source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  35 #include "../librpc/gen_ndr/open_files.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "rpc_server/rpc_ncacn_np.h"
  39 #include "libcli/security/security.h"
  40 #include "libsmb/nmblib.h"
  41 #include "auth.h"
  42 #include "smbprofile.h"
  43 #include "../lib/tsocket/tsocket.h"
  44 #include "lib/tevent_wait.h"
  45 #include "libcli/smb/smb_signing.h"
  46
  47 /****************************************************************************
  48  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  49  path or anything including wildcards.
  50  We're assuming here that '/' is not the second byte in any multibyte char
  51  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  52  set.
  53 ****************************************************************************/
  54
  55 /* Custom version for processing POSIX paths. */
  56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  57
  58 static NTSTATUS check_path_syntax_internal(char *path,
  59                                            bool posix_path,
  60                                            bool *p_last_component_contains_wcard)
  61 {
  62         char *d = path;
  63         const char *s = path;
  64         NTSTATUS ret = NT_STATUS_OK;
  65         bool start_of_name_component = True;
  66         bool stream_started = false;
  67
  68         *p_last_component_contains_wcard = False;
  69
  70         while (*s) {
  71                 if (stream_started) {
  72                         switch (*s) {
  73                         case '/':
  74                         case '\\':
  75                                 return NT_STATUS_OBJECT_NAME_INVALID;
  76                         case ':':
  77                                 if (s[1] == '\0') {
  78                                         return NT_STATUS_OBJECT_NAME_INVALID;
  79                                 }
  80                                 if (strchr_m(&s[1], ':')) {
  81                                         return NT_STATUS_OBJECT_NAME_INVALID;
  82                                 }
  83                                 break;
  84                         }
  85                 }
  86
  87                 if ((*s == ':') && !posix_path && !stream_started) {
  88                         if (*p_last_component_contains_wcard) {
  89                                 return NT_STATUS_OBJECT_NAME_INVALID;
  90                         }
  91                         /* Stream names allow more characters than file names.
  92                            We're overloading posix_path here to allow a wider
  93                            range of characters. If stream_started is true this
  94                            is still a Windows path even if posix_path is true.
  95                            JRA.
  96                         */
  97                         stream_started = true;
  98                         start_of_name_component = false;
  99                         posix_path = true;
 100
 101                         if (s[1] == '\0') {
 102                                 return NT_STATUS_OBJECT_NAME_INVALID;
 103                         }
 104                 }
 105
 106                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 107                         /*
 108                          * Safe to assume is not the second part of a mb char
 109                          * as this is handled below.
 110                          */
 111                         /* Eat multiple '/' or '\\' */
 112                         while (IS_PATH_SEP(*s,posix_path)) {
 113                                 s++;
 114                         }
 115                         if ((d != path) && (*s != '\0')) {
 116                                 /* We only care about non-leading or trailing '/' or '\\' */
 117                                 *d++ = '/';
 118                         }
 119
 120                         start_of_name_component = True;
 121                         /* New component. */
 122                         *p_last_component_contains_wcard = False;
 123                         continue;
 124                 }
 125
 126                 if (start_of_name_component) {
 127                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 128                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 129
 130                                 /*
 131                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 132                                  */
 133
 134                                 /* If  we just added a '/' - delete it */
 135                                 if ((d > path) && (*(d-1) == '/')) {
 136                                         *(d-1) = '\0';
 137                                         d--;
 138                                 }
 139
 140                                 /* Are we at the start ? Can't go back further if so. */
 141                                 if (d <= path) {
 142                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 143                                         break;
 144                                 }
 145                                 /* Go back one level... */
 146                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 147                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 148                                 /* Decrement d first as d points to the *next* char to write into. */
 149                                 for (d--; d > path; d--) {
 150                                         if (*d == '/')
 151                                                 break;
 152                                 }
 153                                 s += 2; /* Else go past the .. */
 154                                 /* We're still at the start of a name component, just the previous one. */
 155                                 continue;
 156
 157                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 158                                 if (posix_path) {
 159                                         /* Eat the '.' */
 160                                         s++;
 161                                         continue;
 162                                 }
 163                         }
 164
 165                 }
 166
 167                 if (!(*s & 0x80)) {
 168                         if (!posix_path) {
 169                                 if (*s <= 0x1f || *s == '|') {
 170                                         return NT_STATUS_OBJECT_NAME_INVALID;
 171                                 }
 172                                 switch (*s) {
 173                                         case '*':
 174                                         case '?':
 175                                         case '<':
 176                                         case '>':
 177                                         case '"':
 178                                                 *p_last_component_contains_wcard = True;
 179                                                 break;
 180                                         default:
 181                                                 break;
 182                                 }
 183                         }
 184                         *d++ = *s++;
 185                 } else {
 186                         size_t siz;
 187                         /* Get the size of the next MB character. */
 188                         next_codepoint(s,&siz);
 189                         switch(siz) {
 190                                 case 5:
 191                                         *d++ = *s++;
 192                                         /*fall through*/
 193                                 case 4:
 194                                         *d++ = *s++;
 195                                         /*fall through*/
 196                                 case 3:
 197                                         *d++ = *s++;
 198                                         /*fall through*/
 199                                 case 2:
 200                                         *d++ = *s++;
 201                                         /*fall through*/
 202                                 case 1:
 203                                         *d++ = *s++;
 204                                         break;
 205                                 default:
 206                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 207                                         *d = '\0';
 208                                         return NT_STATUS_INVALID_PARAMETER;
 209                         }
 210                 }
 211                 start_of_name_component = False;
 212         }
 213
 214         *d = '\0';
 215
 216         return ret;
 217 }
 218
 219 /****************************************************************************
 220  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 221  No wildcards allowed.
 222 ****************************************************************************/
 223
 224 NTSTATUS check_path_syntax(char *path)
 225 {
 226         bool ignore;
 227         return check_path_syntax_internal(path, False, &ignore);
 228 }
 229
 230 /****************************************************************************
 231  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 232  Wildcards allowed - p_contains_wcard returns true if the last component contained
 233  a wildcard.
 234 ****************************************************************************/
 235
 236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 237 {
 238         return check_path_syntax_internal(path, False, p_contains_wcard);
 239 }
 240
 241 /****************************************************************************
 242  Check the path for a POSIX client.
 243  We're assuming here that '/' is not the second byte in any multibyte char
 244  set (a safe assumption).
 245 ****************************************************************************/
 246
 247 NTSTATUS check_path_syntax_posix(char *path)
 248 {
 249         bool ignore;
 250         return check_path_syntax_internal(path, True, &ignore);
 251 }
 252
 253 /****************************************************************************
 254  Pull a string and check the path allowing a wilcard - provide for error return.
 255 ****************************************************************************/
 256
 257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 258                         const char *base_ptr,
 259                         uint16 smb_flags2,
 260                         char **pp_dest,
 261                         const char *src,
 262                         size_t src_len,
 263                         int flags,
 264                         NTSTATUS *err,
 265                         bool *contains_wcard)
 266 {
 267         size_t ret;
 268
 269         *pp_dest = NULL;
 270
 271         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 272                                  src_len, flags);
 273
 274         if (!*pp_dest) {
 275                 *err = NT_STATUS_INVALID_PARAMETER;
 276                 return ret;
 277         }
 278
 279         *contains_wcard = False;
 280
 281         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 282                 /*
 283                  * For a DFS path the function parse_dfs_path()
 284                  * will do the path processing, just make a copy.
 285                  */
 286                 *err = NT_STATUS_OK;
 287                 return ret;
 288         }
 289
 290         if (lp_posix_pathnames()) {
 291                 *err = check_path_syntax_posix(*pp_dest);
 292         } else {
 293                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 294         }
 295
 296         return ret;
 297 }
 298
 299 /****************************************************************************
 300  Pull a string and check the path - provide for error return.
 301 ****************************************************************************/
 302
 303 size_t srvstr_get_path(TALLOC_CTX *ctx,
 304                         const char *base_ptr,
 305                         uint16 smb_flags2,
 306                         char **pp_dest,
 307                         const char *src,
 308                         size_t src_len,
 309                         int flags,
 310                         NTSTATUS *err)
 311 {
 312         bool ignore;
 313         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 314                                      src_len, flags, err, &ignore);
 315 }
 316
 317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 318                                  char **pp_dest, const char *src, int flags,
 319                                  NTSTATUS *err, bool *contains_wcard)
 320 {
 321         ssize_t bufrem = smbreq_bufrem(req, src);
 322
 323         if (bufrem < 0) {
 324                 *err = NT_STATUS_INVALID_PARAMETER;
 325                 return 0;
 326         }
 327
 328         return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
 329                                      req->flags2, pp_dest, src, bufrem, flags,
 330                                      err, contains_wcard);
 331 }
 332
 333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 334                            char **pp_dest, const char *src, int flags,
 335                            NTSTATUS *err)
 336 {
 337         bool ignore;
 338         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 339                                          flags, err, &ignore);
 340 }
 341
 342 /**
 343  * pull a string from the smb_buf part of a packet. In this case the
 344  * string can either be null terminated or it can be terminated by the
 345  * end of the smbbuf area
 346  */
 347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
 348                               char **dest, const char *src, int flags)
 349 {
 350         ssize_t bufrem = smbreq_bufrem(req, src);
 351
 352         if (bufrem < 0) {
 353                 return 0;
 354         }
 355
 356         return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
 357                                   bufrem, flags);
 358 }
 359
 360 /****************************************************************************
 361  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 362 ****************************************************************************/
 363
 364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 365                     files_struct *fsp)
 366 {
 367         if ((fsp == NULL) || (conn == NULL)) {
 368                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 369                 return False;
 370         }
 371         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 372                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 373                 return False;
 374         }
 375         return True;
 376 }
 377
 378 /****************************************************************************
 379  Check if we have a correct fsp pointing to a file.
 380 ****************************************************************************/
 381
 382 bool check_fsp(connection_struct *conn, struct smb_request *req,
 383                files_struct *fsp)
 384 {
 385         if (!check_fsp_open(conn, req, fsp)) {
 386                 return False;
 387         }
 388         if (fsp->is_directory) {
 389                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 390                 return False;
 391         }
 392         if (fsp->fh->fd == -1) {
 393                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 394                 return False;
 395         }
 396         fsp->num_smb_operations++;
 397         return True;
 398 }
 399
 400 /****************************************************************************
 401  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 402  the CHECK_NTQUOTA_HANDLE_OK macro.
 403 ****************************************************************************/
 404
 405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 406                               files_struct *fsp)
 407 {
 408         if (!check_fsp_open(conn, req, fsp)) {
 409                 return false;
 410         }
 411
 412         if (fsp->is_directory) {
 413                 return false;
 414         }
 415
 416         if (fsp->fake_file_handle == NULL) {
 417                 return false;
 418         }
 419
 420         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 421                 return false;
 422         }
 423
 424         if (fsp->fake_file_handle->private_data == NULL) {
 425                 return false;
 426         }
 427
 428         return true;
 429 }
 430
 431 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 432                                      const char *name, int name_type)
 433 {
 434         char *trim_name;
 435         char *trim_name_type;
 436         const char *retarget_parm;
 437         char *retarget;
 438         char *p;
 439         int retarget_type = 0x20;
 440         int retarget_port = NBT_SMB_PORT;
 441         struct sockaddr_storage retarget_addr;
 442         struct sockaddr_in *in_addr;
 443         bool ret = false;
 444         uint8_t outbuf[10];
 445
 446         if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
 447                 return false;
 448         }
 449
 450         trim_name = talloc_strdup(talloc_tos(), name);
 451         if (trim_name == NULL) {
 452                 goto fail;
 453         }
 454         trim_char(trim_name, ' ', ' ');
 455
 456         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 457                                          name_type);
 458         if (trim_name_type == NULL) {
 459                 goto fail;
 460         }
 461
 462         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 463                                              trim_name_type, NULL);
 464         if (retarget_parm == NULL) {
 465                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 466                                                      trim_name, NULL);
 467         }
 468         if (retarget_parm == NULL) {
 469                 goto fail;
 470         }
 471
 472         retarget = talloc_strdup(trim_name, retarget_parm);
 473         if (retarget == NULL) {
 474                 goto fail;
 475         }
 476
 477         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 478
 479         p = strchr(retarget, ':');
 480         if (p != NULL) {
 481                 *p++ = '\0';
 482                 retarget_port = atoi(p);
 483         }
 484
 485         p = strchr_m(retarget, '#');
 486         if (p != NULL) {
 487                 *p++ = '\0';
 488                 if (sscanf(p, "%x", &retarget_type) != 1) {
 489                         goto fail;
 490                 }
 491         }
 492
 493         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 494         if (!ret) {
 495                 DEBUG(10, ("could not resolve %s\n", retarget));
 496                 goto fail;
 497         }
 498
 499         if (retarget_addr.ss_family != AF_INET) {
 500                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 501                 goto fail;
 502         }
 503
 504         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 505
 506         _smb_setlen(outbuf, 6);
 507         SCVAL(outbuf, 0, 0x84);
 508         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 509         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 510
 511         if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
 512                           NULL)) {
 513                 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
 514                                     "failed.");
 515         }
 516
 517         ret = true;
 518  fail:
 519         TALLOC_FREE(trim_name);
 520         return ret;
 521 }
 522
 523 static void reply_called_name_not_present(char *outbuf)
 524 {
 525         smb_setlen(outbuf, 1);
 526         SCVAL(outbuf, 0, 0x83);
 527         SCVAL(outbuf, 4, 0x82);
 528 }
 529
 530 /****************************************************************************
 531  Reply to a (netbios-level) special message.
 532 ****************************************************************************/
 533
 534 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
 535 {
 536         int msg_type = CVAL(inbuf,0);
 537         int msg_flags = CVAL(inbuf,1);
 538         /*
 539          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 540          * calculation & friends (srv_send_smb uses that) we need the full smb
 541          * header.
 542          */
 543         char outbuf[smb_size];
 544
 545         memset(outbuf, '\0', sizeof(outbuf));
 546
 547         smb_setlen(outbuf,0);
 548
 549         switch (msg_type) {
 550         case NBSSrequest: /* session request */
 551         {
 552                 /* inbuf_size is guarenteed to be at least 4. */
 553                 fstring name1,name2;
 554                 int name_type1, name_type2;
 555                 int name_len1, name_len2;
 556
 557                 *name1 = *name2 = 0;
 558
 559                 if (sconn->nbt.got_session) {
 560                         exit_server_cleanly("multiple session request not permitted");
 561                 }
 562
 563                 SCVAL(outbuf,0,NBSSpositive);
 564                 SCVAL(outbuf,3,0);
 565
 566                 /* inbuf_size is guaranteed to be at least 4. */
 567                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 568                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 569                         DEBUG(0,("Invalid name length in session request\n"));
 570                         reply_called_name_not_present(outbuf);
 571                         break;
 572                 }
 573                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 574                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 575                         DEBUG(0,("Invalid name length in session request\n"));
 576                         reply_called_name_not_present(outbuf);
 577                         break;
 578                 }
 579
 580                 name_type1 = name_extract((unsigned char *)inbuf,
 581                                 inbuf_size,(unsigned int)4,name1);
 582                 name_type2 = name_extract((unsigned char *)inbuf,
 583                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 584
 585                 if (name_type1 == -1 || name_type2 == -1) {
 586                         DEBUG(0,("Invalid name type in session request\n"));
 587                         reply_called_name_not_present(outbuf);
 588                         break;
 589                 }
 590
 591                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 592                          name1, name_type1, name2, name_type2));
 593
 594                 if (netbios_session_retarget(sconn, name1, name_type1)) {
 595                         exit_server_cleanly("retargeted client");
 596                 }
 597
 598                 /*
 599                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 600                  * "*SMBSERV" arrggg!!!
 601                  */
 602                 if (strequal(name1, "*SMBSERVER     ")
 603                     || strequal(name1, "*SMBSERV       "))  {
 604                         char *raddr;
 605
 606                         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
 607                                                                  talloc_tos());
 608                         if (raddr == NULL) {
 609                                 exit_server_cleanly("could not allocate raddr");
 610                         }
 611
 612                         fstrcpy(name1, raddr);
 613                 }
 614
 615                 set_local_machine_name(name1, True);
 616                 set_remote_machine_name(name2, True);
 617
 618                 if (is_ipaddress(sconn->remote_hostname)) {
 619                         char *p = discard_const_p(char, sconn->remote_hostname);
 620
 621                         talloc_free(p);
 622
 623                         sconn->remote_hostname = talloc_strdup(sconn,
 624                                                 get_remote_machine_name());
 625                         if (sconn->remote_hostname == NULL) {
 626                                 exit_server_cleanly("could not copy remote name");
 627                         }
 628                         sconn->conn->remote_hostname = sconn->remote_hostname;
 629                 }
 630
 631                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 632                          get_local_machine_name(), get_remote_machine_name(),
 633                          name_type2));
 634
 635                 if (name_type2 == 'R') {
 636                         /* We are being asked for a pathworks session ---
 637                            no thanks! */
 638                         reply_called_name_not_present(outbuf);
 639                         break;
 640                 }
 641
 642                 reload_services(sconn, conn_snum_used, true);
 643                 reopen_logs();
 644
 645                 sconn->nbt.got_session = true;
 646                 break;
 647         }
 648
 649         case 0x89: /* session keepalive request
 650                       (some old clients produce this?) */
 651                 SCVAL(outbuf,0,NBSSkeepalive);
 652                 SCVAL(outbuf,3,0);
 653                 break;
 654
 655         case NBSSpositive: /* positive session response */
 656         case NBSSnegative: /* negative session response */
 657         case NBSSretarget: /* retarget session response */
 658                 DEBUG(0,("Unexpected session response\n"));
 659                 break;
 660
 661         case NBSSkeepalive: /* session keepalive */
 662         default:
 663                 return;
 664         }
 665
 666         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 667                     msg_type, msg_flags));
 668
 669         srv_send_smb(sconn, outbuf, false, 0, false, NULL);
 670
 671         if (CVAL(outbuf, 0) != 0x82) {
 672                 exit_server_cleanly("invalid netbios session");
 673         }
 674         return;
 675 }
 676
 677 /****************************************************************************
 678  Reply to a tcon.
 679  conn POINTER CAN BE NULL HERE !
 680 ****************************************************************************/
 681
 682 void reply_tcon(struct smb_request *req)
 683 {
 684         connection_struct *conn = req->conn;
 685         const char *service;
 686         char *service_buf = NULL;
 687         char *password = NULL;
 688         char *dev = NULL;
 689         int pwlen=0;
 690         NTSTATUS nt_status;
 691         const char *p;
 692         TALLOC_CTX *ctx = talloc_tos();
 693         struct smbd_server_connection *sconn = req->sconn;
 694         NTTIME now = timeval_to_nttime(&req->request_time);
 695
 696         START_PROFILE(SMBtcon);
 697
 698         if (req->buflen < 4) {
 699                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 700                 END_PROFILE(SMBtcon);
 701                 return;
 702         }
 703
 704         p = (const char *)req->buf + 1;
 705         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 706         p += 1;
 707         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 708         p += pwlen+1;
 709         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 710         p += 1;
 711
 712         if (service_buf == NULL || password == NULL || dev == NULL) {
 713                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 714                 END_PROFILE(SMBtcon);
 715                 return;
 716         }
 717         p = strrchr_m(service_buf,'\\');
 718         if (p) {
 719                 service = p+1;
 720         } else {
 721                 service = service_buf;
 722         }
 723
 724         conn = make_connection(sconn, now, service, dev,
 725                                req->vuid,&nt_status);
 726         req->conn = conn;
 727
 728         if (!conn) {
 729                 reply_nterror(req, nt_status);
 730                 END_PROFILE(SMBtcon);
 731                 return;
 732         }
 733
 734         reply_outbuf(req, 2, 0);
 735         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 736         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 737         SSVAL(req->outbuf,smb_tid,conn->cnum);
 738
 739         DEBUG(3,("tcon service=%s cnum=%d\n",
 740                  service, conn->cnum));
 741
 742         END_PROFILE(SMBtcon);
 743         return;
 744 }
 745
 746 /****************************************************************************
 747  Reply to a tcon and X.
 748  conn POINTER CAN BE NULL HERE !
 749 ****************************************************************************/
 750
 751 void reply_tcon_and_X(struct smb_request *req)
 752 {
 753         connection_struct *conn = req->conn;
 754         const char *service = NULL;
 755         TALLOC_CTX *ctx = talloc_tos();
 756         /* what the cleint thinks the device is */
 757         char *client_devicetype = NULL;
 758         /* what the server tells the client the share represents */
 759         const char *server_devicetype;
 760         NTSTATUS nt_status;
 761         int passlen;
 762         char *path = NULL;
 763         const char *p, *q;
 764         uint16_t tcon_flags;
 765         struct smbXsrv_session *session = NULL;
 766         NTTIME now = timeval_to_nttime(&req->request_time);
 767         bool session_key_updated = false;
 768         uint16_t optional_support = 0;
 769         struct smbd_server_connection *sconn = req->sconn;
 770
 771         START_PROFILE(SMBtconX);
 772
 773         if (req->wct < 4) {
 774                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 775                 END_PROFILE(SMBtconX);
 776                 return;
 777         }
 778
 779         passlen = SVAL(req->vwv+3, 0);
 780         tcon_flags = SVAL(req->vwv+2, 0);
 781
 782         /* we might have to close an old one */
 783         if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
 784                 struct smbXsrv_tcon *tcon;
 785                 NTSTATUS status;
 786
 787                 tcon = conn->tcon;
 788                 req->conn = NULL;
 789                 conn = NULL;
 790
 791                 /*
 792                  * TODO: cancel all outstanding requests on the tcon
 793                  */
 794                 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
 795                 if (!NT_STATUS_IS_OK(status)) {
 796                         DEBUG(0, ("reply_tcon_and_X: "
 797                                   "smbXsrv_tcon_disconnect() failed: %s\n",
 798                                   nt_errstr(status)));
 799                         /*
 800                          * If we hit this case, there is something completely
 801                          * wrong, so we better disconnect the transport connection.
 802                          */
 803                         END_PROFILE(SMBtconX);
 804                         exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
 805                         return;
 806                 }
 807
 808                 TALLOC_FREE(tcon);
 809         }
 810
 811         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 812                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 813                 END_PROFILE(SMBtconX);
 814                 return;
 815         }
 816
 817         if (sconn->smb1.negprot.encrypted_passwords) {
 818                 p = (const char *)req->buf + passlen;
 819         } else {
 820                 p = (const char *)req->buf + passlen + 1;
 821         }
 822
 823         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 824
 825         if (path == NULL) {
 826                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 827                 END_PROFILE(SMBtconX);
 828                 return;
 829         }
 830
 831         /*
 832          * the service name can be either: \\server\share
 833          * or share directly like on the DELL PowerVault 705
 834          */
 835         if (*path=='\\') {
 836                 q = strchr_m(path+2,'\\');
 837                 if (!q) {
 838                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 839                         END_PROFILE(SMBtconX);
 840                         return;
 841                 }
 842                 service = q+1;
 843         } else {
 844                 service = path;
 845         }
 846
 847         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 848                                 &client_devicetype, p,
 849                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 850
 851         if (client_devicetype == NULL) {
 852                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 853                 END_PROFILE(SMBtconX);
 854                 return;
 855         }
 856
 857         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 858
 859         nt_status = smb1srv_session_lookup(req->sconn->conn,
 860                                            req->vuid, now, &session);
 861         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
 862                 reply_force_doserror(req, ERRSRV, ERRbaduid);
 863                 END_PROFILE(SMBtconX);
 864                 return;
 865         }
 866         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 867                 reply_nterror(req, nt_status);
 868                 END_PROFILE(SMBtconX);
 869                 return;
 870         }
 871         if (!NT_STATUS_IS_OK(nt_status)) {
 872                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 873                 END_PROFILE(SMBtconX);
 874                 return;
 875         }
 876
 877         if (session->global->auth_session_info == NULL) {
 878                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 879                 END_PROFILE(SMBtconX);
 880                 return;
 881         }
 882
 883         /*
 884          * If there is no application key defined yet
 885          * we create one.
 886          *
 887          * This means we setup the application key on the
 888          * first tcon that happens via the given session.
 889          *
 890          * Once the application key is defined, it does not
 891          * change any more.
 892          */
 893         if (session->global->application_key.length == 0 &&
 894             session->global->signing_key.length > 0)
 895         {
 896                 struct smbXsrv_session *x = session;
 897                 struct auth_session_info *session_info =
 898                         session->global->auth_session_info;
 899                 uint8_t session_key[16];
 900
 901                 ZERO_STRUCT(session_key);
 902                 memcpy(session_key, x->global->signing_key.data,
 903                        MIN(x->global->signing_key.length, sizeof(session_key)));
 904
 905                 /*
 906                  * The application key is truncated/padded to 16 bytes
 907                  */
 908                 x->global->application_key = data_blob_talloc(x->global,
 909                                                              session_key,
 910                                                              sizeof(session_key));
 911                 ZERO_STRUCT(session_key);
 912                 if (x->global->application_key.data == NULL) {
 913                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 914                         END_PROFILE(SMBtconX);
 915                         return;
 916                 }
 917
 918                 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
 919                         smb_key_derivation(x->global->application_key.data,
 920                                            x->global->application_key.length,
 921                                            x->global->application_key.data);
 922                         optional_support |= SMB_EXTENDED_SIGNATURES;
 923                 }
 924
 925                 /*
 926                  * Place the application key into the session_info
 927                  */
 928                 data_blob_clear_free(&session_info->session_key);
 929                 session_info->session_key = data_blob_dup_talloc(session_info,
 930                                                 x->global->application_key);
 931                 if (session_info->session_key.data == NULL) {
 932                         data_blob_clear_free(&x->global->application_key);
 933                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 934                         END_PROFILE(SMBtconX);
 935                         return;
 936                 }
 937                 session_key_updated = true;
 938         }
 939
 940         conn = make_connection(sconn, now, service, client_devicetype,
 941                                req->vuid, &nt_status);
 942         req->conn =conn;
 943
 944         if (!conn) {
 945                 if (session_key_updated) {
 946                         struct smbXsrv_session *x = session;
 947                         struct auth_session_info *session_info =
 948                                 session->global->auth_session_info;
 949                         data_blob_clear_free(&x->global->application_key);
 950                         data_blob_clear_free(&session_info->session_key);
 951                 }
 952                 reply_nterror(req, nt_status);
 953                 END_PROFILE(SMBtconX);
 954                 return;
 955         }
 956
 957         if ( IS_IPC(conn) )
 958                 server_devicetype = "IPC";
 959         else if ( IS_PRINT(conn) )
 960                 server_devicetype = "LPT1:";
 961         else
 962                 server_devicetype = "A:";
 963
 964         if (get_Protocol() < PROTOCOL_NT1) {
 965                 reply_outbuf(req, 2, 0);
 966                 if (message_push_string(&req->outbuf, server_devicetype,
 967                                         STR_TERMINATE|STR_ASCII) == -1) {
 968                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 969                         END_PROFILE(SMBtconX);
 970                         return;
 971                 }
 972         } else {
 973                 /* NT sets the fstype of IPC$ to the null string */
 974                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(ctx, SNUM(conn));
 975
 976                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 977                         /* Return permissions. */
 978                         uint32 perm1 = 0;
 979                         uint32 perm2 = 0;
 980
 981                         reply_outbuf(req, 7, 0);
 982
 983                         if (IS_IPC(conn)) {
 984                                 perm1 = FILE_ALL_ACCESS;
 985                                 perm2 = FILE_ALL_ACCESS;
 986                         } else {
 987                                 perm1 = conn->share_access;
 988                         }
 989
 990                         SIVAL(req->outbuf, smb_vwv3, perm1);
 991                         SIVAL(req->outbuf, smb_vwv5, perm2);
 992                 } else {
 993                         reply_outbuf(req, 3, 0);
 994                 }
 995
 996                 if ((message_push_string(&req->outbuf, server_devicetype,
 997                                          STR_TERMINATE|STR_ASCII) == -1)
 998                     || (message_push_string(&req->outbuf, fstype,
 999                                             STR_TERMINATE) == -1)) {
1000                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1001                         END_PROFILE(SMBtconX);
1002                         return;
1003                 }
1004
1005                 /* what does setting this bit do? It is set by NT4 and
1006                    may affect the ability to autorun mounted cdroms */
1007                 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1008                 optional_support |=
1009                         (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1010
1011                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1012                         DEBUG(2,("Serving %s as a Dfs root\n",
1013                                  lp_servicename(ctx, SNUM(conn)) ));
1014                         optional_support |= SMB_SHARE_IN_DFS;
1015                 }
1016
1017                 SSVAL(req->outbuf, smb_vwv2, optional_support);
1018         }
1019
1020         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1021         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
1022
1023         DEBUG(3,("tconX service=%s \n",
1024                  service));
1025
1026         /* set the incoming and outgoing tid to the just created one */
1027         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1028         SSVAL(req->outbuf,smb_tid,conn->cnum);
1029
1030         END_PROFILE(SMBtconX);
1031
1032         req->tid = conn->cnum;
1033 }
1034
1035 /****************************************************************************
1036  Reply to an unknown type.
1037 ****************************************************************************/
1038
1039 void reply_unknown_new(struct smb_request *req, uint8 type)
1040 {
1041         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1042                   smb_fn_name(type), type, type));
1043         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1044         return;
1045 }
1046
1047 /****************************************************************************
1048  Reply to an ioctl.
1049  conn POINTER CAN BE NULL HERE !
