629         if (!fsp || !conn || conn != fsp->conn ||
3630                         req->vuid != fsp->vuid ||
3631                         fsp->is_directory || fsp->fh->fd == -1) {
3632                 /*
3633                  * fsp could be NULL here so use the value from the packet. JRA.
3634                  */
3635                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3636                         "- cache prime?\n",
3637                         (int)SVAL(req->vwv+0, 0)));
3638                 reply_readbraw_error(xconn);
3639                 END_PROFILE(SMBreadbraw);
3640                 return;
3641         }
3642
3643         /* Do a "by hand" version of CHECK_READ. */
3644         if (!(fsp->can_read ||
3645                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3646                                 (fsp->access_mask & FILE_EXECUTE)))) {
3647                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3648                                 (int)SVAL(req->vwv+0, 0)));
3649                 reply_readbraw_error(xconn);
3650                 END_PROFILE(SMBreadbraw);
3651                 return;
3652         }
3653
3654         flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3655
3656         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3657         if(req->wct == 10) {
3658                 /*
3659                  * This is a large offset (64 bit) read.
3660                  */
3661
3662                 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3663
3664                 if(startpos < 0) {
3665                         DEBUG(0,("reply_readbraw: negative 64 bit "
3666                                 "readraw offset (%.0f) !\n",
3667                                 (double)startpos ));
3668                         reply_readbraw_error(xconn);
3669                         END_PROFILE(SMBreadbraw);
3670                         return;
3671                 }
3672         }
3673
3674         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3675         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3676
3677         /* ensure we don't overrun the packet size */
3678         maxcount = MIN(65535,maxcount);
3679
3680         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3681             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3682             &lock);
3683
3684         if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
3685                 reply_readbraw_error(xconn);
3686                 END_PROFILE(SMBreadbraw);
3687                 return;
3688         }
3689
3690         if (fsp_stat(fsp) == 0) {
3691                 size = fsp->fsp_name->st.st_ex_size;
3692         }
3693
3694         if (startpos >= size) {
3695                 nread = 0;
3696         } else {
3697                 nread = MIN(maxcount,(size - startpos));
3698         }
3699
3700 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3701         if (nread < mincount)
3702                 nread = 0;
3703 #endif
3704
3705         DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3706                 "min=%lu nread=%lu\n",
3707                 fsp_fnum_dbg(fsp), (double)startpos,
3708                 (unsigned long)maxcount,
3709                 (unsigned long)mincount,
3710                 (unsigned long)nread ) );
3711
3712         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3713
3714         DEBUG(5,("reply_readbraw finished\n"));
3715
3716         END_PROFILE(SMBreadbraw);
3717         return;
3718 }
3719
3720 #undef DBGC_CLASS
3721 #define DBGC_CLASS DBGC_LOCKING
3722
3723 /****************************************************************************
3724  Reply to a lockread (core+ protocol).
3725 ****************************************************************************/
3726
3727 void reply_lockread(struct smb_request *req)
3728 {
3729         connection_struct *conn = req->conn;
3730         ssize_t nread = -1;
3731         char *data;
3732         off_t startpos;
3733         size_t numtoread;
3734         size_t maxtoread;
3735         NTSTATUS status;
3736         files_struct *fsp;
3737         struct byte_range_lock *br_lck = NULL;
3738         char *p = NULL;
3739         struct smbXsrv_connection *xconn = req->xconn;
3740
3741         START_PROFILE(SMBlockread);
3742
3743         if (req->wct < 5) {
3744                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3745                 END_PROFILE(SMBlockread);
3746                 return;
3747         }
3748
3749         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3750
3751         if (!check_fsp(conn, req, fsp)) {
3752                 END_PROFILE(SMBlockread);
3753                 return;
3754         }
3755
3756         if (!CHECK_READ(fsp,req)) {
3757                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3758                 END_PROFILE(SMBlockread);
3759                 return;
3760         }
3761
3762         numtoread = SVAL(req->vwv+1, 0);
3763         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3764
3765         /*
3766          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3767          * protocol request that predates the read/write lock concept.
3768          * Thus instead of asking for a read lock here we need to ask
3769          * for a write lock. JRA.
3770          * Note that the requested lock size is unaffected by max_send.
3771          */
3772
3773         br_lck = do_lock(req->sconn->msg_ctx,
3774                         fsp,
3775                         (uint64_t)req->smbpid,
3776                         (uint64_t)numtoread,
3777                         (uint64_t)startpos,
3778                         WRITE_LOCK,
3779                         WINDOWS_LOCK,
3780                         False, /* Non-blocking lock. */
3781                         &status,
3782                         NULL);
3783         TALLOC_FREE(br_lck);
3784
3785         if (NT_STATUS_V(status)) {
3786                 reply_nterror(req, status);
3787                 END_PROFILE(SMBlockread);
3788                 return;
3789         }
3790
3791         /*
3792          * However the requested READ size IS affected by max_send. Insanity.... JRA.
3793          */
3794         maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3795
3796         if (numtoread > maxtoread) {
3797                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3798 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3799                         (unsigned int)numtoread, (unsigned int)maxtoread,
3800                         (unsigned int)xconn->smb1.sessions.max_send));
3801                 numtoread = maxtoread;
3802         }
3803
3804         reply_outbuf(req, 5, numtoread + 3);
3805
3806         data = smb_buf(req->outbuf) + 3;
3807
3808         nread = read_file(fsp,data,startpos,numtoread);
3809
3810         if (nread < 0) {
3811                 reply_nterror(req, map_nt_error_from_unix(errno));
3812                 END_PROFILE(SMBlockread);
3813                 return;
3814         }
3815
3816         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3817
3818         SSVAL(req->outbuf,smb_vwv0,nread);
3819         SSVAL(req->outbuf,smb_vwv5,nread+3);
3820         p = smb_buf(req->outbuf);
3821         SCVAL(p,0,0); /* pad byte. */
3822         SSVAL(p,1,nread);
3823
3824         DEBUG(3,("lockread %s num=%d nread=%d\n",
3825                  fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3826
3827         END_PROFILE(SMBlockread);
3828         return;
3829 }
3830
3831 #undef DBGC_CLASS
3832 #define DBGC_CLASS DBGC_ALL
3833
3834 /****************************************************************************
3835  Reply to a read.
3836 ****************************************************************************/
3837
3838 void reply_read(struct smb_request *req)
3839 {
3840         connection_struct *conn = req->conn;
3841         size_t numtoread;
3842         size_t maxtoread;
3843         ssize_t nread = 0;
3844         char *data;
3845         off_t startpos;
3846         files_struct *fsp;
3847         struct lock_struct lock;
3848         struct smbXsrv_connection *xconn = req->xconn;
3849
3850         START_PROFILE(SMBread);
3851
3852         if (req->wct < 3) {
3853                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3854                 END_PROFILE(SMBread);
3855                 return;
3856         }
3857
3858         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3859
3860         if (!check_fsp(conn, req, fsp)) {
3861                 END_PROFILE(SMBread);
3862                 return;
3863         }
3864
3865         if (!CHECK_READ(fsp,req)) {
3866                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3867                 END_PROFILE(SMBread);
3868                 return;
3869         }
3870
3871         numtoread = SVAL(req->vwv+1, 0);
3872         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3873
3874         /*
3875          * The requested read size cannot be greater than max_send. JRA.
3876          */
3877         maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3878
3879         if (numtoread > maxtoread) {
3880                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3881 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3882                         (unsigned int)numtoread, (unsigned int)maxtoread,
3883                         (unsigned int)xconn->smb1.sessions.max_send));
3884                 numtoread = maxtoread;
3885         }
3886
3887         reply_outbuf(req, 5, numtoread+3);
3888
3889         data = smb_buf(req->outbuf) + 3;
3890
3891         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3892             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3893             &lock);
3894
3895         if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
3896                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3897                 END_PROFILE(SMBread);
3898                 return;
3899         }
3900
3901         if (numtoread > 0)
3902                 nread = read_file(fsp,data,startpos,numtoread);
3903
3904         if (nread < 0) {
3905                 reply_nterror(req, map_nt_error_from_unix(errno));
3906                 goto out;
3907         }
3908
3909         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3910
3911         SSVAL(req->outbuf,smb_vwv0,nread);
3912         SSVAL(req->outbuf,smb_vwv5,nread+3);
3913         SCVAL(smb_buf(req->outbuf),0,1);
3914         SSVAL(smb_buf(req->outbuf),1,nread);
3915
3916         DEBUG(3, ("read %s num=%d nread=%d\n",
3917                   fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3918
3919 out:
3920         END_PROFILE(SMBread);
3921         return;
3922 }
3923
3924 /****************************************************************************
3925  Setup readX header.
3926 ****************************************************************************/
3927
3928 int setup_readX_header(char *outbuf, size_t smb_maxcnt)
3929 {
3930         int outsize;
3931
3932         outsize = srv_set_message(outbuf,12,smb_maxcnt + 1 /* padding byte */,
3933                                   False);
3934
3935         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3936
3937         SCVAL(outbuf,smb_vwv0,0xFF);
3938         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3939         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3940         SSVAL(outbuf,smb_vwv6,
3941               (smb_wct - 4)     /* offset from smb header to wct */
3942               + 1               /* the wct field */
3943               + 12 * sizeof(uint16_t) /* vwv */
3944               + 2               /* the buflen field */
3945               + 1);             /* padding byte */
3946         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3947         SCVAL(smb_buf(outbuf), 0, 0); /* padding byte */
3948         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3949         _smb_setlen_large(outbuf,
3950                           smb_size + 12*2 + smb_maxcnt - 4 + 1 /* pad */);
3951         return outsize;
3952 }
3953
3954 /****************************************************************************
3955  Reply to a read and X - possibly using sendfile.
3956 ****************************************************************************/
3957
3958 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3959                             files_struct *fsp, off_t startpos,
3960                             size_t smb_maxcnt)
3961 {
3962         struct smbXsrv_connection *xconn = req->xconn;
3963         ssize_t nread = -1;
3964         struct lock_struct lock;
3965         int saved_errno = 0;
3966
3967         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3968             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3969             &lock);
3970
3971         if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
3972                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3973                 return;
3974         }
3975
3976         /*
3977          * We can only use sendfile on a non-chained packet
3978          * but we can use on a non-oplocked file. tridge proved this
3979          * on a train in Germany :-). JRA.
3980          */
3981
3982         if (!req_is_in_chain(req) &&
3983             !req->encrypted &&
3984             (fsp->base_fsp == NULL) &&
3985             (fsp->wcp == NULL) &&
3986             lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
3987                 uint8_t headerbuf[smb_size + 12 * 2 + 1 /* padding byte */];
3988                 DATA_BLOB header;
3989
3990                 if(fsp_stat(fsp) == -1) {
3991                         reply_nterror(req, map_nt_error_from_unix(errno));
3992                         goto out;
3993                 }
3994
3995                 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3996                     (startpos > fsp->fsp_name->st.st_ex_size) ||
3997                     (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3998                         /*
3999                          * We already know that we would do a short read, so don't
4000                          * try the sendfile() path.
4001                          */
4002                         goto nosendfile_read;
4003                 }
4004
4005                 /*
4006                  * Set up the packet header before send. We
4007                  * assume here the sendfile will work (get the
4008                  * correct amount of data).
4009                  */
4010
4011                 header = data_blob_const(headerbuf, sizeof(headerbuf));
4012
4013                 construct_reply_common_req(req, (char *)headerbuf);
4014                 setup_readX_header((char *)headerbuf, smb_maxcnt);
4015
4016                 nread = SMB_VFS_SENDFILE(xconn->transport.sock, fsp, &header,
4017                                          startpos, smb_maxcnt);
4018                 if (nread == -1) {
4019                         saved_errno = errno;
4020
4021                         /* Returning ENOSYS means no data at all was sent.
4022                            Do this as a normal read. */
4023                         if (errno == ENOSYS) {
4024                                 goto normal_read;
4025                         }
4026
4027                         /*
4028                          * Special hack for broken Linux with no working sendfile. If we
4029                          * return EINTR we sent the header but not the rest of the data.
4030                          * Fake this up by doing read/write calls.
4031                          */
4032
4033                         if (errno == EINTR) {
4034                                 /* Ensure we don't do this again. */
4035                                 set_use_sendfile(SNUM(conn), False);
4036                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
4037                                 nread = fake_sendfile(xconn, fsp, startpos,
4038                                                       smb_maxcnt);
4039                                 if (nread == -1) {
4040                                         saved_errno = errno;
4041                                         DEBUG(0,("send_file_readX: "
4042                                                  "fake_sendfile failed for "
4043                                                  "file %s (%s) for client %s. "
4044                                                  "Terminating\n",
4045                                                  fsp_str_dbg(fsp),
4046                                                  smbXsrv_connection_dbg(xconn),
4047                                                  strerror(saved_errno)));
4048                                         errno = saved_errno;
4049                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
4050                                 }
4051                                 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
4052                                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
4053                                 /* No outbuf here means successful sendfile. */
4054                                 goto out;
4055                         }
4056
4057                         DEBUG(0,("send_file_readX: sendfile failed for file "
4058                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
4059                                  strerror(errno)));
4060                         exit_server_cleanly("send_file_readX sendfile failed");
4061                 } else if (nread == 0) {
4062                         /*
4063                          * Some sendfile implementations return 0 to indicate
4064                          * that there was a short read, but nothing was
4065                          * actually written to the socket.  In this case,
4066                          * fallback to the normal read path so the header gets
4067                          * the correct byte count.
4068                          */
4069                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
4070                                   "falling back to the normal read: %s\n",
4071                                   fsp_str_dbg(fsp)));
4072                         goto normal_read;
4073                 }
4074
4075                 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
4076                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
4077
4078                 /* Deal with possible short send. */
4079                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
4080                         ssize_t ret;
4081
4082                         ret = sendfile_short_send(xconn, fsp, nread,
4083                                                   sizeof(headerbuf), smb_maxcnt);
4084                         if (ret == -1) {
4085                                 const char *r;
4086                                 r = "send_file_readX: sendfile_short_send failed";
4087                                 DEBUG(0,("%s for file %s (%s).\n",
4088                                          r, fsp_str_dbg(fsp), strerror(errno)));
4089                                 exit_server_cleanly(r);
4090                         }
4091                 }
4092                 /* No outbuf here means successful sendfile. */
4093                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
4094                 SMB_PERFCOUNT_END(&req->pcd);
4095                 goto out;
4096         }
4097
4098 normal_read:
4099
4100         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
4101                 uint8_t headerbuf[smb_size + 2*12 + 1 /* padding byte */];
4102                 ssize_t ret;
4103
4104                 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
4105                     (startpos > fsp->fsp_name->st.st_ex_size) ||
4106                     (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
4107                         /*
4108                          * We already know that we would do a short
4109                          * read, so don't try the sendfile() path.
4110                          */
4111                         goto nosendfile_read;
4112                 }
4113
4114                 construct_reply_common_req(req, (char *)headerbuf);
4115                 setup_readX_header((char *)headerbuf, smb_maxcnt);
4116
4117                 /* Send out the header. */
4118                 ret = write_data(xconn->transport.sock, (char *)headerbuf,
4119                                  sizeof(headerbuf));
4120                 if (ret != sizeof(headerbuf)) {
4121                         saved_errno = errno;
4122                         /*
4123                          * Try and give an error message saying what
4124                          * client failed.
4125                          */
4126                         DEBUG(0,("send_file_readX: write_data failed for file "
4127                                  "%s (%s) for client %s. Terminating\n",
4128                                  fsp_str_dbg(fsp),
4129                                  smbXsrv_connection_dbg(xconn),
4130                                  strerror(saved_errno)));
4131                         errno = saved_errno;
4132                         exit_server_cleanly("send_file_readX sendfile failed");
4133                 }
4134                 nread = fake_sendfile(xconn, fsp, startpos, smb_maxcnt);
4135                 if (nread == -1) {
4136                         saved_errno = errno;
4137                         DEBUG(0,("send_file_readX: fake_sendfile failed for file "
4138                                  "%s (%s) for client %s. Terminating\n",
4139                                  fsp_str_dbg(fsp),
4140                                  smbXsrv_connection_dbg(xconn),
4141                                  strerror(saved_errno)));
4142                         errno = saved_errno;
4143                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
4144                 }
4145                 goto out;
4146         }
4147
4148 nosendfile_read:
4149
4150         reply_outbuf(req, 12, smb_maxcnt + 1 /* padding byte */);
4151         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4152         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
4153
4154         nread = read_file(fsp, smb_buf(req->outbuf) + 1 /* padding byte */,
4155                           startpos, smb_maxcnt);
4156         saved_errno = errno;
4157
4158         if (nread < 0) {
4159                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4160                 return;
4161         }
4162
4163         setup_readX_header((char *)req->outbuf, nread);
4164
4165         DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
4166                   fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
4167         return;
4168
4169 out:
4170         TALLOC_FREE(req->outbuf);
4171         return;
4172 }
4173
4174 /****************************************************************************
4175  Work out how much space we have for a read return.
4176 ****************************************************************************/
4177
4178 static size_t calc_max_read_pdu(const struct smb_request *req)
4179 {
4180         struct smbXsrv_connection *xconn = req->xconn;
4181
4182         if (xconn->protocol < PROTOCOL_NT1) {
4183                 return xconn->smb1.sessions.max_send;
4184         }
4185
4186         if (!lp_large_readwrite()) {
4187                 return xconn->smb1.sessions.max_send;
4188         }
4189
4190         if (req_is_in_chain(req)) {
4191                 return xconn->smb1.sessions.max_send;
4192         }
4193
4194         if (req->encrypted) {
4195                 /*
4196                  * Don't take encrypted traffic up to the
4197                  * limit. There are padding considerations
4198                  * that make that tricky.
4199                  */
4200                 return xconn->smb1.sessions.max_send;
4201         }
4202
4203         if (srv_is_signing_active(xconn)) {
4204                 return 0x1FFFF;
4205         }
4206
4207         if (!lp_unix_extensions()) {
4208                 return 0x1FFFF;
4209         }
4210
4211         /*
4212          * We can do ultra-large POSIX reads.
4213          */
4214         return 0xFFFFFF;
4215 }
4216
4217 /****************************************************************************
4218  Calculate how big a read can be. Copes with all clients. It's always
4219  safe to return a short read - Windows does this.
4220 ****************************************************************************/
4221
4222 static size_t calc_read_size(const struct smb_request *req,
4223                              size_t upper_size,
4224                              size_t lower_size)
4225 {
4226         struct smbXsrv_connection *xconn = req->xconn;
4227         size_t max_pdu = calc_max_read_pdu(req);
4228         size_t total_size = 0;
4229         size_t hdr_len = MIN_SMB_SIZE + VWV(12);
4230         size_t max_len = max_pdu - hdr_len - 1 /* padding byte */;
4231
4232         /*
4233          * Windows explicitly ignores upper size of 0xFFFF.
4234          * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
4235          * We must do the same as these will never fit even in
4236          * an extended size NetBIOS packet.
4237          */
4238         if (upper_size == 0xFFFF) {
4239                 upper_size = 0;
4240         }
4241
4242         if (xconn->protocol < PROTOCOL_NT1) {
4243                 upper_size = 0;
4244         }
4245
4246         total_size = ((upper_size<<16) | lower_size);
4247
4248         /*
4249          * LARGE_READX test shows it's always safe to return
4250          * a short read. Windows does so.