1050 ****************************************************************************/
1051
1052 void reply_ioctl(struct smb_request *req)
1053 {
1054         connection_struct *conn = req->conn;
1055         uint16 device;
1056         uint16 function;
1057         uint32 ioctl_code;
1058         int replysize;
1059         char *p;
1060
1061         START_PROFILE(SMBioctl);
1062
1063         if (req->wct < 3) {
1064                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1065                 END_PROFILE(SMBioctl);
1066                 return;
1067         }
1068
1069         device     = SVAL(req->vwv+1, 0);
1070         function   = SVAL(req->vwv+2, 0);
1071         ioctl_code = (device << 16) + function;
1072
1073         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1074
1075         switch (ioctl_code) {
1076             case IOCTL_QUERY_JOB_INFO:
1077                     replysize = 32;
1078                     break;
1079             default:
1080                     reply_force_doserror(req, ERRSRV, ERRnosupport);
1081                     END_PROFILE(SMBioctl);
1082                     return;
1083         }
1084
1085         reply_outbuf(req, 8, replysize+1);
1086         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1087         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1088         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
1089         p = smb_buf(req->outbuf);
1090         memset(p, '\0', replysize+1); /* valgrind-safe. */
1091         p += 1;          /* Allow for alignment */
1092
1093         switch (ioctl_code) {
1094                 case IOCTL_QUERY_JOB_INFO:
1095                 {
1096                         files_struct *fsp = file_fsp(
1097                                 req, SVAL(req->vwv+0, 0));
1098                         if (!fsp) {
1099                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1100                                 END_PROFILE(SMBioctl);
1101                                 return;
1102                         }
1103                         /* Job number */
1104                         SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1105
1106                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
1107                                     lp_netbios_name(), 15,
1108                                     STR_TERMINATE|STR_ASCII);
1109                         if (conn) {
1110                                 srvstr_push((char *)req->outbuf, req->flags2,
1111                                             p+18,
1112                                             lp_servicename(talloc_tos(),
1113                                                            SNUM(conn)),
1114                                             13, STR_TERMINATE|STR_ASCII);
1115                         } else {
1116                                 memset(p+18, 0, 13);
1117                         }
1118                         break;
1119                 }
1120         }
1121
1122         END_PROFILE(SMBioctl);
1123         return;
1124 }
1125
1126 /****************************************************************************
1127  Strange checkpath NTSTATUS mapping.
1128 ****************************************************************************/
1129
1130 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1131 {
1132         /* Strange DOS error code semantics only for checkpath... */
1133         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1134                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1135                         /* We need to map to ERRbadpath */
1136                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1137                 }
1138         }
1139         return status;
1140 }
1141
1142 /****************************************************************************
1143  Reply to a checkpath.
1144 ****************************************************************************/
1145
1146 void reply_checkpath(struct smb_request *req)
1147 {
1148         connection_struct *conn = req->conn;
1149         struct smb_filename *smb_fname = NULL;
1150         char *name = NULL;
1151         NTSTATUS status;
1152         TALLOC_CTX *ctx = talloc_tos();
1153
1154         START_PROFILE(SMBcheckpath);
1155
1156         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1157                             STR_TERMINATE, &status);
1158
1159         if (!NT_STATUS_IS_OK(status)) {
1160                 status = map_checkpath_error(req->flags2, status);
1161                 reply_nterror(req, status);
1162                 END_PROFILE(SMBcheckpath);
1163                 return;
1164         }
1165
1166         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1167
1168         status = filename_convert(ctx,
1169                                 conn,
1170                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1171                                 name,
1172                                 0,
1173                                 NULL,
1174                                 &smb_fname);
1175
1176         if (!NT_STATUS_IS_OK(status)) {
1177                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1178                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1179                                         ERRSRV, ERRbadpath);
1180                         END_PROFILE(SMBcheckpath);
1181                         return;
1182                 }
1183                 goto path_err;
1184         }
1185
1186         if (!VALID_STAT(smb_fname->st) &&
1187             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1188                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1189                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1190                 status = map_nt_error_from_unix(errno);
1191                 goto path_err;
1192         }
1193
1194         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1195                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1196                                 ERRDOS, ERRbadpath);
1197                 goto out;
1198         }
1199
1200         reply_outbuf(req, 0, 0);
1201
1202  path_err:
1203         /* We special case this - as when a Windows machine
1204                 is parsing a path is steps through the components
1205                 one at a time - if a component fails it expects
1206                 ERRbadpath, not ERRbadfile.
1207         */
1208         status = map_checkpath_error(req->flags2, status);
1209         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1210                 /*
1211                  * Windows returns different error codes if
1212                  * the parent directory is valid but not the
1213                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1214                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1215                  * if the path is invalid.
1216                  */
1217                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1218                                 ERRDOS, ERRbadpath);
1219                 goto out;
1220         }
1221
1222         reply_nterror(req, status);
1223
1224  out:
1225         TALLOC_FREE(smb_fname);
1226         END_PROFILE(SMBcheckpath);
1227         return;
1228 }
1229
1230 /****************************************************************************
1231  Reply to a getatr.
1232 ****************************************************************************/
1233
1234 void reply_getatr(struct smb_request *req)
1235 {
1236         connection_struct *conn = req->conn;
1237         struct smb_filename *smb_fname = NULL;
1238         char *fname = NULL;
1239         int mode=0;
1240         off_t size=0;
1241         time_t mtime=0;
1242         const char *p;
1243         NTSTATUS status;
1244         TALLOC_CTX *ctx = talloc_tos();
1245         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1246
1247         START_PROFILE(SMBgetatr);
1248
1249         p = (const char *)req->buf + 1;
1250         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1251         if (!NT_STATUS_IS_OK(status)) {
1252                 reply_nterror(req, status);
1253                 goto out;
1254         }
1255
1256         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1257                 under WfWg - weird! */
1258         if (*fname == '\0') {
1259                 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1260                 if (!CAN_WRITE(conn)) {
1261                         mode |= FILE_ATTRIBUTE_READONLY;
1262                 }
1263                 size = 0;
1264                 mtime = 0;
1265         } else {
1266                 status = filename_convert(ctx,
1267                                 conn,
1268                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1269                                 fname,
1270                                 0,
1271                                 NULL,
1272                                 &smb_fname);
1273                 if (!NT_STATUS_IS_OK(status)) {
1274                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1275                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1276                                                 ERRSRV, ERRbadpath);
1277                                 goto out;
1278                         }
1279                         reply_nterror(req, status);
1280                         goto out;
1281                 }
1282                 if (!VALID_STAT(smb_fname->st) &&
1283                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1284                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1285                                  smb_fname_str_dbg(smb_fname),
1286                                  strerror(errno)));
1287                         reply_nterror(req,  map_nt_error_from_unix(errno));
1288                         goto out;
1289                 }
1290
1291                 mode = dos_mode(conn, smb_fname);
1292                 size = smb_fname->st.st_ex_size;
1293
1294                 if (ask_sharemode) {
1295                         struct timespec write_time_ts;
1296                         struct file_id fileid;
1297
1298                         ZERO_STRUCT(write_time_ts);
1299                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1300                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1301                         if (!null_timespec(write_time_ts)) {
1302                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1303                         }
1304                 }
1305
1306                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1307                 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1308                         size = 0;
1309                 }
1310         }
1311
1312         reply_outbuf(req, 10, 0);
1313
1314         SSVAL(req->outbuf,smb_vwv0,mode);
1315         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1316                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1317         } else {
1318                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1319         }
1320         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1321
1322         if (get_Protocol() >= PROTOCOL_NT1) {
1323                 SSVAL(req->outbuf, smb_flg2,
1324                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1325         }
1326
1327         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1328                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1329
1330  out:
1331         TALLOC_FREE(smb_fname);
1332         TALLOC_FREE(fname);
1333         END_PROFILE(SMBgetatr);
1334         return;
1335 }
1336
1337 /****************************************************************************
1338  Reply to a setatr.
1339 ****************************************************************************/
1340
1341 void reply_setatr(struct smb_request *req)
1342 {
1343         struct smb_file_time ft;
1344         connection_struct *conn = req->conn;
1345         struct smb_filename *smb_fname = NULL;
1346         char *fname = NULL;
1347         int mode;
1348         time_t mtime;
1349         const char *p;
1350         NTSTATUS status;
1351         TALLOC_CTX *ctx = talloc_tos();
1352
1353         START_PROFILE(SMBsetatr);
1354
1355         ZERO_STRUCT(ft);
1356
1357         if (req->wct < 2) {
1358                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1359                 goto out;
1360         }
1361
1362         p = (const char *)req->buf + 1;
1363         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1364         if (!NT_STATUS_IS_OK(status)) {
1365                 reply_nterror(req, status);
1366                 goto out;
1367         }
1368
1369         status = filename_convert(ctx,
1370                                 conn,
1371                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1372                                 fname,
1373                                 0,
1374                                 NULL,
1375                                 &smb_fname);
1376         if (!NT_STATUS_IS_OK(status)) {
1377                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1378                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1379                                         ERRSRV, ERRbadpath);
1380                         goto out;
1381                 }
1382                 reply_nterror(req, status);
1383                 goto out;
1384         }
1385
1386         if (smb_fname->base_name[0] == '.' &&
1387             smb_fname->base_name[1] == '\0') {
1388                 /*
1389                  * Not sure here is the right place to catch this
1390                  * condition. Might be moved to somewhere else later -- vl
1391                  */
1392                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1393                 goto out;
1394         }
1395
1396         mode = SVAL(req->vwv+0, 0);
1397         mtime = srv_make_unix_date3(req->vwv+1);
1398
1399         if (mode != FILE_ATTRIBUTE_NORMAL) {
1400                 if (VALID_STAT_OF_DIR(smb_fname->st))
1401                         mode |= FILE_ATTRIBUTE_DIRECTORY;
1402                 else
1403                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1404
1405                 status = check_access(conn, NULL, smb_fname,
1406                                         FILE_WRITE_ATTRIBUTES);
1407                 if (!NT_STATUS_IS_OK(status)) {
1408                         reply_nterror(req, status);
1409                         goto out;
1410                 }
1411
1412                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1413                                      false) != 0) {
1414                         reply_nterror(req, map_nt_error_from_unix(errno));
1415                         goto out;
1416                 }
1417         }
1418
1419         ft.mtime = convert_time_t_to_timespec(mtime);
1420         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1421         if (!NT_STATUS_IS_OK(status)) {
1422                 reply_nterror(req, status);
1423                 goto out;
1424         }
1425
1426         reply_outbuf(req, 0, 0);
1427
1428         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1429                  mode));
1430  out:
1431         TALLOC_FREE(smb_fname);
1432         END_PROFILE(SMBsetatr);
1433         return;
1434 }
1435
1436 /****************************************************************************
1437  Reply to a dskattr.
1438 ****************************************************************************/
1439
1440 void reply_dskattr(struct smb_request *req)
1441 {
1442         connection_struct *conn = req->conn;
1443         uint64_t dfree,dsize,bsize;
1444         START_PROFILE(SMBdskattr);
1445
1446         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1447                 reply_nterror(req, map_nt_error_from_unix(errno));
1448                 END_PROFILE(SMBdskattr);
1449                 return;
1450         }
1451
1452         reply_outbuf(req, 5, 0);
1453
1454         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1455                 double total_space, free_space;
1456                 /* we need to scale this to a number that DOS6 can handle. We
1457                    use floating point so we can handle large drives on systems
1458                    that don't have 64 bit integers
1459
1460                    we end up displaying a maximum of 2G to DOS systems
1461                 */
1462                 total_space = dsize * (double)bsize;
1463                 free_space = dfree * (double)bsize;
1464
1465                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1466                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1467
1468                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1469                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1470
1471                 SSVAL(req->outbuf,smb_vwv0,dsize);
1472                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1473                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1474                 SSVAL(req->outbuf,smb_vwv3,dfree);
1475         } else {
1476                 SSVAL(req->outbuf,smb_vwv0,dsize);
1477                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1478                 SSVAL(req->outbuf,smb_vwv2,512);
1479                 SSVAL(req->outbuf,smb_vwv3,dfree);
1480         }
1481
1482         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1483
1484         END_PROFILE(SMBdskattr);
1485         return;
1486 }
1487
1488 /*
1489  * Utility function to split the filename from the directory.
1490  */
1491 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1492                                      char **fname_dir_out,
1493                                      char **fname_mask_out)
1494 {
1495         const char *p = NULL;
1496         char *fname_dir = NULL;
1497         char *fname_mask = NULL;
1498
1499         p = strrchr_m(fname_in, '/');
1500         if (!p) {
1501                 fname_dir = talloc_strdup(ctx, ".");
1502                 fname_mask = talloc_strdup(ctx, fname_in);
1503         } else {
1504                 fname_dir = talloc_strndup(ctx, fname_in,
1505                     PTR_DIFF(p, fname_in));
1506                 fname_mask = talloc_strdup(ctx, p+1);
1507         }
1508
1509         if (!fname_dir || !fname_mask) {
1510                 TALLOC_FREE(fname_dir);
1511                 TALLOC_FREE(fname_mask);
1512                 return NT_STATUS_NO_MEMORY;
1513         }
1514
1515         *fname_dir_out = fname_dir;
1516         *fname_mask_out = fname_mask;
1517         return NT_STATUS_OK;
1518 }
1519
1520 /****************************************************************************
1521  Reply to a search.
1522  Can be called from SMBsearch, SMBffirst or SMBfunique.
1523 ****************************************************************************/
1524
1525 void reply_search(struct smb_request *req)
1526 {
1527         connection_struct *conn = req->conn;
1528         char *path = NULL;
1529         const char *mask = NULL;
1530         char *directory = NULL;
1531         struct smb_filename *smb_fname = NULL;
1532         char *fname = NULL;
1533         off_t size;
1534         uint32 mode;
1535         struct timespec date;
1536         uint32 dirtype;
1537         unsigned int numentries = 0;
1538         unsigned int maxentries = 0;
1539         bool finished = False;
1540         const char *p;
1541         int status_len;
1542         char status[21];
1543         int dptr_num= -1;
1544         bool check_descend = False;
1545         bool expect_close = False;
1546         NTSTATUS nt_status;
1547         bool mask_contains_wcard = False;
1548         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1549         TALLOC_CTX *ctx = talloc_tos();
1550         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1551         struct dptr_struct *dirptr = NULL;
1552         struct smbd_server_connection *sconn = req->sconn;
1553
1554         START_PROFILE(SMBsearch);
1555
1556         if (req->wct < 2) {
1557                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1558                 goto out;
1559         }
1560
1561         if (lp_posix_pathnames()) {
1562                 reply_unknown_new(req, req->cmd);
1563                 goto out;
1564         }
1565
1566         /* If we were called as SMBffirst then we must expect close. */
1567         if(req->cmd == SMBffirst) {
1568                 expect_close = True;
1569         }
1570
1571         reply_outbuf(req, 1, 3);
1572         maxentries = SVAL(req->vwv+0, 0);
1573         dirtype = SVAL(req->vwv+1, 0);
1574         p = (const char *)req->buf + 1;
1575         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1576                                        &nt_status, &mask_contains_wcard);
1577         if (!NT_STATUS_IS_OK(nt_status)) {
1578                 reply_nterror(req, nt_status);
1579                 goto out;
1580         }
1581
1582         p++;
1583         status_len = SVAL(p, 0);
1584         p += 2;
1585
1586         /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1587
1588         if (status_len == 0) {
1589                 nt_status = filename_convert(ctx, conn,
1590                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1591                                              path,
1592                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1593                                              &mask_contains_wcard,
1594                                              &smb_fname);
1595                 if (!NT_STATUS_IS_OK(nt_status)) {
1596                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1597                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1598                                                 ERRSRV, ERRbadpath);
1599                                 goto out;
1600                         }
1601                         reply_nterror(req, nt_status);
1602                         goto out;
1603                 }
1604
1605                 directory = smb_fname->base_name;
1606
1607                 p = strrchr_m(directory,'/');
1608                 if ((p != NULL) && (*directory != '/')) {
1609                         mask = p + 1;
1610                         directory = talloc_strndup(ctx, directory,
1611                                                    PTR_DIFF(p, directory));
1612                 } else {
1613                         mask = directory;
1614                         directory = talloc_strdup(ctx,".");
1615                 }
1616
1617                 if (!directory) {
1618                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1619                         goto out;
1620                 }
1621
1622                 memset((char *)status,'\0',21);
1623                 SCVAL(status,0,(dirtype & 0x1F));
1624
1625                 nt_status = dptr_create(conn,
1626                                         NULL, /* req */
1627                                         NULL, /* fsp */
1628                                         directory,
1629                                         True,
1630                                         expect_close,
1631                                         req->smbpid,
1632                                         mask,
1633                                         mask_contains_wcard,
1634                                         dirtype,
1635                                         &dirptr);
1636                 if (!NT_STATUS_IS_OK(nt_status)) {
1637                         reply_nterror(req, nt_status);
1638                         goto out;
1639                 }
1640                 dptr_num = dptr_dnum(dirptr);
1641         } else {
1642                 int status_dirtype;
1643                 const char *dirpath;
1644
1645                 memcpy(status,p,21);
1646                 status_dirtype = CVAL(status,0) & 0x1F;
1647                 if (status_dirtype != (dirtype & 0x1F)) {
1648                         dirtype = status_dirtype;
1649                 }
1650
1651                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1652                 if (!dirptr) {
1653                         goto SearchEmpty;
1654                 }
1655                 dirpath = dptr_path(sconn, dptr_num);
1656                 directory = talloc_strdup(ctx, dirpath);
1657                 if (!directory) {
1658                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1659                         goto out;
1660                 }
1661
1662                 mask = dptr_wcard(sconn, dptr_num);
1663                 if (!mask) {
1664                         goto SearchEmpty;
1665                 }
1666                 /*
1667                  * For a 'continue' search we have no string. So
1668                  * check from the initial saved string.
1669                  */
1670                 mask_contains_wcard = ms_has_wild(mask);
1671                 dirtype = dptr_attr(sconn, dptr_num);
1672         }
1673
1674         DEBUG(4,("dptr_num is %d\n",dptr_num));
1675
1676         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1677         dptr_init_search_op(dirptr);
1678
1679         if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1680                 char buf[DIR_STRUCT_SIZE];
1681                 memcpy(buf,status,21);
1682                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1683                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1684                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1685                         goto out;
1686                 }
1687                 dptr_fill(sconn, buf+12,dptr_num);
1688                 if (dptr_zero(buf+12) && (status_len==0)) {
1689                         numentries = 1;
1690                 } else {
1691                         numentries = 0;
1692                 }
1693                 if (message_push_blob(&req->outbuf,
1694                                       data_blob_const(buf, sizeof(buf)))
1695                     == -1) {
1696                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1697                         goto out;
1698                 }
1699         } else {
1700                 unsigned int i;
1701                 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1702                 size_t available_space = sconn->smb1.sessions.max_send - hdr_size;
1703
1704                 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1705
1706                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1707                          directory,lp_dontdescend(ctx, SNUM(conn))));
1708                 if (in_list(directory, lp_dontdescend(ctx, SNUM(conn)),True)) {
1709                         check_descend = True;
1710                 }
1711
1712                 for (i=numentries;(i<maxentries) && !finished;i++) {
1713                         finished = !get_dir_entry(ctx,
1714                                                   dirptr,
1715                                                   mask,
1716                                                   dirtype,
1717                                                   &fname,
1718                                                   &size,
1719                                                   &mode,
1720                                                   &date,
1721                                                   check_descend,
1722                                                   ask_sharemode);
1723                         if (!finished) {
1724                                 char buf[DIR_STRUCT_SIZE];
1725                                 memcpy(buf,status,21);
1726                                 if (!make_dir_struct(ctx,
1727                                                 buf,
1728                                                 mask,
1729                                                 fname,
1730                                                 size,
1731                                                 mode,
1732                                                 convert_timespec_to_time_t(date),
1733                                                 !allow_long_path_components)) {
1734                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1735                                         goto out;
1736                                 }
1737                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1738                                         break;
1739                                 }
1740                                 if (message_push_blob(&req->outbuf,
1741                                                       data_blob_const(buf, sizeof(buf)))
1742                                     == -1) {
1743                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1744                                         goto out;
1745                                 }
1746                                 numentries++;
1747                         }
1748                 }
1749         }
1750
1751   SearchEmpty:
1752
1753         /* If we were called as SMBffirst with smb_search_id == NULL
1754                 and no entries were found then return error and close dirptr
1755                 (X/Open spec) */
1756
1757         if (numentries == 0) {
1758                 dptr_close(sconn, &dptr_num);
1759         } else if(expect_close && status_len == 0) {
1760                 /* Close the dptr - we know it's gone */
1761                 dptr_close(sconn, &dptr_num);
1762         }
1763
1764         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1765         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1766                 dptr_close(sconn, &dptr_num);
1767         }
1768
1769         if ((numentries == 0) && !mask_contains_wcard) {
1770                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1771                 goto out;
1772         }
1773
1774         SSVAL(req->outbuf,smb_vwv0,numentries);
1775         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1776         SCVAL(smb_buf(req->outbuf),0,5);
1777         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1778
1779         /* The replies here are never long name. */
1780         SSVAL(req->outbuf, smb_flg2,
1781               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1782         if (!allow_long_path_components) {
1783                 SSVAL(req->outbuf, smb_flg2,
1784                       SVAL(req->outbuf, smb_flg2)
1785                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1786         }
1787
1788         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1789         SSVAL(req->outbuf, smb_flg2,
1790               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1791
1792         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1793                 smb_fn_name(req->cmd),
1794                 mask,
1795                 directory,
1796                 dirtype,
1797                 numentries,
1798                 maxentries ));
1799  out:
1800         TALLOC_FREE(directory);
1801         TALLOC_FREE(smb_fname);
1802         END_PROFILE(SMBsearch);
1803         return;
1804 }
1805
1806 /****************************************************************************
1807  Reply to a fclose (stop directory search).
1808 ****************************************************************************/
1809
1810 void reply_fclose(struct smb_request *req)
1811 {
1812         int status_len;
1813         char status[21];
1814         int dptr_num= -2;
1815         const char *p;
1816         char *path = NULL;
1817         NTSTATUS err;
1818         bool path_contains_wcard = False;
1819         TALLOC_CTX *ctx = talloc_tos();
1820         struct smbd_server_connection *sconn = req->sconn;
1821
1822         START_PROFILE(SMBfclose);
1823
1824         if (lp_posix_pathnames()) {
1825                 reply_unknown_new(req, req->cmd);
1826                 END_PROFILE(SMBfclose);
1827                 return;
1828         }
1829
1830         p = (const char *)req->buf + 1;
1831         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1832                                        &err, &path_contains_wcard);
1833         if (!NT_STATUS_IS_OK(err)) {
1834                 reply_nterror(req, err);
1835                 END_PROFILE(SMBfclose);
1836                 return;
1837         }
1838         p++;
1839         status_len = SVAL(p,0);
1840         p += 2;
1841
1842         if (status_len == 0) {
1843                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1844                 END_PROFILE(SMBfclose);
1845                 return;
1846         }
1847
1848         memcpy(status,p,21);
1849
1850         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1851                 /*  Close the dptr - we know it's gone */
1852                 dptr_close(sconn, &dptr_num);
1853         }
1854
1855         reply_outbuf(req, 1, 0);
1856         SSVAL(req->outbuf,smb_vwv0,0);
1857
1858         DEBUG(3,("search close\n"));
1859
1860         END_PROFILE(SMBfclose);
1861         return;
1862 }
1863
1864 /****************************************************************************
1865  Reply to an open.
1866 ****************************************************************************/
1867
1868 void reply_open(struct smb_request *req)
1869 {
1870         connection_struct *conn = req->conn;
1871         struct smb_filename *smb_fname = NULL;
1872         char *fname = NULL;
1873         uint32 fattr=0;
1874         off_t size = 0;
1875         time_t mtime=0;
1876         int info;
1877         files_struct *fsp;
1878         int oplock_request;
1879         int deny_mode;
1880         uint32 dos_attr;
1881         uint32 access_mask;
1882         uint32 share_mode;
1883         uint32 create_disposition;
1884         uint32 create_options = 0;
1885         uint32_t private_flags = 0;
1886         NTSTATUS status;
1887         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1888         TALLOC_CTX *ctx = talloc_tos();
1889
1890         START_PROFILE(SMBopen);
1891
1892         if (req->wct < 2) {
1893                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1894                 goto out;
1895         }
1896
1897         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1898         deny_mode = SVAL(req->vwv+0, 0);
1899         dos_attr = SVAL(req->vwv+1, 0);
1900
1901         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1902                             STR_TERMINATE, &status);
1903         if (!NT_STATUS_IS_OK(status)) {
1904                 reply_nterror(req, status);
1905                 goto out;
1906         }
1907
1908         if (!map_open_params_to_ntcreate(fname, deny_mode,
1909                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1910                                          &share_mode, &create_disposition,
1911                                          &create_options, &private_flags)) {
1912                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1913                 goto out;
1914         }
1915
1916         status = filename_convert(ctx,
1917                                 conn,
1918                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1919                                 fname,
1920                                 UCF_PREP_CREATEFILE,
1921                                 NULL,
1922                                 &smb_fname);
1923         if (!NT_STATUS_IS_OK(status)) {
1924                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1925                         reply_botherror(req,
1926                                         NT_STATUS_PATH_NOT_COVERED,
1927                                         ERRSRV, ERRbadpath);
1928                         goto out;
1929                 }
1930                 reply_nterror(req, status);
1931                 goto out;
1932         }
1933
1934         status = SMB_VFS_CREATE_FILE(
1935                 conn,                                   /* conn */
1936                 req,                                    /* req */
1937                 0,                                      /* root_dir_fid */
1938                 smb_fname,                              /* fname */
1939                 access_mask,                            /* access_mask */
1940                 share_mode,                             /* share_access */
1941                 create_disposition,                     /* create_disposition*/
1942                 create_options,                         /* create_options */
1943                 dos_attr,                               /* file_attributes */
1944                 oplock_request,                         /* oplock_request */
1945                 0,                                      /* allocation_size */
1946                 private_flags,
1947                 NULL,                                   /* sd */
1948                 NULL,                                   /* ea_list */
1949                 &fsp,                                   /* result */
1950                 &info);                                 /* pinfo */
1951
1952         if (!NT_STATUS_IS_OK(status)) {
1953                 if (open_was_deferred(req->sconn, req->mid)) {
1954                         /* We have re-scheduled this call. */
1955                         goto out;
1956                 }
1957                 reply_openerror(req, status);
1958                 goto out;
1959         }
1960
1961         size = smb_fname->st.st_ex_size;
1962         fattr = dos_mode(conn, smb_fname);
1963
1964         /* Deal with other possible opens having a modified
1965            write time. JRA. */
1966         if (ask_sharemode) {
1967                 struct timespec write_time_ts;
1968
1969                 ZERO_STRUCT(write_time_ts);
1970                 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1971                 if (!null_timespec(write_time_ts)) {
1972                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1973                 }
1974         }
1975
1976         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1977
1978         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1979                 DEBUG(3,("attempt to open a directory %s\n",
1980                          fsp_str_dbg(fsp)));
1981                 close_file(req, fsp, ERROR_CLOSE);
1982                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1983                         ERRDOS, ERRnoaccess);
1984                 goto out;
1985         }
1986
1987         reply_outbuf(req, 7, 0);
1988         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1989         SSVAL(req->outbuf,smb_vwv1,fattr);
1990         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1991                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1992         } else {
1993                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1994         }
1995         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1996         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1997
1998         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1999                 SCVAL(req->outbuf,smb_flg,
2000                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2001         }
2002
2003         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2004                 SCVAL(req->outbuf,smb_flg,
2005                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2006         }
2007  out:
2008         TALLOC_FREE(smb_fname);
2009         END_PROFILE(SMBopen);
2010         return;
2011 }
2012
2013 /****************************************************************************