4251          */
4252         return MIN(total_size, max_len);
4253 }
4254
4255 /****************************************************************************
4256  Reply to a read and X.
4257 ****************************************************************************/
4258
4259 void reply_read_and_X(struct smb_request *req)
4260 {
4261         connection_struct *conn = req->conn;
4262         files_struct *fsp;
4263         off_t startpos;
4264         size_t smb_maxcnt;
4265         size_t upper_size;
4266         bool big_readX = False;
4267 #if 0
4268         size_t smb_mincnt = SVAL(req->vwv+6, 0);
4269 #endif
4270
4271         START_PROFILE(SMBreadX);
4272
4273         if ((req->wct != 10) && (req->wct != 12)) {
4274                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4275                 return;
4276         }
4277
4278         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4279         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4280         smb_maxcnt = SVAL(req->vwv+5, 0);
4281
4282         /* If it's an IPC, pass off the pipe handler. */
4283         if (IS_IPC(conn)) {
4284                 reply_pipe_read_and_X(req);
4285                 END_PROFILE(SMBreadX);
4286                 return;
4287         }
4288
4289         if (!check_fsp(conn, req, fsp)) {
4290                 END_PROFILE(SMBreadX);
4291                 return;
4292         }
4293
4294         if (!CHECK_READ(fsp,req)) {
4295                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4296                 END_PROFILE(SMBreadX);
4297                 return;
4298         }
4299
4300         upper_size = SVAL(req->vwv+7, 0);
4301         smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4302         if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4303                 /*
4304                  * This is a heuristic to avoid keeping large
4305                  * outgoing buffers around over long-lived aio
4306                  * requests.
4307                  */
4308                 big_readX = True;
4309         }
4310
4311         if (req->wct == 12) {
4312                 /*
4313                  * This is a large offset (64 bit) read.
4314                  */
4315                 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4316
4317         }
4318
4319         if (!big_readX) {
4320                 NTSTATUS status = schedule_aio_read_and_X(conn,
4321                                         req,
4322                                         fsp,
4323                                         startpos,
4324                                         smb_maxcnt);
4325                 if (NT_STATUS_IS_OK(status)) {
4326                         /* Read scheduled - we're done. */
4327                         goto out;
4328                 }
4329                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4330                         /* Real error - report to client. */
4331                         END_PROFILE(SMBreadX);
4332                         reply_nterror(req, status);
4333                         return;
4334                 }
4335                 /* NT_STATUS_RETRY - fall back to sync read. */
4336         }
4337
4338         smbd_lock_socket(req->xconn);
4339         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4340         smbd_unlock_socket(req->xconn);
4341
4342  out:
4343         END_PROFILE(SMBreadX);
4344         return;
4345 }
4346
4347 /****************************************************************************
4348  Error replies to writebraw must have smb_wct == 1. Fix this up.
4349 ****************************************************************************/
4350
4351 void error_to_writebrawerr(struct smb_request *req)
4352 {
4353         uint8_t *old_outbuf = req->outbuf;
4354
4355         reply_outbuf(req, 1, 0);
4356
4357         memcpy(req->outbuf, old_outbuf, smb_size);
4358         TALLOC_FREE(old_outbuf);
4359 }
4360
4361 /****************************************************************************
4362  Read 4 bytes of a smb packet and return the smb length of the packet.
4363  Store the result in the buffer. This version of the function will
4364  never return a session keepalive (length of zero).
4365  Timeout is in milliseconds.
4366 ****************************************************************************/
4367
4368 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4369                                 size_t *len)
4370 {
4371         uint8_t msgtype = NBSSkeepalive;
4372
4373         while (msgtype == NBSSkeepalive) {
4374                 NTSTATUS status;
4375
4376                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4377                                                           len);
4378                 if (!NT_STATUS_IS_OK(status)) {
4379                         char addr[INET6_ADDRSTRLEN];
4380                         /* Try and give an error message
4381                          * saying what client failed. */
4382                         DEBUG(0, ("read_fd_with_timeout failed for "
4383                                   "client %s read error = %s.\n",
4384                                   get_peer_addr(fd,addr,sizeof(addr)),
4385                                   nt_errstr(status)));
4386                         return status;
4387                 }
4388
4389                 msgtype = CVAL(inbuf, 0);
4390         }
4391
4392         DEBUG(10,("read_smb_length: got smb length of %lu\n",
4393                   (unsigned long)len));
4394
4395         return NT_STATUS_OK;
4396 }
4397
4398 /****************************************************************************
4399  Reply to a writebraw (core+ or LANMAN1.0 protocol).
4400 ****************************************************************************/
4401
4402 void reply_writebraw(struct smb_request *req)
4403 {
4404         connection_struct *conn = req->conn;
4405         struct smbXsrv_connection *xconn = req->xconn;
4406         char *buf = NULL;
4407         ssize_t nwritten=0;
4408         ssize_t total_written=0;
4409         size_t numtowrite=0;
4410         size_t tcount;
4411         off_t startpos;
4412         const char *data=NULL;
4413         bool write_through;
4414         files_struct *fsp;
4415         struct lock_struct lock;
4416         NTSTATUS status;
4417
4418         START_PROFILE(SMBwritebraw);
4419
4420         /*
4421          * If we ever reply with an error, it must have the SMB command
4422          * type of SMBwritec, not SMBwriteBraw, as this tells the client
4423          * we're finished.
4424          */
4425         SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4426
4427         if (srv_is_signing_active(xconn)) {
4428                 END_PROFILE(SMBwritebraw);
4429                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4430                                 "raw reads/writes are disallowed.");
4431         }
4432
4433         if (req->wct < 12) {
4434                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4435                 error_to_writebrawerr(req);
4436                 END_PROFILE(SMBwritebraw);
4437                 return;
4438         }
4439
4440         if (xconn->smb1.echo_handler.trusted_fde) {
4441                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4442                          "'async smb echo handler = yes'\n"));
4443                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4444                 error_to_writebrawerr(req);
4445                 END_PROFILE(SMBwritebraw);
4446                 return;
4447         }
4448
4449         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4450         if (!check_fsp(conn, req, fsp)) {
4451                 error_to_writebrawerr(req);
4452                 END_PROFILE(SMBwritebraw);
4453                 return;
4454         }
4455
4456         if (!CHECK_WRITE(fsp)) {
4457                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4458                 error_to_writebrawerr(req);
4459                 END_PROFILE(SMBwritebraw);
4460                 return;
4461         }
4462
4463         tcount = IVAL(req->vwv+1, 0);
4464         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4465         write_through = BITSETW(req->vwv+7,0);
4466
4467         /* We have to deal with slightly different formats depending
4468                 on whether we are using the core+ or lanman1.0 protocol */
4469
4470         if(get_Protocol() <= PROTOCOL_COREPLUS) {
4471                 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4472                 data = smb_buf_const(req->inbuf);
4473         } else {
4474                 numtowrite = SVAL(req->vwv+10, 0);
4475                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4476         }
4477
4478         /* Ensure we don't write bytes past the end of this packet. */
4479         /*
4480          * This already protects us against CVE-2017-12163.
4481          */
4482         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4483                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4484                 error_to_writebrawerr(req);
4485                 END_PROFILE(SMBwritebraw);
4486                 return;
4487         }
4488
4489         if (!fsp->print_file) {
4490                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4491                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4492                     &lock);
4493
4494                 if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
4495                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4496                         error_to_writebrawerr(req);
4497                         END_PROFILE(SMBwritebraw);
4498                         return;
4499                 }
4500         }
4501
4502         if (numtowrite>0) {
4503                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4504         }
4505
4506         DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4507                         "wrote=%d sync=%d\n",
4508                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4509                 (int)nwritten, (int)write_through));
4510
4511         if (nwritten < (ssize_t)numtowrite)  {
4512                 reply_nterror(req, NT_STATUS_DISK_FULL);
4513                 error_to_writebrawerr(req);
4514                 goto out;
4515         }
4516
4517         total_written = nwritten;
4518
4519         /* Allocate a buffer of 64k + length. */
4520         buf = talloc_array(NULL, char, 65540);
4521         if (!buf) {
4522                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4523                 error_to_writebrawerr(req);
4524                 goto out;
4525         }
4526
4527         /* Return a SMBwritebraw message to the redirector to tell
4528          * it to send more bytes */
4529
4530         memcpy(buf, req->inbuf, smb_size);
4531         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4532         SCVAL(buf,smb_com,SMBwritebraw);
4533         SSVALS(buf,smb_vwv0,0xFFFF);
4534         show_msg(buf);
4535         if (!srv_send_smb(req->xconn,
4536                           buf,
4537                           false, 0, /* no signing */
4538                           IS_CONN_ENCRYPTED(conn),
4539                           &req->pcd)) {
4540                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4541                         "failed.");
4542         }
4543
4544         /* Now read the raw data into the buffer and write it */
4545         status = read_smb_length(xconn->transport.sock, buf, SMB_SECONDARY_WAIT,
4546                                  &numtowrite);
4547         if (!NT_STATUS_IS_OK(status)) {
4548                 exit_server_cleanly("secondary writebraw failed");
4549         }
4550
4551         /* Set up outbuf to return the correct size */
4552         reply_outbuf(req, 1, 0);
4553
4554         if (numtowrite != 0) {
4555
4556                 if (numtowrite > 0xFFFF) {
4557                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4558                                 "raw requested (%u). Terminating\n",
4559                                 (unsigned int)numtowrite ));
4560                         exit_server_cleanly("secondary writebraw failed");
4561                 }
4562
4563                 if (tcount > nwritten+numtowrite) {
4564                         DEBUG(3,("reply_writebraw: Client overestimated the "
4565                                 "write %d %d %d\n",
4566                                 (int)tcount,(int)nwritten,(int)numtowrite));
4567                 }
4568
4569                 status = read_data_ntstatus(xconn->transport.sock, buf+4,
4570                                             numtowrite);
4571
4572                 if (!NT_STATUS_IS_OK(status)) {
4573                         /* Try and give an error message
4574                          * saying what client failed. */
4575                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4576                                   "raw read failed (%s) for client %s. "
4577                                   "Terminating\n", nt_errstr(status),
4578                                   smbXsrv_connection_dbg(xconn)));
4579                         exit_server_cleanly("secondary writebraw failed");
4580                 }
4581
4582                 /*
4583                  * We are not vulnerable to CVE-2017-12163
4584                  * here as we are guarenteed to have numtowrite
4585                  * bytes available - we just read from the client.
4586                  */
4587                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4588                 if (nwritten == -1) {
4589                         TALLOC_FREE(buf);
4590                         reply_nterror(req, map_nt_error_from_unix(errno));
4591                         error_to_writebrawerr(req);
4592                         goto out;
4593                 }
4594
4595                 if (nwritten < (ssize_t)numtowrite) {
4596                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4597                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4598                 }
4599
4600                 if (nwritten > 0) {
4601                         total_written += nwritten;
4602                 }
4603         }
4604
4605         TALLOC_FREE(buf);
4606         SSVAL(req->outbuf,smb_vwv0,total_written);
4607
4608         status = sync_file(conn, fsp, write_through);
4609         if (!NT_STATUS_IS_OK(status)) {
4610                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4611                          fsp_str_dbg(fsp), nt_errstr(status)));
4612                 reply_nterror(req, status);
4613                 error_to_writebrawerr(req);
4614                 goto out;
4615         }
4616
4617         DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4618                 "wrote=%d\n",
4619                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4620                 (int)total_written));
4621
4622         /* We won't return a status if write through is not selected - this
4623          * follows what WfWg does */
4624         END_PROFILE(SMBwritebraw);
4625
4626         if (!write_through && total_written==tcount) {
4627
4628 #if RABBIT_PELLET_FIX
4629                 /*
4630                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4631                  * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4632                  * JRA.
4633                  */
4634                 if (!send_keepalive(xconn->transport.sock)) {
4635                         exit_server_cleanly("reply_writebraw: send of "
4636                                 "keepalive failed");
4637                 }
4638 #endif
4639                 TALLOC_FREE(req->outbuf);
4640         }
4641         return;
4642
4643 out:
4644         END_PROFILE(SMBwritebraw);
4645         return;
4646 }
4647
4648 #undef DBGC_CLASS
4649 #define DBGC_CLASS DBGC_LOCKING
4650
4651 /****************************************************************************
4652  Reply to a writeunlock (core+).
4653 ****************************************************************************/
4654
4655 void reply_writeunlock(struct smb_request *req)
4656 {
4657         connection_struct *conn = req->conn;
4658         ssize_t nwritten = -1;
4659         size_t numtowrite;
4660         size_t remaining;
4661         off_t startpos;
4662         const char *data;
4663         NTSTATUS status = NT_STATUS_OK;
4664         files_struct *fsp;
4665         struct lock_struct lock;
4666         int saved_errno = 0;
4667
4668         START_PROFILE(SMBwriteunlock);
4669
4670         if (req->wct < 5) {
4671                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4672                 END_PROFILE(SMBwriteunlock);
4673                 return;
4674         }
4675
4676         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4677
4678         if (!check_fsp(conn, req, fsp)) {
4679                 END_PROFILE(SMBwriteunlock);
4680                 return;
4681         }
4682
4683         if (!CHECK_WRITE(fsp)) {
4684                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4685                 END_PROFILE(SMBwriteunlock);
4686                 return;
4687         }
4688
4689         numtowrite = SVAL(req->vwv+1, 0);
4690         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4691         data = (const char *)req->buf + 3;
4692
4693         /*
4694          * Ensure client isn't asking us to write more than
4695          * they sent. CVE-2017-12163.
4696          */
4697         remaining = smbreq_bufrem(req, data);
4698         if (numtowrite > remaining) {
4699                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4700                 END_PROFILE(SMBwriteunlock);
4701                 return;
4702         }
4703
4704         if (!fsp->print_file && numtowrite > 0) {
4705                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4706                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4707                     &lock);
4708
4709                 if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
4710                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4711                         END_PROFILE(SMBwriteunlock);
4712                         return;
4713                 }
4714         }
4715
4716         /* The special X/Open SMB protocol handling of
4717            zero length writes is *NOT* done for
4718            this call */
4719         if(numtowrite == 0) {
4720                 nwritten = 0;
4721         } else {
4722                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4723                 saved_errno = errno;
4724         }
4725
4726         status = sync_file(conn, fsp, False /* write through */);
4727         if (!NT_STATUS_IS_OK(status)) {
4728                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4729                          fsp_str_dbg(fsp), nt_errstr(status)));
4730                 reply_nterror(req, status);
4731                 goto out;
4732         }
4733
4734         if(nwritten < 0) {
4735                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4736                 goto out;
4737         }
4738
4739         if((nwritten < numtowrite) && (numtowrite != 0)) {
4740                 reply_nterror(req, NT_STATUS_DISK_FULL);
4741                 goto out;
4742         }
4743
4744         if (numtowrite && !fsp->print_file) {
4745                 status = do_unlock(req->sconn->msg_ctx,
4746                                 fsp,
4747                                 (uint64_t)req->smbpid,
4748                                 (uint64_t)numtowrite,
4749                                 (uint64_t)startpos,
4750                                 WINDOWS_LOCK);
4751
4752                 if (NT_STATUS_V(status)) {
4753                         reply_nterror(req, status);
4754                         goto out;
4755                 }
4756         }
4757
4758         reply_outbuf(req, 1, 0);
4759
4760         SSVAL(req->outbuf,smb_vwv0,nwritten);
4761
4762         DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4763                   fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4764
4765 out:
4766         END_PROFILE(SMBwriteunlock);
4767         return;
4768 }
4769
4770 #undef DBGC_CLASS
4771 #define DBGC_CLASS DBGC_ALL
4772
4773 /****************************************************************************
4774  Reply to a write.
4775 ****************************************************************************/
4776
4777 void reply_write(struct smb_request *req)
4778 {
4779         connection_struct *conn = req->conn;
4780         size_t numtowrite;
4781         size_t remaining;
4782         ssize_t nwritten = -1;
4783         off_t startpos;
4784         const char *data;
4785         files_struct *fsp;
4786         struct lock_struct lock;
4787         NTSTATUS status;
4788         int saved_errno = 0;
4789
4790         START_PROFILE(SMBwrite);
4791
4792         if (req->wct < 5) {
4793                 END_PROFILE(SMBwrite);
4794                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4795                 return;
4796         }
4797
4798         /* If it's an IPC, pass off the pipe handler. */
4799         if (IS_IPC(conn)) {
4800                 reply_pipe_write(req);
4801                 END_PROFILE(SMBwrite);
4802                 return;
4803         }
4804
4805         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4806
4807         if (!check_fsp(conn, req, fsp)) {
4808                 END_PROFILE(SMBwrite);
4809                 return;
4810         }
4811
4812         if (!CHECK_WRITE(fsp)) {
4813                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4814                 END_PROFILE(SMBwrite);
4815                 return;
4816         }
4817
4818         numtowrite = SVAL(req->vwv+1, 0);
4819         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4820         data = (const char *)req->buf + 3;
4821
4822         /*
4823          * Ensure client isn't asking us to write more than
4824          * they sent. CVE-2017-12163.
4825          */
4826         remaining = smbreq_bufrem(req, data);
4827         if (numtowrite > remaining) {
4828                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4829                 END_PROFILE(SMBwrite);
4830                 return;
4831         }
4832
4833         if (!fsp->print_file) {
4834                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4835                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4836                         &lock);
4837
4838                 if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
4839                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4840                         END_PROFILE(SMBwrite);
4841                         return;
4842                 }
4843         }
4844
4845         /*
4846          * X/Open SMB protocol says that if smb_vwv1 is
4847          * zero then the file size should be extended or
4848          * truncated to the size given in smb_vwv[2-3].
4849          */
4850
4851         if(numtowrite == 0) {
4852                 /*
4853                  * This is actually an allocate call, and set EOF. JRA.
4854                  */
4855                 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4856                 if (nwritten < 0) {
4857                         reply_nterror(req, NT_STATUS_DISK_FULL);
4858                         goto out;
4859                 }
4860                 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4861                 if (nwritten < 0) {
4862                         reply_nterror(req, NT_STATUS_DISK_FULL);
4863                         goto out;
4864                 }
4865                 trigger_write_time_update_immediate(fsp);
4866         } else {
4867                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4868         }
4869
4870         status = sync_file(conn, fsp, False);
4871         if (!NT_STATUS_IS_OK(status)) {
4872                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4873                          fsp_str_dbg(fsp), nt_errstr(status)));
4874                 reply_nterror(req, status);
4875                 goto out;
4876         }
4877
4878         if(nwritten < 0) {
4879                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4880                 goto out;
4881         }
4882
4883         if((nwritten == 0) && (numtowrite != 0)) {
4884                 reply_nterror(req, NT_STATUS_DISK_FULL);
4885                 goto out;
4886         }
4887
4888         reply_outbuf(req, 1, 0);
4889
4890         SSVAL(req->outbuf,smb_vwv0,nwritten);
4891
4892         if (nwritten < (ssize_t)numtowrite) {
4893                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4894                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4895         }
4896
4897         DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4898
4899 out:
4900         END_PROFILE(SMBwrite);
4901         return;
4902 }
4903
4904 /****************************************************************************
4905  Ensure a buffer is a valid writeX for recvfile purposes.
4906 ****************************************************************************/
4907
4908 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4909                                                 (2*14) + /* word count (including bcc) */ \
4910                                                 1 /* pad byte */)
4911
4912 bool is_valid_writeX_buffer(struct smbXsrv_connection *xconn,
4913                             const uint8_t *inbuf)
4914 {
4915         size_t numtowrite;
4916         unsigned int doff = 0;
4917         size_t len = smb_len_large(inbuf);
4918         uint16_t fnum;
4919         struct smbXsrv_open *op = NULL;
4920         struct files_struct *fsp = NULL;
4921         NTSTATUS status;
4922
4923         if (is_encrypted_packet(inbuf)) {
4924                 /* Can't do this on encrypted
4925                  * connections. */
4926                 return false;
4927         }
4928
4929         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4930                 return false;
4931         }
4932
4933         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4934                         CVAL(inbuf,smb_wct) != 14) {
4935                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4936                         "invalid word length.\n"));
4937                 return false;
4938         }
4939
4940         fnum = SVAL(inbuf, smb_vwv2);
4941         status = smb1srv_open_lookup(xconn,
4942                                      fnum,
4943                                      0, /* now */
4944                                      &op);
4945         if (!NT_STATUS_IS_OK(status)) {
4946                 DEBUG(10,("is_valid_writeX_buffer: bad fnum\n"));
4947                 return false;
4948         }
4949         fsp = op->compat;
4950         if (fsp == NULL) {
4951                 DEBUG(10,("is_valid_writeX_buffer: bad fsp\n"));
4952                 return false;
4953         }
4954         if (fsp->conn == NULL) {
4955                 DEBUG(10,("is_valid_writeX_buffer: bad fsp->conn\n"));
4956                 return false;
4957         }
4958
4959         if (IS_IPC(fsp->conn)) {
4960                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4961                 return false;
4962         }
4963         if (IS_PRINT(fsp->conn)) {
4964                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4965                 return false;
4966         }
4967         doff = SVAL(inbuf,smb_vwv11);
4968
4969         numtowrite = SVAL(inbuf,smb_vwv10);
4970
4971         if (len > doff && len - doff > 0xFFFF) {
4972                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4973         }
4974
4975         if (numtowrite == 0) {
4976                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4977                 return false;
4978         }
4979
4980         /* Ensure the sizes match up. */
4981         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4982                 /* no pad byte...old smbclient :-( */
4983                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4984                         (unsigned int)doff,
4985                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4986                 return false;
4987         }
4988
4989         if (len - doff != numtowrite) {
4990                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4991                         "len = %u, doff = %u, numtowrite = %u\n",
4992                         (unsigned int)len,
4993                         (unsigned int)doff,
4994                         (unsigned int)numtowrite ));
4995                 return false;
4996         }
4997
4998         DEBUG(10,("is_valid_writeX_buffer: true "
4999                 "len = %u, doff = %u, numtowrite = %u\n",
5000                 (unsigned int)len,
5001                 (unsigned int)doff,
5002                 (unsigned int)numtowrite ));
5003
5004         return true;
5005 }
5006
5007 /****************************************************************************
5008  Reply to a write and X.
5009 ****************************************************************************/
5010
5011 void reply_write_and_X(struct smb_request *req)
5012 {
5013         connection_struct *conn = req->conn;
5014         struct smbXsrv_connection *xconn = req->xconn;
5015         files_struct *fsp;
5016         struct lock_struct lock;
5017         off_t startpos;
5018         size_t numtowrite;
5019         bool write_through;
5020         ssize_t nwritten;
5021         unsigned int smb_doff;
5022         unsigned int smblen;
5023         const char *data;
5024         NTSTATUS status;
5025         int saved_errno = 0;
5026
5027         START_PROFILE(SMBwriteX);
5028
5029         if ((req->wct != 12) && (req->wct != 14)) {
5030                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5031                 goto out;
5032         }
5033
5034         numtowrite = SVAL(req->vwv+10, 0);
5035         smb_doff = SVAL(req->vwv+11, 0);
5036         smblen = smb_len(req->inbuf);
5037
5038         if (req->unread_bytes > 0xFFFF ||
5039                         (smblen > smb_doff &&
5040                                 smblen - smb_doff > 0xFFFF)) {
5041                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
5042         }
5043
5044         if (req->unread_bytes) {
5045                 /* Can't do a recvfile write on IPC$ */
5046                 if (IS_IPC(conn)) {
5047                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5048                         goto out;
5049                 }
5050                 if (numtowrite != req->unread_bytes) {
5051                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5052                         goto out;
5053                 }
5054         } else {
5055                 /*
5056                  * This already protects us against CVE-2017-12163.
5057                  */
5058                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
5059                                 smb_doff + numtowrite > smblen) {
5060                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5061                         goto out;
5062                 }
5063         }
5064
5065         /* If it's an IPC, pass off the pipe handler. */
5066         if (IS_IPC(conn)) {
5067                 if (req->unread_bytes) {
5068                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5069                         goto out;
5070                 }
5071                 reply_pipe_write_and_X(req);
5072                 goto out;
5073         }
5074
5075         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
5076         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
5077         write_through = BITSETW(req->vwv+7,0);
5078
5079         if (!check_fsp(conn, req, fsp)) {
5080                 goto out;
5081         }
5082
5083         if (!CHECK_WRITE(fsp)) {
5084                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5085                 goto out;
5086         }
5087
5088         data = smb_base(req->inbuf) + smb_doff;
5089
5090         if(req->wct == 14) {
5091                 /*
5092                  * This is a large offset (64 bit) write.
5093                  */
5094                 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
5095
5096         }
5097
5098         /* X/Open SMB protocol says that, unlike SMBwrite
5099         if the length is zero then NO truncation is
5100         done, just a write of zero. To truncate a file,
5101         use SMBwrite. */
5102
5103         if(numtowrite == 0) {
5104                 nwritten = 0;
5105         } else {
5106                 if (req->unread_bytes == 0) {
5107                         status = schedule_aio_write_and_X(conn,
5108                                                 req,
5109                                                 fsp,
5110                                                 data,
5111                                                 startpos,
5112                                                 numtowrite);
5113
5114                         if (NT_STATUS_IS_OK(status)) {
5115                                 /* write scheduled - we're done. */
5116                                 goto out;
5117                         }
5118                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
5119                                 /* Real error - report to client. */
5120                                 reply_nterror(req, status);
5121                                 goto out;
5122                         }
5123                         /* NT_STATUS_RETRY - fall through to sync write. */
5124                 }
5125
5126                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5127                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5128                     &lock);
5129
5130                 if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
5131                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5132                         goto out;
5133                 }
5134
5135                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
5136                 saved_errno = errno;
5137         }
5138
5139         if(nwritten < 0) {
5140                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
5141                 goto out;
5142         }
5143
5144         if((nwritten == 0) && (numtowrite != 0)) {
5145                 reply_nterror(req, NT_STATUS_DISK_FULL);
5146                 goto out;
5147         }
5148
5149         reply_outbuf(req, 6, 0);
5150         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
5151         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
5152         SSVAL(req->outbuf,smb_vwv2,nwritten);
5153         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
5154
5155         DEBUG(3,("writeX %s num=%d wrote=%d\n",
5156                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
5157
5158         status = sync_file(conn, fsp, write_through);
5159         if (!NT_STATUS_IS_OK(status)) {
5160                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
5161                          fsp_str_dbg(fsp), nt_errstr(status)));
5162                 reply_nterror(req, status);
5163                 goto out;
5164         }
5165
5166         END_PROFILE(SMBwriteX);
5167         return;
5168
5169 out:
5170         if (req->unread_bytes) {
5171                 /* writeX failed. drain socket. */
5172                 if (drain_socket(xconn->transport.sock, req->unread_bytes) !=
5173                                 req->unread_bytes) {
5174                         smb_panic("failed to drain pending bytes");
5175                 }
5176                 req->unread_bytes = 0;
5177         }
5178
5179         END_PROFILE(SMBwriteX);
5180         return;
5181 }
5182
5183 /****************************************************************************
5184  Reply to a lseek.
5185 ****************************************************************************/
5186
5187 void reply_lseek(struct smb_request *req)
5188 {
5189         connection_struct *conn = req->conn;
5190         off_t startpos;
5191         off_t res= -1;
5192         int mode,umode;
5193         files_struct *fsp;
5194
5195         START_PROFILE(SMBlseek);
5196
5197         if (req->wct < 4) {
5198                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5199                 END_PROFILE(SMBlseek);
5200                 return;
5201         }
5202
5203         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5204
5205         if (!check_fsp(conn, req, fsp)) {
5206                 return;
5207         }
5208
5209         flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
5210
5211         mode = SVAL(req->vwv+1, 0) & 3;
5212         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
5213         startpos = (off_t)IVALS(req->vwv+2, 0);
5214
5215         switch (mode) {
5216                 case 0:
5217                         umode = SEEK_SET;
5218                         res = startpos;
5219                         break;
5220                 case 1:
5221                         umode = SEEK_CUR;
5222                         res = fsp->fh->pos + startpos;
5223                         break;
5224                 case 2:
5225                         umode = SEEK_END;
5226                         break;
5227                 default:
5228                         umode = SEEK_SET;
5229                         res = startpos;
5230                         break;
5231         }
5232
5233         if (umode == SEEK_END) {
5234                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
5235                         if(errno == EINVAL) {
5236                                 off_t current_pos = startpos;
5237
5238                                 if(fsp_stat(fsp) == -1) {
5239                                         reply_nterror(req,
5240                                                 map_nt_error_from_unix(errno));
5241                                         END_PROFILE(SMBlseek);
5242                                         return;
5243                                 }
5244
5245                                 current_pos += fsp->fsp_name->st.st_ex_size;
5246                                 if(current_pos < 0)
5247                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
5248                         }
5249                 }
5250
5251                 if(res == -1) {
5252                         reply_nterror(req, map_nt_error_from_unix(errno));
5253                         END_PROFILE(SMBlseek);
5254                         return;
5255                 }
5256         }
5257
5258         fsp->fh->pos = res;
5259
5260         reply_outbuf(req, 2, 0);
5261         SIVAL(req->outbuf,smb_vwv0,res);
5262
5263         DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
5264                 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
5265
5266         END_PROFILE(SMBlseek);
5267         return;
5268 }
5269
5270 /****************************************************************************
5271  Reply to a flush.
5272 ****************************************************************************/
5273
5274 void reply_flush(struct smb_request *req)
5275 {
5276         connection_struct *conn = req->conn;
5277         uint16_t fnum;
5278         files_struct *fsp;
5279
5280         START_PROFILE(SMBflush);
5281
5282         if (req->wct < 1) {
5283                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5284                 return;
5285         }
5286
5287         fnum = SVAL(req->vwv+0, 0);
5288         fsp = file_fsp(req, fnum);
5289
5290         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
5291                 return;
5292         }
5293
5294         if (!fsp) {
5295                 file_sync_all(conn);
5296         } else {
5297                 NTSTATUS status = sync_file(conn, fsp, True);
5298                 if (!NT_STATUS_IS_OK(status)) {
5299                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
5300                                 fsp_str_dbg(fsp), nt_errstr(status)));
5301                         reply_nterror(req, status);
5302                         END_PROFILE(SMBflush);
5303                         return;
5304                 }
5305         }
5306
5307         reply_outbuf(req, 0, 0);
5308
5309         DEBUG(3,("flush\n"));
5310         END_PROFILE(SMBflush);
5311         return;
5312 }
5313
5314 /****************************************************************************
5315  Reply to a exit.
5316  conn POINTER CAN BE NULL HERE !
5317 ****************************************************************************/
5318
5319 void reply_exit(struct smb_request *req)
5320 {
5321         START_PROFILE(SMBexit);
5322
5323         file_close_pid(req->sconn, req->smbpid, req->vuid);
5324
5325         reply_outbuf(req, 0, 0);
5326
5327         DEBUG(3,("exit\n"));
5328
5329         END_PROFILE(SMBexit);
5330         return;
5331 }
5332
5333 struct reply_close_state {
5334         files_struct *fsp;
5335         struct smb_request *smbreq;
5336 };
5337
5338 static void do_smb1_close(struct tevent_req *req);
5339
5340 void reply_close(struct smb_request *req)
5341 {
5342         connection_struct *conn = req->conn;
5343         NTSTATUS status = NT_STATUS_OK;
5344         files_struct *fsp = NULL;
5345         START_PROFILE(SMBclose);
5346
5347         if (req->wct < 3) {
5348                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5349                 END_PROFILE(SMBclose);
5350                 return;
5351         }
5352
5353         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5354
5355         /*
5356          * We can only use check_fsp if we know it's not a directory.
5357          */
5358
5359         if (!check_fsp_open(conn, req, fsp)) {
5360                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5361                 END_PROFILE(SMBclose);
5362                 return;
5363         }
5364
5365         DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5366                   fsp->is_directory ? "directory" : "file",
5367                   fsp->fh->fd, fsp_fnum_dbg(fsp),
5368                   conn->num_files_open));
5369
5370         if (!fsp->is_directory) {
5371                 time_t t;
5372
5373                 /*
5374                  * Take care of any time sent in the close.
5375                  */
5376
5377                 t = srv_make_unix_date3(req->vwv+1);
5378                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5379         }
5380
5381         if (fsp->num_aio_requests != 0) {
5382
5383                 struct reply_close_state *state;
5384
5385                 DEBUG(10, ("closing with aio %u requests pending\n",
5386                            fsp->num_aio_requests));
5387
5388                 /*
5389                  * We depend on the aio_extra destructor to take care of this
5390                  * close request once fsp->num_aio_request drops to 0.
5391                  */
5392
5393                 fsp->deferred_close = tevent_wait_send(
5394                         fsp, fsp->conn->sconn->ev_ctx);
5395                 if (fsp->deferred_close == NULL) {
5396                         status = NT_STATUS_NO_MEMORY;
5397                         goto done;
5398                 }
5399
5400                 state = talloc(fsp, struct reply_close_state);
5401                 if (state == NULL) {
5402                         TALLOC_FREE(fsp->deferred_close);
5403                         status = NT_STATUS_NO_MEMORY;
5404                         goto done;
5405                 }
5406                 state->fsp = fsp;
5407                 state->smbreq = talloc_move(fsp, &req);
5408                 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5409                                         state);
5410                 END_PROFILE(SMBclose);
5411                 return;
5412         }
5413
5414         /*
5415          * close_file() returns the unix errno if an error was detected on
5416          * close - normally this is due to a disk full error. If not then it
5417          * was probably an I/O error.
5418          */
5419
5420         status = close_file(req, fsp, NORMAL_CLOSE);
5421 done:
5422         if (!NT_STATUS_IS_OK(status)) {
5423                 reply_nterror(req, status);
5424                 END_PROFILE(SMBclose);
5425                 return;
5426         }
5427
5428         reply_outbuf(req, 0, 0);
5429         END_PROFILE(SMBclose);
5430         return;
5431 }
5432
5433 static void do_smb1_close(struct tevent_req *req)
5434 {
5435         struct reply_close_state *state = tevent_req_callback_data(
5436                 req, struct reply_close_state);
5437         struct smb_request *smbreq;
5438         NTSTATUS status;
5439         int ret;
5440
5441         ret = tevent_wait_recv(req);
5442         TALLOC_FREE(req);
5443         if (ret != 0) {
5444                 DEBUG(10, ("tevent_wait_recv returned %s\n",
5445                            strerror(ret)));
5446                 /*
5447                  * Continue anyway, this should never happen
5448                  */
5449         }
5450
5451         /*
5452          * fsp->smb2_close_request right now is a talloc grandchild of
5453          * fsp. When we close_file(fsp), it would go with it. No chance to
5454          * reply...
5455          */
5456         smbreq = talloc_move(talloc_tos(), &state->smbreq);
5457
5458         status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5459         if (NT_STATUS_IS_OK(status)) {
5460                 reply_outbuf(smbreq, 0, 0);
5461         } else {
5462                 reply_nterror(smbreq, status);
5463         }
5464         if (!srv_send_smb(smbreq->xconn,
5465                         (char *)smbreq->outbuf,
5466                         true,
5467                         smbreq->seqnum+1,
5468                         IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5469                         NULL)) {
5470                 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5471                                     "failed.");
5472         }
5473         TALLOC_FREE(smbreq);
5474 }
5475
5476 /****************************************************************************
5477  Reply to a writeclose (Core+ protocol).
5478 ****************************************************************************/
5479
5480 void reply_writeclose(struct smb_request *req)
5481 {
5482         connection_struct *conn = req->conn;
5483         size_t numtowrite;
5484         size_t remaining;
5485         ssize_t nwritten = -1;
5486         NTSTATUS close_status = NT_STATUS_OK;
5487         off_t startpos;
5488         const char *data;
5489         struct timespec mtime;
5490         files_struct *fsp;
5491         struct lock_struct lock;
5492
5493         START_PROFILE(SMBwriteclose);
5494
5495         if (req->wct < 6) {
5496                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5497                 END_PROFILE(SMBwriteclose);
5498                 return;
5499         }
5500
5501         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5502
5503         if (!check_fsp(conn, req, fsp)) {
5504                 END_PROFILE(SMBwriteclose);
5505                 return;
5506         }
5507         if (!CHECK_WRITE(fsp)) {
5508                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5509                 END_PROFILE(SMBwriteclose);
5510                 return;
5511         }
5512
5513         numtowrite = SVAL(req->vwv+1, 0);
5514         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5515         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5516         data = (const char *)req->buf + 1;
5517
5518         /*
5519          * Ensure client isn't asking us to write more than
5520          * they sent. CVE-2017-12163.
5521          */
5522         remaining = smbreq_bufrem(req, data);
5523         if (numtowrite > remaining) {
5524                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5525                 END_PROFILE(SMBwriteclose);
5526                 return;
5527         }
5528
5529         if (fsp->print_file == NULL) {
5530                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5531                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5532                     &lock);
5533
5534                 if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
5535                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5536                         END_PROFILE(SMBwriteclose);
5537                         return;
5538                 }
5539         }
5540
5541         nwritten = write_file(req,fsp,data,startpos,numtowrite);
5542
5543         set_close_write_time(fsp, mtime);
5544
5545         /*
5546          * More insanity. W2K only closes the file if writelen > 0.
5547          * JRA.