2014  Reply to an open and X.
2015 ****************************************************************************/
2016
2017 void reply_open_and_X(struct smb_request *req)
2018 {
2019         connection_struct *conn = req->conn;
2020         struct smb_filename *smb_fname = NULL;
2021         char *fname = NULL;
2022         uint16 open_flags;
2023         int deny_mode;
2024         uint32 smb_attr;
2025         /* Breakout the oplock request bits so we can set the
2026                 reply bits separately. */
2027         int ex_oplock_request;
2028         int core_oplock_request;
2029         int oplock_request;
2030 #if 0
2031         int smb_sattr = SVAL(req->vwv+4, 0);
2032         uint32 smb_time = make_unix_date3(req->vwv+6);
2033 #endif
2034         int smb_ofun;
2035         uint32 fattr=0;
2036         int mtime=0;
2037         int smb_action = 0;
2038         files_struct *fsp;
2039         NTSTATUS status;
2040         uint64_t allocation_size;
2041         ssize_t retval = -1;
2042         uint32 access_mask;
2043         uint32 share_mode;
2044         uint32 create_disposition;
2045         uint32 create_options = 0;
2046         uint32_t private_flags = 0;
2047         TALLOC_CTX *ctx = talloc_tos();
2048
2049         START_PROFILE(SMBopenX);
2050
2051         if (req->wct < 15) {
2052                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2053                 goto out;
2054         }
2055
2056         open_flags = SVAL(req->vwv+2, 0);
2057         deny_mode = SVAL(req->vwv+3, 0);
2058         smb_attr = SVAL(req->vwv+5, 0);
2059         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2060         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2061         oplock_request = ex_oplock_request | core_oplock_request;
2062         smb_ofun = SVAL(req->vwv+8, 0);
2063         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2064
2065         /* If it's an IPC, pass off the pipe handler. */
2066         if (IS_IPC(conn)) {
2067                 if (lp_nt_pipe_support()) {
2068                         reply_open_pipe_and_X(conn, req);
2069                 } else {
2070                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2071                 }
2072                 goto out;
2073         }
2074
2075         /* XXXX we need to handle passed times, sattr and flags */
2076         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2077                         STR_TERMINATE, &status);
2078         if (!NT_STATUS_IS_OK(status)) {
2079                 reply_nterror(req, status);
2080                 goto out;
2081         }
2082
2083         if (!map_open_params_to_ntcreate(fname, deny_mode,
2084                                          smb_ofun,
2085                                          &access_mask, &share_mode,
2086                                          &create_disposition,
2087                                          &create_options,
2088                                          &private_flags)) {
2089                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2090                 goto out;
2091         }
2092
2093         status = filename_convert(ctx,
2094                                 conn,
2095                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2096                                 fname,
2097                                 UCF_PREP_CREATEFILE,
2098                                 NULL,
2099                                 &smb_fname);
2100         if (!NT_STATUS_IS_OK(status)) {
2101                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2102                         reply_botherror(req,
2103                                         NT_STATUS_PATH_NOT_COVERED,
2104                                         ERRSRV, ERRbadpath);
2105                         goto out;
2106                 }
2107                 reply_nterror(req, status);
2108                 goto out;
2109         }
2110
2111         status = SMB_VFS_CREATE_FILE(
2112                 conn,                                   /* conn */
2113                 req,                                    /* req */
2114                 0,                                      /* root_dir_fid */
2115                 smb_fname,                              /* fname */
2116                 access_mask,                            /* access_mask */
2117                 share_mode,                             /* share_access */
2118                 create_disposition,                     /* create_disposition*/
2119                 create_options,                         /* create_options */
2120                 smb_attr,                               /* file_attributes */
2121                 oplock_request,                         /* oplock_request */
2122                 0,                                      /* allocation_size */
2123                 private_flags,
2124                 NULL,                                   /* sd */
2125                 NULL,                                   /* ea_list */
2126                 &fsp,                                   /* result */
2127                 &smb_action);                           /* pinfo */
2128
2129         if (!NT_STATUS_IS_OK(status)) {
2130                 if (open_was_deferred(req->sconn, req->mid)) {
2131                         /* We have re-scheduled this call. */
2132                         goto out;
2133                 }
2134                 reply_openerror(req, status);
2135                 goto out;
2136         }
2137
2138         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2139            if the file is truncated or created. */
2140         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2141                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2142                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2143                         close_file(req, fsp, ERROR_CLOSE);
2144                         reply_nterror(req, NT_STATUS_DISK_FULL);
2145                         goto out;
2146                 }
2147                 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2148                 if (retval < 0) {
2149                         close_file(req, fsp, ERROR_CLOSE);
2150                         reply_nterror(req, NT_STATUS_DISK_FULL);
2151                         goto out;
2152                 }
2153                 status = vfs_stat_fsp(fsp);
2154                 if (!NT_STATUS_IS_OK(status)) {
2155                         close_file(req, fsp, ERROR_CLOSE);
2156                         reply_nterror(req, status);
2157                         goto out;
2158                 }
2159         }
2160
2161         fattr = dos_mode(conn, fsp->fsp_name);
2162         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2163         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2164                 close_file(req, fsp, ERROR_CLOSE);
2165                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2166                 goto out;
2167         }
2168
2169         /* If the caller set the extended oplock request bit
2170                 and we granted one (by whatever means) - set the
2171                 correct bit for extended oplock reply.
2172         */
2173
2174         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2175                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2176         }
2177
2178         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2179                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2180         }
2181
2182         /* If the caller set the core oplock request bit
2183                 and we granted one (by whatever means) - set the
2184                 correct bit for core oplock reply.
2185         */
2186
2187         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2188                 reply_outbuf(req, 19, 0);
2189         } else {
2190                 reply_outbuf(req, 15, 0);
2191         }
2192
2193         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2194         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2195
2196         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2197                 SCVAL(req->outbuf, smb_flg,
2198                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2199         }
2200
2201         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2202                 SCVAL(req->outbuf, smb_flg,
2203                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2204         }
2205
2206         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2207         SSVAL(req->outbuf,smb_vwv3,fattr);
2208         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2209                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2210         } else {
2211                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2212         }
2213         SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2214         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2215         SSVAL(req->outbuf,smb_vwv11,smb_action);
2216
2217         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2218                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2219         }
2220
2221  out:
2222         TALLOC_FREE(smb_fname);
2223         END_PROFILE(SMBopenX);
2224         return;
2225 }
2226
2227 /****************************************************************************
2228  Reply to a SMBulogoffX.
2229 ****************************************************************************/
2230
2231 void reply_ulogoffX(struct smb_request *req)
2232 {
2233         struct smbd_server_connection *sconn = req->sconn;
2234         struct user_struct *vuser;
2235         struct smbXsrv_session *session = NULL;
2236         NTSTATUS status;
2237
2238         START_PROFILE(SMBulogoffX);
2239
2240         vuser = get_valid_user_struct(sconn, req->vuid);
2241
2242         if(vuser == NULL) {
2243                 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2244                          (unsigned long long)req->vuid));
2245
2246                 req->vuid = UID_FIELD_INVALID;
2247                 reply_force_doserror(req, ERRSRV, ERRbaduid);
2248                 END_PROFILE(SMBulogoffX);
2249                 return;
2250         }
2251
2252         session = vuser->session;
2253         vuser = NULL;
2254
2255         /*
2256          * TODO: cancel all outstanding requests on the session
2257          */
2258         status = smbXsrv_session_logoff(session);
2259         if (!NT_STATUS_IS_OK(status)) {
2260                 DEBUG(0, ("reply_ulogoff: "
2261                           "smbXsrv_session_logoff() failed: %s\n",
2262                           nt_errstr(status)));
2263                 /*
2264                  * If we hit this case, there is something completely
2265                  * wrong, so we better disconnect the transport connection.
2266                  */
2267                 END_PROFILE(SMBulogoffX);
2268                 exit_server(__location__ ": smbXsrv_session_logoff failed");
2269                 return;
2270         }
2271
2272         TALLOC_FREE(session);
2273
2274         reply_outbuf(req, 2, 0);
2275         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2276         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2277
2278         DEBUG(3, ("ulogoffX vuid=%llu\n",
2279                   (unsigned long long)req->vuid));
2280
2281         END_PROFILE(SMBulogoffX);
2282         req->vuid = UID_FIELD_INVALID;
2283 }
2284
2285 /****************************************************************************
2286  Reply to a mknew or a create.
2287 ****************************************************************************/
2288
2289 void reply_mknew(struct smb_request *req)
2290 {
2291         connection_struct *conn = req->conn;
2292         struct smb_filename *smb_fname = NULL;
2293         char *fname = NULL;
2294         uint32 fattr = 0;
2295         struct smb_file_time ft;
2296         files_struct *fsp;
2297         int oplock_request = 0;
2298         NTSTATUS status;
2299         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2300         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2301         uint32 create_disposition;
2302         uint32 create_options = 0;
2303         TALLOC_CTX *ctx = talloc_tos();
2304
2305         START_PROFILE(SMBcreate);
2306         ZERO_STRUCT(ft);
2307
2308         if (req->wct < 3) {
2309                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2310                 goto out;
2311         }
2312
2313         fattr = SVAL(req->vwv+0, 0);
2314         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2315
2316         /* mtime. */
2317         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2318
2319         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2320                             STR_TERMINATE, &status);
2321         if (!NT_STATUS_IS_OK(status)) {
2322                 reply_nterror(req, status);
2323                 goto out;
2324         }
2325
2326         status = filename_convert(ctx,
2327                                 conn,
2328                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2329                                 fname,
2330                                 UCF_PREP_CREATEFILE,
2331                                 NULL,
2332                                 &smb_fname);
2333         if (!NT_STATUS_IS_OK(status)) {
2334                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2335                         reply_botherror(req,
2336                                         NT_STATUS_PATH_NOT_COVERED,
2337                                         ERRSRV, ERRbadpath);
2338                         goto out;
2339                 }
2340                 reply_nterror(req, status);
2341                 goto out;
2342         }
2343
2344         if (fattr & FILE_ATTRIBUTE_VOLUME) {
2345                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2346                          "please report this\n",
2347                          smb_fname_str_dbg(smb_fname)));
2348         }
2349
2350         if(req->cmd == SMBmknew) {
2351                 /* We should fail if file exists. */
2352                 create_disposition = FILE_CREATE;
2353         } else {
2354                 /* Create if file doesn't exist, truncate if it does. */
2355                 create_disposition = FILE_OVERWRITE_IF;
2356         }
2357
2358         status = SMB_VFS_CREATE_FILE(
2359                 conn,                                   /* conn */
2360                 req,                                    /* req */
2361                 0,                                      /* root_dir_fid */
2362                 smb_fname,                              /* fname */
2363                 access_mask,                            /* access_mask */
2364                 share_mode,                             /* share_access */
2365                 create_disposition,                     /* create_disposition*/
2366                 create_options,                         /* create_options */
2367                 fattr,                                  /* file_attributes */
2368                 oplock_request,                         /* oplock_request */
2369                 0,                                      /* allocation_size */
2370                 0,                                      /* private_flags */
2371                 NULL,                                   /* sd */
2372                 NULL,                                   /* ea_list */
2373                 &fsp,                                   /* result */
2374                 NULL);                                  /* pinfo */
2375
2376         if (!NT_STATUS_IS_OK(status)) {
2377                 if (open_was_deferred(req->sconn, req->mid)) {
2378                         /* We have re-scheduled this call. */
2379                         goto out;
2380                 }
2381                 reply_openerror(req, status);
2382                 goto out;
2383         }
2384
2385         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2386         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2387         if (!NT_STATUS_IS_OK(status)) {
2388                 END_PROFILE(SMBcreate);
2389                 goto out;
2390         }
2391
2392         reply_outbuf(req, 1, 0);
2393         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2394
2395         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2396                 SCVAL(req->outbuf,smb_flg,
2397                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2398         }
2399
2400         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2401                 SCVAL(req->outbuf,smb_flg,
2402                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2403         }
2404
2405         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2406         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2407                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2408                   (unsigned int)fattr));
2409
2410  out:
2411         TALLOC_FREE(smb_fname);
2412         END_PROFILE(SMBcreate);
2413         return;
2414 }
2415
2416 /****************************************************************************
2417  Reply to a create temporary file.
2418 ****************************************************************************/
2419
2420 void reply_ctemp(struct smb_request *req)
2421 {
2422         connection_struct *conn = req->conn;
2423         struct smb_filename *smb_fname = NULL;
2424         char *wire_name = NULL;
2425         char *fname = NULL;
2426         uint32 fattr;
2427         files_struct *fsp;
2428         int oplock_request;
2429         char *s;
2430         NTSTATUS status;
2431         int i;
2432         TALLOC_CTX *ctx = talloc_tos();
2433
2434         START_PROFILE(SMBctemp);
2435
2436         if (req->wct < 3) {
2437                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2438                 goto out;
2439         }
2440
2441         fattr = SVAL(req->vwv+0, 0);
2442         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2443
2444         srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2445                             STR_TERMINATE, &status);
2446         if (!NT_STATUS_IS_OK(status)) {
2447                 reply_nterror(req, status);
2448                 goto out;
2449         }
2450
2451         for (i = 0; i < 10; i++) {
2452                 if (*wire_name) {
2453                         fname = talloc_asprintf(ctx,
2454                                         "%s/TMP%s",
2455                                         wire_name,
2456                                         generate_random_str_list(ctx, 5, "0123456789"));
2457                 } else {
2458                         fname = talloc_asprintf(ctx,
2459                                         "TMP%s",
2460                                         generate_random_str_list(ctx, 5, "0123456789"));
2461                 }
2462
2463                 if (!fname) {
2464                         reply_nterror(req, NT_STATUS_NO_MEMORY);
2465                         goto out;
2466                 }
2467
2468                 status = filename_convert(ctx, conn,
2469                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2470                                 fname,
2471                                 UCF_PREP_CREATEFILE,
2472                                 NULL,
2473                                 &smb_fname);
2474                 if (!NT_STATUS_IS_OK(status)) {
2475                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2476                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2477                                         ERRSRV, ERRbadpath);
2478                                 goto out;
2479                         }
2480                         reply_nterror(req, status);
2481                         goto out;
2482                 }
2483
2484                 /* Create the file. */
2485                 status = SMB_VFS_CREATE_FILE(
2486                         conn,                                   /* conn */
2487                         req,                                    /* req */
2488                         0,                                      /* root_dir_fid */
2489                         smb_fname,                              /* fname */
2490                         FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2491                         FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2492                         FILE_CREATE,                            /* create_disposition*/
2493                         0,                                      /* create_options */
2494                         fattr,                                  /* file_attributes */
2495                         oplock_request,                         /* oplock_request */
2496                         0,                                      /* allocation_size */
2497                         0,                                      /* private_flags */
2498                         NULL,                                   /* sd */
2499                         NULL,                                   /* ea_list */
2500                         &fsp,                                   /* result */
2501                         NULL);                                  /* pinfo */
2502
2503                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2504                         TALLOC_FREE(fname);
2505                         TALLOC_FREE(smb_fname);
2506                         continue;
2507                 }
2508
2509                 if (!NT_STATUS_IS_OK(status)) {
2510                         if (open_was_deferred(req->sconn, req->mid)) {
2511                                 /* We have re-scheduled this call. */
2512                                 goto out;
2513                         }
2514                         reply_openerror(req, status);
2515                         goto out;
2516                 }
2517
2518                 break;
2519         }
2520
2521         if (i == 10) {
2522                 /* Collision after 10 times... */
2523                 reply_nterror(req, status);
2524                 goto out;
2525         }
2526
2527         reply_outbuf(req, 1, 0);
2528         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2529
2530         /* the returned filename is relative to the directory */
2531         s = strrchr_m(fsp->fsp_name->base_name, '/');
2532         if (!s) {
2533                 s = fsp->fsp_name->base_name;
2534         } else {
2535                 s++;
2536         }
2537
2538 #if 0
2539         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2540            thing in the byte section. JRA */
2541         SSVALS(p, 0, -1); /* what is this? not in spec */
2542 #endif
2543         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2544             == -1) {
2545                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2546                 goto out;
2547         }
2548
2549         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2550                 SCVAL(req->outbuf, smb_flg,
2551                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2552         }
2553
2554         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2555                 SCVAL(req->outbuf, smb_flg,
2556                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2557         }
2558
2559         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2560         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2561                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2562  out:
2563         TALLOC_FREE(smb_fname);
2564         TALLOC_FREE(wire_name);
2565         END_PROFILE(SMBctemp);
2566         return;
2567 }
2568
2569 /*******************************************************************
2570  Check if a user is allowed to rename a file.
2571 ********************************************************************/
2572
2573 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2574                         uint16 dirtype)
2575 {
2576         if (!CAN_WRITE(conn)) {
2577                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2578         }
2579
2580         if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2581                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2582                 /* Only bother to read the DOS attribute if we might deny the
2583                    rename on the grounds of attribute missmatch. */
2584                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2585                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2586                         return NT_STATUS_NO_SUCH_FILE;
2587                 }
2588         }
2589
2590         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2591                 if (fsp->posix_open) {
2592                         return NT_STATUS_OK;
2593                 }
2594
2595                 /* If no pathnames are open below this
2596                    directory, allow the rename. */
2597
2598                 if (file_find_subpath(fsp)) {
2599                         return NT_STATUS_ACCESS_DENIED;
2600                 }
2601                 return NT_STATUS_OK;
2602         }
2603
2604         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2605                 return NT_STATUS_OK;
2606         }
2607
2608         return NT_STATUS_ACCESS_DENIED;
2609 }
2610
2611 /*******************************************************************
2612  * unlink a file with all relevant access checks
2613  *******************************************************************/
2614
2615 static NTSTATUS do_unlink(connection_struct *conn,
2616                         struct smb_request *req,
2617                         struct smb_filename *smb_fname,
2618                         uint32 dirtype)
2619 {
2620         uint32 fattr;
2621         files_struct *fsp;
2622         uint32 dirtype_orig = dirtype;
2623         NTSTATUS status;
2624         int ret;
2625         bool posix_paths = lp_posix_pathnames();
2626
2627         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2628                   smb_fname_str_dbg(smb_fname),
2629                   dirtype));
2630
2631         if (!CAN_WRITE(conn)) {
2632                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2633         }
2634
2635         if (posix_paths) {
2636                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2637         } else {
2638                 ret = SMB_VFS_STAT(conn, smb_fname);
2639         }
2640         if (ret != 0) {
2641                 return map_nt_error_from_unix(errno);
2642         }
2643
2644         fattr = dos_mode(conn, smb_fname);
2645
2646         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2647                 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2648         }
2649
2650         dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2651         if (!dirtype) {
2652                 return NT_STATUS_NO_SUCH_FILE;
2653         }
2654
2655         if (!dir_check_ftype(fattr, dirtype)) {
2656                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2657                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2658                 }
2659                 return NT_STATUS_NO_SUCH_FILE;
2660         }
2661
2662         if (dirtype_orig & 0x8000) {
2663                 /* These will never be set for POSIX. */
2664                 return NT_STATUS_NO_SUCH_FILE;
2665         }
2666
2667 #if 0
2668         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2669                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2670         }
2671
2672         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2673                 return NT_STATUS_NO_SUCH_FILE;
2674         }
2675
2676         if (dirtype & 0xFF00) {
2677                 /* These will never be set for POSIX. */
2678                 return NT_STATUS_NO_SUCH_FILE;
2679         }
2680
2681         dirtype &= 0xFF;
2682         if (!dirtype) {
2683                 return NT_STATUS_NO_SUCH_FILE;
2684         }
2685
2686         /* Can't delete a directory. */
2687         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2688                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2689         }
2690 #endif
2691
2692 #if 0 /* JRATEST */
2693         else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2694                 return NT_STATUS_OBJECT_NAME_INVALID;
2695 #endif /* JRATEST */
2696
2697         /* On open checks the open itself will check the share mode, so
2698            don't do it here as we'll get it wrong. */
2699
2700         status = SMB_VFS_CREATE_FILE
2701                 (conn,                  /* conn */
2702                  req,                   /* req */
2703                  0,                     /* root_dir_fid */
2704                  smb_fname,             /* fname */
2705                  DELETE_ACCESS,         /* access_mask */
2706                  FILE_SHARE_NONE,       /* share_access */
2707                  FILE_OPEN,             /* create_disposition*/
2708                  FILE_NON_DIRECTORY_FILE, /* create_options */
2709                                         /* file_attributes */
2710                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2711                                 FILE_ATTRIBUTE_NORMAL,
2712                  0,                     /* oplock_request */
2713                  0,                     /* allocation_size */
2714                  0,                     /* private_flags */
2715                  NULL,                  /* sd */
2716                  NULL,                  /* ea_list */
2717                  &fsp,                  /* result */
2718                  NULL);                 /* pinfo */
2719
2720         if (!NT_STATUS_IS_OK(status)) {
2721                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2722                            nt_errstr(status)));
2723                 return status;
2724         }
2725
2726         status = can_set_delete_on_close(fsp, fattr);
2727         if (!NT_STATUS_IS_OK(status)) {
2728                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2729                         "(%s)\n",
2730                         smb_fname_str_dbg(smb_fname),
2731                         nt_errstr(status)));
2732                 close_file(req, fsp, NORMAL_CLOSE);
2733                 return status;
2734         }
2735
2736         /* The set is across all open files on this dev/inode pair. */
2737         if (!set_delete_on_close(fsp, True,
2738                                 conn->session_info->security_token,
2739                                 conn->session_info->unix_token)) {
2740                 close_file(req, fsp, NORMAL_CLOSE);
2741                 return NT_STATUS_ACCESS_DENIED;
2742         }
2743
2744         return close_file(req, fsp, NORMAL_CLOSE);
2745 }
2746
2747 /****************************************************************************
2748  The guts of the unlink command, split out so it may be called by the NT SMB
2749  code.
2750 ****************************************************************************/
2751
2752 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2753                           uint32 dirtype, struct smb_filename *smb_fname,
2754                           bool has_wild)
2755 {
2756         char *fname_dir = NULL;
2757         char *fname_mask = NULL;
2758         int count=0;
2759         NTSTATUS status = NT_STATUS_OK;
2760         TALLOC_CTX *ctx = talloc_tos();
2761
2762         /* Split up the directory from the filename/mask. */
2763         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2764                                       &fname_dir, &fname_mask);
2765         if (!NT_STATUS_IS_OK(status)) {
2766                 goto out;
2767         }
2768
2769         /*
2770          * We should only check the mangled cache
2771          * here if unix_convert failed. This means
2772          * that the path in 'mask' doesn't exist
2773          * on the file system and so we need to look
2774          * for a possible mangle. This patch from
2775          * Tine Smukavec <valentin.smukavec@hermes.si>.
2776          */
2777
2778         if (!VALID_STAT(smb_fname->st) &&
2779             mangle_is_mangled(fname_mask, conn->params)) {
2780                 char *new_mask = NULL;
2781                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2782                                             &new_mask, conn->params);
2783                 if (new_mask) {
2784                         TALLOC_FREE(fname_mask);
2785                         fname_mask = new_mask;
2786                 }
2787         }
2788
2789         if (!has_wild) {
2790
2791                 /*
2792                  * Only one file needs to be unlinked. Append the mask back
2793                  * onto the directory.
2794                  */
2795                 TALLOC_FREE(smb_fname->base_name);
2796                 if (ISDOT(fname_dir)) {
2797                         /* Ensure we use canonical names on open. */
2798                         smb_fname->base_name = talloc_asprintf(smb_fname,
2799                                                         "%s",
2800                                                         fname_mask);
2801                 } else {
2802                         smb_fname->base_name = talloc_asprintf(smb_fname,
2803                                                         "%s/%s",
2804                                                         fname_dir,
2805                                                         fname_mask);
2806                 }
2807                 if (!smb_fname->base_name) {
2808                         status = NT_STATUS_NO_MEMORY;
2809                         goto out;
2810                 }
2811                 if (dirtype == 0) {
2812                         dirtype = FILE_ATTRIBUTE_NORMAL;
2813                 }
2814
2815                 status = check_name(conn, smb_fname->base_name);
2816                 if (!NT_STATUS_IS_OK(status)) {
2817                         goto out;
2818                 }
2819
2820                 status = do_unlink(conn, req, smb_fname, dirtype);
2821                 if (!NT_STATUS_IS_OK(status)) {
2822                         goto out;
2823                 }
2824
2825                 count++;
2826         } else {
2827                 struct smb_Dir *dir_hnd = NULL;
2828                 long offset = 0;
2829                 const char *dname = NULL;
2830                 char *talloced = NULL;
2831
2832                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2833                         status = NT_STATUS_OBJECT_NAME_INVALID;
2834                         goto out;
2835                 }
2836
2837                 if (strequal(fname_mask,"????????.???")) {
2838                         TALLOC_FREE(fname_mask);
2839                         fname_mask = talloc_strdup(ctx, "*");
2840                         if (!fname_mask) {
2841                                 status = NT_STATUS_NO_MEMORY;
2842                                 goto out;
2843                         }
2844                 }
2845
2846                 status = check_name(conn, fname_dir);
2847                 if (!NT_STATUS_IS_OK(status)) {
2848                         goto out;
2849                 }
2850
2851                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2852                                   dirtype);
2853                 if (dir_hnd == NULL) {
2854                         status = map_nt_error_from_unix(errno);
2855                         goto out;
2856                 }
2857
2858                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2859                    the pattern matches against the long name, otherwise the short name
2860                    We don't implement this yet XXXX
2861                 */
2862
2863                 status = NT_STATUS_NO_SUCH_FILE;
2864
2865                 while ((dname = ReadDirName(dir_hnd, &offset,
2866                                             &smb_fname->st, &talloced))) {
2867                         TALLOC_CTX *frame = talloc_stackframe();
2868
2869                         if (!is_visible_file(conn, fname_dir, dname,
2870                                              &smb_fname->st, true)) {
2871                                 TALLOC_FREE(frame);
2872                                 TALLOC_FREE(talloced);
2873                                 continue;
2874                         }
2875
2876                         /* Quick check for "." and ".." */
2877                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2878                                 TALLOC_FREE(frame);
2879                                 TALLOC_FREE(talloced);
2880                                 continue;
2881                         }
2882
2883                         if(!mask_match(dname, fname_mask,
2884                                        conn->case_sensitive)) {
2885                                 TALLOC_FREE(frame);
2886                                 TALLOC_FREE(talloced);
2887                                 continue;
2888                         }
2889
2890                         TALLOC_FREE(smb_fname->base_name);
2891                         if (ISDOT(fname_dir)) {
2892                                 /* Ensure we use canonical names on open. */
2893                                 smb_fname->base_name =
2894                                         talloc_asprintf(smb_fname, "%s",
2895                                                 dname);
2896                         } else {
2897                                 smb_fname->base_name =
2898                                         talloc_asprintf(smb_fname, "%s/%s",
2899                                                 fname_dir, dname);
2900                         }
2901
2902                         if (!smb_fname->base_name) {
2903                                 TALLOC_FREE(dir_hnd);
2904                                 status = NT_STATUS_NO_MEMORY;
2905                                 TALLOC_FREE(frame);
2906                                 TALLOC_FREE(talloced);
2907                                 goto out;
2908                         }
2909
2910                         status = check_name(conn, smb_fname->base_name);
2911                         if (!NT_STATUS_IS_OK(status)) {
2912                                 TALLOC_FREE(dir_hnd);
2913                                 TALLOC_FREE(frame);
2914                                 TALLOC_FREE(talloced);
2915                                 goto out;
2916                         }
2917
2918                         status = do_unlink(conn, req, smb_fname, dirtype);
2919                         if (!NT_STATUS_IS_OK(status)) {
2920                                 TALLOC_FREE(dir_hnd);
2921                                 TALLOC_FREE(frame);
2922                                 TALLOC_FREE(talloced);
2923                                 goto out;
2924                         }
2925
2926                         count++;
2927                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2928                                  smb_fname->base_name));
2929
2930                         TALLOC_FREE(frame);
2931                         TALLOC_FREE(talloced);
2932                 }
2933                 TALLOC_FREE(dir_hnd);
2934         }
2935
2936         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2937                 status = map_nt_error_from_unix(errno);
2938         }
2939
2940  out:
2941         TALLOC_FREE(fname_dir);
2942         TALLOC_FREE(fname_mask);
2943         return status;
2944 }
2945
2946 /****************************************************************************
2947  Reply to a unlink
2948 ****************************************************************************/
2949
2950 void reply_unlink(struct smb_request *req)
2951 {
2952         connection_struct *conn = req->conn;
2953         char *name = NULL;
2954         struct smb_filename *smb_fname = NULL;
2955         uint32 dirtype;
2956         NTSTATUS status;
2957         bool path_contains_wcard = False;
2958         TALLOC_CTX *ctx = talloc_tos();
2959
2960         START_PROFILE(SMBunlink);
2961
2962         if (req->wct < 1) {
2963                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2964                 goto out;
2965         }
2966
2967         dirtype = SVAL(req->vwv+0, 0);
2968
2969         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2970                                   STR_TERMINATE, &status,
2971                                   &path_contains_wcard);
2972         if (!NT_STATUS_IS_OK(status)) {
2973                 reply_nterror(req, status);
2974                 goto out;
2975         }
2976
2977         status = filename_convert(ctx, conn,
2978                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2979                                   name,
2980                                   UCF_COND_ALLOW_WCARD_LCOMP,
2981                                   &path_contains_wcard,
2982                                   &smb_fname);
2983         if (!NT_STATUS_IS_OK(status)) {
2984                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2985                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2986                                         ERRSRV, ERRbadpath);
2987                         goto out;
2988                 }
2989                 reply_nterror(req, status);
2990                 goto out;
2991         }
2992
2993         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2994
2995         status = unlink_internals(conn, req, dirtype, smb_fname,
2996                                   path_contains_wcard);
2997         if (!NT_STATUS_IS_OK(status)) {
2998                 if (open_was_deferred(req->sconn, req->mid)) {
2999                         /* We have re-scheduled this call. */
3000                         goto out;
3001                 }
3002                 reply_nterror(req, status);
3003                 goto out;
3004         }
3005
3006         reply_outbuf(req, 0, 0);
3007  out:
3008         TALLOC_FREE(smb_fname);
3009         END_PROFILE(SMBunlink);
3010         return;
3011 }
3012
3013 /****************************************************************************
3014  Fail for readbraw.
3015 ****************************************************************************/
3016
3017 static void fail_readraw(void)
3018 {
3019         const char *errstr = talloc_asprintf(talloc_tos(),
3020                         "FAIL ! reply_readbraw: socket write fail (%s)",
3021                         strerror(errno));
3022         if (!errstr) {
3023                 errstr = "";
3024         }
3025         exit_server_cleanly(errstr);
3026 }
3027
3028 /****************************************************************************
3029  Fake (read/write) sendfile. Returns -1 on read or write fail.
3030 ****************************************************************************/
3031
3032 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
3033 {
3034         size_t bufsize;
3035         size_t tosend = nread;
3036         char *buf;
3037
3038         if (nread == 0) {
3039                 return 0;
3040         }
3041
3042         bufsize = MIN(nread, 65536);
3043
3044         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3045                 return -1;
3046         }
3047
3048         while (tosend > 0) {
3049                 ssize_t ret;
3050                 size_t cur_read;
3051
3052                 if (tosend > bufsize) {
3053                         cur_read = bufsize;
3054                 } else {
3055                         cur_read = tosend;
3056                 }
3057                 ret = read_file(fsp,buf,startpos,cur_read);
3058                 if (ret == -1) {
3059                         SAFE_FREE(buf);
3060                         return -1;
3061                 }
3062
3063                 /* If we had a short read, fill with zeros. */
3064                 if (ret < cur_read) {
3065                         memset(buf + ret, '\0', cur_read - ret);
3066                 }
3067
3068                 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
3069                     != cur_read) {
3070                         char addr[INET6_ADDRSTRLEN];
3071                         /*
3072                          * Try and give an error message saying what
3073                          * client failed.