5548          */
5549
5550         DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5551                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5552                 (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
5553
5554         if (numtowrite) {
5555                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5556                          "file %s\n", fsp_str_dbg(fsp)));
5557                 close_status = close_file(req, fsp, NORMAL_CLOSE);
5558                 fsp = NULL;
5559         }
5560
5561         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5562                 reply_nterror(req, NT_STATUS_DISK_FULL);
5563                 goto out;
5564         }
5565
5566         if(!NT_STATUS_IS_OK(close_status)) {
5567                 reply_nterror(req, close_status);
5568                 goto out;
5569         }
5570
5571         reply_outbuf(req, 1, 0);
5572
5573         SSVAL(req->outbuf,smb_vwv0,nwritten);
5574
5575 out:
5576
5577         END_PROFILE(SMBwriteclose);
5578         return;
5579 }
5580
5581 #undef DBGC_CLASS
5582 #define DBGC_CLASS DBGC_LOCKING
5583
5584 /****************************************************************************
5585  Reply to a lock.
5586 ****************************************************************************/
5587
5588 void reply_lock(struct smb_request *req)
5589 {
5590         connection_struct *conn = req->conn;
5591         uint64_t count,offset;
5592         NTSTATUS status;
5593         files_struct *fsp;
5594         struct byte_range_lock *br_lck = NULL;
5595
5596         START_PROFILE(SMBlock);
5597
5598         if (req->wct < 5) {
5599                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5600                 END_PROFILE(SMBlock);
5601                 return;
5602         }
5603
5604         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5605
5606         if (!check_fsp(conn, req, fsp)) {
5607                 END_PROFILE(SMBlock);
5608                 return;
5609         }
5610
5611         count = (uint64_t)IVAL(req->vwv+1, 0);
5612         offset = (uint64_t)IVAL(req->vwv+3, 0);
5613
5614         DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5615                  fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5616
5617         br_lck = do_lock(req->sconn->msg_ctx,
5618                         fsp,
5619                         (uint64_t)req->smbpid,
5620                         count,
5621                         offset,
5622                         WRITE_LOCK,
5623                         WINDOWS_LOCK,
5624                         False, /* Non-blocking lock. */
5625                         &status,
5626                         NULL);
5627
5628         TALLOC_FREE(br_lck);
5629
5630         if (NT_STATUS_V(status)) {
5631                 reply_nterror(req, status);
5632                 END_PROFILE(SMBlock);
5633                 return;
5634         }
5635
5636         reply_outbuf(req, 0, 0);
5637
5638         END_PROFILE(SMBlock);
5639         return;
5640 }
5641
5642 /****************************************************************************
5643  Reply to a unlock.
5644 ****************************************************************************/
5645
5646 void reply_unlock(struct smb_request *req)
5647 {
5648         connection_struct *conn = req->conn;
5649         uint64_t count,offset;
5650         NTSTATUS status;
5651         files_struct *fsp;
5652
5653         START_PROFILE(SMBunlock);
5654
5655         if (req->wct < 5) {
5656                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5657                 END_PROFILE(SMBunlock);
5658                 return;
5659         }
5660
5661         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5662
5663         if (!check_fsp(conn, req, fsp)) {
5664                 END_PROFILE(SMBunlock);
5665                 return;
5666         }
5667
5668         count = (uint64_t)IVAL(req->vwv+1, 0);
5669         offset = (uint64_t)IVAL(req->vwv+3, 0);
5670
5671         status = do_unlock(req->sconn->msg_ctx,
5672                         fsp,
5673                         (uint64_t)req->smbpid,
5674                         count,
5675                         offset,
5676                         WINDOWS_LOCK);
5677
5678         if (NT_STATUS_V(status)) {
5679                 reply_nterror(req, status);
5680                 END_PROFILE(SMBunlock);
5681                 return;
5682         }
5683
5684         DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5685                     fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5686
5687         reply_outbuf(req, 0, 0);
5688
5689         END_PROFILE(SMBunlock);
5690         return;
5691 }
5692
5693 #undef DBGC_CLASS
5694 #define DBGC_CLASS DBGC_ALL
5695
5696 /****************************************************************************
5697  Reply to a tdis.
5698  conn POINTER CAN BE NULL HERE !
5699 ****************************************************************************/
5700
5701 void reply_tdis(struct smb_request *req)
5702 {
5703         NTSTATUS status;
5704         connection_struct *conn = req->conn;
5705         struct smbXsrv_tcon *tcon;
5706
5707         START_PROFILE(SMBtdis);
5708
5709         if (!conn) {
5710                 DEBUG(4,("Invalid connection in tdis\n"));
5711                 reply_force_doserror(req, ERRSRV, ERRinvnid);
5712                 END_PROFILE(SMBtdis);
5713                 return;
5714         }
5715
5716         tcon = conn->tcon;
5717         req->conn = NULL;
5718
5719         /*
5720          * TODO: cancel all outstanding requests on the tcon
5721          */
5722         status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5723         if (!NT_STATUS_IS_OK(status)) {
5724                 DEBUG(0, ("reply_tdis: "
5725                           "smbXsrv_tcon_disconnect() failed: %s\n",
5726                           nt_errstr(status)));
5727                 /*
5728                  * If we hit this case, there is something completely
5729                  * wrong, so we better disconnect the transport connection.
5730                  */
5731                 END_PROFILE(SMBtdis);
5732                 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5733                 return;
5734         }
5735
5736         TALLOC_FREE(tcon);
5737
5738         reply_outbuf(req, 0, 0);
5739         END_PROFILE(SMBtdis);
5740         return;
5741 }
5742
5743 /****************************************************************************
5744  Reply to a echo.
5745  conn POINTER CAN BE NULL HERE !
5746 ****************************************************************************/
5747
5748 void reply_echo(struct smb_request *req)
5749 {
5750         connection_struct *conn = req->conn;
5751         struct smb_perfcount_data local_pcd;
5752         struct smb_perfcount_data *cur_pcd;
5753         int smb_reverb;
5754         int seq_num;
5755
5756         START_PROFILE(SMBecho);
5757
5758         smb_init_perfcount_data(&local_pcd);
5759
5760         if (req->wct < 1) {
5761                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5762                 END_PROFILE(SMBecho);
5763                 return;
5764         }
5765
5766         smb_reverb = SVAL(req->vwv+0, 0);
5767
5768         reply_outbuf(req, 1, req->buflen);
5769
5770         /* copy any incoming data back out */
5771         if (req->buflen > 0) {
5772                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5773         }
5774
5775         if (smb_reverb > 100) {
5776                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5777                 smb_reverb = 100;
5778         }
5779
5780         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5781
5782                 /* this makes sure we catch the request pcd */
5783                 if (seq_num == smb_reverb) {
5784                         cur_pcd = &req->pcd;
5785                 } else {
5786                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5787                         cur_pcd = &local_pcd;
5788                 }
5789
5790                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5791
5792                 show_msg((char *)req->outbuf);
5793                 if (!srv_send_smb(req->xconn,
5794                                 (char *)req->outbuf,
5795                                 true, req->seqnum+1,
5796                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5797                                 cur_pcd))
5798                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5799         }
5800
5801         DEBUG(3,("echo %d times\n", smb_reverb));
5802
5803         TALLOC_FREE(req->outbuf);
5804
5805         END_PROFILE(SMBecho);
5806         return;
5807 }
5808
5809 /****************************************************************************
5810  Reply to a printopen.
5811 ****************************************************************************/
5812
5813 void reply_printopen(struct smb_request *req)
5814 {
5815         connection_struct *conn = req->conn;
5816         files_struct *fsp;
5817         NTSTATUS status;
5818
5819         START_PROFILE(SMBsplopen);
5820
5821         if (req->wct < 2) {
5822                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5823                 END_PROFILE(SMBsplopen);
5824                 return;
5825         }
5826
5827         if (!CAN_PRINT(conn)) {
5828                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5829                 END_PROFILE(SMBsplopen);
5830                 return;
5831         }
5832
5833         status = file_new(req, conn, &fsp);
5834         if(!NT_STATUS_IS_OK(status)) {
5835                 reply_nterror(req, status);
5836                 END_PROFILE(SMBsplopen);
5837                 return;
5838         }
5839
5840         /* Open for exclusive use, write only. */
5841         status = print_spool_open(fsp, NULL, req->vuid);
5842
5843         if (!NT_STATUS_IS_OK(status)) {
5844                 file_free(req, fsp);
5845                 reply_nterror(req, status);
5846                 END_PROFILE(SMBsplopen);
5847                 return;
5848         }
5849
5850         reply_outbuf(req, 1, 0);
5851         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5852
5853         DEBUG(3,("openprint fd=%d %s\n",
5854                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5855
5856         END_PROFILE(SMBsplopen);
5857         return;
5858 }
5859
5860 /****************************************************************************
5861  Reply to a printclose.
5862 ****************************************************************************/
5863
5864 void reply_printclose(struct smb_request *req)
5865 {
5866         connection_struct *conn = req->conn;
5867         files_struct *fsp;
5868         NTSTATUS status;
5869
5870         START_PROFILE(SMBsplclose);
5871
5872         if (req->wct < 1) {
5873                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5874                 END_PROFILE(SMBsplclose);
5875                 return;
5876         }
5877
5878         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5879
5880         if (!check_fsp(conn, req, fsp)) {
5881                 END_PROFILE(SMBsplclose);
5882                 return;
5883         }
5884
5885         if (!CAN_PRINT(conn)) {
5886                 reply_force_doserror(req, ERRSRV, ERRerror);
5887                 END_PROFILE(SMBsplclose);
5888                 return;
5889         }
5890
5891         DEBUG(3,("printclose fd=%d %s\n",
5892                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5893
5894         status = close_file(req, fsp, NORMAL_CLOSE);
5895
5896         if(!NT_STATUS_IS_OK(status)) {
5897                 reply_nterror(req, status);
5898                 END_PROFILE(SMBsplclose);
5899                 return;
5900         }
5901
5902         reply_outbuf(req, 0, 0);
5903
5904         END_PROFILE(SMBsplclose);
5905         return;
5906 }
5907
5908 /****************************************************************************
5909  Reply to a printqueue.
5910 ****************************************************************************/
5911
5912 void reply_printqueue(struct smb_request *req)
5913 {
5914         connection_struct *conn = req->conn;
5915         int max_count;
5916         int start_index;
5917
5918         START_PROFILE(SMBsplretq);
5919
5920         if (req->wct < 2) {
5921                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5922                 END_PROFILE(SMBsplretq);
5923                 return;
5924         }
5925
5926         max_count = SVAL(req->vwv+0, 0);
5927         start_index = SVAL(req->vwv+1, 0);
5928
5929         /* we used to allow the client to get the cnum wrong, but that
5930            is really quite gross and only worked when there was only
5931            one printer - I think we should now only accept it if they
5932            get it right (tridge) */
5933         if (!CAN_PRINT(conn)) {
5934                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5935                 END_PROFILE(SMBsplretq);
5936                 return;
5937         }
5938
5939         reply_outbuf(req, 2, 3);
5940         SSVAL(req->outbuf,smb_vwv0,0);
5941         SSVAL(req->outbuf,smb_vwv1,0);
5942         SCVAL(smb_buf(req->outbuf),0,1);
5943         SSVAL(smb_buf(req->outbuf),1,0);
5944
5945         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5946                  start_index, max_count));
5947
5948         {
5949                 TALLOC_CTX *mem_ctx = talloc_tos();
5950                 NTSTATUS status;
5951                 WERROR werr;
5952                 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5953                 struct rpc_pipe_client *cli = NULL;
5954                 struct dcerpc_binding_handle *b = NULL;
5955                 struct policy_handle handle;
5956                 struct spoolss_DevmodeContainer devmode_ctr;
5957                 union spoolss_JobInfo *info;
5958                 uint32_t count;
5959                 uint32_t num_to_get;
5960                 uint32_t first;
5961                 uint32_t i;
5962
5963                 ZERO_STRUCT(handle);
5964
5965                 status = rpc_pipe_open_interface(mem_ctx,
5966                                                  &ndr_table_spoolss,
5967                                                  conn->session_info,
5968                                                  conn->sconn->remote_address,
5969                                                  conn->sconn->local_address,
5970                                                  conn->sconn->msg_ctx,
5971                                                  &cli);
5972                 if (!NT_STATUS_IS_OK(status)) {
5973                         DEBUG(0, ("reply_printqueue: "
5974                                   "could not connect to spoolss: %s\n",
5975                                   nt_errstr(status)));
5976                         reply_nterror(req, status);
5977                         goto out;
5978                 }
5979                 b = cli->binding_handle;
5980
5981                 ZERO_STRUCT(devmode_ctr);
5982
5983                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5984                                                 sharename,
5985                                                 NULL, devmode_ctr,
5986                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5987                                                 &handle,
5988                                                 &werr);
5989                 if (!NT_STATUS_IS_OK(status)) {
5990                         reply_nterror(req, status);
5991                         goto out;
5992                 }
5993                 if (!W_ERROR_IS_OK(werr)) {
5994                         reply_nterror(req, werror_to_ntstatus(werr));
5995                         goto out;
5996                 }
5997
5998                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5999                                                &handle,
6000                                                0, /* firstjob */
6001                                                0xff, /* numjobs */
6002                                                2, /* level */
6003                                                0, /* offered */
6004                                                &count,
6005                                                &info);
6006                 if (!W_ERROR_IS_OK(werr)) {
6007                         reply_nterror(req, werror_to_ntstatus(werr));
6008                         goto out;
6009                 }
6010
6011                 if (max_count > 0) {
6012                         first = start_index;
6013                 } else {
6014                         first = start_index + max_count + 1;
6015                 }
6016
6017                 if (first >= count) {
6018                         num_to_get = first;
6019                 } else {
6020                         num_to_get = first + MIN(ABS(max_count), count - first);
6021                 }
6022
6023                 for (i = first; i < num_to_get; i++) {
6024                         char blob[28];
6025                         char *p = blob;
6026                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
6027                         int qstatus;
6028                         size_t len = 0;
6029                         uint16_t qrapjobid = pjobid_to_rap(sharename,
6030                                                         info[i].info2.job_id);
6031
6032                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
6033                                 qstatus = 2;
6034                         } else {
6035                                 qstatus = 3;
6036                         }
6037
6038                         srv_put_dos_date2(p, 0, qtime);
6039                         SCVAL(p, 4, qstatus);
6040                         SSVAL(p, 5, qrapjobid);
6041                         SIVAL(p, 7, info[i].info2.size);
6042                         SCVAL(p, 11, 0);
6043                         status = srvstr_push(blob, req->flags2, p+12,
6044                                     info[i].info2.notify_name, 16, STR_ASCII, &len);
6045                         if (!NT_STATUS_IS_OK(status)) {
6046                                 reply_nterror(req, status);
6047                                 goto out;
6048                         }
6049                         if (message_push_blob(
6050                                     &req->outbuf,
6051                                     data_blob_const(
6052                                             blob, sizeof(blob))) == -1) {
6053                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6054                                 goto out;
6055                         }
6056                 }
6057
6058                 if (count > 0) {
6059                         SSVAL(req->outbuf,smb_vwv0,count);
6060                         SSVAL(req->outbuf,smb_vwv1,
6061                               (max_count>0?first+count:first-1));
6062                         SCVAL(smb_buf(req->outbuf),0,1);
6063                         SSVAL(smb_buf(req->outbuf),1,28*count);
6064                 }
6065
6066
6067                 DEBUG(3, ("%u entries returned in queue\n",
6068                           (unsigned)count));
6069
6070 out:
6071                 if (b && is_valid_policy_hnd(&handle)) {
6072                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
6073                 }
6074
6075         }
6076
6077         END_PROFILE(SMBsplretq);
6078         return;
6079 }
6080
6081 /****************************************************************************
6082  Reply to a printwrite.
6083 ****************************************************************************/
6084
6085 void reply_printwrite(struct smb_request *req)
6086 {
6087         connection_struct *conn = req->conn;
6088         int numtowrite;
6089         const char *data;
6090         files_struct *fsp;
6091
6092         START_PROFILE(SMBsplwr);
6093
6094         if (req->wct < 1) {
6095                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6096                 END_PROFILE(SMBsplwr);
6097                 return;
6098         }
6099
6100         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
6101
6102         if (!check_fsp(conn, req, fsp)) {
6103                 END_PROFILE(SMBsplwr);
6104                 return;
6105         }
6106
6107         if (!fsp->print_file) {
6108                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
6109                 END_PROFILE(SMBsplwr);
6110                 return;
6111         }
6112
6113         if (!CHECK_WRITE(fsp)) {
6114                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
6115                 END_PROFILE(SMBsplwr);
6116                 return;
6117         }
6118
6119         numtowrite = SVAL(req->buf, 1);
6120
6121         /*
6122          * This already protects us against CVE-2017-12163.
6123          */
6124         if (req->buflen < numtowrite + 3) {
6125                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6126                 END_PROFILE(SMBsplwr);
6127                 return;
6128         }
6129
6130         data = (const char *)req->buf + 3;
6131
6132         if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
6133                 reply_nterror(req, map_nt_error_from_unix(errno));
6134                 END_PROFILE(SMBsplwr);
6135                 return;
6136         }
6137
6138         DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
6139
6140         END_PROFILE(SMBsplwr);
6141         return;
6142 }
6143
6144 /****************************************************************************
6145  Reply to a mkdir.
6146 ****************************************************************************/
6147
6148 void reply_mkdir(struct smb_request *req)
6149 {
6150         connection_struct *conn = req->conn;
6151         struct smb_filename *smb_dname = NULL;
6152         char *directory = NULL;
6153         NTSTATUS status;
6154         uint32_t ucf_flags;
6155         TALLOC_CTX *ctx = talloc_tos();
6156
6157         START_PROFILE(SMBmkdir);
6158
6159         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
6160                             STR_TERMINATE, &status);
6161         if (!NT_STATUS_IS_OK(status)) {
6162                 reply_nterror(req, status);
6163                 goto out;
6164         }
6165
6166         ucf_flags = filename_create_ucf_flags(req, FILE_CREATE);
6167         status = filename_convert(ctx, conn,
6168                                  directory,
6169                                  ucf_flags,
6170                                  NULL,
6171                                  &smb_dname);
6172         if (!NT_STATUS_IS_OK(status)) {
6173                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6174                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6175                                         ERRSRV, ERRbadpath);
6176                         goto out;
6177                 }
6178                 reply_nterror(req, status);
6179                 goto out;
6180         }
6181
6182         status = create_directory(conn, req, smb_dname);
6183
6184         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
6185
6186         if (!NT_STATUS_IS_OK(status)) {
6187
6188                 if (!use_nt_status()
6189                     && NT_STATUS_EQUAL(status,
6190                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
6191                         /*
6192                          * Yes, in the DOS error code case we get a
6193                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
6194                          * samba4 torture test.