3074                          */
3075                         DEBUG(0, ("write_data failed for client %s. "
3076                                   "Error %s\n",
3077                                   get_peer_addr(fsp->conn->sconn->sock, addr,
3078                                                 sizeof(addr)),
3079                                   strerror(errno)));
3080                         SAFE_FREE(buf);
3081                         return -1;
3082                 }
3083                 tosend -= cur_read;
3084                 startpos += cur_read;
3085         }
3086
3087         SAFE_FREE(buf);
3088         return (ssize_t)nread;
3089 }
3090
3091 /****************************************************************************
3092  Deal with the case of sendfile reading less bytes from the file than
3093  requested. Fill with zeros (all we can do).
3094 ****************************************************************************/
3095
3096 void sendfile_short_send(files_struct *fsp,
3097                                 ssize_t nread,
3098                                 size_t headersize,
3099                                 size_t smb_maxcnt)
3100 {
3101 #define SHORT_SEND_BUFSIZE 1024
3102         if (nread < headersize) {
3103                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3104                         "header for file %s (%s). Terminating\n",
3105                         fsp_str_dbg(fsp), strerror(errno)));
3106                 exit_server_cleanly("sendfile_short_send failed");
3107         }
3108
3109         nread -= headersize;
3110
3111         if (nread < smb_maxcnt) {
3112                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3113                 if (!buf) {
3114                         exit_server_cleanly("sendfile_short_send: "
3115                                 "malloc failed");
3116                 }
3117
3118                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3119                         "with zeros !\n", fsp_str_dbg(fsp)));
3120
3121                 while (nread < smb_maxcnt) {
3122                         /*
3123                          * We asked for the real file size and told sendfile
3124                          * to not go beyond the end of the file. But it can
3125                          * happen that in between our fstat call and the
3126                          * sendfile call the file was truncated. This is very
3127                          * bad because we have already announced the larger
3128                          * number of bytes to the client.
3129                          *
3130                          * The best we can do now is to send 0-bytes, just as
3131                          * a read from a hole in a sparse file would do.
3132                          *
3133                          * This should happen rarely enough that I don't care
3134                          * about efficiency here :-)
3135                          */
3136                         size_t to_write;
3137
3138                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3139                         if (write_data(fsp->conn->sconn->sock, buf, to_write)
3140                             != to_write) {
3141                                 char addr[INET6_ADDRSTRLEN];
3142                                 /*
3143                                  * Try and give an error message saying what
3144                                  * client failed.
3145                                  */
3146                                 DEBUG(0, ("write_data failed for client %s. "
3147                                           "Error %s\n",
3148                                           get_peer_addr(
3149                                                   fsp->conn->sconn->sock, addr,
3150                                                   sizeof(addr)),
3151                                           strerror(errno)));
3152                                 exit_server_cleanly("sendfile_short_send: "
3153                                                     "write_data failed");
3154                         }
3155                         nread += to_write;
3156                 }
3157                 SAFE_FREE(buf);
3158         }
3159 }
3160
3161 /****************************************************************************
3162  Return a readbraw error (4 bytes of zero).
3163 ****************************************************************************/
3164
3165 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3166 {
3167         char header[4];
3168
3169         SIVAL(header,0,0);
3170
3171         smbd_lock_socket(sconn);
3172         if (write_data(sconn->sock,header,4) != 4) {
3173                 char addr[INET6_ADDRSTRLEN];
3174                 /*
3175                  * Try and give an error message saying what
3176                  * client failed.
3177                  */
3178                 DEBUG(0, ("write_data failed for client %s. "
3179                           "Error %s\n",
3180                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
3181                           strerror(errno)));
3182
3183                 fail_readraw();
3184         }
3185         smbd_unlock_socket(sconn);
3186 }
3187
3188 /****************************************************************************
3189  Use sendfile in readbraw.
3190 ****************************************************************************/
3191
3192 static void send_file_readbraw(connection_struct *conn,
3193                                struct smb_request *req,
3194                                files_struct *fsp,
3195                                off_t startpos,
3196                                size_t nread,
3197                                ssize_t mincount)
3198 {
3199         struct smbd_server_connection *sconn = req->sconn;
3200         char *outbuf = NULL;
3201         ssize_t ret=0;
3202
3203         /*
3204          * We can only use sendfile on a non-chained packet
3205          * but we can use on a non-oplocked file. tridge proved this
3206          * on a train in Germany :-). JRA.
3207          * reply_readbraw has already checked the length.
3208          */
3209
3210         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3211             (fsp->wcp == NULL) &&
3212             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3213                 ssize_t sendfile_read = -1;
3214                 char header[4];
3215                 DATA_BLOB header_blob;
3216
3217                 _smb_setlen(header,nread);
3218                 header_blob = data_blob_const(header, 4);
3219
3220                 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3221                                                  &header_blob, startpos,
3222                                                  nread);
3223                 if (sendfile_read == -1) {
3224                         /* Returning ENOSYS means no data at all was sent.
3225                          * Do this as a normal read. */
3226                         if (errno == ENOSYS) {
3227                                 goto normal_readbraw;
3228                         }
3229
3230                         /*
3231                          * Special hack for broken Linux with no working sendfile. If we
3232                          * return EINTR we sent the header but not the rest of the data.
3233                          * Fake this up by doing read/write calls.
3234                          */
3235                         if (errno == EINTR) {
3236                                 /* Ensure we don't do this again. */
3237                                 set_use_sendfile(SNUM(conn), False);
3238                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3239
3240                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
3241                                         DEBUG(0,("send_file_readbraw: "
3242                                                  "fake_sendfile failed for "
3243                                                  "file %s (%s).\n",
3244                                                  fsp_str_dbg(fsp),
3245                                                  strerror(errno)));
3246                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3247                                 }
3248                                 return;
3249                         }
3250
3251                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3252                                  "file %s (%s). Terminating\n",
3253                                  fsp_str_dbg(fsp), strerror(errno)));
3254                         exit_server_cleanly("send_file_readbraw sendfile failed");
3255                 } else if (sendfile_read == 0) {
3256                         /*
3257                          * Some sendfile implementations return 0 to indicate
3258                          * that there was a short read, but nothing was
3259                          * actually written to the socket.  In this case,
3260                          * fallback to the normal read path so the header gets
3261                          * the correct byte count.
3262                          */
3263                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3264                                   "bytes falling back to the normal read: "
3265                                   "%s\n", fsp_str_dbg(fsp)));
3266                         goto normal_readbraw;
3267                 }
3268
3269                 /* Deal with possible short send. */
3270                 if (sendfile_read != 4+nread) {
3271                         sendfile_short_send(fsp, sendfile_read, 4, nread);
3272                 }
3273                 return;
3274         }
3275
3276 normal_readbraw:
3277
3278         outbuf = talloc_array(NULL, char, nread+4);
3279         if (!outbuf) {
3280                 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3281                         (unsigned)(nread+4)));
3282                 reply_readbraw_error(sconn);
3283                 return;
3284         }
3285
3286         if (nread > 0) {
3287                 ret = read_file(fsp,outbuf+4,startpos,nread);
3288 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3289                 if (ret < mincount)
3290                         ret = 0;
3291 #else
3292                 if (ret < nread)
3293                         ret = 0;
3294 #endif
3295         }
3296
3297         _smb_setlen(outbuf,ret);
3298         if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3299                 char addr[INET6_ADDRSTRLEN];
3300                 /*
3301                  * Try and give an error message saying what
3302                  * client failed.
3303                  */
3304                 DEBUG(0, ("write_data failed for client %s. "
3305                           "Error %s\n",
3306                           get_peer_addr(fsp->conn->sconn->sock, addr,
3307                                         sizeof(addr)),
3308                           strerror(errno)));
3309
3310                 fail_readraw();
3311         }
3312
3313         TALLOC_FREE(outbuf);
3314 }
3315
3316 /****************************************************************************
3317  Reply to a readbraw (core+ protocol).
3318 ****************************************************************************/
3319
3320 void reply_readbraw(struct smb_request *req)
3321 {
3322         connection_struct *conn = req->conn;
3323         struct smbd_server_connection *sconn = req->sconn;
3324         ssize_t maxcount,mincount;
3325         size_t nread = 0;
3326         off_t startpos;
3327         files_struct *fsp;
3328         struct lock_struct lock;
3329         off_t size = 0;
3330
3331         START_PROFILE(SMBreadbraw);
3332
3333         if (srv_is_signing_active(sconn) || req->encrypted) {
3334                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3335                         "raw reads/writes are disallowed.");
3336         }
3337
3338         if (req->wct < 8) {
3339                 reply_readbraw_error(sconn);
3340                 END_PROFILE(SMBreadbraw);
3341                 return;
3342         }
3343
3344         if (sconn->smb1.echo_handler.trusted_fde) {
3345                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3346                          "'async smb echo handler = yes'\n"));
3347                 reply_readbraw_error(sconn);
3348                 END_PROFILE(SMBreadbraw);
3349                 return;
3350         }
3351
3352         /*
3353          * Special check if an oplock break has been issued
3354          * and the readraw request croses on the wire, we must
3355          * return a zero length response here.
3356          */
3357
3358         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3359
3360         /*
3361          * We have to do a check_fsp by hand here, as
3362          * we must always return 4 zero bytes on error,
3363          * not a NTSTATUS.
3364          */
3365
3366         if (!fsp || !conn || conn != fsp->conn ||
3367                         req->vuid != fsp->vuid ||
3368                         fsp->is_directory || fsp->fh->fd == -1) {
3369                 /*
3370                  * fsp could be NULL here so use the value from the packet. JRA.
3371                  */
3372                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3373                         "- cache prime?\n",
3374                         (int)SVAL(req->vwv+0, 0)));
3375                 reply_readbraw_error(sconn);
3376                 END_PROFILE(SMBreadbraw);
3377                 return;
3378         }
3379
3380         /* Do a "by hand" version of CHECK_READ. */
3381         if (!(fsp->can_read ||
3382                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3383                                 (fsp->access_mask & FILE_EXECUTE)))) {
3384                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3385                                 (int)SVAL(req->vwv+0, 0)));
3386                 reply_readbraw_error(sconn);
3387                 END_PROFILE(SMBreadbraw);
3388                 return;
3389         }
3390
3391         flush_write_cache(fsp, READRAW_FLUSH);
3392
3393         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3394         if(req->wct == 10) {
3395                 /*
3396                  * This is a large offset (64 bit) read.
3397                  */
3398
3399                 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3400
3401                 if(startpos < 0) {
3402                         DEBUG(0,("reply_readbraw: negative 64 bit "
3403                                 "readraw offset (%.0f) !\n",
3404                                 (double)startpos ));
3405                         reply_readbraw_error(sconn);
3406                         END_PROFILE(SMBreadbraw);
3407                         return;
3408                 }
3409         }
3410
3411         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3412         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3413
3414         /* ensure we don't overrun the packet size */
3415         maxcount = MIN(65535,maxcount);
3416
3417         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3418             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3419             &lock);
3420
3421         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3422                 reply_readbraw_error(sconn);
3423                 END_PROFILE(SMBreadbraw);
3424                 return;
3425         }
3426
3427         if (fsp_stat(fsp) == 0) {
3428                 size = fsp->fsp_name->st.st_ex_size;
3429         }
3430
3431         if (startpos >= size) {
3432                 nread = 0;
3433         } else {
3434                 nread = MIN(maxcount,(size - startpos));
3435         }
3436
3437 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3438         if (nread < mincount)
3439                 nread = 0;
3440 #endif
3441
3442         DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3443                 "min=%lu nread=%lu\n",
3444                 fsp_fnum_dbg(fsp), (double)startpos,
3445                 (unsigned long)maxcount,
3446                 (unsigned long)mincount,
3447                 (unsigned long)nread ) );
3448
3449         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3450
3451         DEBUG(5,("reply_readbraw finished\n"));
3452
3453         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3454
3455         END_PROFILE(SMBreadbraw);
3456         return;
3457 }
3458
3459 #undef DBGC_CLASS
3460 #define DBGC_CLASS DBGC_LOCKING
3461
3462 /****************************************************************************
3463  Reply to a lockread (core+ protocol).
3464 ****************************************************************************/
3465
3466 void reply_lockread(struct smb_request *req)
3467 {
3468         connection_struct *conn = req->conn;
3469         ssize_t nread = -1;
3470         char *data;
3471         off_t startpos;
3472         size_t numtoread;
3473         size_t maxtoread;
3474         NTSTATUS status;
3475         files_struct *fsp;
3476         struct byte_range_lock *br_lck = NULL;
3477         char *p = NULL;
3478         struct smbd_server_connection *sconn = req->sconn;
3479
3480         START_PROFILE(SMBlockread);
3481
3482         if (req->wct < 5) {
3483                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3484                 END_PROFILE(SMBlockread);
3485                 return;
3486         }
3487
3488         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3489
3490         if (!check_fsp(conn, req, fsp)) {
3491                 END_PROFILE(SMBlockread);
3492                 return;
3493         }
3494
3495         if (!CHECK_READ(fsp,req)) {
3496                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3497                 END_PROFILE(SMBlockread);
3498                 return;
3499         }
3500
3501         numtoread = SVAL(req->vwv+1, 0);
3502         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3503
3504         /*
3505          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3506          * protocol request that predates the read/write lock concept.
3507          * Thus instead of asking for a read lock here we need to ask
3508          * for a write lock. JRA.
3509          * Note that the requested lock size is unaffected by max_send.
3510          */
3511
3512         br_lck = do_lock(req->sconn->msg_ctx,
3513                         fsp,
3514                         (uint64_t)req->smbpid,
3515                         (uint64_t)numtoread,
3516                         (uint64_t)startpos,
3517                         WRITE_LOCK,
3518                         WINDOWS_LOCK,
3519                         False, /* Non-blocking lock. */
3520                         &status,
3521                         NULL,
3522                         NULL);
3523         TALLOC_FREE(br_lck);
3524
3525         if (NT_STATUS_V(status)) {
3526                 reply_nterror(req, status);
3527                 END_PROFILE(SMBlockread);
3528                 return;
3529         }
3530
3531         /*
3532          * However the requested READ size IS affected by max_send. Insanity.... JRA.
3533          */
3534         maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3535
3536         if (numtoread > maxtoread) {
3537                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3538 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3539                         (unsigned int)numtoread, (unsigned int)maxtoread,
3540                         (unsigned int)sconn->smb1.sessions.max_send));
3541                 numtoread = maxtoread;
3542         }
3543
3544         reply_outbuf(req, 5, numtoread + 3);
3545
3546         data = smb_buf(req->outbuf) + 3;
3547
3548         nread = read_file(fsp,data,startpos,numtoread);
3549
3550         if (nread < 0) {
3551                 reply_nterror(req, map_nt_error_from_unix(errno));
3552                 END_PROFILE(SMBlockread);
3553                 return;
3554         }
3555
3556         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3557
3558         SSVAL(req->outbuf,smb_vwv0,nread);
3559         SSVAL(req->outbuf,smb_vwv5,nread+3);
3560         p = smb_buf(req->outbuf);
3561         SCVAL(p,0,0); /* pad byte. */
3562         SSVAL(p,1,nread);
3563
3564         DEBUG(3,("lockread %s num=%d nread=%d\n",
3565                  fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3566
3567         END_PROFILE(SMBlockread);
3568         return;
3569 }
3570
3571 #undef DBGC_CLASS
3572 #define DBGC_CLASS DBGC_ALL
3573
3574 /****************************************************************************
3575  Reply to a read.
3576 ****************************************************************************/
3577
3578 void reply_read(struct smb_request *req)
3579 {
3580         connection_struct *conn = req->conn;
3581         size_t numtoread;
3582         size_t maxtoread;
3583         ssize_t nread = 0;
3584         char *data;
3585         off_t startpos;
3586         files_struct *fsp;
3587         struct lock_struct lock;
3588         struct smbd_server_connection *sconn = req->sconn;
3589
3590         START_PROFILE(SMBread);
3591
3592         if (req->wct < 3) {
3593                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3594                 END_PROFILE(SMBread);
3595                 return;
3596         }
3597
3598         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3599
3600         if (!check_fsp(conn, req, fsp)) {
3601                 END_PROFILE(SMBread);
3602                 return;
3603         }
3604
3605         if (!CHECK_READ(fsp,req)) {
3606                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3607                 END_PROFILE(SMBread);
3608                 return;
3609         }
3610
3611         numtoread = SVAL(req->vwv+1, 0);
3612         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3613
3614         /*
3615          * The requested read size cannot be greater than max_send. JRA.
3616          */
3617         maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3618
3619         if (numtoread > maxtoread) {
3620                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3621 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3622                         (unsigned int)numtoread, (unsigned int)maxtoread,
3623                         (unsigned int)sconn->smb1.sessions.max_send));
3624                 numtoread = maxtoread;
3625         }
3626
3627         reply_outbuf(req, 5, numtoread+3);
3628
3629         data = smb_buf(req->outbuf) + 3;
3630
3631         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3632             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3633             &lock);
3634
3635         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3636                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3637                 END_PROFILE(SMBread);
3638                 return;
3639         }
3640
3641         if (numtoread > 0)
3642                 nread = read_file(fsp,data,startpos,numtoread);
3643
3644         if (nread < 0) {
3645                 reply_nterror(req, map_nt_error_from_unix(errno));
3646                 goto strict_unlock;
3647         }
3648
3649         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3650
3651         SSVAL(req->outbuf,smb_vwv0,nread);
3652         SSVAL(req->outbuf,smb_vwv5,nread+3);
3653         SCVAL(smb_buf(req->outbuf),0,1);
3654         SSVAL(smb_buf(req->outbuf),1,nread);
3655
3656         DEBUG(3, ("read %s num=%d nread=%d\n",
3657                   fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3658
3659 strict_unlock:
3660         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3661
3662         END_PROFILE(SMBread);
3663         return;
3664 }
3665
3666 /****************************************************************************
3667  Setup readX header.
3668 ****************************************************************************/
3669
3670 static int setup_readX_header(struct smb_request *req, char *outbuf,
3671                               size_t smb_maxcnt)
3672 {
3673         int outsize;
3674
3675         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3676
3677         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3678
3679         SCVAL(outbuf,smb_vwv0,0xFF);
3680         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3681         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3682         SSVAL(outbuf,smb_vwv6,
3683               (smb_wct - 4)     /* offset from smb header to wct */
3684               + 1               /* the wct field */
3685               + 12 * sizeof(uint16_t) /* vwv */
3686               + 2);             /* the buflen field */
3687         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3688         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3689         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3690         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3691         return outsize;
3692 }
3693
3694 /****************************************************************************
3695  Reply to a read and X - possibly using sendfile.
3696 ****************************************************************************/
3697
3698 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3699                             files_struct *fsp, off_t startpos,
3700                             size_t smb_maxcnt)
3701 {
3702         ssize_t nread = -1;
3703         struct lock_struct lock;
3704         int saved_errno = 0;
3705
3706         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3707             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3708             &lock);
3709
3710         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3711                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3712                 return;
3713         }
3714
3715         /*
3716          * We can only use sendfile on a non-chained packet
3717          * but we can use on a non-oplocked file. tridge proved this
3718          * on a train in Germany :-). JRA.
3719          */
3720
3721         if (!req_is_in_chain(req) &&
3722             !req->encrypted &&
3723             (fsp->base_fsp == NULL) &&
3724             (fsp->wcp == NULL) &&
3725             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3726                 uint8 headerbuf[smb_size + 12 * 2];
3727                 DATA_BLOB header;
3728
3729                 if(fsp_stat(fsp) == -1) {
3730                         reply_nterror(req, map_nt_error_from_unix(errno));
3731                         goto strict_unlock;
3732                 }
3733
3734                 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3735                     (startpos > fsp->fsp_name->st.st_ex_size) ||
3736                     (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3737                         /*
3738                          * We already know that we would do a short read, so don't
3739                          * try the sendfile() path.
3740                          */
3741                         goto nosendfile_read;
3742                 }
3743
3744                 /*
3745                  * Set up the packet header before send. We
3746                  * assume here the sendfile will work (get the
3747                  * correct amount of data).
3748                  */
3749
3750                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3751
3752                 construct_reply_common_req(req, (char *)headerbuf);
3753                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3754
3755                 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3756                                          startpos, smb_maxcnt);
3757                 if (nread == -1) {
3758                         /* Returning ENOSYS means no data at all was sent.
3759                            Do this as a normal read. */
3760                         if (errno == ENOSYS) {
3761                                 goto normal_read;
3762                         }
3763
3764                         /*
3765                          * Special hack for broken Linux with no working sendfile. If we
3766                          * return EINTR we sent the header but not the rest of the data.
3767                          * Fake this up by doing read/write calls.
3768                          */
3769
3770                         if (errno == EINTR) {
3771                                 /* Ensure we don't do this again. */
3772                                 set_use_sendfile(SNUM(conn), False);
3773                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3774                                 nread = fake_sendfile(fsp, startpos,
3775                                                       smb_maxcnt);
3776                                 if (nread == -1) {
3777                                         DEBUG(0,("send_file_readX: "
3778                                                  "fake_sendfile failed for "
3779                                                  "file %s (%s).\n",
3780                                                  fsp_str_dbg(fsp),
3781                                                  strerror(errno)));
3782                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3783                                 }
3784                                 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3785                                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3786                                 /* No outbuf here means successful sendfile. */
3787                                 goto strict_unlock;
3788                         }
3789
3790                         DEBUG(0,("send_file_readX: sendfile failed for file "
3791                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3792                                  strerror(errno)));
3793                         exit_server_cleanly("send_file_readX sendfile failed");
3794                 } else if (nread == 0) {
3795                         /*
3796                          * Some sendfile implementations return 0 to indicate
3797                          * that there was a short read, but nothing was
3798                          * actually written to the socket.  In this case,
3799                          * fallback to the normal read path so the header gets
3800                          * the correct byte count.
3801                          */
3802                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3803                                   "falling back to the normal read: %s\n",
3804                                   fsp_str_dbg(fsp)));
3805                         goto normal_read;
3806                 }
3807
3808                 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3809                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3810
3811                 /* Deal with possible short send. */
3812                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3813                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3814                 }
3815                 /* No outbuf here means successful sendfile. */
3816                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3817                 SMB_PERFCOUNT_END(&req->pcd);
3818                 goto strict_unlock;
3819         }
3820
3821 normal_read:
3822
3823         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3824                 uint8 headerbuf[smb_size + 2*12];
3825
3826                 construct_reply_common_req(req, (char *)headerbuf);
3827                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3828
3829                 /* Send out the header. */
3830                 if (write_data(req->sconn->sock, (char *)headerbuf,
3831                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3832
3833                         char addr[INET6_ADDRSTRLEN];
3834                         /*
3835                          * Try and give an error message saying what
3836                          * client failed.
3837                          */
3838                         DEBUG(0, ("write_data failed for client %s. "
3839                                   "Error %s\n",
3840                                   get_peer_addr(req->sconn->sock, addr,
3841                                                 sizeof(addr)),
3842                                   strerror(errno)));
3843
3844                         DEBUG(0,("send_file_readX: write_data failed for file "
3845                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3846                                  strerror(errno)));
3847                         exit_server_cleanly("send_file_readX sendfile failed");
3848                 }
3849                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3850                 if (nread == -1) {
3851                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3852                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3853                                  strerror(errno)));
3854                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3855                 }
3856                 goto strict_unlock;
3857         }
3858
3859 nosendfile_read:
3860
3861         reply_outbuf(req, 12, smb_maxcnt);
3862         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3863         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
3864
3865         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3866         saved_errno = errno;
3867
3868         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3869
3870         if (nread < 0) {
3871                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3872                 return;
3873         }
3874
3875         setup_readX_header(req, (char *)req->outbuf, nread);
3876
3877         DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3878                   fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3879         return;
3880
3881  strict_unlock:
3882         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3883         TALLOC_FREE(req->outbuf);
3884         return;
3885 }
3886
3887 /****************************************************************************
3888  Work out how much space we have for a read return.
3889 ****************************************************************************/
3890
3891 static size_t calc_max_read_pdu(const struct smb_request *req)
3892 {
3893         if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3894                 return req->sconn->smb1.sessions.max_send;
3895         }
3896
3897         if (!lp_large_readwrite()) {
3898                 return req->sconn->smb1.sessions.max_send;
3899         }
3900
3901         if (req_is_in_chain(req)) {
3902                 return req->sconn->smb1.sessions.max_send;
3903         }
3904
3905         if (req->encrypted) {
3906                 /*
3907                  * Don't take encrypted traffic up to the
3908                  * limit. There are padding considerations
3909                  * that make that tricky.
3910                  */
3911                 return req->sconn->smb1.sessions.max_send;
3912         }
3913
3914         if (srv_is_signing_active(req->sconn)) {
3915                 return 0x1FFFF;
3916         }
3917
3918         if (!lp_unix_extensions()) {
3919                 return 0x1FFFF;
3920         }
3921
3922         /*
3923          * We can do ultra-large POSIX reads.
3924          */
3925         return 0xFFFFFF;
3926 }
3927
3928 /****************************************************************************
3929  Calculate how big a read can be. Copes with all clients. It's always
3930  safe to return a short read - Windows does this.
3931 ****************************************************************************/
3932
3933 static size_t calc_read_size(const struct smb_request *req,
3934                              size_t upper_size,
3935                              size_t lower_size)
3936 {
3937         size_t max_pdu = calc_max_read_pdu(req);
3938         size_t total_size = 0;
3939         size_t hdr_len = MIN_SMB_SIZE + VWV(12);
3940         size_t max_len = max_pdu - hdr_len;
3941
3942         /*
3943          * Windows explicitly ignores upper size of 0xFFFF.
3944          * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3945          * We must do the same as these will never fit even in
3946          * an extended size NetBIOS packet.
3947          */
3948         if (upper_size == 0xFFFF) {
3949                 upper_size = 0;
3950         }
3951
3952         if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3953                 upper_size = 0;
3954         }
3955
3956         total_size = ((upper_size<<16) | lower_size);
3957
3958         /*
3959          * LARGE_READX test shows it's always safe to return
3960          * a short read. Windows does so.