6195                          */
6196                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
6197                 }
6198
6199                 reply_nterror(req, status);
6200                 goto out;
6201         }
6202
6203         reply_outbuf(req, 0, 0);
6204
6205         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
6206  out:
6207         TALLOC_FREE(smb_dname);
6208         END_PROFILE(SMBmkdir);
6209         return;
6210 }
6211
6212 /****************************************************************************
6213  Reply to a rmdir.
6214 ****************************************************************************/
6215
6216 void reply_rmdir(struct smb_request *req)
6217 {
6218         connection_struct *conn = req->conn;
6219         struct smb_filename *smb_dname = NULL;
6220         char *directory = NULL;
6221         NTSTATUS status;
6222         TALLOC_CTX *ctx = talloc_tos();
6223         files_struct *fsp = NULL;
6224         int info = 0;
6225         uint32_t ucf_flags = ucf_flags_from_smb_request(req);
6226         struct smbd_server_connection *sconn = req->sconn;
6227
6228         START_PROFILE(SMBrmdir);
6229
6230         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
6231                             STR_TERMINATE, &status);
6232         if (!NT_STATUS_IS_OK(status)) {
6233                 reply_nterror(req, status);
6234                 goto out;
6235         }
6236
6237         status = filename_convert(ctx, conn,
6238                                  directory,
6239                                  ucf_flags,
6240                                  NULL,
6241                                  &smb_dname);
6242         if (!NT_STATUS_IS_OK(status)) {
6243                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6244                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6245                                         ERRSRV, ERRbadpath);
6246                         goto out;
6247                 }
6248                 reply_nterror(req, status);
6249                 goto out;
6250         }
6251
6252         if (is_ntfs_stream_smb_fname(smb_dname)) {
6253                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
6254                 goto out;
6255         }
6256
6257         status = SMB_VFS_CREATE_FILE(
6258                 conn,                                   /* conn */
6259                 req,                                    /* req */
6260                 0,                                      /* root_dir_fid */
6261                 smb_dname,                              /* fname */
6262                 DELETE_ACCESS,                          /* access_mask */
6263                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
6264                         FILE_SHARE_DELETE),
6265                 FILE_OPEN,                              /* create_disposition*/
6266                 FILE_DIRECTORY_FILE,                    /* create_options */
6267                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
6268                 0,                                      /* oplock_request */
6269                 NULL,                                   /* lease */
6270                 0,                                      /* allocation_size */
6271                 0,                                      /* private_flags */
6272                 NULL,                                   /* sd */
6273                 NULL,                                   /* ea_list */
6274                 &fsp,                                   /* result */
6275                 &info,                                  /* pinfo */
6276                 NULL, NULL);                            /* create context */
6277
6278         if (!NT_STATUS_IS_OK(status)) {
6279                 if (open_was_deferred(req->xconn, req->mid)) {
6280                         /* We have re-scheduled this call. */
6281                         goto out;
6282                 }
6283                 reply_nterror(req, status);
6284                 goto out;
6285         }
6286
6287         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
6288         if (!NT_STATUS_IS_OK(status)) {
6289                 close_file(req, fsp, ERROR_CLOSE);
6290                 reply_nterror(req, status);
6291                 goto out;
6292         }
6293
6294         if (!set_delete_on_close(fsp, true,
6295                         conn->session_info->security_token,
6296                         conn->session_info->unix_token)) {
6297                 close_file(req, fsp, ERROR_CLOSE);
6298                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
6299                 goto out;
6300         }
6301
6302         status = close_file(req, fsp, NORMAL_CLOSE);
6303         if (!NT_STATUS_IS_OK(status)) {
6304                 reply_nterror(req, status);
6305         } else {
6306                 reply_outbuf(req, 0, 0);
6307         }
6308
6309         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
6310
6311         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
6312  out:
6313         TALLOC_FREE(smb_dname);
6314         END_PROFILE(SMBrmdir);
6315         return;
6316 }
6317
6318 /*******************************************************************
6319  Resolve wildcards in a filename rename.
6320 ********************************************************************/
6321
6322 static bool resolve_wildcards(TALLOC_CTX *ctx,
6323                                 const char *name1,
6324                                 const char *name2,
6325                                 char **pp_newname)
6326 {
6327         char *name2_copy = NULL;
6328         char *root1 = NULL;
6329         char *root2 = NULL;
6330         char *ext1 = NULL;
6331         char *ext2 = NULL;
6332         char *p,*p2, *pname1, *pname2;
6333
6334         name2_copy = talloc_strdup(ctx, name2);
6335         if (!name2_copy) {
6336                 return False;
6337         }
6338
6339         pname1 = strrchr_m(name1,'/');
6340         pname2 = strrchr_m(name2_copy,'/');
6341
6342         if (!pname1 || !pname2) {
6343                 return False;
6344         }
6345
6346         /* Truncate the copy of name2 at the last '/' */
6347         *pname2 = '\0';
6348
6349         /* Now go past the '/' */
6350         pname1++;
6351         pname2++;
6352
6353         root1 = talloc_strdup(ctx, pname1);
6354         root2 = talloc_strdup(ctx, pname2);
6355
6356         if (!root1 || !root2) {
6357                 return False;
6358         }
6359
6360         p = strrchr_m(root1,'.');
6361         if (p) {
6362                 *p = 0;
6363                 ext1 = talloc_strdup(ctx, p+1);
6364         } else {
6365                 ext1 = talloc_strdup(ctx, "");
6366         }
6367         p = strrchr_m(root2,'.');
6368         if (p) {
6369                 *p = 0;
6370                 ext2 = talloc_strdup(ctx, p+1);
6371         } else {
6372                 ext2 = talloc_strdup(ctx, "");
6373         }
6374
6375         if (!ext1 || !ext2) {
6376                 return False;
6377         }
6378
6379         p = root1;
6380         p2 = root2;
6381         while (*p2) {
6382                 if (*p2 == '?') {
6383                         /* Hmmm. Should this be mb-aware ? */
6384                         *p2 = *p;
6385                         p2++;
6386                 } else if (*p2 == '*') {
6387                         *p2 = '\0';
6388                         root2 = talloc_asprintf(ctx, "%s%s",
6389                                                 root2,
6390                                                 p);
6391                         if (!root2) {
6392                                 return False;
6393                         }
6394                         break;
6395                 } else {
6396                         p2++;
6397                 }
6398                 if (*p) {
6399                         p++;
6400                 }
6401         }
6402
6403         p = ext1;
6404         p2 = ext2;
6405         while (*p2) {
6406                 if (*p2 == '?') {
6407                         /* Hmmm. Should this be mb-aware ? */
6408                         *p2 = *p;
6409                         p2++;
6410                 } else if (*p2 == '*') {
6411                         *p2 = '\0';
6412                         ext2 = talloc_asprintf(ctx, "%s%s",
6413                                                 ext2,
6414                                                 p);
6415                         if (!ext2) {
6416                                 return False;
6417                         }
6418                         break;
6419                 } else {
6420                         p2++;
6421                 }
6422                 if (*p) {
6423                         p++;
6424                 }
6425         }
6426
6427         if (*ext2) {
6428                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6429                                 name2_copy,
6430                                 root2,
6431                                 ext2);
6432         } else {
6433                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6434                                 name2_copy,
6435                                 root2);
6436         }
6437
6438         if (!*pp_newname) {
6439                 return False;
6440         }
6441
6442         return True;
6443 }
6444
6445 /****************************************************************************
6446  Ensure open files have their names updated. Updated to notify other smbd's
6447  asynchronously.
6448 ****************************************************************************/
6449
6450 static void rename_open_files(connection_struct *conn,
6451                               struct share_mode_lock *lck,
6452                               struct file_id id,
6453                               uint32_t orig_name_hash,
6454                               const struct smb_filename *smb_fname_dst)
6455 {
6456         files_struct *fsp;
6457         bool did_rename = False;
6458         NTSTATUS status;
6459         uint32_t new_name_hash = 0;
6460
6461         for(fsp = file_find_di_first(conn->sconn, id); fsp;
6462             fsp = file_find_di_next(fsp)) {
6463                 /* fsp_name is a relative path under the fsp. To change this for other
6464                    sharepaths we need to manipulate relative paths. */
6465                 /* TODO - create the absolute path and manipulate the newname
6466                    relative to the sharepath. */
6467                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6468                         continue;
6469                 }
6470                 if (fsp->name_hash != orig_name_hash) {
6471                         continue;
6472                 }
6473                 DEBUG(10, ("rename_open_files: renaming file %s "
6474                            "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6475                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6476                            smb_fname_str_dbg(smb_fname_dst)));
6477
6478                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6479                 if (NT_STATUS_IS_OK(status)) {
6480                         did_rename = True;
6481                         new_name_hash = fsp->name_hash;
6482                 }
6483         }
6484
6485         if (!did_rename) {
6486                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6487                            "for %s\n", file_id_string_tos(&id),
6488                            smb_fname_str_dbg(smb_fname_dst)));
6489         }
6490
6491         /* Send messages to all smbd's (not ourself) that the name has changed. */
6492         rename_share_filename(conn->sconn->msg_ctx, lck, id, conn->connectpath,
6493                               orig_name_hash, new_name_hash,
6494                               smb_fname_dst);
6495
6496 }
6497
6498 /****************************************************************************
6499  We need to check if the source path is a parent directory of the destination
6500  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6501  refuse the rename with a sharing violation. Under UNIX the above call can
6502  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6503  probably need to check that the client is a Windows one before disallowing
6504  this as a UNIX client (one with UNIX extensions) can know the source is a
6505  symlink and make this decision intelligently. Found by an excellent bug
6506  report from <AndyLiebman@aol.com>.
6507 ****************************************************************************/
6508
6509 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6510                                      const struct smb_filename *smb_fname_dst)
6511 {
6512         const char *psrc = smb_fname_src->base_name;
6513         const char *pdst = smb_fname_dst->base_name;
6514         size_t slen;
6515
6516         if (psrc[0] == '.' && psrc[1] == '/') {
6517                 psrc += 2;
6518         }
6519         if (pdst[0] == '.' && pdst[1] == '/') {
6520                 pdst += 2;
6521         }
6522         if ((slen = strlen(psrc)) > strlen(pdst)) {
6523                 return False;
6524         }
6525         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6526 }
6527
6528 /*
6529  * Do the notify calls from a rename
6530  */
6531
6532 static void notify_rename(connection_struct *conn, bool is_dir,
6533                           const struct smb_filename *smb_fname_src,
6534                           const struct smb_filename *smb_fname_dst)
6535 {
6536         char *parent_dir_src = NULL;
6537         char *parent_dir_dst = NULL;
6538         uint32_t mask;
6539
6540         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6541                 : FILE_NOTIFY_CHANGE_FILE_NAME;
6542
6543         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6544                             &parent_dir_src, NULL) ||
6545             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6546                             &parent_dir_dst, NULL)) {
6547                 goto out;
6548         }
6549
6550         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6551                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6552                              smb_fname_src->base_name);
6553                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6554                              smb_fname_dst->base_name);
6555         }
6556         else {
6557                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6558                              smb_fname_src->base_name);
6559                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6560                              smb_fname_dst->base_name);
6561         }
6562
6563         /* this is a strange one. w2k3 gives an additional event for
6564            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6565            files, but not directories */
6566         if (!is_dir) {
6567                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6568                              FILE_NOTIFY_CHANGE_ATTRIBUTES
6569                              |FILE_NOTIFY_CHANGE_CREATION,
6570                              smb_fname_dst->base_name);
6571         }
6572  out:
6573         TALLOC_FREE(parent_dir_src);
6574         TALLOC_FREE(parent_dir_dst);
6575 }
6576
6577 /****************************************************************************
6578  Returns an error if the parent directory for a filename is open in an
6579  incompatible way.
6580 ****************************************************************************/
6581
6582 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6583                                         const struct smb_filename *smb_fname_dst_in)
6584 {
6585         char *parent_dir = NULL;
6586         struct smb_filename smb_fname_parent;
6587         struct file_id id;
6588         files_struct *fsp = NULL;
6589         int ret;
6590
6591         if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6592                         &parent_dir, NULL)) {
6593                 return NT_STATUS_NO_MEMORY;
6594         }
6595         ZERO_STRUCT(smb_fname_parent);
6596         smb_fname_parent.base_name = parent_dir;
6597
6598         ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6599         if (ret == -1) {
6600                 return map_nt_error_from_unix(errno);
6601         }
6602
6603         /*
6604          * We're only checking on this smbd here, mostly good
6605          * enough.. and will pass tests.
6606          */
6607
6608         id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6609         for (fsp = file_find_di_first(conn->sconn, id); fsp;
6610                         fsp = file_find_di_next(fsp)) {
6611                 if (fsp->access_mask & DELETE_ACCESS) {
6612                         return NT_STATUS_SHARING_VIOLATION;
6613                 }
6614         }
6615         return NT_STATUS_OK;
6616 }
6617
6618 /****************************************************************************
6619  Rename an open file - given an fsp.
6620 ****************************************************************************/
6621
6622 NTSTATUS rename_internals_fsp(connection_struct *conn,
6623                         files_struct *fsp,
6624                         const struct smb_filename *smb_fname_dst_in,
6625                         uint32_t attrs,
6626                         bool replace_if_exists)
6627 {
6628         TALLOC_CTX *ctx = talloc_tos();
6629         struct smb_filename *smb_fname_dst = NULL;
6630         NTSTATUS status = NT_STATUS_OK;
6631         struct share_mode_lock *lck = NULL;
6632         uint32_t access_mask = SEC_DIR_ADD_FILE;
6633         bool dst_exists, old_is_stream, new_is_stream;
6634
6635         status = check_name(conn, smb_fname_dst_in);
6636         if (!NT_STATUS_IS_OK(status)) {
6637                 return status;
6638         }
6639
6640         status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6641         if (!NT_STATUS_IS_OK(status)) {
6642                 return status;
6643         }
6644
6645         /* Make a copy of the dst smb_fname structs */
6646
6647         smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6648         if (smb_fname_dst == NULL) {
6649                 status = NT_STATUS_NO_MEMORY;
6650                 goto out;
6651         }
6652
6653         /*
6654          * Check for special case with case preserving and not
6655          * case sensitive. If the new last component differs from the original
6656          * last component only by case, then we should allow
6657          * the rename (user is trying to change the case of the
6658          * filename).
6659          */
6660         if (!conn->case_sensitive && conn->case_preserve &&
6661             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6662             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6663                 char *fname_dst_parent = NULL;
6664                 const char *fname_dst_lcomp = NULL;
6665                 char *orig_lcomp_path = NULL;
6666                 char *orig_lcomp_stream = NULL;
6667                 bool ok = true;
6668
6669                 /*
6670                  * Split off the last component of the processed
6671                  * destination name. We will compare this to
6672                  * the split components of smb_fname_dst->original_lcomp.
6673                  */
6674                 if (!parent_dirname(ctx,
6675                                 smb_fname_dst->base_name,
6676                                 &fname_dst_parent,
6677                                 &fname_dst_lcomp)) {
6678                         status = NT_STATUS_NO_MEMORY;
6679                         goto out;
6680                 }
6681
6682                 /*
6683                  * The original_lcomp component contains
6684                  * the last_component of the path + stream
6685                  * name (if a stream exists).
6686                  *
6687                  * Split off the stream name so we
6688                  * can check them separately.
6689                  */
6690
6691                 if (fsp->posix_flags & FSP_POSIX_FLAGS_PATHNAMES) {
6692                         /* POSIX - no stream component. */
6693                         orig_lcomp_path = talloc_strdup(ctx,
6694                                                 smb_fname_dst->original_lcomp);
6695                         if (orig_lcomp_path == NULL) {
6696                                 ok = false;
6697                         }
6698                 } else {
6699                         ok = split_stream_filename(ctx,
6700                                         smb_fname_dst->original_lcomp,
6701                                         &orig_lcomp_path,
6702                                         &orig_lcomp_stream);
6703                 }
6704
6705                 if (!ok) {
6706                         TALLOC_FREE(fname_dst_parent);
6707                         status = NT_STATUS_NO_MEMORY;
6708                         goto out;
6709                 }
6710
6711                 /* If the base names only differ by case, use original. */
6712                 if(!strcsequal(fname_dst_lcomp, orig_lcomp_path)) {
6713                         char *tmp;
6714                         /*
6715                          * Replace the modified last component with the
6716                          * original.
6717                          */
6718                         if (!ISDOT(fname_dst_parent)) {
6719                                 tmp = talloc_asprintf(smb_fname_dst,
6720                                         "%s/%s",
6721                                         fname_dst_parent,
6722                                         orig_lcomp_path);
6723                         } else {
6724                                 tmp = talloc_strdup(smb_fname_dst,
6725                                         orig_lcomp_path);
6726                         }
6727                         if (tmp == NULL) {
6728                                 status = NT_STATUS_NO_MEMORY;
6729                                 TALLOC_FREE(fname_dst_parent);
6730                                 TALLOC_FREE(orig_lcomp_path);
6731                                 TALLOC_FREE(orig_lcomp_stream);
6732                                 goto out;
6733                         }
6734                         TALLOC_FREE(smb_fname_dst->base_name);
6735                         smb_fname_dst->base_name = tmp;
6736                 }
6737
6738                 /* If the stream_names only differ by case, use original. */
6739                 if(!strcsequal(smb_fname_dst->stream_name,
6740                                orig_lcomp_stream)) {
6741                         /* Use the original stream. */
6742                         char *tmp = talloc_strdup(smb_fname_dst,
6743                                             orig_lcomp_stream);
6744                         if (tmp == NULL) {
6745                                 status = NT_STATUS_NO_MEMORY;
6746                                 TALLOC_FREE(fname_dst_parent);
6747                                 TALLOC_FREE(orig_lcomp_path);
6748                                 TALLOC_FREE(orig_lcomp_stream);
6749                                 goto out;
6750                         }
6751                         TALLOC_FREE(smb_fname_dst->stream_name);
6752                         smb_fname_dst->stream_name = tmp;
6753                 }
6754                 TALLOC_FREE(fname_dst_parent);
6755                 TALLOC_FREE(orig_lcomp_path);
6756                 TALLOC_FREE(orig_lcomp_stream);
6757         }
6758
6759         /*
6760          * If the src and dest names are identical - including case,
6761          * don't do the rename, just return success.
6762          */
6763
6764         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6765             strcsequal(fsp->fsp_name->stream_name,
6766                        smb_fname_dst->stream_name)) {
6767                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6768                           "- returning success\n",
6769                           smb_fname_str_dbg(smb_fname_dst)));
6770                 status = NT_STATUS_OK;
6771                 goto out;
6772         }
6773
6774         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6775         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6776
6777         /* Return the correct error code if both names aren't streams. */
6778         if (!old_is_stream && new_is_stream) {
6779                 status = NT_STATUS_OBJECT_NAME_INVALID;
6780                 goto out;
6781         }
6782
6783         if (old_is_stream && !new_is_stream) {
6784                 status = NT_STATUS_INVALID_PARAMETER;
6785                 goto out;
6786         }
6787
6788         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6789
6790         if(!replace_if_exists && dst_exists) {
6791                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6792                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6793                           smb_fname_str_dbg(smb_fname_dst)));
6794                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6795                 goto out;
6796         }
6797
6798         if (dst_exists) {
6799                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6800                     &smb_fname_dst->st);
6801                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6802                                                            fileid);
6803                 /* The file can be open when renaming a stream */
6804                 if (dst_fsp && !new_is_stream) {
6805                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6806                         status = NT_STATUS_ACCESS_DENIED;
6807                         goto out;
6808                 }
6809         }
6810
6811         /* Ensure we have a valid stat struct for the source. */
6812         status = vfs_stat_fsp(fsp);
6813         if (!NT_STATUS_IS_OK(status)) {
6814                 goto out;
6815         }
6816
6817         status = can_rename(conn, fsp, attrs);
6818
6819         if (!NT_STATUS_IS_OK(status)) {
6820                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6821                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6822                           smb_fname_str_dbg(smb_fname_dst)));
6823                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6824                         status = NT_STATUS_ACCESS_DENIED;
6825                 goto out;
6826         }
6827
6828         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6829                 status = NT_STATUS_ACCESS_DENIED;
6830                 goto out;
6831         }
6832
6833         /* Do we have rights to move into the destination ? */
6834         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
6835                 /* We're moving a directory. */
6836                 access_mask = SEC_DIR_ADD_SUBDIR;
6837         }
6838         status = check_parent_access(conn,
6839                                 smb_fname_dst,
6840                                 access_mask);
6841         if (!NT_STATUS_IS_OK(status)) {
6842                 DBG_INFO("check_parent_access on "
6843                         "dst %s returned %s\n",
6844                         smb_fname_str_dbg(smb_fname_dst),
6845                         nt_errstr(status));
6846                 goto out;
6847         }
6848
6849         lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6850
6851         /*
6852          * We have the file open ourselves, so not being able to get the
6853          * corresponding share mode lock is a fatal error.
6854          */
6855
6856         SMB_ASSERT(lck != NULL);
6857
6858         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6859                 uint32_t create_options = fsp->fh->private_options;
6860
6861                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6862                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6863                           smb_fname_str_dbg(smb_fname_dst)));
6864
6865                 if (!fsp->is_directory &&
6866                     !(fsp->posix_flags & FSP_POSIX_FLAGS_PATHNAMES) &&
6867                     (lp_map_archive(SNUM(conn)) ||
6868                     lp_store_dos_attributes(SNUM(conn)))) {
6869                         /* We must set the archive bit on the newly
6870                            renamed file. */
6871                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6872                                 uint32_t old_dosmode = dos_mode(conn,
6873                                                         smb_fname_dst);
6874                                 file_set_dosmode(conn,
6875                                         smb_fname_dst,
6876                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6877                                         NULL,
6878                                         true);
6879                         }
6880                 }
6881
6882                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6883                               smb_fname_dst);
6884
6885                 rename_open_files(conn, lck, fsp->file_id, fsp->name_hash,
6886                                   smb_fname_dst);
6887
6888                 /*
6889                  * A rename acts as a new file create w.r.t. allowing an initial delete
6890                  * on close, probably because in Windows there is a new handle to the
6891                  * new file. If initial delete on close was requested but not
6892                  * originally set, we need to set it here. This is probably not 100% correct,
6893                  * but will work for the CIFSFS client which in non-posix mode
6894                  * depends on these semantics. JRA.
6895                  */
6896
6897                 if (create_options & FILE_DELETE_ON_CLOSE) {
6898                         status = can_set_delete_on_close(fsp, 0);
6899
6900                         if (NT_STATUS_IS_OK(status)) {
6901                                 /* Note that here we set the *inital* delete on close flag,
6902                                  * not the regular one. The magic gets handled in close. */
6903                                 fsp->initial_delete_on_close = True;
6904                         }
6905                 }
6906                 TALLOC_FREE(lck);
6907                 status = NT_STATUS_OK;
6908                 goto out;
6909         }
6910
6911         TALLOC_FREE(lck);
6912
6913         if (errno == ENOTDIR || errno == EISDIR) {
6914                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6915         } else {
6916                 status = map_nt_error_from_unix(errno);
6917         }
6918
6919         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6920                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6921                   smb_fname_str_dbg(smb_fname_dst)));
6922
6923  out:
6924         TALLOC_FREE(smb_fname_dst);
6925
6926         return status;
6927 }
6928
6929 /****************************************************************************
6930  The guts of the rename command, split out so it may be called by the NT SMB
6931  code.
6932 ****************************************************************************/
6933
6934 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6935                         connection_struct *conn,
6936                         struct smb_request *req,
6937                         struct smb_filename *smb_fname_src,
6938                         struct smb_filename *smb_fname_dst,
6939                         uint32_t attrs,
6940                         bool replace_if_exists,
6941                         bool src_has_wild,
6942                         bool dest_has_wild,
6943                         uint32_t access_mask)
6944 {
6945         char *fname_src_dir = NULL;
6946         struct smb_filename *smb_fname_src_dir = NULL;
6947         char *fname_src_mask = NULL;
6948         int count=0;
6949         NTSTATUS status = NT_STATUS_OK;
6950         struct smb_Dir *dir_hnd = NULL;
6951         const char *dname = NULL;
6952         char *talloced = NULL;
6953         long offset = 0;
6954         int create_options = 0;
6955         bool posix_pathnames = (req != NULL && req->posix_pathnames);
6956         int rc;
6957
6958         /*
6959          * Split the old name into directory and last component
6960          * strings. Note that unix_convert may have stripped off a
6961          * leading ./ from both name and newname if the rename is
6962          * at the root of the share. We need to make sure either both
6963          * name and newname contain a / character or neither of them do
6964          * as this is checked in resolve_wildcards().
6965          */
6966
6967         /* Split up the directory from the filename/mask. */
6968         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6969                                       &fname_src_dir, &fname_src_mask);
6970         if (!NT_STATUS_IS_OK(status)) {
6971                 status = NT_STATUS_NO_MEMORY;
6972                 goto out;
6973         }
6974
6975         /*
6976          * We should only check the mangled cache
6977          * here if unix_convert failed. This means
6978          * that the path in 'mask' doesn't exist
6979          * on the file system and so we need to look
6980          * for a possible mangle. This patch from
6981          * Tine Smukavec <valentin.smukavec@hermes.si>.
6982          */
6983
6984         if (!VALID_STAT(smb_fname_src->st) &&
6985             mangle_is_mangled(fname_src_mask, conn->params)) {
6986                 char *new_mask = NULL;
6987                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6988                                             conn->params);
6989                 if (new_mask) {
6990                         TALLOC_FREE(fname_src_mask);
6991                         fname_src_mask = new_mask;
6992                 }
6993         }
6994
6995         if (!src_has_wild) {
6996                 files_struct *fsp;
6997
6998                 /*
6999                  * Only one file needs to be renamed. Append the mask back
7000                  * onto the directory.
7001                  */
7002                 TALLOC_FREE(smb_fname_src->base_name);
7003                 if (ISDOT(fname_src_dir)) {
7004                         /* Ensure we use canonical names on open. */
7005                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7006                                                         "%s",
7007                                                         fname_src_mask);
7008                 } else {
7009                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7010                                                         "%s/%s",
7011                                                         fname_src_dir,
7012                                                         fname_src_mask);
7013                 }
7014                 if (!smb_fname_src->base_name) {
7015                         status = NT_STATUS_NO_MEMORY;
7016                         goto out;
7017                 }
7018
7019                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
7020                           "case_preserve = %d, short case preserve = %d, "
7021                           "directory = %s, newname = %s, "
7022                           "last_component_dest = %s\n",
7023                           conn->case_sensitive, conn->case_preserve,
7024                           conn->short_case_preserve,
7025                           smb_fname_str_dbg(smb_fname_src),
7026                           smb_fname_str_dbg(smb_fname_dst),
7027                           smb_fname_dst->original_lcomp));
7028
7029                 /* The dest name still may have wildcards. */
7030                 if (dest_has_wild) {
7031                         char *fname_dst_mod = NULL;
7032                         if (!resolve_wildcards(smb_fname_dst,
7033                                                smb_fname_src->base_name,
7034                                                smb_fname_dst->base_name,
7035                                                &fname_dst_mod)) {
7036                                 DEBUG(6, ("rename_internals: resolve_wildcards "
7037                                           "%s %s failed\n",
7038                                           smb_fname_src->base_name,
7039                                           smb_fname_dst->base_name));
7040                                 status = NT_STATUS_NO_MEMORY;
7041                                 goto out;
7042                         }
7043                         TALLOC_FREE(smb_fname_dst->base_name);
7044                         smb_fname_dst->base_name = fname_dst_mod;
7045                 }
7046
7047                 ZERO_STRUCT(smb_fname_src->st);
7048                 if (posix_pathnames) {
7049                         rc = SMB_VFS_LSTAT(conn, smb_fname_src);
7050                 } else {
7051                         rc = SMB_VFS_STAT(conn, smb_fname_src);
7052                 }
7053                 if (rc == -1) {
7054                         status = map_nt_error_from_unix_common(errno);
7055                         goto out;
7056                 }
7057
7058                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
7059                         create_options |= FILE_DIRECTORY_FILE;
7060                 }
7061
7062                 status = SMB_VFS_CREATE_FILE(
7063                         conn,                           /* conn */
7064                         req,                            /* req */
7065                         0,                              /* root_dir_fid */
7066                         smb_fname_src,                  /* fname */
7067                         access_mask,                    /* access_mask */
7068                         (FILE_SHARE_READ |              /* share_access */
7069                             FILE_SHARE_WRITE),
7070                         FILE_OPEN,                      /* create_disposition*/
7071                         create_options,                 /* create_options */
7072                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
7073                         0,                              /* oplock_request */
7074                         NULL,                           /* lease */
7075                         0,                              /* allocation_size */
7076                         0,                              /* private_flags */
7077                         NULL,                           /* sd */
7078                         NULL,                           /* ea_list */
7079                         &fsp,                           /* result */
7080                         NULL,                           /* pinfo */
7081                         NULL, NULL);                    /* create context */
7082
7083                 if (!NT_STATUS_IS_OK(status)) {
7084                         DEBUG(3, ("Could not open rename source %s: %s\n",
7085                                   smb_fname_str_dbg(smb_fname_src),
7086                                   nt_errstr(status)));
7087                         goto out;
7088                 }
7089
7090                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
7091                                               attrs, replace_if_exists);
7092
7093                 close_file(req, fsp, NORMAL_CLOSE);
7094
7095                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
7096                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
7097                           smb_fname_str_dbg(smb_fname_dst)));
7098
7099                 goto out;
7100         }
7101
7102         /*
7103          * Wildcards - process each file that matches.
7104          */
7105         if (strequal(fname_src_mask, "????????.???")) {
7106                 TALLOC_FREE(fname_src_mask);
7107                 fname_src_mask = talloc_strdup(ctx, "*");
7108                 if (!fname_src_mask) {
7109                         status = NT_STATUS_NO_MEMORY;
7110                         goto out;
7111                 }
7112         }
7113
7114         smb_fname_src_dir = synthetic_smb_fname(talloc_tos(),
7115                                 fname_src_dir,
7116                                 NULL,
7117                                 NULL,
7118                                 smb_fname_src->flags);
7119         if (smb_fname_src_dir == NULL) {
7120                 status = NT_STATUS_NO_MEMORY;
7121                 goto out;
7122         }
7123
7124         status = check_name(conn, smb_fname_src_dir);
7125         if (!NT_STATUS_IS_OK(status)) {
7126                 goto out;
7127         }
7128
7129         dir_hnd = OpenDir(talloc_tos(), conn, smb_fname_src_dir, fname_src_mask,
7130                           attrs);
7131         if (dir_hnd == NULL) {
7132                 status = map_nt_error_from_unix(errno);
7133                 goto out;
7134         }
7135
7136         status = NT_STATUS_NO_SUCH_FILE;
7137         /*
7138          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
7139          * - gentest fix. JRA
7140          */
7141
7142         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
7143                                     &talloced))) {
7144                 files_struct *fsp = NULL;
7145                 char *destname = NULL;
7146                 bool sysdir_entry = False;
7147
7148                 /* Quick check for "." and ".." */
7149                 if (ISDOT(dname) || ISDOTDOT(dname)) {
7150                         if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
7151                                 sysdir_entry = True;
7152                         } else {
7153                                 TALLOC_FREE(talloced);
7154                                 continue;
7155                         }
7156                 }
7157
7158                 if (!is_visible_file(conn, fname_src_dir, dname,
7159                                      &smb_fname_src->st, false)) {
7160                         TALLOC_FREE(talloced);
7161                         continue;
7162                 }
7163
7164                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
7165                         TALLOC_FREE(talloced);
7166                         continue;
7167                 }
7168
7169                 if (sysdir_entry) {
7170                         status = NT_STATUS_OBJECT_NAME_INVALID;
7171                         break;
7172                 }
7173
7174                 TALLOC_FREE(smb_fname_src->base_name);
7175                 if (ISDOT(fname_src_dir)) {
7176                         /* Ensure we use canonical names on open. */
7177                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7178                                                         "%s",
7179                                                         dname);
7180                 } else {
7181                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7182                                                         "%s/%s",
7183                                                         fname_src_dir,
7184                                                         dname);
7185                 }
7186                 if (!smb_fname_src->base_name) {
7187                         status = NT_STATUS_NO_MEMORY;
7188                         goto out;
7189                 }
7190
7191                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7192                                        smb_fname_dst->base_name,
7193                                        &destname)) {
7194                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
7195                                   smb_fname_src->base_name, destname));
7196                         TALLOC_FREE(talloced);
7197                         continue;
7198                 }
7199                 if (!destname) {
7200                         status = NT_STATUS_NO_MEMORY;
7201                         goto out;
7202                 }
7203
7204                 TALLOC_FREE(smb_fname_dst->base_name);
7205                 smb_fname_dst->base_name = destname;
7206
7207                 ZERO_STRUCT(smb_fname_src->st);
7208                 if (posix_pathnames) {
7209                         SMB_VFS_LSTAT(conn, smb_fname_src);
7210                 } else {
7211                         SMB_VFS_STAT(conn, smb_fname_src);
7212                 }
7213
7214                 create_options = 0;
7215
7216                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
7217                         create_options |= FILE_DIRECTORY_FILE;
7218                 }
7219
7220                 status = SMB_VFS_CREATE_FILE(
7221                         conn,                           /* conn */
7222                         req,                            /* req */
7223                         0,                              /* root_dir_fid */
7224                         smb_fname_src,                  /* fname */
7225                         access_mask,                    /* access_mask */
7226                         (FILE_SHARE_READ |              /* share_access */
7227                             FILE_SHARE_WRITE),
7228                         FILE_OPEN,                      /* create_disposition*/
7229                         create_options,                 /* create_options */
7230                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
7231                         0,                              /* oplock_request */
7232                         NULL,                           /* lease */
7233                         0,                              /* allocation_size */
7234                         0,                              /* private_flags */
7235                         NULL,                           /* sd */
7236                         NULL,                           /* ea_list */
7237                         &fsp,                           /* result */
7238                         NULL,                           /* pinfo */
7239                         NULL, NULL);                    /* create context */
7240
7241                 if (!NT_STATUS_IS_OK(status)) {
7242                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
7243                                  "returned %s rename %s -> %s\n",
7244                                  nt_errstr(status),
7245                                  smb_fname_str_dbg(smb_fname_src),
7246                                  smb_fname_str_dbg(smb_fname_dst)));
7247                         break;
7248                 }
7249
7250                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
7251                                                               dname);
7252                 if (!smb_fname_dst->original_lcomp) {
7253                         status = NT_STATUS_NO_MEMORY;
7254                         goto out;
7255                 }
7256
7257                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
7258                                               attrs, replace_if_exists);
7259
7260                 close_file(req, fsp, NORMAL_CLOSE);
7261
7262                 if (!NT_STATUS_IS_OK(status)) {
7263                         DEBUG(3, ("rename_internals_fsp returned %s for "
7264                                   "rename %s -> %s\n", nt_errstr(status),
7265                                   smb_fname_str_dbg(smb_fname_src),
7266                                   smb_fname_str_dbg(smb_fname_dst)));
7267                         break;
7268                 }
7269
7270                 count++;
7271
7272                 DEBUG(3,("rename_internals: doing rename on %s -> "
7273                          "%s\n", smb_fname_str_dbg(smb_fname_src),
7274                          smb_fname_str_dbg(smb_fname_src)));
7275                 TALLOC_FREE(talloced);
7276         }
7277         TALLOC_FREE(dir_hnd);
7278
7279         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
7280                 status = map_nt_error_from_unix(errno);
7281         }
7282
7283  out:
7284         TALLOC_FREE(talloced);
7285         TALLOC_FREE(smb_fname_src_dir);
7286         TALLOC_FREE(fname_src_dir);
7287         TALLOC_FREE(fname_src_mask);
7288         return status;
7289 }
7290
7291 /****************************************************************************
7292  Reply to a mv.
7293 ****************************************************************************/
7294
7295 void reply_mv(struct smb_request *req)
7296 {
7297         connection_struct *conn = req->conn;
7298         char *name = NULL;
7299         char *newname = NULL;
7300         const char *p;
7301         uint32_t attrs;
7302         NTSTATUS status;
7303         bool src_has_wcard = False;
7304         bool dest_has_wcard = False;
7305         TALLOC_CTX *ctx = talloc_tos();
7306         struct smb_filename *smb_fname_src = NULL;
7307         struct smb_filename *smb_fname_dst = NULL;
7308         uint32_t src_ucf_flags = ucf_flags_from_smb_request(req) |
7309                 (req->posix_pathnames ?
7310                         UCF_UNIX_NAME_LOOKUP :
7311                         UCF_COND_ALLOW_WCARD_LCOMP);
7312         uint32_t dst_ucf_flags = ucf_flags_from_smb_request(req) |
7313                 UCF_SAVE_LCOMP |
7314                 (req->posix_pathnames ?
7315                         0 :
7316                         UCF_COND_ALLOW_WCARD_LCOMP);
7317         bool stream_rename = false;
7318
7319         START_PROFILE(SMBmv);
7320
7321         if (req->wct < 1) {
7322                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7323                 goto out;
7324         }
7325
7326         attrs = SVAL(req->vwv+0, 0);
7327
7328         p = (const char *)req->buf + 1;
7329         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
7330                                        &status, &src_has_wcard);
7331         if (!NT_STATUS_IS_OK(status)) {
7332                 reply_nterror(req, status);
7333                 goto out;
7334         }
7335         p++;
7336         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
7337                                        &status, &dest_has_wcard);
7338         if (!NT_STATUS_IS_OK(status)) {
7339                 reply_nterror(req, status);
7340                 goto out;
7341         }
7342
7343         if (!req->posix_pathnames) {
7344                 /* The newname must begin with a ':' if the
7345                    name contains a ':'. */
7346                 if (strchr_m(name, ':')) {
7347                         if (newname[0] != ':') {
7348                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7349                                 goto out;
7350                         }
7351                         stream_rename = true;
7352                 }
7353         }
7354
7355         status = filename_convert(ctx,
7356                                   conn,
7357                                   name,
7358                                   src_ucf_flags,
7359                                   &src_has_wcard,
7360                                   &smb_fname_src);
7361
7362         if (!NT_STATUS_IS_OK(status)) {
7363                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7364                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7365                                         ERRSRV, ERRbadpath);
7366                         goto out;
7367                 }
7368                 reply_nterror(req, status);
7369                 goto out;
7370         }
7371
7372         status = filename_convert(ctx,
7373                                   conn,
7374                                   newname,
7375                                   dst_ucf_flags,
7376                                   &dest_has_wcard,
7377                                   &smb_fname_dst);
7378
7379         if (!NT_STATUS_IS_OK(status)) {
7380                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7381                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7382                                         ERRSRV, ERRbadpath);
7383                         goto out;
7384                 }
7385                 reply_nterror(req, status);
7386                 goto out;
7387         }
7388
7389         if (stream_rename) {
7390                 /* smb_fname_dst->base_name must be the same as
7391                    smb_fname_src->base_name. */
7392                 TALLOC_FREE(smb_fname_dst->base_name);
7393                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
7394                                                 smb_fname_src->base_name);
7395                 if (!smb_fname_dst->base_name) {
7396                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7397                         goto out;
7398                 }
7399         }
7400
7401         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7402                  smb_fname_str_dbg(smb_fname_dst)));
7403
7404         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7405                                   attrs, False, src_has_wcard, dest_has_wcard,
7406                                   DELETE_ACCESS);
7407         if (!NT_STATUS_IS_OK(status)) {
7408                 if (open_was_deferred(req->xconn, req->mid)) {
7409                         /* We have re-scheduled this call. */
7410                         goto out;
7411                 }
7412                 reply_nterror(req, status);
7413                 goto out;
7414         }
7415
7416         reply_outbuf(req, 0, 0);
7417  out:
7418         TALLOC_FREE(smb_fname_src);
7419         TALLOC_FREE(smb_fname_dst);
7420         END_PROFILE(SMBmv);
7421         return;