3961          */
3962         return MIN(total_size, max_len);
3963 }
3964
3965 /****************************************************************************
3966  Reply to a read and X.
3967 ****************************************************************************/
3968
3969 void reply_read_and_X(struct smb_request *req)
3970 {
3971         connection_struct *conn = req->conn;
3972         files_struct *fsp;
3973         off_t startpos;
3974         size_t smb_maxcnt;
3975         size_t upper_size;
3976         bool big_readX = False;
3977 #if 0
3978         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3979 #endif
3980
3981         START_PROFILE(SMBreadX);
3982
3983         if ((req->wct != 10) && (req->wct != 12)) {
3984                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3985                 return;
3986         }
3987
3988         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3989         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3990         smb_maxcnt = SVAL(req->vwv+5, 0);
3991
3992         /* If it's an IPC, pass off the pipe handler. */
3993         if (IS_IPC(conn)) {
3994                 reply_pipe_read_and_X(req);
3995                 END_PROFILE(SMBreadX);
3996                 return;
3997         }
3998
3999         if (!check_fsp(conn, req, fsp)) {
4000                 END_PROFILE(SMBreadX);
4001                 return;
4002         }
4003
4004         if (!CHECK_READ(fsp,req)) {
4005                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4006                 END_PROFILE(SMBreadX);
4007                 return;
4008         }
4009
4010         upper_size = SVAL(req->vwv+7, 0);
4011         smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4012         if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4013                 /*
4014                  * This is a heuristic to avoid keeping large
4015                  * outgoing buffers around over long-lived aio
4016                  * requests.
4017                  */
4018                 big_readX = True;
4019         }
4020
4021         if (req->wct == 12) {
4022                 /*
4023                  * This is a large offset (64 bit) read.
4024                  */
4025                 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4026
4027         }
4028
4029         if (!big_readX) {
4030                 NTSTATUS status = schedule_aio_read_and_X(conn,
4031                                         req,
4032                                         fsp,
4033                                         startpos,
4034                                         smb_maxcnt);
4035                 if (NT_STATUS_IS_OK(status)) {
4036                         /* Read scheduled - we're done. */
4037                         goto out;
4038                 }
4039                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4040                         /* Real error - report to client. */
4041                         END_PROFILE(SMBreadX);
4042                         reply_nterror(req, status);
4043                         return;
4044                 }
4045                 /* NT_STATUS_RETRY - fall back to sync read. */
4046         }
4047
4048         smbd_lock_socket(req->sconn);
4049         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4050         smbd_unlock_socket(req->sconn);
4051
4052  out:
4053         END_PROFILE(SMBreadX);
4054         return;
4055 }
4056
4057 /****************************************************************************
4058  Error replies to writebraw must have smb_wct == 1. Fix this up.
4059 ****************************************************************************/
4060
4061 void error_to_writebrawerr(struct smb_request *req)
4062 {
4063         uint8 *old_outbuf = req->outbuf;
4064
4065         reply_outbuf(req, 1, 0);
4066
4067         memcpy(req->outbuf, old_outbuf, smb_size);
4068         TALLOC_FREE(old_outbuf);
4069 }
4070
4071 /****************************************************************************
4072  Read 4 bytes of a smb packet and return the smb length of the packet.
4073  Store the result in the buffer. This version of the function will
4074  never return a session keepalive (length of zero).
4075  Timeout is in milliseconds.
4076 ****************************************************************************/
4077
4078 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4079                                 size_t *len)
4080 {
4081         uint8_t msgtype = NBSSkeepalive;
4082
4083         while (msgtype == NBSSkeepalive) {
4084                 NTSTATUS status;
4085
4086                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4087                                                           len);
4088                 if (!NT_STATUS_IS_OK(status)) {
4089                         char addr[INET6_ADDRSTRLEN];
4090                         /* Try and give an error message
4091                          * saying what client failed. */
4092                         DEBUG(0, ("read_fd_with_timeout failed for "
4093                                   "client %s read error = %s.\n",
4094                                   get_peer_addr(fd,addr,sizeof(addr)),
4095                                   nt_errstr(status)));
4096                         return status;
4097                 }
4098
4099                 msgtype = CVAL(inbuf, 0);
4100         }
4101
4102         DEBUG(10,("read_smb_length: got smb length of %lu\n",
4103                   (unsigned long)len));
4104
4105         return NT_STATUS_OK;
4106 }
4107
4108 /****************************************************************************
4109  Reply to a writebraw (core+ or LANMAN1.0 protocol).
4110 ****************************************************************************/
4111
4112 void reply_writebraw(struct smb_request *req)
4113 {
4114         connection_struct *conn = req->conn;
4115         char *buf = NULL;
4116         ssize_t nwritten=0;
4117         ssize_t total_written=0;
4118         size_t numtowrite=0;
4119         size_t tcount;
4120         off_t startpos;
4121         const char *data=NULL;
4122         bool write_through;
4123         files_struct *fsp;
4124         struct lock_struct lock;
4125         NTSTATUS status;
4126
4127         START_PROFILE(SMBwritebraw);
4128
4129         /*
4130          * If we ever reply with an error, it must have the SMB command
4131          * type of SMBwritec, not SMBwriteBraw, as this tells the client
4132          * we're finished.
4133          */
4134         SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4135
4136         if (srv_is_signing_active(req->sconn)) {
4137                 END_PROFILE(SMBwritebraw);
4138                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4139                                 "raw reads/writes are disallowed.");
4140         }
4141
4142         if (req->wct < 12) {
4143                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4144                 error_to_writebrawerr(req);
4145                 END_PROFILE(SMBwritebraw);
4146                 return;
4147         }
4148
4149         if (req->sconn->smb1.echo_handler.trusted_fde) {
4150                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4151                          "'async smb echo handler = yes'\n"));
4152                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4153                 error_to_writebrawerr(req);
4154                 END_PROFILE(SMBwritebraw);
4155                 return;
4156         }
4157
4158         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4159         if (!check_fsp(conn, req, fsp)) {
4160                 error_to_writebrawerr(req);
4161                 END_PROFILE(SMBwritebraw);
4162                 return;
4163         }
4164
4165         if (!CHECK_WRITE(fsp)) {
4166                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4167                 error_to_writebrawerr(req);
4168                 END_PROFILE(SMBwritebraw);
4169                 return;
4170         }
4171
4172         tcount = IVAL(req->vwv+1, 0);
4173         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4174         write_through = BITSETW(req->vwv+7,0);
4175
4176         /* We have to deal with slightly different formats depending
4177                 on whether we are using the core+ or lanman1.0 protocol */
4178
4179         if(get_Protocol() <= PROTOCOL_COREPLUS) {
4180                 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4181                 data = smb_buf_const(req->inbuf);
4182         } else {
4183                 numtowrite = SVAL(req->vwv+10, 0);
4184                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4185         }
4186
4187         /* Ensure we don't write bytes past the end of this packet. */
4188         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4189                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4190                 error_to_writebrawerr(req);
4191                 END_PROFILE(SMBwritebraw);
4192                 return;
4193         }
4194
4195         if (!fsp->print_file) {
4196                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4197                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4198                     &lock);
4199
4200                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4201                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4202                         error_to_writebrawerr(req);
4203                         END_PROFILE(SMBwritebraw);
4204                         return;
4205                 }
4206         }
4207
4208         if (numtowrite>0) {
4209                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4210         }
4211
4212         DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4213                         "wrote=%d sync=%d\n",
4214                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4215                 (int)nwritten, (int)write_through));
4216
4217         if (nwritten < (ssize_t)numtowrite)  {
4218                 reply_nterror(req, NT_STATUS_DISK_FULL);
4219                 error_to_writebrawerr(req);
4220                 goto strict_unlock;
4221         }
4222
4223         total_written = nwritten;
4224
4225         /* Allocate a buffer of 64k + length. */
4226         buf = talloc_array(NULL, char, 65540);
4227         if (!buf) {
4228                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4229                 error_to_writebrawerr(req);
4230                 goto strict_unlock;
4231         }
4232
4233         /* Return a SMBwritebraw message to the redirector to tell
4234          * it to send more bytes */
4235
4236         memcpy(buf, req->inbuf, smb_size);
4237         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4238         SCVAL(buf,smb_com,SMBwritebraw);
4239         SSVALS(buf,smb_vwv0,0xFFFF);
4240         show_msg(buf);
4241         if (!srv_send_smb(req->sconn,
4242                           buf,
4243                           false, 0, /* no signing */
4244                           IS_CONN_ENCRYPTED(conn),
4245                           &req->pcd)) {
4246                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4247                         "failed.");
4248         }
4249
4250         /* Now read the raw data into the buffer and write it */
4251         status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4252                                  &numtowrite);
4253         if (!NT_STATUS_IS_OK(status)) {
4254                 exit_server_cleanly("secondary writebraw failed");
4255         }
4256
4257         /* Set up outbuf to return the correct size */
4258         reply_outbuf(req, 1, 0);
4259
4260         if (numtowrite != 0) {
4261
4262                 if (numtowrite > 0xFFFF) {
4263                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4264                                 "raw requested (%u). Terminating\n",
4265                                 (unsigned int)numtowrite ));
4266                         exit_server_cleanly("secondary writebraw failed");
4267                 }
4268
4269                 if (tcount > nwritten+numtowrite) {
4270                         DEBUG(3,("reply_writebraw: Client overestimated the "
4271                                 "write %d %d %d\n",
4272                                 (int)tcount,(int)nwritten,(int)numtowrite));
4273                 }
4274
4275                 status = read_data(req->sconn->sock, buf+4, numtowrite);
4276
4277                 if (!NT_STATUS_IS_OK(status)) {
4278                         char addr[INET6_ADDRSTRLEN];
4279                         /* Try and give an error message
4280                          * saying what client failed. */
4281                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4282                                   "raw read failed (%s) for client %s. "
4283                                   "Terminating\n", nt_errstr(status),
4284                                   get_peer_addr(req->sconn->sock, addr,
4285                                                 sizeof(addr))));
4286                         exit_server_cleanly("secondary writebraw failed");
4287                 }
4288
4289                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4290                 if (nwritten == -1) {
4291                         TALLOC_FREE(buf);
4292                         reply_nterror(req, map_nt_error_from_unix(errno));
4293                         error_to_writebrawerr(req);
4294                         goto strict_unlock;
4295                 }
4296
4297                 if (nwritten < (ssize_t)numtowrite) {
4298                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4299                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4300                 }
4301
4302                 if (nwritten > 0) {
4303                         total_written += nwritten;
4304                 }
4305         }
4306
4307         TALLOC_FREE(buf);
4308         SSVAL(req->outbuf,smb_vwv0,total_written);
4309
4310         status = sync_file(conn, fsp, write_through);
4311         if (!NT_STATUS_IS_OK(status)) {
4312                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4313                          fsp_str_dbg(fsp), nt_errstr(status)));
4314                 reply_nterror(req, status);
4315                 error_to_writebrawerr(req);
4316                 goto strict_unlock;
4317         }
4318
4319         DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4320                 "wrote=%d\n",
4321                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4322                 (int)total_written));
4323
4324         if (!fsp->print_file) {
4325                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4326         }
4327
4328         /* We won't return a status if write through is not selected - this
4329          * follows what WfWg does */
4330         END_PROFILE(SMBwritebraw);
4331
4332         if (!write_through && total_written==tcount) {
4333
4334 #if RABBIT_PELLET_FIX
4335                 /*
4336                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4337                  * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4338                  * JRA.
4339                  */
4340                 if (!send_keepalive(req->sconn->sock)) {
4341                         exit_server_cleanly("reply_writebraw: send of "
4342                                 "keepalive failed");
4343                 }
4344 #endif
4345                 TALLOC_FREE(req->outbuf);
4346         }
4347         return;
4348
4349 strict_unlock:
4350         if (!fsp->print_file) {
4351                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4352         }
4353
4354         END_PROFILE(SMBwritebraw);
4355         return;
4356 }
4357
4358 #undef DBGC_CLASS
4359 #define DBGC_CLASS DBGC_LOCKING
4360
4361 /****************************************************************************
4362  Reply to a writeunlock (core+).
4363 ****************************************************************************/
4364
4365 void reply_writeunlock(struct smb_request *req)
4366 {
4367         connection_struct *conn = req->conn;
4368         ssize_t nwritten = -1;
4369         size_t numtowrite;
4370         off_t startpos;
4371         const char *data;
4372         NTSTATUS status = NT_STATUS_OK;
4373         files_struct *fsp;
4374         struct lock_struct lock;
4375         int saved_errno = 0;
4376
4377         START_PROFILE(SMBwriteunlock);
4378
4379         if (req->wct < 5) {
4380                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4381                 END_PROFILE(SMBwriteunlock);
4382                 return;
4383         }
4384
4385         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4386
4387         if (!check_fsp(conn, req, fsp)) {
4388                 END_PROFILE(SMBwriteunlock);
4389                 return;
4390         }
4391
4392         if (!CHECK_WRITE(fsp)) {
4393                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4394                 END_PROFILE(SMBwriteunlock);
4395                 return;
4396         }
4397
4398         numtowrite = SVAL(req->vwv+1, 0);
4399         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4400         data = (const char *)req->buf + 3;
4401
4402         if (!fsp->print_file && numtowrite > 0) {
4403                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4404                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4405                     &lock);
4406
4407                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4408                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4409                         END_PROFILE(SMBwriteunlock);
4410                         return;
4411                 }
4412         }
4413
4414         /* The special X/Open SMB protocol handling of
4415            zero length writes is *NOT* done for
4416            this call */
4417         if(numtowrite == 0) {
4418                 nwritten = 0;
4419         } else {
4420                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4421                 saved_errno = errno;
4422         }
4423
4424         status = sync_file(conn, fsp, False /* write through */);
4425         if (!NT_STATUS_IS_OK(status)) {
4426                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4427                          fsp_str_dbg(fsp), nt_errstr(status)));
4428                 reply_nterror(req, status);
4429                 goto strict_unlock;
4430         }
4431
4432         if(nwritten < 0) {
4433                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4434                 goto strict_unlock;
4435         }
4436
4437         if((nwritten < numtowrite) && (numtowrite != 0)) {
4438                 reply_nterror(req, NT_STATUS_DISK_FULL);
4439                 goto strict_unlock;
4440         }
4441
4442         if (numtowrite && !fsp->print_file) {
4443                 status = do_unlock(req->sconn->msg_ctx,
4444                                 fsp,
4445                                 (uint64_t)req->smbpid,
4446                                 (uint64_t)numtowrite,
4447                                 (uint64_t)startpos,
4448                                 WINDOWS_LOCK);
4449
4450                 if (NT_STATUS_V(status)) {
4451                         reply_nterror(req, status);
4452                         goto strict_unlock;
4453                 }
4454         }
4455
4456         reply_outbuf(req, 1, 0);
4457
4458         SSVAL(req->outbuf,smb_vwv0,nwritten);
4459
4460         DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4461                   fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4462
4463 strict_unlock:
4464         if (numtowrite && !fsp->print_file) {
4465                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4466         }
4467
4468         END_PROFILE(SMBwriteunlock);
4469         return;
4470 }
4471
4472 #undef DBGC_CLASS
4473 #define DBGC_CLASS DBGC_ALL
4474
4475 /****************************************************************************
4476  Reply to a write.
4477 ****************************************************************************/
4478
4479 void reply_write(struct smb_request *req)
4480 {
4481         connection_struct *conn = req->conn;
4482         size_t numtowrite;
4483         ssize_t nwritten = -1;
4484         off_t startpos;
4485         const char *data;
4486         files_struct *fsp;
4487         struct lock_struct lock;
4488         NTSTATUS status;
4489         int saved_errno = 0;
4490
4491         START_PROFILE(SMBwrite);
4492
4493         if (req->wct < 5) {
4494                 END_PROFILE(SMBwrite);
4495                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4496                 return;
4497         }
4498
4499         /* If it's an IPC, pass off the pipe handler. */
4500         if (IS_IPC(conn)) {
4501                 reply_pipe_write(req);
4502                 END_PROFILE(SMBwrite);
4503                 return;
4504         }
4505
4506         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4507
4508         if (!check_fsp(conn, req, fsp)) {
4509                 END_PROFILE(SMBwrite);
4510                 return;
4511         }
4512
4513         if (!CHECK_WRITE(fsp)) {
4514                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4515                 END_PROFILE(SMBwrite);
4516                 return;
4517         }
4518
4519         numtowrite = SVAL(req->vwv+1, 0);
4520         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4521         data = (const char *)req->buf + 3;
4522
4523         if (!fsp->print_file) {
4524                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4525                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4526                         &lock);
4527
4528                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4529                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4530                         END_PROFILE(SMBwrite);
4531                         return;
4532                 }
4533         }
4534
4535         /*
4536          * X/Open SMB protocol says that if smb_vwv1 is
4537          * zero then the file size should be extended or
4538          * truncated to the size given in smb_vwv[2-3].
4539          */
4540
4541         if(numtowrite == 0) {
4542                 /*
4543                  * This is actually an allocate call, and set EOF. JRA.
4544                  */
4545                 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4546                 if (nwritten < 0) {
4547                         reply_nterror(req, NT_STATUS_DISK_FULL);
4548                         goto strict_unlock;
4549                 }
4550                 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4551                 if (nwritten < 0) {
4552                         reply_nterror(req, NT_STATUS_DISK_FULL);
4553                         goto strict_unlock;
4554                 }
4555                 trigger_write_time_update_immediate(fsp);
4556         } else {
4557                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4558         }
4559
4560         status = sync_file(conn, fsp, False);
4561         if (!NT_STATUS_IS_OK(status)) {
4562                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4563                          fsp_str_dbg(fsp), nt_errstr(status)));
4564                 reply_nterror(req, status);
4565                 goto strict_unlock;
4566         }
4567
4568         if(nwritten < 0) {
4569                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4570                 goto strict_unlock;
4571         }
4572
4573         if((nwritten == 0) && (numtowrite != 0)) {
4574                 reply_nterror(req, NT_STATUS_DISK_FULL);
4575                 goto strict_unlock;
4576         }
4577
4578         reply_outbuf(req, 1, 0);
4579
4580         SSVAL(req->outbuf,smb_vwv0,nwritten);
4581
4582         if (nwritten < (ssize_t)numtowrite) {
4583                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4584                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4585         }
4586
4587         DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4588
4589 strict_unlock:
4590         if (!fsp->print_file) {
4591                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4592         }
4593
4594         END_PROFILE(SMBwrite);
4595         return;
4596 }
4597
4598 /****************************************************************************
4599  Ensure a buffer is a valid writeX for recvfile purposes.
4600 ****************************************************************************/
4601
4602 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4603                                                 (2*14) + /* word count (including bcc) */ \
4604                                                 1 /* pad byte */)
4605
4606 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4607                             const uint8_t *inbuf)
4608 {
4609         size_t numtowrite;
4610         connection_struct *conn = NULL;
4611         unsigned int doff = 0;
4612         size_t len = smb_len_large(inbuf);
4613         struct smbXsrv_tcon *tcon;
4614         NTSTATUS status;
4615         NTTIME now = 0;
4616
4617         if (is_encrypted_packet(sconn, inbuf)) {
4618                 /* Can't do this on encrypted
4619                  * connections. */
4620                 return false;
4621         }
4622
4623         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4624                 return false;
4625         }
4626
4627         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4628                         CVAL(inbuf,smb_wct) != 14) {
4629                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4630                         "invalid word length.\n"));
4631                 return false;
4632         }
4633
4634         status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
4635                                      now, &tcon);
4636         if (!NT_STATUS_IS_OK(status)) {
4637                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4638                 return false;
4639         }
4640         conn = tcon->compat;
4641
4642         if (IS_IPC(conn)) {
4643                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4644                 return false;
4645         }
4646         if (IS_PRINT(conn)) {
4647                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4648                 return false;
4649         }
4650         doff = SVAL(inbuf,smb_vwv11);
4651
4652         numtowrite = SVAL(inbuf,smb_vwv10);
4653
4654         if (len > doff && len - doff > 0xFFFF) {
4655                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4656         }
4657
4658         if (numtowrite == 0) {
4659                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4660                 return false;
4661         }
4662
4663         /* Ensure the sizes match up. */
4664         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4665                 /* no pad byte...old smbclient :-( */
4666                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4667                         (unsigned int)doff,
4668                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4669                 return false;
4670         }
4671
4672         if (len - doff != numtowrite) {
4673                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4674                         "len = %u, doff = %u, numtowrite = %u\n",
4675                         (unsigned int)len,
4676                         (unsigned int)doff,
4677                         (unsigned int)numtowrite ));
4678                 return false;
4679         }
4680
4681         DEBUG(10,("is_valid_writeX_buffer: true "
4682                 "len = %u, doff = %u, numtowrite = %u\n",
4683                 (unsigned int)len,
4684                 (unsigned int)doff,
4685                 (unsigned int)numtowrite ));
4686
4687         return true;
4688 }
4689
4690 /****************************************************************************
4691  Reply to a write and X.
4692 ****************************************************************************/
4693
4694 void reply_write_and_X(struct smb_request *req)
4695 {
4696         connection_struct *conn = req->conn;
4697         files_struct *fsp;
4698         struct lock_struct lock;
4699         off_t startpos;
4700         size_t numtowrite;
4701         bool write_through;
4702         ssize_t nwritten;
4703         unsigned int smb_doff;
4704         unsigned int smblen;
4705         const char *data;
4706         NTSTATUS status;
4707         int saved_errno = 0;
4708
4709         START_PROFILE(SMBwriteX);
4710
4711         if ((req->wct != 12) && (req->wct != 14)) {
4712                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4713                 goto out;
4714         }
4715
4716         numtowrite = SVAL(req->vwv+10, 0);
4717         smb_doff = SVAL(req->vwv+11, 0);
4718         smblen = smb_len(req->inbuf);
4719
4720         if (req->unread_bytes > 0xFFFF ||
4721                         (smblen > smb_doff &&
4722                                 smblen - smb_doff > 0xFFFF)) {
4723                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4724         }
4725
4726         if (req->unread_bytes) {
4727                 /* Can't do a recvfile write on IPC$ */
4728                 if (IS_IPC(conn)) {
4729                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4730                         goto out;
4731                 }
4732                 if (numtowrite != req->unread_bytes) {
4733                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4734                         goto out;
4735                 }
4736         } else {
4737                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4738                                 smb_doff + numtowrite > smblen) {
4739                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4740                         goto out;
4741                 }
4742         }
4743
4744         /* If it's an IPC, pass off the pipe handler. */
4745         if (IS_IPC(conn)) {
4746                 if (req->unread_bytes) {
4747                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4748                         goto out;
4749                 }
4750                 reply_pipe_write_and_X(req);
4751                 goto out;
4752         }
4753
4754         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4755         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4756         write_through = BITSETW(req->vwv+7,0);
4757
4758         if (!check_fsp(conn, req, fsp)) {
4759                 goto out;
4760         }
4761
4762         if (!CHECK_WRITE(fsp)) {
4763                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4764                 goto out;
4765         }
4766
4767         data = smb_base(req->inbuf) + smb_doff;
4768
4769         if(req->wct == 14) {
4770                 /*
4771                  * This is a large offset (64 bit) write.
4772                  */
4773                 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4774
4775         }
4776
4777         /* X/Open SMB protocol says that, unlike SMBwrite
4778         if the length is zero then NO truncation is
4779         done, just a write of zero. To truncate a file,
4780         use SMBwrite. */
4781
4782         if(numtowrite == 0) {
4783                 nwritten = 0;
4784         } else {
4785                 if (req->unread_bytes == 0) {
4786                         status = schedule_aio_write_and_X(conn,
4787                                                 req,
4788                                                 fsp,
4789                                                 data,
4790                                                 startpos,
4791                                                 numtowrite);
4792
4793                         if (NT_STATUS_IS_OK(status)) {
4794                                 /* write scheduled - we're done. */
4795                                 goto out;
4796                         }
4797                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4798                                 /* Real error - report to client. */
4799                                 reply_nterror(req, status);
4800                                 goto out;
4801                         }
4802                         /* NT_STATUS_RETRY - fall through to sync write. */
4803                 }
4804
4805                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4806                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4807                     &lock);
4808
4809                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4810                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4811                         goto out;
4812                 }
4813
4814                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4815                 saved_errno = errno;
4816
4817                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4818         }
4819
4820         if(nwritten < 0) {
4821                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4822                 goto out;
4823         }
4824
4825         if((nwritten == 0) && (numtowrite != 0)) {
4826                 reply_nterror(req, NT_STATUS_DISK_FULL);
4827                 goto out;
4828         }
4829
4830         reply_outbuf(req, 6, 0);
4831         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4832         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
4833         SSVAL(req->outbuf,smb_vwv2,nwritten);
4834         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4835
4836         DEBUG(3,("writeX %s num=%d wrote=%d\n",
4837                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4838
4839         status = sync_file(conn, fsp, write_through);
4840         if (!NT_STATUS_IS_OK(status)) {
4841                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4842                          fsp_str_dbg(fsp), nt_errstr(status)));
4843                 reply_nterror(req, status);
4844                 goto out;
4845         }
4846
4847         END_PROFILE(SMBwriteX);
4848         return;
4849
4850 out:
4851         if (req->unread_bytes) {
4852                 /* writeX failed. drain socket. */
4853                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4854                                 req->unread_bytes) {
4855                         smb_panic("failed to drain pending bytes");
4856                 }
4857                 req->unread_bytes = 0;
4858         }
4859
4860         END_PROFILE(SMBwriteX);
4861         return;
4862 }
4863
4864 /****************************************************************************
4865  Reply to a lseek.
4866 ****************************************************************************/
4867
4868 void reply_lseek(struct smb_request *req)
4869 {
4870         connection_struct *conn = req->conn;
4871         off_t startpos;
4872         off_t res= -1;
4873         int mode,umode;
4874         files_struct *fsp;
4875
4876         START_PROFILE(SMBlseek);
4877
4878         if (req->wct < 4) {
4879                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4880                 END_PROFILE(SMBlseek);
4881                 return;
4882         }
4883
4884         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4885
4886         if (!check_fsp(conn, req, fsp)) {
4887                 return;
4888         }
4889
4890         flush_write_cache(fsp, SEEK_FLUSH);
4891
4892         mode = SVAL(req->vwv+1, 0) & 3;
4893         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4894         startpos = (off_t)IVALS(req->vwv+2, 0);
4895
4896         switch (mode) {
4897                 case 0:
4898                         umode = SEEK_SET;
4899                         res = startpos;
4900                         break;
4901                 case 1:
4902                         umode = SEEK_CUR;
4903                         res = fsp->fh->pos + startpos;
4904                         break;
4905                 case 2:
4906                         umode = SEEK_END;
4907                         break;
4908                 default:
4909                         umode = SEEK_SET;
4910                         res = startpos;
4911                         break;
4912         }
4913
4914         if (umode == SEEK_END) {
4915                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4916                         if(errno == EINVAL) {
4917                                 off_t current_pos = startpos;
4918
4919                                 if(fsp_stat(fsp) == -1) {
4920                                         reply_nterror(req,
4921                                                 map_nt_error_from_unix(errno));
4922                                         END_PROFILE(SMBlseek);
4923                                         return;
4924                                 }
4925
4926                                 current_pos += fsp->fsp_name->st.st_ex_size;
4927                                 if(current_pos < 0)
4928                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4929                         }
4930                 }
4931
4932                 if(res == -1) {
4933                         reply_nterror(req, map_nt_error_from_unix(errno));
4934                         END_PROFILE(SMBlseek);
4935                         return;
4936                 }
4937         }
4938
4939         fsp->fh->pos = res;
4940
4941         reply_outbuf(req, 2, 0);
4942         SIVAL(req->outbuf,smb_vwv0,res);
4943
4944         DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4945                 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4946
4947         END_PROFILE(SMBlseek);
4948         return;
4949 }
4950
4951 /****************************************************************************
4952  Reply to a flush.
4953 ****************************************************************************/
4954
4955 void reply_flush(struct smb_request *req)
4956 {
4957         connection_struct *conn = req->conn;
4958         uint16 fnum;
4959         files_struct *fsp;
4960
4961         START_PROFILE(SMBflush);
4962
4963         if (req->wct < 1) {
4964                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4965                 return;
4966         }
4967
4968         fnum = SVAL(req->vwv+0, 0);
4969         fsp = file_fsp(req, fnum);
4970
4971         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4972                 return;
4973         }
4974
4975         if (!fsp) {
4976                 file_sync_all(conn);
4977         } else {
4978                 NTSTATUS status = sync_file(conn, fsp, True);
4979                 if (!NT_STATUS_IS_OK(status)) {
4980                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4981                                 fsp_str_dbg(fsp), nt_errstr(status)));
4982                         reply_nterror(req, status);
4983                         END_PROFILE(SMBflush);
4984                         return;
4985                 }
4986         }
4987
4988         reply_outbuf(req, 0, 0);
4989
4990         DEBUG(3,("flush\n"));
4991         END_PROFILE(SMBflush);
4992         return;
4993 }
4994
4995 /****************************************************************************
4996  Reply to a exit.
4997  conn POINTER CAN BE NULL HERE !
4998 ****************************************************************************/
4999
5000 void reply_exit(struct smb_request *req)
5001 {
5002         START_PROFILE(SMBexit);
5003
5004         file_close_pid(req->sconn, req->smbpid, req->vuid);
5005
5006         reply_outbuf(req, 0, 0);
5007
5008         DEBUG(3,("exit\n"));
5009
5010         END_PROFILE(SMBexit);
5011         return;
5012 }
5013
5014 struct reply_close_state {
5015         files_struct *fsp;
5016         struct smb_request *smbreq;
5017 };
5018
5019 static void do_smb1_close(struct tevent_req *req);
5020
5021 void reply_close(struct smb_request *req)
5022 {
5023         connection_struct *conn = req->conn;
5024         NTSTATUS status = NT_STATUS_OK;
5025         files_struct *fsp = NULL;
5026         START_PROFILE(SMBclose);
5027
5028         if (req->wct < 3) {
5029                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5030                 END_PROFILE(SMBclose);
5031                 return;
5032         }
5033
5034         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5035
5036         /*
5037          * We can only use check_fsp if we know it's not a directory.
5038          */
5039
5040         if (!check_fsp_open(conn, req, fsp)) {
5041                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5042                 END_PROFILE(SMBclose);
5043                 return;
5044         }
5045
5046         DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5047                   fsp->is_directory ? "directory" : "file",
5048                   fsp->fh->fd, fsp_fnum_dbg(fsp),
5049                   conn->num_files_open));
5050
5051         if (!fsp->is_directory) {
5052                 time_t t;
5053
5054                 /*
5055                  * Take care of any time sent in the close.
5056                  */
5057
5058                 t = srv_make_unix_date3(req->vwv+1);
5059                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5060         }
5061
5062         if (fsp->num_aio_requests != 0) {
5063
5064                 struct reply_close_state *state;
5065
5066                 DEBUG(10, ("closing with aio %u requests pending\n",
5067                            fsp->num_aio_requests));
5068
5069                 /*
5070                  * We depend on the aio_extra destructor to take care of this
5071                  * close request once fsp->num_aio_request drops to 0.
5072                  */
5073
5074                 fsp->deferred_close = tevent_wait_send(
5075                         fsp, fsp->conn->sconn->ev_ctx);
5076                 if (fsp->deferred_close == NULL) {
5077                         status = NT_STATUS_NO_MEMORY;
5078                         goto done;
5079                 }
5080
5081                 state = talloc(fsp, struct reply_close_state);
5082                 if (state == NULL) {
5083                         TALLOC_FREE(fsp->deferred_close);
5084                         status = NT_STATUS_NO_MEMORY;
5085                         goto done;
5086                 }
5087                 state->fsp = fsp;
5088                 state->smbreq = talloc_move(fsp, &req);
5089                 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5090                                         state);
5091                 END_PROFILE(SMBclose);
5092                 return;
5093         }
5094
5095         /*
5096          * close_file() returns the unix errno if an error was detected on
5097          * close - normally this is due to a disk full error. If not then it
5098          * was probably an I/O error.
5099          */
5100
5101         status = close_file(req, fsp, NORMAL_CLOSE);
5102 done:
5103         if (!NT_STATUS_IS_OK(status)) {
5104                 reply_nterror(req, status);
5105                 END_PROFILE(SMBclose);
5106                 return;
5107         }
5108
5109         reply_outbuf(req, 0, 0);
5110         END_PROFILE(SMBclose);
5111         return;
5112 }
5113
5114 static void do_smb1_close(struct tevent_req *req)
5115 {
5116         struct reply_close_state *state = tevent_req_callback_data(
5117                 req, struct reply_close_state);
5118         struct smb_request *smbreq;
5119         NTSTATUS status;
5120         int ret;
5121
5122         ret = tevent_wait_recv(req);
5123         TALLOC_FREE(req);
5124         if (ret != 0) {
5125                 DEBUG(10, ("tevent_wait_recv returned %s\n",
5126                            strerror(ret)));
5127                 /*
5128                  * Continue anyway, this should never happen
5129                  */
5130         }
5131
5132         /*
5133          * fsp->smb2_close_request right now is a talloc grandchild of
5134          * fsp. When we close_file(fsp), it would go with it. No chance to
5135          * reply...
5136          */
5137         smbreq = talloc_move(talloc_tos(), &state->smbreq);
5138
5139         status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5140         if (NT_STATUS_IS_OK(status)) {
5141                 reply_outbuf(smbreq, 0, 0);
5142         } else {
5143                 reply_nterror(smbreq, status);
5144         }
5145         if (!srv_send_smb(smbreq->sconn,
5146                         (char *)smbreq->outbuf,
5147                         true,
5148                         smbreq->seqnum+1,
5149                         IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5150                         NULL)) {
5151                 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5152                                     "failed.");
5153         }
5154         TALLOC_FREE(smbreq);
5155 }
5156
5157 /****************************************************************************
5158  Reply to a writeclose (Core+ protocol).
5159 ****************************************************************************/
5160
5161 void reply_writeclose(struct smb_request *req)
5162 {
5163         connection_struct *conn = req->conn;
5164         size_t numtowrite;
5165         ssize_t nwritten = -1;
5166         NTSTATUS close_status = NT_STATUS_OK;
5167         off_t startpos;
5168         const char *data;
5169         struct timespec mtime;
5170         files_struct *fsp;
5171         struct lock_struct lock;
5172
5173         START_PROFILE(SMBwriteclose);
5174
5175         if (req->wct < 6) {
5176                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5177                 END_PROFILE(SMBwriteclose);
5178                 return;
5179         }
5180
5181         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5182
5183         if (!check_fsp(conn, req, fsp)) {
5184                 END_PROFILE(SMBwriteclose);
5185                 return;
5186         }
5187         if (!CHECK_WRITE(fsp)) {
5188                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5189                 END_PROFILE(SMBwriteclose);
5190                 return;
5191         }
5192
5193         numtowrite = SVAL(req->vwv+1, 0);
5194         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5195         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5196         data = (const char *)req->buf + 1;
5197
5198         if (fsp->print_file == NULL) {
5199                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5200                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5201                     &lock);
5202
5203                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5204                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5205                         END_PROFILE(SMBwriteclose);
5206                         return;
5207                 }
5208         }
5209
5210         nwritten = write_file(req,fsp,data,startpos,numtowrite);
5211
5212         if (fsp->print_file == NULL) {
5213                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5214         }
5215
5216         set_close_write_time(fsp, mtime);
5217
5218         /*
5219          * More insanity. W2K only closes the file if writelen > 0.
5220          * JRA.
5221          */
5222
5223         DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5224                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5225                 (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
5226
5227         if (numtowrite) {
5228                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5229                          "file %s\n", fsp_str_dbg(fsp)));
5230                 close_status = close_file(req, fsp, NORMAL_CLOSE);
5231                 fsp = NULL;
5232         }
5233
5234         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5235                 reply_nterror(req, NT_STATUS_DISK_FULL);
5236                 goto out;
5237         }
5238
5239         if(!NT_STATUS_IS_OK(close_status)) {
5240                 reply_nterror(req, close_status);
5241                 goto out;
5242         }
5243
5244         reply_outbuf(req, 1, 0);
5245
5246         SSVAL(req->outbuf,smb_vwv0,nwritten);
5247
5248 out:
5249
5250         END_PROFILE(SMBwriteclose);
5251         return;
5252 }
5253
5254 #undef DBGC_CLASS
5255 #define DBGC_CLASS DBGC_LOCKING
5256
5257 /****************************************************************************
5258  Reply to a lock.
5259 ****************************************************************************/
5260
5261 void reply_lock(struct smb_request *req)
5262 {
5263         connection_struct *conn = req->conn;
5264         uint64_t count,offset;
5265         NTSTATUS status;
5266         files_struct *fsp;
5267         struct byte_range_lock *br_lck = NULL;
5268
5269         START_PROFILE(SMBlock);
5270
5271         if (req->wct < 5) {
5272                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5273                 END_PROFILE(SMBlock);
5274                 return;
5275         }
5276
5277         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5278
5279         if (!check_fsp(conn, req, fsp)) {
5280                 END_PROFILE(SMBlock);
5281                 return;
5282         }
5283
5284         count = (uint64_t)IVAL(req->vwv+1, 0);
5285         offset = (uint64_t)IVAL(req->vwv+3, 0);
5286
5287         DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5288                  fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5289
5290         br_lck = do_lock(req->sconn->msg_ctx,
5291                         fsp,
5292                         (uint64_t)req->smbpid,
5293                         count,
5294                         offset,
5295                         WRITE_LOCK,
5296                         WINDOWS_LOCK,
5297                         False, /* Non-blocking lock. */
5298                         &status,
5299                         NULL,
5300                         NULL);
5301
5302         TALLOC_FREE(br_lck);
5303
5304         if (NT_STATUS_V(status)) {
5305                 reply_nterror(req, status);
5306                 END_PROFILE(SMBlock);
5307                 return;
5308         }
5309
5310         reply_outbuf(req, 0, 0);
5311
5312         END_PROFILE(SMBlock);
5313         return;
5314 }
5315
5316 /****************************************************************************
5317  Reply to a unlock.
5318 ****************************************************************************/
5319
5320 void reply_unlock(struct smb_request *req)
5321 {
5322         connection_struct *conn = req->conn;
5323         uint64_t count,offset;
5324         NTSTATUS status;
5325         files_struct *fsp;
5326
5327         START_PROFILE(SMBunlock);
5328
5329         if (req->wct < 5) {
5330                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5331                 END_PROFILE(SMBunlock);
5332                 return;
5333         }
5334
5335         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5336
5337         if (!check_fsp(conn, req, fsp)) {
5338                 END_PROFILE(SMBunlock);
5339                 return;
5340         }
5341
5342         count = (uint64_t)IVAL(req->vwv+1, 0);
5343         offset = (uint64_t)IVAL(req->vwv+3, 0);
5344
5345         status = do_unlock(req->sconn->msg_ctx,
5346                         fsp,
5347                         (uint64_t)req->smbpid,
5348                         count,
5349                         offset,
5350                         WINDOWS_LOCK);
5351
5352         if (NT_STATUS_V(status)) {
5353                 reply_nterror(req, status);
5354                 END_PROFILE(SMBunlock);
5355                 return;
5356         }
5357
5358         DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5359                     fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5360
5361         reply_outbuf(req, 0, 0);
5362
5363         END_PROFILE(SMBunlock);
5364         return;
5365 }
5366
5367 #undef DBGC_CLASS
5368 #define DBGC_CLASS DBGC_ALL
5369
5370 /****************************************************************************
5371  Reply to a tdis.
5372  conn POINTER CAN BE NULL HERE !
5373 ****************************************************************************/
5374
5375 void reply_tdis(struct smb_request *req)
5376 {
5377         NTSTATUS status;
5378         connection_struct *conn = req->conn;
5379         struct smbXsrv_tcon *tcon;
5380
5381         START_PROFILE(SMBtdis);
5382
5383         if (!conn) {
5384                 DEBUG(4,("Invalid connection in tdis\n"));
5385                 reply_force_doserror(req, ERRSRV, ERRinvnid);
5386                 END_PROFILE(SMBtdis);
5387                 return;
5388         }
5389
5390         tcon = conn->tcon;
5391         req->conn = NULL;
5392
5393         /*
5394          * TODO: cancel all outstanding requests on the tcon
5395          */
5396         status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5397         if (!NT_STATUS_IS_OK(status)) {
5398                 DEBUG(0, ("reply_tdis: "
5399                           "smbXsrv_tcon_disconnect() failed: %s\n",
5400                           nt_errstr(status)));
5401                 /*
5402                  * If we hit this case, there is something completely
5403                  * wrong, so we better disconnect the transport connection.
5404                  */
5405                 END_PROFILE(SMBtdis);
5406                 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5407                 return;
5408         }
5409
5410         TALLOC_FREE(tcon);
5411
5412         reply_outbuf(req, 0, 0);
5413         END_PROFILE(SMBtdis);
5414         return;
5415 }
5416
5417 /****************************************************************************
5418  Reply to a echo.
5419  conn POINTER CAN BE NULL HERE !
5420 ****************************************************************************/
5421
5422 void reply_echo(struct smb_request *req)
5423 {
5424         connection_struct *conn = req->conn;
5425         struct smb_perfcount_data local_pcd;
5426         struct smb_perfcount_data *cur_pcd;
5427         int smb_reverb;
5428         int seq_num;
5429
5430         START_PROFILE(SMBecho);
5431
5432         smb_init_perfcount_data(&local_pcd);
5433
5434         if (req->wct < 1) {
5435                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5436                 END_PROFILE(SMBecho);
5437                 return;
5438         }
5439
5440         smb_reverb = SVAL(req->vwv+0, 0);
5441
5442         reply_outbuf(req, 1, req->buflen);
5443
5444         /* copy any incoming data back out */
5445         if (req->buflen > 0) {
5446                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5447         }
5448
5449         if (smb_reverb > 100) {
5450                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5451                 smb_reverb = 100;
5452         }
5453
5454         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5455
5456                 /* this makes sure we catch the request pcd */
5457                 if (seq_num == smb_reverb) {
5458                         cur_pcd = &req->pcd;
5459                 } else {
5460                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5461                         cur_pcd = &local_pcd;
5462                 }
5463
5464                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5465
5466                 show_msg((char *)req->outbuf);
5467                 if (!srv_send_smb(req->sconn,
5468                                 (char *)req->outbuf,
5469                                 true, req->seqnum+1,
5470                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5471                                 cur_pcd))
5472                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5473         }
5474
5475         DEBUG(3,("echo %d times\n", smb_reverb));
5476
5477         TALLOC_FREE(req->outbuf);
5478
5479         END_PROFILE(SMBecho);
5480         return;
5481 }
5482
5483 /****************************************************************************
5484  Reply to a printopen.
5485 ****************************************************************************/
5486
5487 void reply_printopen(struct smb_request *req)
5488 {
5489         connection_struct *conn = req->conn;
5490         files_struct *fsp;
5491         NTSTATUS status;
5492
5493         START_PROFILE(SMBsplopen);
5494
5495         if (req->wct < 2) {
5496                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5497                 END_PROFILE(SMBsplopen);
5498                 return;
5499         }
5500
5501         if (!CAN_PRINT(conn)) {
5502                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5503                 END_PROFILE(SMBsplopen);
5504                 return;
5505         }
5506
5507         status = file_new(req, conn, &fsp);
5508         if(!NT_STATUS_IS_OK(status)) {
5509                 reply_nterror(req, status);
5510                 END_PROFILE(SMBsplopen);
5511                 return;
5512         }
5513
5514         /* Open for exclusive use, write only. */
5515         status = print_spool_open(fsp, NULL, req->vuid);
5516
5517         if (!NT_STATUS_IS_OK(status)) {
5518                 file_free(req, fsp);
5519                 reply_nterror(req, status);
5520                 END_PROFILE(SMBsplopen);
5521                 return;
5522         }
5523
5524         reply_outbuf(req, 1, 0);
5525         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5526
5527         DEBUG(3,("openprint fd=%d %s\n",
5528                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5529
5530         END_PROFILE(SMBsplopen);
5531         return;
5532 }
5533
5534 /****************************************************************************
5535  Reply to a printclose.
5536 ****************************************************************************/
5537
5538 void reply_printclose(struct smb_request *req)
5539 {
5540         connection_struct *conn = req->conn;
5541         files_struct *fsp;
5542         NTSTATUS status;
5543
5544         START_PROFILE(SMBsplclose);
5545
5546         if (req->wct < 1) {
5547                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5548                 END_PROFILE(SMBsplclose);
5549                 return;
5550         }
5551
5552         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5553
5554         if (!check_fsp(conn, req, fsp)) {
5555                 END_PROFILE(SMBsplclose);
5556                 return;
5557         }
5558
5559         if (!CAN_PRINT(conn)) {
5560                 reply_force_doserror(req, ERRSRV, ERRerror);
5561                 END_PROFILE(SMBsplclose);
5562                 return;
5563         }
5564
5565         DEBUG(3,("printclose fd=%d %s\n",
5566                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5567
5568         status = close_file(req, fsp, NORMAL_CLOSE);
5569
5570         if(!NT_STATUS_IS_OK(status)) {
5571                 reply_nterror(req, status);
5572                 END_PROFILE(SMBsplclose);
5573                 return;
5574         }
5575
5576         reply_outbuf(req, 0, 0);
5577
5578         END_PROFILE(SMBsplclose);
5579         return;
5580 }
5581
5582 /****************************************************************************
5583  Reply to a printqueue.
5584 ****************************************************************************/
5585
5586 void reply_printqueue(struct smb_request *req)
5587 {
5588         connection_struct *conn = req->conn;
5589         int max_count;
5590         int start_index;
5591
5592         START_PROFILE(SMBsplretq);
5593
5594         if (req->wct < 2) {
5595                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5596                 END_PROFILE(SMBsplretq);
5597                 return;
5598         }
5599
5600         max_count = SVAL(req->vwv+0, 0);
5601         start_index = SVAL(req->vwv+1, 0);
5602
5603         /* we used to allow the client to get the cnum wrong, but that
5604            is really quite gross and only worked when there was only
5605            one printer - I think we should now only accept it if they
5606            get it right (tridge) */
5607         if (!CAN_PRINT(conn)) {
5608                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5609                 END_PROFILE(SMBsplretq);
5610                 return;
5611         }
5612
5613         reply_outbuf(req, 2, 3);
5614         SSVAL(req->outbuf,smb_vwv0,0);
5615         SSVAL(req->outbuf,smb_vwv1,0);
5616         SCVAL(smb_buf(req->outbuf),0,1);
5617         SSVAL(smb_buf(req->outbuf),1,0);
5618
5619         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5620                  start_index, max_count));
5621
5622         {
5623                 TALLOC_CTX *mem_ctx = talloc_tos();
5624                 NTSTATUS status;
5625                 WERROR werr;
5626                 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5627                 struct rpc_pipe_client *cli = NULL;
5628                 struct dcerpc_binding_handle *b = NULL;
5629                 struct policy_handle handle;
5630                 struct spoolss_DevmodeContainer devmode_ctr;
5631                 union spoolss_JobInfo *info;
5632                 uint32_t count;
5633                 uint32_t num_to_get;
5634                 uint32_t first;
5635                 uint32_t i;
5636
5637                 ZERO_STRUCT(handle);
5638
5639                 status = rpc_pipe_open_interface(conn,
5640                                                  &ndr_table_spoolss.syntax_id,
5641                                                  conn->session_info,
5642                                                  conn->sconn->remote_address,
5643                                                  conn->sconn->msg_ctx,
5644                                                  &cli);
5645                 if (!NT_STATUS_IS_OK(status)) {
5646                         DEBUG(0, ("reply_printqueue: "
5647                                   "could not connect to spoolss: %s\n",
5648                                   nt_errstr(status)));
5649                         reply_nterror(req, status);
5650                         goto out;
5651                 }
5652                 b = cli->binding_handle;
5653
5654                 ZERO_STRUCT(devmode_ctr);
5655
5656                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5657                                                 sharename,
5658                                                 NULL, devmode_ctr,
5659                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5660                                                 &handle,
5661                                                 &werr);
5662                 if (!NT_STATUS_IS_OK(status)) {
5663                         reply_nterror(req, status);
5664                         goto out;
5665                 }
5666                 if (!W_ERROR_IS_OK(werr)) {
5667                         reply_nterror(req, werror_to_ntstatus(werr));
5668                         goto out;
5669                 }
5670
5671                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5672                                                &handle,
5673                                                0, /* firstjob */
5674                                                0xff, /* numjobs */
5675                                                2, /* level */
5676                                                0, /* offered */
5677                                                &count,
5678                                                &info);
5679                 if (!W_ERROR_IS_OK(werr)) {
5680                         reply_nterror(req, werror_to_ntstatus(werr));
5681                         goto out;
5682                 }
5683
5684                 if (max_count > 0) {
5685                         first = start_index;
5686                 } else {
5687                         first = start_index + max_count + 1;
5688                 }
5689
5690                 if (first >= count) {
5691                         num_to_get = first;
5692                 } else {
5693                         num_to_get = first + MIN(ABS(max_count), count - first);
5694                 }
5695
5696                 for (i = first; i < num_to_get; i++) {
5697                         char blob[28];
5698                         char *p = blob;
5699                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5700                         int qstatus;
5701                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5702                                                         info[i].info2.job_id);
5703
5704                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5705                                 qstatus = 2;
5706                         } else {
5707                                 qstatus = 3;
5708                         }
5709
5710                         srv_put_dos_date2(p, 0, qtime);
5711                         SCVAL(p, 4, qstatus);
5712                         SSVAL(p, 5, qrapjobid);
5713                         SIVAL(p, 7, info[i].info2.size);
5714                         SCVAL(p, 11, 0);
5715                         srvstr_push(blob, req->flags2, p+12,
5716                                     info[i].info2.notify_name, 16, STR_ASCII);
5717
5718                         if (message_push_blob(
5719                                     &req->outbuf,
5720                                     data_blob_const(
5721                                             blob, sizeof(blob))) == -1) {
5722                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5723                                 goto out;
5724                         }
5725                 }
5726
5727                 if (count > 0) {
5728                         SSVAL(req->outbuf,smb_vwv0,count);
5729                         SSVAL(req->outbuf,smb_vwv1,
5730                               (max_count>0?first+count:first-1));
5731                         SCVAL(smb_buf(req->outbuf),0,1);
5732                         SSVAL(smb_buf(req->outbuf),1,28*count);
5733                 }
5734
5735
5736                 DEBUG(3, ("%u entries returned in queue\n",
5737                           (unsigned)count));
5738
5739 out:
5740                 if (b && is_valid_policy_hnd(&handle)) {
5741                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5742                 }
5743
5744         }
5745
5746         END_PROFILE(SMBsplretq);
5747         return;
5748 }
5749
5750 /****************************************************************************
5751  Reply to a printwrite.
5752 ****************************************************************************/
5753
5754 void reply_printwrite(struct smb_request *req)
5755 {
5756         connection_struct *conn = req->conn;
5757         int numtowrite;
5758         const char *data;
5759         files_struct *fsp;
5760
5761         START_PROFILE(SMBsplwr);
5762
5763         if (req->wct < 1) {
5764                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5765                 END_PROFILE(SMBsplwr);
5766                 return;
5767         }
5768
5769         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5770
5771         if (!check_fsp(conn, req, fsp)) {
5772                 END_PROFILE(SMBsplwr);
5773                 return;
5774         }
5775
5776         if (!fsp->print_file) {
5777                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5778                 END_PROFILE(SMBsplwr);
5779                 return;
5780         }
5781
5782         if (!CHECK_WRITE(fsp)) {
5783                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5784                 END_PROFILE(SMBsplwr);
5785                 return;
5786         }
5787
5788         numtowrite = SVAL(req->buf, 1);
5789
5790         if (req->buflen < numtowrite + 3) {
5791                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5792                 END_PROFILE(SMBsplwr);
5793                 return;
5794         }
5795
5796         data = (const char *)req->buf + 3;
5797
5798         if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5799                 reply_nterror(req, map_nt_error_from_unix(errno));
5800                 END_PROFILE(SMBsplwr);
5801                 return;
5802         }
5803
5804         DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5805
5806         END_PROFILE(SMBsplwr);
5807         return;
5808 }
5809
5810 /****************************************************************************
5811  Reply to a mkdir.
5812 ****************************************************************************/
5813
5814 void reply_mkdir(struct smb_request *req)
5815 {
5816         connection_struct *conn = req->conn;
5817         struct smb_filename *smb_dname = NULL;
5818         char *directory = NULL;
5819         NTSTATUS status;
5820         TALLOC_CTX *ctx = talloc_tos();
5821
5822         START_PROFILE(SMBmkdir);
5823
5824         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5825                             STR_TERMINATE, &status);
5826         if (!NT_STATUS_IS_OK(status)) {
5827                 reply_nterror(req, status);
5828                 goto out;
5829         }
5830
5831         status = filename_convert(ctx, conn,
5832                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5833                                  directory,
5834                                  UCF_PREP_CREATEFILE,
5835                                  NULL,
5836                                  &smb_dname);
5837         if (!NT_STATUS_IS_OK(status)) {
5838                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5839                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5840                                         ERRSRV, ERRbadpath);
5841                         goto out;
5842                 }
5843                 reply_nterror(req, status);
5844                 goto out;
5845         }
5846
5847         status = create_directory(conn, req, smb_dname);
5848
5849         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5850
5851         if (!NT_STATUS_IS_OK(status)) {
5852
5853                 if (!use_nt_status()
5854                     && NT_STATUS_EQUAL(status,
5855                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5856                         /*
5857                          * Yes, in the DOS error code case we get a
5858                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5859                          * samba4 torture test.
5860                          */
5861                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5862                 }
5863
5864                 reply_nterror(req, status);
5865                 goto out;
5866         }
5867
5868         reply_outbuf(req, 0, 0);
5869
5870         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5871  out:
5872         TALLOC_FREE(smb_dname);
5873         END_PROFILE(SMBmkdir);
5874         return;
5875 }
5876
5877 /****************************************************************************
5878  Reply to a rmdir.
5879 ****************************************************************************/
5880
5881 void reply_rmdir(struct smb_request *req)
5882 {
5883         connection_struct *conn = req->conn;
5884         struct smb_filename *smb_dname = NULL;
5885         char *directory = NULL;
5886         NTSTATUS status;
5887         TALLOC_CTX *ctx = talloc_tos();
5888         files_struct *fsp = NULL;
5889         int info = 0;
5890         struct smbd_server_connection *sconn = req->sconn;
5891
5892         START_PROFILE(SMBrmdir);
5893
5894         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5895                             STR_TERMINATE, &status);
5896         if (!NT_STATUS_IS_OK(status)) {
5897                 reply_nterror(req, status);
5898                 goto out;
5899         }
5900
5901         status = filename_convert(ctx, conn,
5902                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5903                                  directory,
5904                                  0,
5905                                  NULL,
5906                                  &smb_dname);
5907         if (!NT_STATUS_IS_OK(status)) {
5908                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5909                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5910                                         ERRSRV, ERRbadpath);
5911                         goto out;
5912                 }
5913                 reply_nterror(req, status);
5914                 goto out;
5915         }
5916
5917         if (is_ntfs_stream_smb_fname(smb_dname)) {
5918                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5919                 goto out;
5920         }
5921
5922         status = SMB_VFS_CREATE_FILE(
5923                 conn,                                   /* conn */
5924                 req,                                    /* req */
5925                 0,                                      /* root_dir_fid */
5926                 smb_dname,                              /* fname */
5927                 DELETE_ACCESS,                          /* access_mask */
5928                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5929                         FILE_SHARE_DELETE),
5930                 FILE_OPEN,                              /* create_disposition*/
5931                 FILE_DIRECTORY_FILE,                    /* create_options */
5932                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5933                 0,                                      /* oplock_request */
5934                 0,                                      /* allocation_size */
5935                 0,                                      /* private_flags */
5936                 NULL,                                   /* sd */
5937                 NULL,                                   /* ea_list */
5938                 &fsp,                                   /* result */
5939                 &info);                                 /* pinfo */
5940
5941         if (!NT_STATUS_IS_OK(status)) {
5942                 if (open_was_deferred(req->sconn, req->mid)) {
5943                         /* We have re-scheduled this call. */
5944                         goto out;
5945                 }
5946                 reply_nterror(req, status);
5947                 goto out;
5948         }
5949
5950         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5951         if (!NT_STATUS_IS_OK(status)) {
5952                 close_file(req, fsp, ERROR_CLOSE);
5953                 reply_nterror(req, status);
5954                 goto out;
5955         }
5956
5957         if (!set_delete_on_close(fsp, true,
5958                         conn->session_info->security_token,
5959                         conn->session_info->unix_token)) {
5960                 close_file(req, fsp, ERROR_CLOSE);
5961                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5962                 goto out;
5963         }
5964
5965         status = close_file(req, fsp, NORMAL_CLOSE);
5966         if (!NT_STATUS_IS_OK(status)) {
5967                 reply_nterror(req, status);
5968         } else {
5969                 reply_outbuf(req, 0, 0);
5970         }
5971
5972         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5973
5974         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5975  out:
5976         TALLOC_FREE(smb_dname);
5977         END_PROFILE(SMBrmdir);
5978         return;
5979 }
5980
5981 /*******************************************************************
5982  Resolve wildcards in a filename rename.
5983 ********************************************************************/
5984
5985 static bool resolve_wildcards(TALLOC_CTX *ctx,
5986                                 const char *name1,
5987                                 const char *name2,
5988                                 char **pp_newname)
5989 {
5990         char *name2_copy = NULL;
5991         char *root1 = NULL;
5992         char *root2 = NULL;
5993         char *ext1 = NULL;
5994         char *ext2 = NULL;
5995         char *p,*p2, *pname1, *pname2;
5996
5997         name2_copy = talloc_strdup(ctx, name2);
5998         if (!name2_copy) {
5999                 return False;
6000         }
6001
6002         pname1 = strrchr_m(name1,'/');
6003         pname2 = strrchr_m(name2_copy,'/');
6004
6005         if (!pname1 || !pname2) {
6006                 return False;
6007         }
6008
6009         /* Truncate the copy of name2 at the last '/' */
6010         *pname2 = '\0';
6011
6012         /* Now go past the '/' */
6013         pname1++;
6014         pname2++;
6015
6016         root1 = talloc_strdup(ctx, pname1);
6017         root2 = talloc_strdup(ctx, pname2);
6018
6019         if (!root1 || !root2) {
6020                 return False;
6021         }
6022
6023         p = strrchr_m(root1,'.');
6024         if (p) {
6025                 *p = 0;
6026                 ext1 = talloc_strdup(ctx, p+1);
6027         } else {
6028                 ext1 = talloc_strdup(ctx, "");
6029         }
6030         p = strrchr_m(root2,'.');
6031         if (p) {
6032                 *p = 0;
6033                 ext2 = talloc_strdup(ctx, p+1);
6034         } else {
6035                 ext2 = talloc_strdup(ctx, "");
6036         }
6037
6038         if (!ext1 || !ext2) {
6039                 return False;
6040         }
6041
6042         p = root1;
6043         p2 = root2;
6044         while (*p2) {
6045                 if (*p2 == '?') {
6046                         /* Hmmm. Should this be mb-aware ? */
6047                         *p2 = *p;
6048                         p2++;
6049                 } else if (*p2 == '*') {
6050                         *p2 = '\0';
6051                         root2 = talloc_asprintf(ctx, "%s%s",
6052                                                 root2,
6053                                                 p);
6054                         if (!root2) {
6055                                 return False;
6056                         }
6057                         break;
6058                 } else {
6059                         p2++;
6060                 }
6061                 if (*p) {
6062                         p++;
6063                 }
6064         }
6065
6066         p = ext1;
6067         p2 = ext2;
6068         while (*p2) {
6069                 if (*p2 == '?') {
6070                         /* Hmmm. Should this be mb-aware ? */
6071                         *p2 = *p;
6072                         p2++;
6073                 } else if (*p2 == '*') {
6074                         *p2 = '\0';
6075                         ext2 = talloc_asprintf(ctx, "%s%s",
6076                                                 ext2,
6077                                                 p);
6078                         if (!ext2) {
6079                                 return False;
6080                         }
6081                         break;
6082                 } else {
6083                         p2++;
6084                 }
6085                 if (*p) {
6086                         p++;
6087                 }
6088         }
6089
6090         if (*ext2) {
6091                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6092                                 name2_copy,
6093                                 root2,
6094                                 ext2);
6095         } else {
6096                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6097                                 name2_copy,
6098                                 root2);
6099         }
6100
6101         if (!*pp_newname) {
6102                 return False;
6103         }
6104
6105         return True;
6106 }
6107
6108 /****************************************************************************
6109  Ensure open files have their names updated. Updated to notify other smbd's
6110  asynchronously.