7422 }
7423
7424 /*******************************************************************
7425  Copy a file as part of a reply_copy.
7426 ******************************************************************/
7427
7428 /*
7429  * TODO: check error codes on all callers
7430  */
7431
7432 NTSTATUS copy_file(TALLOC_CTX *ctx,
7433                         connection_struct *conn,
7434                         struct smb_filename *smb_fname_src,
7435                         struct smb_filename *smb_fname_dst,
7436                         int ofun,
7437                         int count,
7438                         bool target_is_directory)
7439 {
7440         struct smb_filename *smb_fname_dst_tmp = NULL;
7441         off_t ret=-1;
7442         files_struct *fsp1,*fsp2;
7443         uint32_t dosattrs;
7444         uint32_t new_create_disposition;
7445         NTSTATUS status;
7446
7447
7448         smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7449         if (smb_fname_dst_tmp == NULL) {
7450                 return NT_STATUS_NO_MEMORY;
7451         }
7452
7453         /*
7454          * If the target is a directory, extract the last component from the
7455          * src filename and append it to the dst filename
7456          */
7457         if (target_is_directory) {
7458                 const char *p;
7459
7460                 /* dest/target can't be a stream if it's a directory. */
7461                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7462
7463                 p = strrchr_m(smb_fname_src->base_name,'/');
7464                 if (p) {
7465                         p++;
7466                 } else {
7467                         p = smb_fname_src->base_name;
7468                 }
7469                 smb_fname_dst_tmp->base_name =
7470                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7471                                            p);
7472                 if (!smb_fname_dst_tmp->base_name) {
7473                         status = NT_STATUS_NO_MEMORY;
7474                         goto out;
7475                 }
7476         }
7477
7478         status = vfs_file_exist(conn, smb_fname_src);
7479         if (!NT_STATUS_IS_OK(status)) {
7480                 goto out;
7481         }
7482
7483         if (!target_is_directory && count) {
7484                 new_create_disposition = FILE_OPEN;
7485         } else {
7486                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7487                                                  0, ofun,
7488                                                  NULL, NULL,
7489                                                  &new_create_disposition,
7490                                                  NULL,
7491                                                  NULL)) {
7492                         status = NT_STATUS_INVALID_PARAMETER;
7493                         goto out;
7494                 }
7495         }
7496
7497         /* Open the src file for reading. */
7498         status = SMB_VFS_CREATE_FILE(
7499                 conn,                                   /* conn */
7500                 NULL,                                   /* req */
7501                 0,                                      /* root_dir_fid */
7502                 smb_fname_src,                          /* fname */
7503                 FILE_GENERIC_READ,                      /* access_mask */
7504                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7505                 FILE_OPEN,                              /* create_disposition*/
7506                 0,                                      /* create_options */
7507                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
7508                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7509                 NULL,                                   /* lease */
7510                 0,                                      /* allocation_size */
7511                 0,                                      /* private_flags */
7512                 NULL,                                   /* sd */
7513                 NULL,                                   /* ea_list */
7514                 &fsp1,                                  /* result */
7515                 NULL,                                   /* psbuf */
7516                 NULL, NULL);                            /* create context */
7517
7518         if (!NT_STATUS_IS_OK(status)) {
7519                 goto out;
7520         }
7521
7522         dosattrs = dos_mode(conn, smb_fname_src);
7523
7524         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7525                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7526         }
7527
7528         /* Open the dst file for writing. */
7529         status = SMB_VFS_CREATE_FILE(
7530                 conn,                                   /* conn */
7531                 NULL,                                   /* req */
7532                 0,                                      /* root_dir_fid */
7533                 smb_fname_dst,                          /* fname */
7534                 FILE_GENERIC_WRITE,                     /* access_mask */
7535                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7536                 new_create_disposition,                 /* create_disposition*/
7537                 0,                                      /* create_options */
7538                 dosattrs,                               /* file_attributes */
7539                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7540                 NULL,                                   /* lease */
7541                 0,                                      /* allocation_size */
7542                 0,                                      /* private_flags */
7543                 NULL,                                   /* sd */
7544                 NULL,                                   /* ea_list */
7545                 &fsp2,                                  /* result */
7546                 NULL,                                   /* psbuf */
7547                 NULL, NULL);                            /* create context */
7548
7549         if (!NT_STATUS_IS_OK(status)) {
7550                 close_file(NULL, fsp1, ERROR_CLOSE);
7551                 goto out;
7552         }
7553
7554         if (ofun & OPENX_FILE_EXISTS_OPEN) {
7555                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7556                 if (ret == -1) {
7557                         DEBUG(0, ("error - vfs lseek returned error %s\n",
7558                                 strerror(errno)));
7559                         status = map_nt_error_from_unix(errno);
7560                         close_file(NULL, fsp1, ERROR_CLOSE);
7561                         close_file(NULL, fsp2, ERROR_CLOSE);
7562                         goto out;
7563                 }
7564         }
7565
7566         /* Do the actual copy. */
7567         if (smb_fname_src->st.st_ex_size) {
7568                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7569         } else {
7570                 ret = 0;
7571         }
7572
7573         close_file(NULL, fsp1, NORMAL_CLOSE);
7574
7575         /* Ensure the modtime is set correctly on the destination file. */
7576         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7577
7578         /*
7579          * As we are opening fsp1 read-only we only expect
7580          * an error on close on fsp2 if we are out of space.
7581          * Thus we don't look at the error return from the
7582          * close of fsp1.
7583          */
7584         status = close_file(NULL, fsp2, NORMAL_CLOSE);
7585
7586         if (!NT_STATUS_IS_OK(status)) {
7587                 goto out;
7588         }
7589
7590         if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7591                 status = NT_STATUS_DISK_FULL;
7592                 goto out;
7593         }
7594
7595         status = NT_STATUS_OK;
7596
7597  out:
7598         TALLOC_FREE(smb_fname_dst_tmp);
7599         return status;
7600 }
7601
7602 /****************************************************************************
7603  Reply to a file copy.
7604 ****************************************************************************/
7605
7606 void reply_copy(struct smb_request *req)
7607 {
7608         connection_struct *conn = req->conn;
7609         struct smb_filename *smb_fname_src = NULL;
7610         struct smb_filename *smb_fname_src_dir = NULL;
7611         struct smb_filename *smb_fname_dst = NULL;
7612         char *fname_src = NULL;
7613         char *fname_dst = NULL;
7614         char *fname_src_mask = NULL;
7615         char *fname_src_dir = NULL;
7616         const char *p;
7617         int count=0;
7618         int error = ERRnoaccess;
7619         int tid2;
7620         int ofun;
7621         int flags;
7622         bool target_is_directory=False;
7623         bool source_has_wild = False;
7624         bool dest_has_wild = False;
7625         NTSTATUS status;
7626         uint32_t ucf_flags_src = UCF_COND_ALLOW_WCARD_LCOMP |
7627                 ucf_flags_from_smb_request(req);
7628         uint32_t ucf_flags_dst = UCF_COND_ALLOW_WCARD_LCOMP |
7629                 ucf_flags_from_smb_request(req);
7630         TALLOC_CTX *ctx = talloc_tos();
7631
7632         START_PROFILE(SMBcopy);
7633
7634         if (req->wct < 3) {
7635                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7636                 goto out;
7637         }
7638
7639         tid2 = SVAL(req->vwv+0, 0);
7640         ofun = SVAL(req->vwv+1, 0);
7641         flags = SVAL(req->vwv+2, 0);
7642
7643         p = (const char *)req->buf;
7644         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7645                                        &status, &source_has_wild);
7646         if (!NT_STATUS_IS_OK(status)) {
7647                 reply_nterror(req, status);
7648                 goto out;
7649         }
7650         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7651                                        &status, &dest_has_wild);
7652         if (!NT_STATUS_IS_OK(status)) {
7653                 reply_nterror(req, status);
7654                 goto out;
7655         }
7656
7657         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7658
7659         if (tid2 != conn->cnum) {
7660                 /* can't currently handle inter share copies XXXX */
7661                 DEBUG(3,("Rejecting inter-share copy\n"));
7662                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7663                 goto out;
7664         }
7665
7666         status = filename_convert(ctx, conn,
7667                                   fname_src,
7668                                   ucf_flags_src,
7669                                   &source_has_wild,
7670                                   &smb_fname_src);
7671         if (!NT_STATUS_IS_OK(status)) {
7672                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7673                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7674                                         ERRSRV, ERRbadpath);
7675                         goto out;
7676                 }
7677                 reply_nterror(req, status);
7678                 goto out;
7679         }
7680
7681         status = filename_convert(ctx, conn,
7682                                   fname_dst,
7683                                   ucf_flags_dst,
7684                                   &dest_has_wild,
7685                                   &smb_fname_dst);
7686         if (!NT_STATUS_IS_OK(status)) {
7687                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7688                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7689                                         ERRSRV, ERRbadpath);
7690                         goto out;
7691                 }
7692                 reply_nterror(req, status);
7693                 goto out;
7694         }
7695
7696         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7697
7698         if ((flags&1) && target_is_directory) {
7699                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7700                 goto out;
7701         }
7702
7703         if ((flags&2) && !target_is_directory) {
7704                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7705                 goto out;
7706         }
7707
7708         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7709                 /* wants a tree copy! XXXX */
7710                 DEBUG(3,("Rejecting tree copy\n"));
7711                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7712                 goto out;
7713         }
7714
7715         /* Split up the directory from the filename/mask. */
7716         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7717                                       &fname_src_dir, &fname_src_mask);
7718         if (!NT_STATUS_IS_OK(status)) {
7719                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7720                 goto out;
7721         }
7722
7723         /*
7724          * We should only check the mangled cache
7725          * here if unix_convert failed. This means
7726          * that the path in 'mask' doesn't exist
7727          * on the file system and so we need to look
7728          * for a possible mangle. This patch from
7729          * Tine Smukavec <valentin.smukavec@hermes.si>.
7730          */
7731         if (!VALID_STAT(smb_fname_src->st) &&
7732             mangle_is_mangled(fname_src_mask, conn->params)) {
7733                 char *new_mask = NULL;
7734                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7735                                             &new_mask, conn->params);
7736
7737                 /* Use demangled name if one was successfully found. */
7738                 if (new_mask) {
7739                         TALLOC_FREE(fname_src_mask);
7740                         fname_src_mask = new_mask;
7741                 }
7742         }
7743
7744         if (!source_has_wild) {
7745
7746                 /*
7747                  * Only one file needs to be copied. Append the mask back onto
7748                  * the directory.
7749                  */
7750                 TALLOC_FREE(smb_fname_src->base_name);
7751                 if (ISDOT(fname_src_dir)) {
7752                         /* Ensure we use canonical names on open. */
7753                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7754                                                         "%s",
7755                                                         fname_src_mask);
7756                 } else {
7757                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7758                                                         "%s/%s",
7759                                                         fname_src_dir,
7760                                                         fname_src_mask);
7761                 }
7762                 if (!smb_fname_src->base_name) {
7763                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7764                         goto out;
7765                 }
7766
7767                 if (dest_has_wild) {
7768                         char *fname_dst_mod = NULL;
7769                         if (!resolve_wildcards(smb_fname_dst,
7770                                                smb_fname_src->base_name,
7771                                                smb_fname_dst->base_name,
7772                                                &fname_dst_mod)) {
7773                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7774                                 goto out;
7775                         }
7776                         TALLOC_FREE(smb_fname_dst->base_name);
7777                         smb_fname_dst->base_name = fname_dst_mod;
7778                 }
7779
7780                 status = check_name(conn, smb_fname_src);
7781                 if (!NT_STATUS_IS_OK(status)) {
7782                         reply_nterror(req, status);
7783                         goto out;
7784                 }
7785
7786                 status = check_name(conn, smb_fname_dst);
7787                 if (!NT_STATUS_IS_OK(status)) {
7788                         reply_nterror(req, status);
7789                         goto out;
7790                 }
7791
7792                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7793                                    ofun, count, target_is_directory);
7794
7795                 if(!NT_STATUS_IS_OK(status)) {
7796                         reply_nterror(req, status);
7797                         goto out;
7798                 } else {
7799                         count++;
7800                 }
7801         } else {
7802                 struct smb_Dir *dir_hnd = NULL;
7803                 const char *dname = NULL;
7804                 char *talloced = NULL;
7805                 long offset = 0;
7806
7807                 /*
7808                  * There is a wildcard that requires us to actually read the
7809                  * src dir and copy each file matching the mask to the dst.
7810                  * Right now streams won't be copied, but this could
7811                  * presumably be added with a nested loop for reach dir entry.
7812                  */
7813                 SMB_ASSERT(!smb_fname_src->stream_name);
7814                 SMB_ASSERT(!smb_fname_dst->stream_name);
7815
7816                 smb_fname_src->stream_name = NULL;
7817                 smb_fname_dst->stream_name = NULL;
7818
7819                 if (strequal(fname_src_mask,"????????.???")) {
7820                         TALLOC_FREE(fname_src_mask);
7821                         fname_src_mask = talloc_strdup(ctx, "*");
7822                         if (!fname_src_mask) {
7823                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7824                                 goto out;
7825                         }
7826                 }
7827
7828                 smb_fname_src_dir = synthetic_smb_fname(talloc_tos(),
7829                                         fname_src_dir,
7830                                         NULL,
7831                                         NULL,
7832                                         smb_fname_src->flags);
7833                 if (smb_fname_src_dir == NULL) {
7834                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7835                         goto out;
7836                 }
7837
7838                 status = check_name(conn, smb_fname_src_dir);
7839                 if (!NT_STATUS_IS_OK(status)) {
7840                         reply_nterror(req, status);
7841                         goto out;
7842                 }
7843
7844                 dir_hnd = OpenDir(ctx,
7845                                 conn,
7846                                 smb_fname_src_dir,
7847                                 fname_src_mask,
7848                                 0);
7849                 if (dir_hnd == NULL) {
7850                         status = map_nt_error_from_unix(errno);
7851                         reply_nterror(req, status);
7852                         goto out;
7853                 }
7854
7855                 error = ERRbadfile;
7856
7857                 /* Iterate over the src dir copying each entry to the dst. */
7858                 while ((dname = ReadDirName(dir_hnd, &offset,
7859                                             &smb_fname_src->st, &talloced))) {
7860                         char *destname = NULL;
7861
7862                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7863                                 TALLOC_FREE(talloced);
7864                                 continue;
7865                         }
7866
7867                         if (!is_visible_file(conn, fname_src_dir, dname,
7868                                              &smb_fname_src->st, false)) {
7869                                 TALLOC_FREE(talloced);
7870                                 continue;
7871                         }
7872
7873                         if(!mask_match(dname, fname_src_mask,
7874                                        conn->case_sensitive)) {
7875                                 TALLOC_FREE(talloced);
7876                                 continue;
7877                         }
7878
7879                         error = ERRnoaccess;
7880
7881                         /* Get the src smb_fname struct setup. */
7882                         TALLOC_FREE(smb_fname_src->base_name);
7883                         if (ISDOT(fname_src_dir)) {
7884                                 /* Ensure we use canonical names on open. */
7885                                 smb_fname_src->base_name =
7886                                         talloc_asprintf(smb_fname_src, "%s",
7887                                                 dname);
7888                         } else {
7889                                 smb_fname_src->base_name =
7890                                         talloc_asprintf(smb_fname_src, "%s/%s",
7891                                                 fname_src_dir, dname);
7892                         }
7893
7894                         if (!smb_fname_src->base_name) {
7895                                 TALLOC_FREE(dir_hnd);
7896                                 TALLOC_FREE(talloced);
7897                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7898                                 goto out;
7899                         }
7900
7901                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7902                                                smb_fname_dst->base_name,
7903                                                &destname)) {
7904                                 TALLOC_FREE(talloced);
7905                                 continue;
7906                         }
7907                         if (!destname) {
7908                                 TALLOC_FREE(dir_hnd);
7909                                 TALLOC_FREE(talloced);
7910                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7911                                 goto out;
7912                         }
7913
7914                         TALLOC_FREE(smb_fname_dst->base_name);
7915                         smb_fname_dst->base_name = destname;
7916
7917                         status = check_name(conn, smb_fname_src);
7918                         if (!NT_STATUS_IS_OK(status)) {
7919                                 TALLOC_FREE(dir_hnd);
7920                                 TALLOC_FREE(talloced);
7921                                 reply_nterror(req, status);
7922                                 goto out;
7923                         }
7924
7925                         status = check_name(conn, smb_fname_dst);
7926                         if (!NT_STATUS_IS_OK(status)) {
7927                                 TALLOC_FREE(dir_hnd);
7928                                 TALLOC_FREE(talloced);
7929                                 reply_nterror(req, status);
7930                                 goto out;
7931                         }
7932
7933                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7934                                 smb_fname_src->base_name,
7935                                 smb_fname_dst->base_name));
7936
7937                         status = copy_file(ctx, conn, smb_fname_src,
7938                                            smb_fname_dst, ofun, count,
7939                                            target_is_directory);
7940                         if (NT_STATUS_IS_OK(status)) {
7941                                 count++;
7942                         }
7943
7944                         TALLOC_FREE(talloced);
7945                 }
7946                 TALLOC_FREE(dir_hnd);
7947         }
7948
7949         if (count == 0) {
7950                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7951                 goto out;
7952         }
7953
7954         reply_outbuf(req, 1, 0);
7955         SSVAL(req->outbuf,smb_vwv0,count);
7956  out:
7957         TALLOC_FREE(smb_fname_src);
7958         TALLOC_FREE(smb_fname_src_dir);
7959         TALLOC_FREE(smb_fname_dst);
7960         TALLOC_FREE(fname_src);
7961         TALLOC_FREE(fname_dst);
7962         TALLOC_FREE(fname_src_mask);
7963         TALLOC_FREE(fname_src_dir);
7964
7965         END_PROFILE(SMBcopy);
7966         return;
7967 }
7968
7969 #undef DBGC_CLASS
7970 #define DBGC_CLASS DBGC_LOCKING
7971
7972 /****************************************************************************
7973  Get a lock pid, dealing with large count requests.
7974 ****************************************************************************/
7975
7976 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7977                     bool large_file_format)
7978 {
7979         if(!large_file_format)
7980                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7981         else
7982                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7983 }
7984
7985 /****************************************************************************
7986  Get a lock count, dealing with large count requests.
7987 ****************************************************************************/
7988
7989 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7990                         bool large_file_format)
7991 {
7992         uint64_t count = 0;
7993
7994         if(!large_file_format) {
7995                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7996         } else {
7997                 /*
7998                  * No BVAL, this is reversed!
7999                  */
8000                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
8001                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
8002         }
8003
8004         return count;
8005 }
8006
8007 /****************************************************************************
8008  Get a lock offset, dealing with large offset requests.
8009 ****************************************************************************/
8010
8011 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
8012                          bool large_file_format)
8013 {
8014         uint64_t offset = 0;
8015
8016         if(!large_file_format) {
8017                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
8018         } else {
8019                 /*
8020                  * No BVAL, this is reversed!
8021                  */
8022                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
8023                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
8024         }
8025
8026         return offset;
8027 }
8028
8029 NTSTATUS smbd_do_locking(struct smb_request *req,
8030                          files_struct *fsp,
8031                          uint8_t type,
8032                          int32_t timeout,
8033                          uint16_t num_locks,
8034                          struct smbd_lock_element *locks,
8035                          bool *async)
8036 {
8037         connection_struct *conn = req->conn;
8038         int i;
8039         NTSTATUS status = NT_STATUS_OK;
8040
8041         *async = false;
8042
8043         /* Setup the timeout in seconds. */
8044
8045         if (!lp_blocking_locks(SNUM(conn))) {
8046                 timeout = 0;
8047         }
8048
8049         for(i = 0; i < (int)num_locks; i++) {
8050                 struct smbd_lock_element *e = &locks[i];
8051
8052                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
8053                           "%llu, file %s timeout = %d\n",
8054                           (double)e->offset,
8055                           (double)e->count,
8056                           (unsigned long long)e->smblctx,
8057                           fsp_str_dbg(fsp),
8058                           (int)timeout));
8059
8060                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
8061                         struct blocking_lock_record *blr = NULL;
8062
8063                         if (num_locks > 1) {
8064                                 /*
8065                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
8066                                  * if the lock vector contains one entry. When given multiple cancel
8067                                  * requests in a single PDU we expect the server to return an
8068                                  * error. Windows servers seem to accept the request but only
8069                                  * cancel the first lock.