6111 ****************************************************************************/
6112
6113 static void rename_open_files(connection_struct *conn,
6114                               struct share_mode_lock *lck,
6115                               uint32_t orig_name_hash,
6116                               const struct smb_filename *smb_fname_dst)
6117 {
6118         files_struct *fsp;
6119         bool did_rename = False;
6120         NTSTATUS status;
6121         uint32_t new_name_hash = 0;
6122
6123         for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
6124             fsp = file_find_di_next(fsp)) {
6125                 /* fsp_name is a relative path under the fsp. To change this for other
6126                    sharepaths we need to manipulate relative paths. */
6127                 /* TODO - create the absolute path and manipulate the newname
6128                    relative to the sharepath. */
6129                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6130                         continue;
6131                 }
6132                 if (fsp->name_hash != orig_name_hash) {
6133                         continue;
6134                 }
6135                 DEBUG(10, ("rename_open_files: renaming file %s "
6136                            "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6137                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6138                            smb_fname_str_dbg(smb_fname_dst)));
6139
6140                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6141                 if (NT_STATUS_IS_OK(status)) {
6142                         did_rename = True;
6143                         new_name_hash = fsp->name_hash;
6144                 }
6145         }
6146
6147         if (!did_rename) {
6148                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6149                            "for %s\n", file_id_string_tos(&lck->data->id),
6150                            smb_fname_str_dbg(smb_fname_dst)));
6151         }
6152
6153         /* Send messages to all smbd's (not ourself) that the name has changed. */
6154         rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
6155                               orig_name_hash, new_name_hash,
6156                               smb_fname_dst);
6157
6158 }
6159
6160 /****************************************************************************
6161  We need to check if the source path is a parent directory of the destination
6162  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6163  refuse the rename with a sharing violation. Under UNIX the above call can
6164  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6165  probably need to check that the client is a Windows one before disallowing
6166  this as a UNIX client (one with UNIX extensions) can know the source is a
6167  symlink and make this decision intelligently. Found by an excellent bug
6168  report from <AndyLiebman@aol.com>.
6169 ****************************************************************************/
6170
6171 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6172                                      const struct smb_filename *smb_fname_dst)
6173 {
6174         const char *psrc = smb_fname_src->base_name;
6175         const char *pdst = smb_fname_dst->base_name;
6176         size_t slen;
6177
6178         if (psrc[0] == '.' && psrc[1] == '/') {
6179                 psrc += 2;
6180         }
6181         if (pdst[0] == '.' && pdst[1] == '/') {
6182                 pdst += 2;
6183         }
6184         if ((slen = strlen(psrc)) > strlen(pdst)) {
6185                 return False;
6186         }
6187         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6188 }
6189
6190 /*
6191  * Do the notify calls from a rename
6192  */
6193
6194 static void notify_rename(connection_struct *conn, bool is_dir,
6195                           const struct smb_filename *smb_fname_src,
6196                           const struct smb_filename *smb_fname_dst)
6197 {
6198         char *parent_dir_src = NULL;
6199         char *parent_dir_dst = NULL;
6200         uint32 mask;
6201
6202         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6203                 : FILE_NOTIFY_CHANGE_FILE_NAME;
6204
6205         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6206                             &parent_dir_src, NULL) ||
6207             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6208                             &parent_dir_dst, NULL)) {
6209                 goto out;
6210         }
6211
6212         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6213                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6214                              smb_fname_src->base_name);
6215                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6216                              smb_fname_dst->base_name);
6217         }
6218         else {
6219                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6220                              smb_fname_src->base_name);
6221                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6222                              smb_fname_dst->base_name);
6223         }
6224
6225         /* this is a strange one. w2k3 gives an additional event for
6226            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6227            files, but not directories */
6228         if (!is_dir) {
6229                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6230                              FILE_NOTIFY_CHANGE_ATTRIBUTES
6231                              |FILE_NOTIFY_CHANGE_CREATION,
6232                              smb_fname_dst->base_name);
6233         }
6234  out:
6235         TALLOC_FREE(parent_dir_src);
6236         TALLOC_FREE(parent_dir_dst);
6237 }
6238
6239 /****************************************************************************
6240  Returns an error if the parent directory for a filename is open in an
6241  incompatible way.
6242 ****************************************************************************/
6243
6244 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6245                                         const struct smb_filename *smb_fname_dst_in)
6246 {
6247         char *parent_dir = NULL;
6248         struct smb_filename smb_fname_parent;
6249         struct file_id id;
6250         files_struct *fsp = NULL;
6251         int ret;
6252
6253         if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6254                         &parent_dir, NULL)) {
6255                 return NT_STATUS_NO_MEMORY;
6256         }
6257         ZERO_STRUCT(smb_fname_parent);
6258         smb_fname_parent.base_name = parent_dir;
6259
6260         ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6261         if (ret == -1) {
6262                 return map_nt_error_from_unix(errno);
6263         }
6264
6265         /*
6266          * We're only checking on this smbd here, mostly good
6267          * enough.. and will pass tests.
6268          */
6269
6270         id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6271         for (fsp = file_find_di_first(conn->sconn, id); fsp;
6272                         fsp = file_find_di_next(fsp)) {
6273                 if (fsp->access_mask & DELETE_ACCESS) {
6274                         return NT_STATUS_SHARING_VIOLATION;
6275                 }
6276         }
6277         return NT_STATUS_OK;
6278 }
6279
6280 /****************************************************************************
6281  Rename an open file - given an fsp.
6282 ****************************************************************************/
6283
6284 NTSTATUS rename_internals_fsp(connection_struct *conn,
6285                         files_struct *fsp,
6286                         const struct smb_filename *smb_fname_dst_in,
6287                         uint32 attrs,
6288                         bool replace_if_exists)
6289 {
6290         TALLOC_CTX *ctx = talloc_tos();
6291         struct smb_filename *smb_fname_dst = NULL;
6292         NTSTATUS status = NT_STATUS_OK;
6293         struct share_mode_lock *lck = NULL;
6294         bool dst_exists, old_is_stream, new_is_stream;
6295
6296         status = check_name(conn, smb_fname_dst_in->base_name);
6297         if (!NT_STATUS_IS_OK(status)) {
6298                 return status;
6299         }
6300
6301         status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6302         if (!NT_STATUS_IS_OK(status)) {
6303                 return status;
6304         }
6305
6306         /* Make a copy of the dst smb_fname structs */
6307
6308         smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6309         if (smb_fname_dst == NULL) {
6310                 status = NT_STATUS_NO_MEMORY;
6311                 goto out;
6312         }
6313
6314         /*
6315          * Check for special case with case preserving and not
6316          * case sensitive. If the old last component differs from the original
6317          * last component only by case, then we should allow
6318          * the rename (user is trying to change the case of the
6319          * filename).
6320          */
6321         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6322             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6323             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6324                 char *last_slash;
6325                 char *fname_dst_lcomp_base_mod = NULL;
6326                 struct smb_filename *smb_fname_orig_lcomp = NULL;
6327
6328                 /*
6329                  * Get the last component of the destination name.
6330                  */
6331                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6332                 if (last_slash) {
6333                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6334                 } else {
6335                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6336                 }
6337                 if (!fname_dst_lcomp_base_mod) {
6338                         status = NT_STATUS_NO_MEMORY;
6339                         goto out;
6340                 }
6341
6342                 /*
6343                  * Create an smb_filename struct using the original last
6344                  * component of the destination.
6345                  */
6346                 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6347                         ctx, smb_fname_dst->original_lcomp, NULL);
6348                 if (smb_fname_orig_lcomp == NULL) {
6349                         status = NT_STATUS_NO_MEMORY;
6350                         TALLOC_FREE(fname_dst_lcomp_base_mod);
6351                         goto out;
6352                 }
6353
6354                 /* If the base names only differ by case, use original. */
6355                 if(!strcsequal(fname_dst_lcomp_base_mod,
6356                                smb_fname_orig_lcomp->base_name)) {
6357                         char *tmp;
6358                         /*
6359                          * Replace the modified last component with the
6360                          * original.
6361                          */
6362                         if (last_slash) {
6363                                 *last_slash = '\0'; /* Truncate at the '/' */
6364                                 tmp = talloc_asprintf(smb_fname_dst,
6365                                         "%s/%s",
6366                                         smb_fname_dst->base_name,
6367                                         smb_fname_orig_lcomp->base_name);
6368                         } else {
6369                                 tmp = talloc_asprintf(smb_fname_dst,
6370                                         "%s",
6371                                         smb_fname_orig_lcomp->base_name);
6372                         }
6373                         if (tmp == NULL) {
6374                                 status = NT_STATUS_NO_MEMORY;
6375                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6376                                 TALLOC_FREE(smb_fname_orig_lcomp);
6377                                 goto out;
6378                         }
6379                         TALLOC_FREE(smb_fname_dst->base_name);
6380                         smb_fname_dst->base_name = tmp;
6381                 }
6382
6383                 /* If the stream_names only differ by case, use original. */
6384                 if(!strcsequal(smb_fname_dst->stream_name,
6385                                smb_fname_orig_lcomp->stream_name)) {
6386                         char *tmp = NULL;
6387                         /* Use the original stream. */
6388                         tmp = talloc_strdup(smb_fname_dst,
6389                                             smb_fname_orig_lcomp->stream_name);
6390                         if (tmp == NULL) {
6391                                 status = NT_STATUS_NO_MEMORY;
6392                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6393                                 TALLOC_FREE(smb_fname_orig_lcomp);
6394                                 goto out;
6395                         }
6396                         TALLOC_FREE(smb_fname_dst->stream_name);
6397                         smb_fname_dst->stream_name = tmp;
6398                 }
6399                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6400                 TALLOC_FREE(smb_fname_orig_lcomp);
6401         }
6402
6403         /*
6404          * If the src and dest names are identical - including case,
6405          * don't do the rename, just return success.
6406          */
6407
6408         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6409             strcsequal(fsp->fsp_name->stream_name,
6410                        smb_fname_dst->stream_name)) {
6411                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6412                           "- returning success\n",
6413                           smb_fname_str_dbg(smb_fname_dst)));
6414                 status = NT_STATUS_OK;
6415                 goto out;
6416         }
6417
6418         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6419         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6420
6421         /* Return the correct error code if both names aren't streams. */
6422         if (!old_is_stream && new_is_stream) {
6423                 status = NT_STATUS_OBJECT_NAME_INVALID;
6424                 goto out;
6425         }
6426
6427         if (old_is_stream && !new_is_stream) {
6428                 status = NT_STATUS_INVALID_PARAMETER;
6429                 goto out;
6430         }
6431
6432         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6433
6434         if(!replace_if_exists && dst_exists) {
6435                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6436                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6437                           smb_fname_str_dbg(smb_fname_dst)));
6438                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6439                 goto out;
6440         }
6441
6442         if (dst_exists) {
6443                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6444                     &smb_fname_dst->st);
6445                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6446                                                            fileid);
6447                 /* The file can be open when renaming a stream */
6448                 if (dst_fsp && !new_is_stream) {
6449                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6450                         status = NT_STATUS_ACCESS_DENIED;
6451                         goto out;
6452                 }
6453         }
6454
6455         /* Ensure we have a valid stat struct for the source. */
6456         status = vfs_stat_fsp(fsp);
6457         if (!NT_STATUS_IS_OK(status)) {
6458                 goto out;
6459         }
6460
6461         status = can_rename(conn, fsp, attrs);
6462
6463         if (!NT_STATUS_IS_OK(status)) {
6464                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6465                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6466                           smb_fname_str_dbg(smb_fname_dst)));
6467                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6468                         status = NT_STATUS_ACCESS_DENIED;
6469                 goto out;
6470         }
6471
6472         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6473                 status = NT_STATUS_ACCESS_DENIED;
6474         }
6475
6476         lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6477
6478         /*
6479          * We have the file open ourselves, so not being able to get the
6480          * corresponding share mode lock is a fatal error.
6481          */
6482
6483         SMB_ASSERT(lck != NULL);
6484
6485         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6486                 uint32 create_options = fsp->fh->private_options;
6487
6488                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6489                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6490                           smb_fname_str_dbg(smb_fname_dst)));
6491
6492                 if (!fsp->is_directory &&
6493                     !lp_posix_pathnames() &&
6494                     (lp_map_archive(SNUM(conn)) ||
6495                     lp_store_dos_attributes(SNUM(conn)))) {
6496                         /* We must set the archive bit on the newly
6497                            renamed file. */
6498                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6499                                 uint32_t old_dosmode = dos_mode(conn,
6500                                                         smb_fname_dst);
6501                                 file_set_dosmode(conn,
6502                                         smb_fname_dst,
6503                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6504                                         NULL,
6505                                         true);
6506                         }
6507                 }
6508
6509                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6510                               smb_fname_dst);
6511
6512                 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6513
6514                 /*
6515                  * A rename acts as a new file create w.r.t. allowing an initial delete
6516                  * on close, probably because in Windows there is a new handle to the
6517                  * new file. If initial delete on close was requested but not
6518                  * originally set, we need to set it here. This is probably not 100% correct,
6519                  * but will work for the CIFSFS client which in non-posix mode
6520                  * depends on these semantics. JRA.
6521                  */
6522
6523                 if (create_options & FILE_DELETE_ON_CLOSE) {
6524                         status = can_set_delete_on_close(fsp, 0);
6525
6526                         if (NT_STATUS_IS_OK(status)) {
6527                                 /* Note that here we set the *inital* delete on close flag,
6528                                  * not the regular one. The magic gets handled in close. */
6529                                 fsp->initial_delete_on_close = True;
6530                         }
6531                 }
6532                 TALLOC_FREE(lck);
6533                 status = NT_STATUS_OK;
6534                 goto out;
6535         }
6536
6537         TALLOC_FREE(lck);
6538
6539         if (errno == ENOTDIR || errno == EISDIR) {
6540                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6541         } else {
6542                 status = map_nt_error_from_unix(errno);
6543         }
6544
6545         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6546                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6547                   smb_fname_str_dbg(smb_fname_dst)));
6548
6549  out:
6550         TALLOC_FREE(smb_fname_dst);
6551
6552         return status;
6553 }
6554
6555 /****************************************************************************
6556  The guts of the rename command, split out so it may be called by the NT SMB
6557  code.
6558 ****************************************************************************/
6559
6560 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6561                         connection_struct *conn,
6562                         struct smb_request *req,
6563                         struct smb_filename *smb_fname_src,
6564                         struct smb_filename *smb_fname_dst,
6565                         uint32 attrs,
6566                         bool replace_if_exists,
6567                         bool src_has_wild,
6568                         bool dest_has_wild,
6569                         uint32_t access_mask)
6570 {
6571         char *fname_src_dir = NULL;
6572         char *fname_src_mask = NULL;
6573         int count=0;
6574         NTSTATUS status = NT_STATUS_OK;
6575         struct smb_Dir *dir_hnd = NULL;
6576         const char *dname = NULL;
6577         char *talloced = NULL;
6578         long offset = 0;
6579         int create_options = 0;
6580         bool posix_pathnames = lp_posix_pathnames();
6581         int rc;
6582
6583         /*
6584          * Split the old name into directory and last component
6585          * strings. Note that unix_convert may have stripped off a
6586          * leading ./ from both name and newname if the rename is
6587          * at the root of the share. We need to make sure either both
6588          * name and newname contain a / character or neither of them do
6589          * as this is checked in resolve_wildcards().
6590          */
6591
6592         /* Split up the directory from the filename/mask. */
6593         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6594                                       &fname_src_dir, &fname_src_mask);
6595         if (!NT_STATUS_IS_OK(status)) {
6596                 status = NT_STATUS_NO_MEMORY;
6597                 goto out;
6598         }
6599
6600         /*
6601          * We should only check the mangled cache
6602          * here if unix_convert failed. This means
6603          * that the path in 'mask' doesn't exist
6604          * on the file system and so we need to look
6605          * for a possible mangle. This patch from
6606          * Tine Smukavec <valentin.smukavec@hermes.si>.
6607          */
6608
6609         if (!VALID_STAT(smb_fname_src->st) &&
6610             mangle_is_mangled(fname_src_mask, conn->params)) {
6611                 char *new_mask = NULL;
6612                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6613                                             conn->params);
6614                 if (new_mask) {
6615                         TALLOC_FREE(fname_src_mask);
6616                         fname_src_mask = new_mask;
6617                 }
6618         }
6619
6620         if (!src_has_wild) {
6621                 files_struct *fsp;
6622
6623                 /*
6624                  * Only one file needs to be renamed. Append the mask back
6625                  * onto the directory.
6626                  */
6627                 TALLOC_FREE(smb_fname_src->base_name);
6628                 if (ISDOT(fname_src_dir)) {
6629                         /* Ensure we use canonical names on open. */
6630                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6631                                                         "%s",
6632                                                         fname_src_mask);
6633                 } else {
6634                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6635                                                         "%s/%s",
6636                                                         fname_src_dir,
6637                                                         fname_src_mask);
6638                 }
6639                 if (!smb_fname_src->base_name) {
6640                         status = NT_STATUS_NO_MEMORY;
6641                         goto out;
6642                 }
6643
6644                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6645                           "case_preserve = %d, short case preserve = %d, "
6646                           "directory = %s, newname = %s, "
6647                           "last_component_dest = %s\n",
6648                           conn->case_sensitive, conn->case_preserve,
6649                           conn->short_case_preserve,
6650                           smb_fname_str_dbg(smb_fname_src),
6651                           smb_fname_str_dbg(smb_fname_dst),
6652                           smb_fname_dst->original_lcomp));
6653
6654                 /* The dest name still may have wildcards. */
6655                 if (dest_has_wild) {
6656                         char *fname_dst_mod = NULL;
6657                         if (!resolve_wildcards(smb_fname_dst,
6658                                                smb_fname_src->base_name,
6659                                                smb_fname_dst->base_name,
6660                                                &fname_dst_mod)) {
6661                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6662                                           "%s %s failed\n",
6663                                           smb_fname_src->base_name,
6664                                           smb_fname_dst->base_name));
6665                                 status = NT_STATUS_NO_MEMORY;
6666                                 goto out;
6667                         }
6668                         TALLOC_FREE(smb_fname_dst->base_name);
6669                         smb_fname_dst->base_name = fname_dst_mod;
6670                 }
6671
6672                 ZERO_STRUCT(smb_fname_src->st);
6673                 if (posix_pathnames) {
6674                         rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6675                 } else {
6676                         rc = SMB_VFS_STAT(conn, smb_fname_src);
6677                 }
6678                 if (rc == -1) {
6679                         status = map_nt_error_from_unix_common(errno);
6680                         goto out;
6681                 }
6682
6683                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6684                         create_options |= FILE_DIRECTORY_FILE;
6685                 }
6686
6687                 status = SMB_VFS_CREATE_FILE(
6688                         conn,                           /* conn */
6689                         req,                            /* req */
6690                         0,                              /* root_dir_fid */
6691                         smb_fname_src,                  /* fname */
6692                         access_mask,                    /* access_mask */
6693                         (FILE_SHARE_READ |              /* share_access */
6694                             FILE_SHARE_WRITE),
6695                         FILE_OPEN,                      /* create_disposition*/
6696                         create_options,                 /* create_options */
6697                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6698                         0,                              /* oplock_request */
6699                         0,                              /* allocation_size */
6700                         0,                              /* private_flags */
6701                         NULL,                           /* sd */
6702                         NULL,                           /* ea_list */
6703                         &fsp,                           /* result */
6704                         NULL);                          /* pinfo */
6705
6706                 if (!NT_STATUS_IS_OK(status)) {
6707                         DEBUG(3, ("Could not open rename source %s: %s\n",
6708                                   smb_fname_str_dbg(smb_fname_src),
6709                                   nt_errstr(status)));
6710                         goto out;
6711                 }
6712
6713                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6714                                               attrs, replace_if_exists);
6715
6716                 close_file(req, fsp, NORMAL_CLOSE);
6717
6718                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6719                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6720                           smb_fname_str_dbg(smb_fname_dst)));
6721
6722                 goto out;
6723         }
6724
6725         /*
6726          * Wildcards - process each file that matches.
6727          */
6728         if (strequal(fname_src_mask, "????????.???")) {
6729                 TALLOC_FREE(fname_src_mask);
6730                 fname_src_mask = talloc_strdup(ctx, "*");
6731                 if (!fname_src_mask) {
6732                         status = NT_STATUS_NO_MEMORY;
6733                         goto out;
6734                 }
6735         }
6736
6737         status = check_name(conn, fname_src_dir);
6738         if (!NT_STATUS_IS_OK(status)) {
6739                 goto out;
6740         }
6741
6742         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6743                           attrs);
6744         if (dir_hnd == NULL) {
6745                 status = map_nt_error_from_unix(errno);
6746                 goto out;
6747         }
6748
6749         status = NT_STATUS_NO_SUCH_FILE;
6750         /*
6751          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6752          * - gentest fix. JRA
6753          */
6754
6755         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6756                                     &talloced))) {
6757                 files_struct *fsp = NULL;
6758                 char *destname = NULL;
6759                 bool sysdir_entry = False;
6760
6761                 /* Quick check for "." and ".." */
6762                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6763                         if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6764                                 sysdir_entry = True;
6765                         } else {
6766                                 TALLOC_FREE(talloced);
6767                                 continue;
6768                         }
6769                 }
6770
6771                 if (!is_visible_file(conn, fname_src_dir, dname,
6772                                      &smb_fname_src->st, false)) {
6773                         TALLOC_FREE(talloced);
6774                         continue;
6775                 }
6776
6777                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6778                         TALLOC_FREE(talloced);
6779                         continue;
6780                 }
6781
6782                 if (sysdir_entry) {
6783                         status = NT_STATUS_OBJECT_NAME_INVALID;
6784                         break;
6785                 }
6786
6787                 TALLOC_FREE(smb_fname_src->base_name);
6788                 if (ISDOT(fname_src_dir)) {
6789                         /* Ensure we use canonical names on open. */
6790                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6791                                                         "%s",
6792                                                         dname);
6793                 } else {
6794                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6795                                                         "%s/%s",
6796                                                         fname_src_dir,
6797                                                         dname);
6798                 }
6799                 if (!smb_fname_src->base_name) {
6800                         status = NT_STATUS_NO_MEMORY;
6801                         goto out;
6802                 }
6803
6804                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6805                                        smb_fname_dst->base_name,
6806                                        &destname)) {
6807                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6808                                   smb_fname_src->base_name, destname));
6809                         TALLOC_FREE(talloced);
6810                         continue;
6811                 }
6812                 if (!destname) {
6813                         status = NT_STATUS_NO_MEMORY;
6814                         goto out;
6815                 }
6816
6817                 TALLOC_FREE(smb_fname_dst->base_name);
6818                 smb_fname_dst->base_name = destname;
6819
6820                 ZERO_STRUCT(smb_fname_src->st);
6821                 if (posix_pathnames) {
6822                         SMB_VFS_LSTAT(conn, smb_fname_src);
6823                 } else {
6824                         SMB_VFS_STAT(conn, smb_fname_src);
6825                 }
6826
6827                 create_options = 0;
6828
6829                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6830                         create_options |= FILE_DIRECTORY_FILE;
6831                 }
6832
6833                 status = SMB_VFS_CREATE_FILE(
6834                         conn,                           /* conn */
6835                         req,                            /* req */
6836                         0,                              /* root_dir_fid */
6837                         smb_fname_src,                  /* fname */
6838                         access_mask,                    /* access_mask */
6839                         (FILE_SHARE_READ |              /* share_access */
6840                             FILE_SHARE_WRITE),
6841                         FILE_OPEN,                      /* create_disposition*/
6842                         create_options,                 /* create_options */
6843                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6844                         0,                              /* oplock_request */
6845                         0,                              /* allocation_size */
6846                         0,                              /* private_flags */
6847                         NULL,                           /* sd */
6848                         NULL,                           /* ea_list */
6849                         &fsp,                           /* result */
6850                         NULL);                          /* pinfo */
6851
6852                 if (!NT_STATUS_IS_OK(status)) {
6853                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6854                                  "returned %s rename %s -> %s\n",
6855                                  nt_errstr(status),
6856                                  smb_fname_str_dbg(smb_fname_src),
6857                                  smb_fname_str_dbg(smb_fname_dst)));
6858                         break;
6859                 }
6860
6861                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6862                                                               dname);
6863                 if (!smb_fname_dst->original_lcomp) {
6864                         status = NT_STATUS_NO_MEMORY;
6865                         goto out;
6866                 }
6867
6868                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6869                                               attrs, replace_if_exists);
6870
6871                 close_file(req, fsp, NORMAL_CLOSE);
6872
6873                 if (!NT_STATUS_IS_OK(status)) {
6874                         DEBUG(3, ("rename_internals_fsp returned %s for "
6875                                   "rename %s -> %s\n", nt_errstr(status),
6876                                   smb_fname_str_dbg(smb_fname_src),
6877                                   smb_fname_str_dbg(smb_fname_dst)));
6878                         break;
6879                 }
6880
6881                 count++;
6882
6883                 DEBUG(3,("rename_internals: doing rename on %s -> "
6884                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6885                          smb_fname_str_dbg(smb_fname_src)));
6886                 TALLOC_FREE(talloced);
6887         }
6888         TALLOC_FREE(dir_hnd);
6889
6890         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6891                 status = map_nt_error_from_unix(errno);
6892         }
6893
6894  out:
6895         TALLOC_FREE(talloced);
6896         TALLOC_FREE(fname_src_dir);
6897         TALLOC_FREE(fname_src_mask);
6898         return status;
6899 }
6900
6901 /****************************************************************************