8070                                  * JRA - Do what Windows does (tm) :-).
8071                                  */
8072
8073 #if 0
8074                                 /* MS-CIFS (2.2.4.32.1) behavior. */
8075                                 return NT_STATUS_DOS(ERRDOS,
8076                                                 ERRcancelviolation);
8077 #else
8078                                 /* Windows behavior. */
8079                                 if (i != 0) {
8080                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
8081                                                 "cancel request\n"));
8082                                         continue;
8083                                 }
8084 #endif
8085                         }
8086
8087                         if (lp_blocking_locks(SNUM(conn))) {
8088
8089                                 /* Schedule a message to ourselves to
8090                                    remove the blocking lock record and
8091                                    return the right error. */
8092
8093                                 blr = blocking_lock_cancel_smb1(fsp,
8094                                                 e->smblctx,
8095                                                 e->offset,
8096                                                 e->count,
8097                                                 WINDOWS_LOCK,
8098                                                 type,
8099                                                 NT_STATUS_FILE_LOCK_CONFLICT);
8100                                 if (blr == NULL) {
8101                                         return NT_STATUS_DOS(
8102                                                         ERRDOS,
8103                                                         ERRcancelviolation);
8104                                 }
8105                         }
8106                         /* Remove a matching pending lock. */
8107                         status = do_lock_cancel(fsp,
8108                                                 e->smblctx,
8109                                                 e->count,
8110                                                 e->offset,
8111                                                 WINDOWS_LOCK);
8112                 } else {
8113                         bool blocking_lock = timeout ? true : false;
8114                         bool defer_lock = false;
8115                         struct byte_range_lock *br_lck;
8116                         uint64_t block_smblctx;
8117
8118                         br_lck = do_lock(req->sconn->msg_ctx,
8119                                         fsp,
8120                                         e->smblctx,
8121                                         e->count,
8122                                         e->offset,
8123                                         e->brltype,
8124                                         WINDOWS_LOCK,
8125                                         blocking_lock,
8126                                         &status,
8127                                         &block_smblctx);
8128
8129                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
8130                                 /* Windows internal resolution for blocking locks seems
8131                                    to be about 200ms... Don't wait for less than that. JRA. */
8132                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
8133                                         timeout = lp_lock_spin_time();
8134                                 }
8135                                 defer_lock = true;
8136                         }
8137
8138                         /* If a lock sent with timeout of zero would fail, and
8139                          * this lock has been requested multiple times,
8140                          * according to brl_lock_failed() we convert this
8141                          * request to a blocking lock with a timeout of between
8142                          * 150 - 300 milliseconds.
8143                          *
8144                          * If lp_lock_spin_time() has been set to 0, we skip
8145                          * this blocking retry and fail immediately.
8146                          *
8147                          * Replacement for do_lock_spin(). JRA. */
8148
8149                         if (!req->sconn->using_smb2 &&
8150                             br_lck && lp_blocking_locks(SNUM(conn)) &&
8151                             lp_lock_spin_time() && !blocking_lock &&
8152                             NT_STATUS_EQUAL((status),
8153                                 NT_STATUS_FILE_LOCK_CONFLICT))
8154                         {
8155                                 defer_lock = true;
8156                                 timeout = lp_lock_spin_time();
8157                         }
8158
8159                         if (br_lck && defer_lock) {
8160                                 /*
8161                                  * A blocking lock was requested. Package up
8162                                  * this smb into a queued request and push it
8163                                  * onto the blocking lock queue.
8164                                  */
8165                                 if(push_blocking_lock_request(br_lck,
8166                                                         req,
8167                                                         fsp,
8168                                                         timeout,
8169                                                         i,
8170                                                         e->smblctx,
8171                                                         e->brltype,
8172                                                         WINDOWS_LOCK,
8173                                                         e->offset,
8174                                                         e->count,
8175                                                         block_smblctx)) {
8176                                         TALLOC_FREE(br_lck);
8177                                         *async = true;
8178                                         return NT_STATUS_OK;
8179                                 }
8180                         }
8181
8182                         TALLOC_FREE(br_lck);
8183                 }
8184
8185                 if (!NT_STATUS_IS_OK(status)) {
8186                         break;
8187                 }
8188         }
8189
8190         /* If any of the above locks failed, then we must unlock
8191            all of the previous locks (X/Open spec). */
8192
8193         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
8194
8195                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
8196                         i = -1; /* we want to skip the for loop */
8197                 }
8198
8199                 /*
8200                  * Ensure we don't do a remove on the lock that just failed,
8201                  * as under POSIX rules, if we have a lock already there, we
8202                  * will delete it (and we shouldn't) .....
8203                  */
8204                 for(i--; i >= 0; i--) {
8205                         struct smbd_lock_element *e = &locks[i];
8206
8207                         do_unlock(req->sconn->msg_ctx,
8208                                 fsp,
8209                                 e->smblctx,
8210                                 e->count,
8211                                 e->offset,
8212                                 WINDOWS_LOCK);
8213                 }
8214                 return status;
8215         }
8216
8217         DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d\n",
8218                   fsp_fnum_dbg(fsp), (unsigned int)type, num_locks));
8219
8220         return NT_STATUS_OK;
8221 }
8222
8223 NTSTATUS smbd_do_unlocking(struct smb_request *req,
8224                            files_struct *fsp,
8225                            uint16_t num_ulocks,
8226                            struct smbd_lock_element *ulocks)
8227 {
8228         int i;
8229
8230         for(i = 0; i < (int)num_ulocks; i++) {
8231                 struct smbd_lock_element *e = &ulocks[i];
8232                 NTSTATUS status;
8233
8234                 DEBUG(10,("%s: unlock start=%.0f, len=%.0f for "
8235                           "pid %u, file %s\n", __func__,
8236                           (double)e->offset,
8237                           (double)e->count,
8238                           (unsigned int)e->smblctx,
8239                           fsp_str_dbg(fsp)));
8240
8241                 if (e->brltype != UNLOCK_LOCK) {
8242                         /* this can only happen with SMB2 */
8243                         return NT_STATUS_INVALID_PARAMETER;
8244                 }
8245
8246                 status = do_unlock(req->sconn->msg_ctx,
8247                                 fsp,
8248                                 e->smblctx,
8249                                 e->count,
8250                                 e->offset,
8251                                 WINDOWS_LOCK);
8252
8253                 DEBUG(10, ("%s: unlock returned %s\n", __func__,
8254                            nt_errstr(status)));
8255
8256                 if (!NT_STATUS_IS_OK(status)) {
8257                         return status;
8258                 }
8259         }
8260
8261         DEBUG(3, ("%s: %s num_ulocks=%d\n", __func__, fsp_fnum_dbg(fsp),
8262                   num_ulocks));
8263
8264         return NT_STATUS_OK;
8265 }
8266
8267 /****************************************************************************
8268  Reply to a lockingX request.
8269 ****************************************************************************/
8270
8271 void reply_lockingX(struct smb_request *req)
8272 {
8273         connection_struct *conn = req->conn;
8274         files_struct *fsp;
8275         unsigned char locktype;
8276         unsigned char oplocklevel;
8277         uint16_t num_ulocks;
8278         uint16_t num_locks;
8279         int32_t lock_timeout;
8280         int i;
8281         const uint8_t *data;
8282         bool large_file_format;
8283         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
8284         struct smbd_lock_element *ulocks;
8285         struct smbd_lock_element *locks;
8286         bool async = false;
8287
8288         START_PROFILE(SMBlockingX);
8289
8290         if (req->wct < 8) {
8291                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8292                 END_PROFILE(SMBlockingX);
8293                 return;
8294         }
8295
8296         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
8297         locktype = CVAL(req->vwv+3, 0);
8298         oplocklevel = CVAL(req->vwv+3, 1);
8299         num_ulocks = SVAL(req->vwv+6, 0);
8300         num_locks = SVAL(req->vwv+7, 0);
8301         lock_timeout = IVAL(req->vwv+4, 0);
8302         large_file_format = ((locktype & LOCKING_ANDX_LARGE_FILES) != 0);
8303
8304         if (!check_fsp(conn, req, fsp)) {
8305                 END_PROFILE(SMBlockingX);
8306                 return;
8307         }
8308
8309         data = req->buf;
8310
8311         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
8312                 /* we don't support these - and CANCEL_LOCK makes w2k
8313                    and XP reboot so I don't really want to be
8314                    compatible! (tridge) */
8315                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
8316                 END_PROFILE(SMBlockingX);
8317                 return;
8318         }
8319
8320         /* Check if this is an oplock break on a file
8321            we have granted an oplock on.
8322         */
8323         if (locktype & LOCKING_ANDX_OPLOCK_RELEASE) {
8324                 /* Client can insist on breaking to none. */
8325                 bool break_to_none = (oplocklevel == 0);
8326                 bool result;
8327
8328                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
8329                          "for %s\n", (unsigned int)oplocklevel,
8330                          fsp_fnum_dbg(fsp)));
8331
8332                 /*
8333                  * Make sure we have granted an exclusive or batch oplock on
8334                  * this file.
8335                  */
8336
8337                 if (fsp->oplock_type == 0) {
8338
8339                         /* The Samba4 nbench simulator doesn't understand
8340                            the difference between break to level2 and break
8341                            to none from level2 - it sends oplock break
8342                            replies in both cases. Don't keep logging an error
8343                            message here - just ignore it. JRA. */
8344
8345                         DEBUG(5,("reply_lockingX: Error : oplock break from "
8346                                  "client for %s (oplock=%d) and no "
8347                                  "oplock granted on this file (%s).\n",
8348                                  fsp_fnum_dbg(fsp), fsp->oplock_type,
8349                                  fsp_str_dbg(fsp)));
8350
8351                         /* if this is a pure oplock break request then don't
8352                          * send a reply */
8353                         if (num_locks == 0 && num_ulocks == 0) {
8354                                 END_PROFILE(SMBlockingX);
8355                                 return;
8356                         } else {
8357                                 END_PROFILE(SMBlockingX);
8358                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8359                                 return;
8360                         }
8361                 }
8362
8363                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8364                     (break_to_none)) {
8365                         result = remove_oplock(fsp);
8366                 } else {
8367                         result = downgrade_oplock(fsp);
8368                 }
8369
8370                 if (!result) {
8371                         DEBUG(0, ("reply_lockingX: error in removing "
8372                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
8373                         /* Hmmm. Is this panic justified? */
8374                         smb_panic("internal tdb error");
8375                 }
8376
8377                 /* if this is a pure oplock break request then don't send a
8378                  * reply */
8379                 if (num_locks == 0 && num_ulocks == 0) {
8380                         /* Sanity check - ensure a pure oplock break is not a
8381                            chained request. */
8382                         if (CVAL(req->vwv+0, 0) != 0xff) {
8383                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
8384                                          "break is a chained %d request !\n",
8385                                          (unsigned int)CVAL(req->vwv+0, 0)));
8386                         }
8387                         END_PROFILE(SMBlockingX);
8388                         return;
8389                 }
8390         }
8391
8392         if (req->buflen <
8393             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8394                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8395                 END_PROFILE(SMBlockingX);
8396                 return;
8397         }
8398
8399         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8400         if (ulocks == NULL) {
8401                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8402                 END_PROFILE(SMBlockingX);
8403                 return;
8404         }
8405
8406         locks = talloc_array(req, struct smbd_lock_element, num_locks);
8407         if (locks == NULL) {
8408                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8409                 END_PROFILE(SMBlockingX);
8410                 return;
8411         }
8412
8413         /* Data now points at the beginning of the list
8414            of smb_unlkrng structs */
8415         for(i = 0; i < (int)num_ulocks; i++) {
8416                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8417                 ulocks[i].count = get_lock_count(data, i, large_file_format);
8418                 ulocks[i].offset = get_lock_offset(data, i, large_file_format);
8419                 ulocks[i].brltype = UNLOCK_LOCK;
8420         }
8421
8422         /* Now do any requested locks */
8423         data += ((large_file_format ? 20 : 10)*num_ulocks);
8424
8425         /* Data now points at the beginning of the list
8426            of smb_lkrng structs */
8427
8428         for(i = 0; i < (int)num_locks; i++) {
8429                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8430                 locks[i].count = get_lock_count(data, i, large_file_format);
8431                 locks[i].offset = get_lock_offset(data, i, large_file_format);
8432
8433                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8434                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8435                                 locks[i].brltype = PENDING_READ_LOCK;
8436                         } else {
8437                                 locks[i].brltype = READ_LOCK;
8438                         }
8439                 } else {
8440                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8441                                 locks[i].brltype = PENDING_WRITE_LOCK;
8442                         } else {
8443                                 locks[i].brltype = WRITE_LOCK;
8444                         }
8445                 }
8446         }
8447
8448         status = smbd_do_unlocking(req, fsp, num_ulocks, ulocks);
8449         if (!NT_STATUS_IS_OK(status)) {
8450                 END_PROFILE(SMBlockingX);
8451                 reply_nterror(req, status);
8452                 return;
8453         }
8454
8455         status = smbd_do_locking(req, fsp,
8456                                  locktype, lock_timeout,
8457                                  num_locks, locks,
8458                                  &async);
8459         if (!NT_STATUS_IS_OK(status)) {
8460                 END_PROFILE(SMBlockingX);
8461                 reply_nterror(req, status);
8462                 return;
8463         }
8464         if (async) {
8465                 END_PROFILE(SMBlockingX);
8466                 return;
8467         }
8468
8469         reply_outbuf(req, 2, 0);
8470         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8471         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
8472
8473         DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8474                   fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8475
8476         END_PROFILE(SMBlockingX);
8477 }
8478
8479 #undef DBGC_CLASS
8480 #define DBGC_CLASS DBGC_ALL
8481
8482 /****************************************************************************
8483  Reply to a SMBreadbmpx (read block multiplex) request.
8484  Always reply with an error, if someone has a platform really needs this,
8485  please contact vl@samba.org
8486 ****************************************************************************/
8487
8488 void reply_readbmpx(struct smb_request *req)
8489 {
8490         START_PROFILE(SMBreadBmpx);
8491         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8492         END_PROFILE(SMBreadBmpx);
8493         return;
8494 }
8495
8496 /****************************************************************************
8497  Reply to a SMBreadbs (read block multiplex secondary) request.
8498  Always reply with an error, if someone has a platform really needs this,
8499  please contact vl@samba.org
8500 ****************************************************************************/
8501
8502 void reply_readbs(struct smb_request *req)
8503 {
8504         START_PROFILE(SMBreadBs);
8505         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8506         END_PROFILE(SMBreadBs);
8507         return;
8508 }
8509
8510 /****************************************************************************
8511  Reply to a SMBsetattrE.
8512 ****************************************************************************/
8513
8514 void reply_setattrE(struct smb_request *req)
8515 {
8516         connection_struct *conn = req->conn;
8517         struct smb_file_time ft;
8518         files_struct *fsp;
8519         NTSTATUS status;
8520
8521         START_PROFILE(SMBsetattrE);
8522         ZERO_STRUCT(ft);
8523
8524         if (req->wct < 7) {
8525                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8526                 goto out;
8527         }
8528
8529         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8530
8531         if(!fsp || (fsp->conn != conn)) {
8532                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8533                 goto out;
8534         }
8535
8536         /*
8537          * Convert the DOS times into unix times.
8538          */
8539
8540         ft.atime = convert_time_t_to_timespec(
8541             srv_make_unix_date2(req->vwv+3));
8542         ft.mtime = convert_time_t_to_timespec(
8543             srv_make_unix_date2(req->vwv+5));
8544         ft.create_time = convert_time_t_to_timespec(
8545             srv_make_unix_date2(req->vwv+1));
8546
8547         reply_outbuf(req, 0, 0);
8548
8549         /*
8550          * Patch from Ray Frush <frush@engr.colostate.edu>
8551          * Sometimes times are sent as zero - ignore them.
8552          */
8553
8554         /* Ensure we have a valid stat struct for the source. */
8555         status = vfs_stat_fsp(fsp);
8556         if (!NT_STATUS_IS_OK(status)) {
8557                 reply_nterror(req, status);
8558                 goto out;
8559         }
8560
8561         if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8562                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8563                 goto out;
8564         }
8565
8566         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8567         if (!NT_STATUS_IS_OK(status)) {
8568                 reply_nterror(req, status);
8569                 goto out;
8570         }
8571
8572         DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8573                " createtime=%u\n",
8574                 fsp_fnum_dbg(fsp),
8575                 (unsigned int)ft.atime.tv_sec,
8576                 (unsigned int)ft.mtime.tv_sec,
8577                 (unsigned int)ft.create_time.tv_sec
8578                 ));
8579  out:
8580         END_PROFILE(SMBsetattrE);
8581         return;
8582 }
8583
8584
8585 /* Back from the dead for OS/2..... JRA. */
8586
8587 /****************************************************************************
8588  Reply to a SMBwritebmpx (write block multiplex primary) request.
8589  Always reply with an error, if someone has a platform really needs this,
8590  please contact vl@samba.org
8591 ****************************************************************************/
8592
8593 void reply_writebmpx(struct smb_request *req)
8594 {
8595         START_PROFILE(SMBwriteBmpx);
8596         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8597         END_PROFILE(SMBwriteBmpx);
8598         return;
8599 }
8600
8601 /****************************************************************************
8602  Reply to a SMBwritebs (write block multiplex secondary) request.
8603  Always reply with an error, if someone has a platform really needs this,
8604  please contact vl@samba.org
8605 ****************************************************************************/
8606
8607 void reply_writebs(struct smb_request *req)
8608 {
8609         START_PROFILE(SMBwriteBs);
8610         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8611         END_PROFILE(SMBwriteBs);
8612         return;
8613 }
8614
8615 /****************************************************************************
8616  Reply to a SMBgetattrE.
8617 ****************************************************************************/
8618
8619 void reply_getattrE(struct smb_request *req)
8620 {
8621         connection_struct *conn = req->conn;
8622         int mode;
8623         files_struct *fsp;
8624         struct timespec create_ts;
8625
8626         START_PROFILE(SMBgetattrE);
8627
8628         if (req->wct < 1) {
8629                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8630                 END_PROFILE(SMBgetattrE);
8631                 return;
8632         }
8633
8634         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8635
8636         if(!fsp || (fsp->conn != conn)) {
8637                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8638                 END_PROFILE(SMBgetattrE);
8639                 return;
8640         }
8641
8642         /* Do an fstat on this file */
8643         if(fsp_stat(fsp)) {
8644                 reply_nterror(req, map_nt_error_from_unix(errno));
8645                 END_PROFILE(SMBgetattrE);
8646                 return;
8647         }
8648
8649         mode = dos_mode(conn, fsp->fsp_name);
8650
8651         /*
8652          * Convert the times into dos times. Set create
8653          * date to be last modify date as UNIX doesn't save
8654          * this.
8655          */
8656
8657         reply_outbuf(req, 11, 0);
8658
8659         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8660         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8661         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8662                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8663         /* Should we check pending modtime here ? JRA */
8664         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8665                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8666
8667         if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8668                 SIVAL(req->outbuf, smb_vwv6, 0);
8669                 SIVAL(req->outbuf, smb_vwv8, 0);
8670         } else {
8671                 uint32_t allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8672                 SIVAL(req->outbuf, smb_vwv6, (uint32_t)fsp->fsp_name->st.st_ex_size);
8673                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8674         }
8675         SSVAL(req->outbuf,smb_vwv10, mode);
8676
8677         DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8678
8679         END_PROFILE(SMBgetattrE);
8680         return;
8681 }