6902  Reply to a mv.
6903 ****************************************************************************/
6904
6905 void reply_mv(struct smb_request *req)
6906 {
6907         connection_struct *conn = req->conn;
6908         char *name = NULL;
6909         char *newname = NULL;
6910         const char *p;
6911         uint32 attrs;
6912         NTSTATUS status;
6913         bool src_has_wcard = False;
6914         bool dest_has_wcard = False;
6915         TALLOC_CTX *ctx = talloc_tos();
6916         struct smb_filename *smb_fname_src = NULL;
6917         struct smb_filename *smb_fname_dst = NULL;
6918         uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6919         uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6920         bool stream_rename = false;
6921
6922         START_PROFILE(SMBmv);
6923
6924         if (req->wct < 1) {
6925                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6926                 goto out;
6927         }
6928
6929         attrs = SVAL(req->vwv+0, 0);
6930
6931         p = (const char *)req->buf + 1;
6932         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6933                                        &status, &src_has_wcard);
6934         if (!NT_STATUS_IS_OK(status)) {
6935                 reply_nterror(req, status);
6936                 goto out;
6937         }
6938         p++;
6939         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6940                                        &status, &dest_has_wcard);
6941         if (!NT_STATUS_IS_OK(status)) {
6942                 reply_nterror(req, status);
6943                 goto out;
6944         }
6945
6946         if (!lp_posix_pathnames()) {
6947                 /* The newname must begin with a ':' if the
6948                    name contains a ':'. */
6949                 if (strchr_m(name, ':')) {
6950                         if (newname[0] != ':') {
6951                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6952                                 goto out;
6953                         }
6954                         stream_rename = true;
6955                 }
6956         }
6957
6958         status = filename_convert(ctx,
6959                                   conn,
6960                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6961                                   name,
6962                                   src_ucf_flags,
6963                                   &src_has_wcard,
6964                                   &smb_fname_src);
6965
6966         if (!NT_STATUS_IS_OK(status)) {
6967                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6968                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6969                                         ERRSRV, ERRbadpath);
6970                         goto out;
6971                 }
6972                 reply_nterror(req, status);
6973                 goto out;
6974         }
6975
6976         status = filename_convert(ctx,
6977                                   conn,
6978                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6979                                   newname,
6980                                   dst_ucf_flags,
6981                                   &dest_has_wcard,
6982                                   &smb_fname_dst);
6983
6984         if (!NT_STATUS_IS_OK(status)) {
6985                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6986                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6987                                         ERRSRV, ERRbadpath);
6988                         goto out;
6989                 }
6990                 reply_nterror(req, status);
6991                 goto out;
6992         }
6993
6994         if (stream_rename) {
6995                 /* smb_fname_dst->base_name must be the same as
6996                    smb_fname_src->base_name. */
6997                 TALLOC_FREE(smb_fname_dst->base_name);
6998                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6999                                                 smb_fname_src->base_name);
7000                 if (!smb_fname_dst->base_name) {
7001                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7002                         goto out;
7003                 }
7004         }
7005
7006         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7007                  smb_fname_str_dbg(smb_fname_dst)));
7008
7009         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7010                                   attrs, False, src_has_wcard, dest_has_wcard,
7011                                   DELETE_ACCESS);
7012         if (!NT_STATUS_IS_OK(status)) {
7013                 if (open_was_deferred(req->sconn, req->mid)) {
7014                         /* We have re-scheduled this call. */
7015                         goto out;
7016                 }
7017                 reply_nterror(req, status);
7018                 goto out;
7019         }
7020
7021         reply_outbuf(req, 0, 0);
7022  out:
7023         TALLOC_FREE(smb_fname_src);
7024         TALLOC_FREE(smb_fname_dst);
7025         END_PROFILE(SMBmv);
7026         return;
7027 }
7028
7029 /*******************************************************************
7030  Copy a file as part of a reply_copy.
7031 ******************************************************************/
7032
7033 /*
7034  * TODO: check error codes on all callers
7035  */
7036
7037 NTSTATUS copy_file(TALLOC_CTX *ctx,
7038                         connection_struct *conn,
7039                         struct smb_filename *smb_fname_src,
7040                         struct smb_filename *smb_fname_dst,
7041                         int ofun,
7042                         int count,
7043                         bool target_is_directory)
7044 {
7045         struct smb_filename *smb_fname_dst_tmp = NULL;
7046         off_t ret=-1;
7047         files_struct *fsp1,*fsp2;
7048         uint32 dosattrs;
7049         uint32 new_create_disposition;
7050         NTSTATUS status;
7051
7052
7053         smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7054         if (smb_fname_dst_tmp == NULL) {
7055                 return NT_STATUS_NO_MEMORY;
7056         }
7057
7058         /*
7059          * If the target is a directory, extract the last component from the
7060          * src filename and append it to the dst filename
7061          */
7062         if (target_is_directory) {
7063                 const char *p;
7064
7065                 /* dest/target can't be a stream if it's a directory. */
7066                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7067
7068                 p = strrchr_m(smb_fname_src->base_name,'/');
7069                 if (p) {
7070                         p++;
7071                 } else {
7072                         p = smb_fname_src->base_name;
7073                 }
7074                 smb_fname_dst_tmp->base_name =
7075                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7076                                            p);
7077                 if (!smb_fname_dst_tmp->base_name) {
7078                         status = NT_STATUS_NO_MEMORY;
7079                         goto out;
7080                 }
7081         }
7082
7083         status = vfs_file_exist(conn, smb_fname_src);
7084         if (!NT_STATUS_IS_OK(status)) {
7085                 goto out;
7086         }
7087
7088         if (!target_is_directory && count) {
7089                 new_create_disposition = FILE_OPEN;
7090         } else {
7091                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7092                                                  0, ofun,
7093                                                  NULL, NULL,
7094                                                  &new_create_disposition,
7095                                                  NULL,
7096                                                  NULL)) {
7097                         status = NT_STATUS_INVALID_PARAMETER;
7098                         goto out;
7099                 }
7100         }
7101
7102         /* Open the src file for reading. */
7103         status = SMB_VFS_CREATE_FILE(
7104                 conn,                                   /* conn */
7105                 NULL,                                   /* req */
7106                 0,                                      /* root_dir_fid */
7107                 smb_fname_src,                          /* fname */
7108                 FILE_GENERIC_READ,                      /* access_mask */
7109                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7110                 FILE_OPEN,                              /* create_disposition*/
7111                 0,                                      /* create_options */
7112                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
7113                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7114                 0,                                      /* allocation_size */
7115                 0,                                      /* private_flags */
7116                 NULL,                                   /* sd */
7117                 NULL,                                   /* ea_list */
7118                 &fsp1,                                  /* result */
7119                 NULL);                                  /* psbuf */
7120
7121         if (!NT_STATUS_IS_OK(status)) {
7122                 goto out;
7123         }
7124
7125         dosattrs = dos_mode(conn, smb_fname_src);
7126
7127         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7128                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7129         }
7130
7131         /* Open the dst file for writing. */
7132         status = SMB_VFS_CREATE_FILE(
7133                 conn,                                   /* conn */
7134                 NULL,                                   /* req */
7135                 0,                                      /* root_dir_fid */
7136                 smb_fname_dst,                          /* fname */
7137                 FILE_GENERIC_WRITE,                     /* access_mask */
7138                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7139                 new_create_disposition,                 /* create_disposition*/
7140                 0,                                      /* create_options */
7141                 dosattrs,                               /* file_attributes */
7142                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7143                 0,                                      /* allocation_size */
7144                 0,                                      /* private_flags */
7145                 NULL,                                   /* sd */
7146                 NULL,                                   /* ea_list */
7147                 &fsp2,                                  /* result */
7148                 NULL);                                  /* psbuf */
7149
7150         if (!NT_STATUS_IS_OK(status)) {
7151                 close_file(NULL, fsp1, ERROR_CLOSE);
7152                 goto out;
7153         }
7154
7155         if (ofun & OPENX_FILE_EXISTS_OPEN) {
7156                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7157                 if (ret == -1) {
7158                         DEBUG(0, ("error - vfs lseek returned error %s\n",
7159                                 strerror(errno)));
7160                         status = map_nt_error_from_unix(errno);
7161                         close_file(NULL, fsp1, ERROR_CLOSE);
7162                         close_file(NULL, fsp2, ERROR_CLOSE);
7163                         goto out;
7164                 }
7165         }
7166
7167         /* Do the actual copy. */
7168         if (smb_fname_src->st.st_ex_size) {
7169                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7170         } else {
7171                 ret = 0;
7172         }
7173
7174         close_file(NULL, fsp1, NORMAL_CLOSE);
7175
7176         /* Ensure the modtime is set correctly on the destination file. */
7177         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7178
7179         /*
7180          * As we are opening fsp1 read-only we only expect
7181          * an error on close on fsp2 if we are out of space.
7182          * Thus we don't look at the error return from the
7183          * close of fsp1.
7184          */
7185         status = close_file(NULL, fsp2, NORMAL_CLOSE);
7186
7187         if (!NT_STATUS_IS_OK(status)) {
7188                 goto out;
7189         }
7190
7191         if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7192                 status = NT_STATUS_DISK_FULL;
7193                 goto out;
7194         }
7195
7196         status = NT_STATUS_OK;
7197
7198  out:
7199         TALLOC_FREE(smb_fname_dst_tmp);
7200         return status;
7201 }
7202
7203 /****************************************************************************
7204  Reply to a file copy.
7205 ****************************************************************************/
7206
7207 void reply_copy(struct smb_request *req)
7208 {
7209         connection_struct *conn = req->conn;
7210         struct smb_filename *smb_fname_src = NULL;
7211         struct smb_filename *smb_fname_dst = NULL;
7212         char *fname_src = NULL;
7213         char *fname_dst = NULL;
7214         char *fname_src_mask = NULL;
7215         char *fname_src_dir = NULL;
7216         const char *p;
7217         int count=0;
7218         int error = ERRnoaccess;
7219         int tid2;
7220         int ofun;
7221         int flags;
7222         bool target_is_directory=False;
7223         bool source_has_wild = False;
7224         bool dest_has_wild = False;
7225         NTSTATUS status;
7226         TALLOC_CTX *ctx = talloc_tos();
7227
7228         START_PROFILE(SMBcopy);
7229
7230         if (req->wct < 3) {
7231                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7232                 goto out;
7233         }
7234
7235         tid2 = SVAL(req->vwv+0, 0);
7236         ofun = SVAL(req->vwv+1, 0);
7237         flags = SVAL(req->vwv+2, 0);
7238
7239         p = (const char *)req->buf;
7240         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7241                                        &status, &source_has_wild);
7242         if (!NT_STATUS_IS_OK(status)) {
7243                 reply_nterror(req, status);
7244                 goto out;
7245         }
7246         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7247                                        &status, &dest_has_wild);
7248         if (!NT_STATUS_IS_OK(status)) {
7249                 reply_nterror(req, status);
7250                 goto out;
7251         }
7252
7253         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7254
7255         if (tid2 != conn->cnum) {
7256                 /* can't currently handle inter share copies XXXX */
7257                 DEBUG(3,("Rejecting inter-share copy\n"));
7258                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7259                 goto out;
7260         }
7261
7262         status = filename_convert(ctx, conn,
7263                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7264                                   fname_src,
7265                                   UCF_COND_ALLOW_WCARD_LCOMP,
7266                                   &source_has_wild,
7267                                   &smb_fname_src);
7268         if (!NT_STATUS_IS_OK(status)) {
7269                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7270                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7271                                         ERRSRV, ERRbadpath);
7272                         goto out;
7273                 }
7274                 reply_nterror(req, status);
7275                 goto out;
7276         }
7277
7278         status = filename_convert(ctx, conn,
7279                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7280                                   fname_dst,
7281                                   UCF_COND_ALLOW_WCARD_LCOMP,
7282                                   &dest_has_wild,
7283                                   &smb_fname_dst);
7284         if (!NT_STATUS_IS_OK(status)) {
7285                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7286                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7287                                         ERRSRV, ERRbadpath);
7288                         goto out;
7289                 }
7290                 reply_nterror(req, status);
7291                 goto out;
7292         }
7293
7294         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7295
7296         if ((flags&1) && target_is_directory) {
7297                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7298                 goto out;
7299         }
7300
7301         if ((flags&2) && !target_is_directory) {
7302                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7303                 goto out;
7304         }
7305
7306         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7307                 /* wants a tree copy! XXXX */
7308                 DEBUG(3,("Rejecting tree copy\n"));
7309                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7310                 goto out;
7311         }
7312
7313         /* Split up the directory from the filename/mask. */
7314         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7315                                       &fname_src_dir, &fname_src_mask);
7316         if (!NT_STATUS_IS_OK(status)) {
7317                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7318                 goto out;
7319         }
7320
7321         /*
7322          * We should only check the mangled cache
7323          * here if unix_convert failed. This means
7324          * that the path in 'mask' doesn't exist
7325          * on the file system and so we need to look
7326          * for a possible mangle. This patch from
7327          * Tine Smukavec <valentin.smukavec@hermes.si>.
7328          */
7329         if (!VALID_STAT(smb_fname_src->st) &&
7330             mangle_is_mangled(fname_src_mask, conn->params)) {
7331                 char *new_mask = NULL;
7332                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7333                                             &new_mask, conn->params);
7334
7335                 /* Use demangled name if one was successfully found. */
7336                 if (new_mask) {
7337                         TALLOC_FREE(fname_src_mask);
7338                         fname_src_mask = new_mask;
7339                 }
7340         }
7341
7342         if (!source_has_wild) {
7343
7344                 /*
7345                  * Only one file needs to be copied. Append the mask back onto
7346                  * the directory.
7347                  */
7348                 TALLOC_FREE(smb_fname_src->base_name);
7349                 if (ISDOT(fname_src_dir)) {
7350                         /* Ensure we use canonical names on open. */
7351                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7352                                                         "%s",
7353                                                         fname_src_mask);
7354                 } else {
7355                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7356                                                         "%s/%s",
7357                                                         fname_src_dir,
7358                                                         fname_src_mask);
7359                 }
7360                 if (!smb_fname_src->base_name) {
7361                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7362                         goto out;
7363                 }
7364
7365                 if (dest_has_wild) {
7366                         char *fname_dst_mod = NULL;
7367                         if (!resolve_wildcards(smb_fname_dst,
7368                                                smb_fname_src->base_name,
7369                                                smb_fname_dst->base_name,
7370                                                &fname_dst_mod)) {
7371                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7372                                 goto out;
7373                         }
7374                         TALLOC_FREE(smb_fname_dst->base_name);
7375                         smb_fname_dst->base_name = fname_dst_mod;
7376                 }
7377
7378                 status = check_name(conn, smb_fname_src->base_name);
7379                 if (!NT_STATUS_IS_OK(status)) {
7380                         reply_nterror(req, status);
7381                         goto out;
7382                 }
7383
7384                 status = check_name(conn, smb_fname_dst->base_name);
7385                 if (!NT_STATUS_IS_OK(status)) {
7386                         reply_nterror(req, status);
7387                         goto out;
7388                 }
7389
7390                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7391                                    ofun, count, target_is_directory);
7392
7393                 if(!NT_STATUS_IS_OK(status)) {
7394                         reply_nterror(req, status);
7395                         goto out;
7396                 } else {
7397                         count++;
7398                 }
7399         } else {
7400                 struct smb_Dir *dir_hnd = NULL;
7401                 const char *dname = NULL;
7402                 char *talloced = NULL;
7403                 long offset = 0;
7404
7405                 /*
7406                  * There is a wildcard that requires us to actually read the
7407                  * src dir and copy each file matching the mask to the dst.
7408                  * Right now streams won't be copied, but this could
7409                  * presumably be added with a nested loop for reach dir entry.
7410                  */
7411                 SMB_ASSERT(!smb_fname_src->stream_name);
7412                 SMB_ASSERT(!smb_fname_dst->stream_name);
7413
7414                 smb_fname_src->stream_name = NULL;
7415                 smb_fname_dst->stream_name = NULL;
7416
7417                 if (strequal(fname_src_mask,"????????.???")) {
7418                         TALLOC_FREE(fname_src_mask);
7419                         fname_src_mask = talloc_strdup(ctx, "*");
7420                         if (!fname_src_mask) {
7421                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7422                                 goto out;
7423                         }
7424                 }
7425
7426                 status = check_name(conn, fname_src_dir);
7427                 if (!NT_STATUS_IS_OK(status)) {
7428                         reply_nterror(req, status);
7429                         goto out;
7430                 }
7431
7432                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7433                 if (dir_hnd == NULL) {
7434                         status = map_nt_error_from_unix(errno);
7435                         reply_nterror(req, status);
7436                         goto out;
7437                 }
7438
7439                 error = ERRbadfile;
7440
7441                 /* Iterate over the src dir copying each entry to the dst. */
7442                 while ((dname = ReadDirName(dir_hnd, &offset,
7443                                             &smb_fname_src->st, &talloced))) {
7444                         char *destname = NULL;
7445
7446                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7447                                 TALLOC_FREE(talloced);
7448                                 continue;
7449                         }
7450
7451                         if (!is_visible_file(conn, fname_src_dir, dname,
7452                                              &smb_fname_src->st, false)) {
7453                                 TALLOC_FREE(talloced);
7454                                 continue;
7455                         }
7456
7457                         if(!mask_match(dname, fname_src_mask,
7458                                        conn->case_sensitive)) {
7459                                 TALLOC_FREE(talloced);
7460                                 continue;
7461                         }
7462
7463                         error = ERRnoaccess;
7464
7465                         /* Get the src smb_fname struct setup. */
7466                         TALLOC_FREE(smb_fname_src->base_name);
7467                         if (ISDOT(fname_src_dir)) {
7468                                 /* Ensure we use canonical names on open. */
7469                                 smb_fname_src->base_name =
7470                                         talloc_asprintf(smb_fname_src, "%s",
7471                                                 dname);
7472                         } else {
7473                                 smb_fname_src->base_name =
7474                                         talloc_asprintf(smb_fname_src, "%s/%s",
7475                                                 fname_src_dir, dname);
7476                         }
7477
7478                         if (!smb_fname_src->base_name) {
7479                                 TALLOC_FREE(dir_hnd);
7480                                 TALLOC_FREE(talloced);
7481                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7482                                 goto out;
7483                         }
7484
7485                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7486                                                smb_fname_dst->base_name,
7487                                                &destname)) {
7488                                 TALLOC_FREE(talloced);
7489                                 continue;
7490                         }
7491                         if (!destname) {
7492                                 TALLOC_FREE(dir_hnd);
7493                                 TALLOC_FREE(talloced);
7494                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7495                                 goto out;
7496                         }
7497
7498                         TALLOC_FREE(smb_fname_dst->base_name);
7499                         smb_fname_dst->base_name = destname;
7500
7501                         status = check_name(conn, smb_fname_src->base_name);
7502                         if (!NT_STATUS_IS_OK(status)) {
7503                                 TALLOC_FREE(dir_hnd);
7504                                 TALLOC_FREE(talloced);
7505                                 reply_nterror(req, status);
7506                                 goto out;
7507                         }
7508
7509                         status = check_name(conn, smb_fname_dst->base_name);
7510                         if (!NT_STATUS_IS_OK(status)) {
7511                                 TALLOC_FREE(dir_hnd);
7512                                 TALLOC_FREE(talloced);
7513                                 reply_nterror(req, status);
7514                                 goto out;
7515                         }
7516
7517                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7518                                 smb_fname_src->base_name,
7519                                 smb_fname_dst->base_name));
7520
7521                         status = copy_file(ctx, conn, smb_fname_src,
7522                                            smb_fname_dst, ofun, count,
7523                                            target_is_directory);
7524                         if (NT_STATUS_IS_OK(status)) {
7525                                 count++;
7526                         }
7527
7528                         TALLOC_FREE(talloced);
7529                 }
7530                 TALLOC_FREE(dir_hnd);
7531         }
7532
7533         if (count == 0) {
7534                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7535                 goto out;
7536         }
7537
7538         reply_outbuf(req, 1, 0);
7539         SSVAL(req->outbuf,smb_vwv0,count);
7540  out:
7541         TALLOC_FREE(smb_fname_src);
7542         TALLOC_FREE(smb_fname_dst);
7543         TALLOC_FREE(fname_src);
7544         TALLOC_FREE(fname_dst);
7545         TALLOC_FREE(fname_src_mask);
7546         TALLOC_FREE(fname_src_dir);
7547
7548         END_PROFILE(SMBcopy);
7549         return;
7550 }
7551
7552 #undef DBGC_CLASS
7553 #define DBGC_CLASS DBGC_LOCKING
7554
7555 /****************************************************************************
7556  Get a lock pid, dealing with large count requests.
7557 ****************************************************************************/
7558
7559 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7560                     bool large_file_format)
7561 {
7562         if(!large_file_format)
7563                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7564         else
7565                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7566 }
7567
7568 /****************************************************************************
7569  Get a lock count, dealing with large count requests.
7570 ****************************************************************************/
7571
7572 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7573                         bool large_file_format)
7574 {
7575         uint64_t count = 0;
7576
7577         if(!large_file_format) {
7578                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7579         } else {
7580
7581 #if defined(HAVE_LONGLONG)
7582                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7583                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7584 #else /* HAVE_LONGLONG */
7585
7586                 /*
7587                  * NT4.x seems to be broken in that it sends large file (64 bit)
7588                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7589                  * negotiated. For boxes without large unsigned ints truncate the
7590                  * lock count by dropping the top 32 bits.
7591                  */
7592
7593                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7594                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7595                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7596                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7597                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7598                 }
7599
7600                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7601 #endif /* HAVE_LONGLONG */
7602         }
7603
7604         return count;
7605 }
7606
7607 #if !defined(HAVE_LONGLONG)
7608 /****************************************************************************
7609  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7610 ****************************************************************************/
7611
7612 static uint32 map_lock_offset(uint32 high, uint32 low)
7613 {
7614         unsigned int i;
7615         uint32 mask = 0;
7616         uint32 highcopy = high;
7617
7618         /*
7619          * Try and find out how many significant bits there are in high.
7620          */
7621
7622         for(i = 0; highcopy; i++)
7623                 highcopy >>= 1;
7624
7625         /*
7626          * We use 31 bits not 32 here as POSIX
7627          * lock offsets may not be negative.
7628          */
7629
7630         mask = (~0) << (31 - i);
7631
7632         if(low & mask)
7633                 return 0; /* Fail. */
7634
7635         high <<= (31 - i);
7636
7637         return (high|low);
7638 }
7639 #endif /* !defined(HAVE_LONGLONG) */
7640
7641 /****************************************************************************
7642  Get a lock offset, dealing with large offset requests.
7643 ****************************************************************************/
7644
7645 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7646                          bool large_file_format, bool *err)
7647 {
7648         uint64_t offset = 0;
7649
7650         *err = False;
7651
7652         if(!large_file_format) {
7653                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7654         } else {
7655
7656 #if defined(HAVE_LONGLONG)
7657                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7658                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7659 #else /* HAVE_LONGLONG */
7660
7661                 /*
7662                  * NT4.x seems to be broken in that it sends large file (64 bit)
7663                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7664                  * negotiated. For boxes without large unsigned ints mangle the
7665                  * lock offset by mapping the top 32 bits onto the lower 32.
7666                  */
7667
7668                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7669                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7670                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7671                         uint32 new_low = 0;
7672
7673                         if((new_low = map_lock_offset(high, low)) == 0) {
7674                                 *err = True;
7675                                 return (uint64_t)-1;
7676                         }
7677
7678                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7679                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7680                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7681                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7682                 }
7683
7684                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7685 #endif /* HAVE_LONGLONG */
7686         }
7687
7688         return offset;
7689 }
7690
7691 NTSTATUS smbd_do_locking(struct smb_request *req,
7692                          files_struct *fsp,
7693                          uint8_t type,
7694                          int32_t timeout,
7695                          uint16_t num_ulocks,
7696                          struct smbd_lock_element *ulocks,
7697                          uint16_t num_locks,
7698                          struct smbd_lock_element *locks,
7699                          bool *async)
7700 {
7701         connection_struct *conn = req->conn;
7702         int i;
7703         NTSTATUS status = NT_STATUS_OK;
7704
7705         *async = false;
7706
7707         /* Data now points at the beginning of the list
7708            of smb_unlkrng structs */
7709         for(i = 0; i < (int)num_ulocks; i++) {
7710                 struct smbd_lock_element *e = &ulocks[i];
7711
7712                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7713                           "pid %u, file %s\n",
7714                           (double)e->offset,
7715                           (double)e->count,
7716                           (unsigned int)e->smblctx,
7717                           fsp_str_dbg(fsp)));
7718
7719                 if (e->brltype != UNLOCK_LOCK) {
7720                         /* this can only happen with SMB2 */
7721                         return NT_STATUS_INVALID_PARAMETER;
7722                 }
7723
7724                 status = do_unlock(req->sconn->msg_ctx,
7725                                 fsp,
7726                                 e->smblctx,
7727                                 e->count,
7728                                 e->offset,
7729                                 WINDOWS_LOCK);
7730
7731                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7732                     nt_errstr(status)));
7733
7734                 if (!NT_STATUS_IS_OK(status)) {
7735                         return status;
7736                 }
7737         }
7738
7739         /* Setup the timeout in seconds. */
7740
7741         if (!lp_blocking_locks(SNUM(conn))) {
7742                 timeout = 0;
7743         }
7744
7745         /* Data now points at the beginning of the list
7746            of smb_lkrng structs */
7747
7748         for(i = 0; i < (int)num_locks; i++) {
7749                 struct smbd_lock_element *e = &locks[i];
7750
7751                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7752                           "%llu, file %s timeout = %d\n",
7753                           (double)e->offset,
7754                           (double)e->count,
7755                           (unsigned long long)e->smblctx,
7756                           fsp_str_dbg(fsp),
7757                           (int)timeout));
7758
7759                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7760                         struct blocking_lock_record *blr = NULL;
7761
7762                         if (num_locks > 1) {
7763                                 /*
7764                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7765                                  * if the lock vector contains one entry. When given mutliple cancel
7766                                  * requests in a single PDU we expect the server to return an
7767                                  * error. Windows servers seem to accept the request but only
7768                                  * cancel the first lock.
7769                                  * JRA - Do what Windows does (tm) :-).
7770                                  */
7771
7772 #if 0
7773                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7774                                 return NT_STATUS_DOS(ERRDOS,
7775                                                 ERRcancelviolation);
7776 #else
7777                                 /* Windows behavior. */
7778                                 if (i != 0) {
7779                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7780                                                 "cancel request\n"));
7781                                         continue;
7782                                 }
7783 #endif
7784                         }
7785
7786                         if (lp_blocking_locks(SNUM(conn))) {
7787
7788                                 /* Schedule a message to ourselves to
7789                                    remove the blocking lock record and
7790                                    return the right error. */
7791
7792                                 blr = blocking_lock_cancel_smb1(fsp,
7793                                                 e->smblctx,
7794                                                 e->offset,
7795                                                 e->count,
7796                                                 WINDOWS_LOCK,
7797                                                 type,
7798                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7799                                 if (blr == NULL) {
7800                                         return NT_STATUS_DOS(
7801                                                         ERRDOS,
7802                                                         ERRcancelviolation);
7803                                 }
7804                         }
7805                         /* Remove a matching pending lock. */
7806                         status = do_lock_cancel(fsp,
7807                                                 e->smblctx,
7808                                                 e->count,
7809                                                 e->offset,
7810                                                 WINDOWS_LOCK,
7811                                                 blr);
7812                 } else {
7813                         bool blocking_lock = timeout ? true : false;
7814                         bool defer_lock = false;
7815                         struct byte_range_lock *br_lck;
7816                         uint64_t block_smblctx;
7817
7818                         br_lck = do_lock(req->sconn->msg_ctx,
7819                                         fsp,
7820                                         e->smblctx,
7821                                         e->count,
7822                                         e->offset,
7823                                         e->brltype,
7824                                         WINDOWS_LOCK,
7825                                         blocking_lock,
7826                                         &status,
7827                                         &block_smblctx,
7828                                         NULL);
7829
7830                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7831                                 /* Windows internal resolution for blocking locks seems
7832                                    to be about 200ms... Don't wait for less than that. JRA. */
7833                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7834                                         timeout = lp_lock_spin_time();
7835                                 }
7836                                 defer_lock = true;
7837                         }
7838
7839                         /* If a lock sent with timeout of zero would fail, and
7840                          * this lock has been requested multiple times,
7841                          * according to brl_lock_failed() we convert this
7842                          * request to a blocking lock with a timeout of between
7843                          * 150 - 300 milliseconds.
7844                          *
7845                          * If lp_lock_spin_time() has been set to 0, we skip
7846                          * this blocking retry and fail immediately.
7847                          *
7848                          * Replacement for do_lock_spin(). JRA. */
7849
7850                         if (!req->sconn->using_smb2 &&
7851                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7852                             lp_lock_spin_time() && !blocking_lock &&
7853                             NT_STATUS_EQUAL((status),
7854                                 NT_STATUS_FILE_LOCK_CONFLICT))
7855                         {
7856                                 defer_lock = true;
7857                                 timeout = lp_lock_spin_time();
7858                         }
7859
7860                         if (br_lck && defer_lock) {
7861                                 /*
7862                                  * A blocking lock was requested. Package up
7863                                  * this smb into a queued request and push it
7864                                  * onto the blocking lock queue.
7865                                  */
7866                                 if(push_blocking_lock_request(br_lck,
7867                                                         req,
7868                                                         fsp,
7869                                                         timeout,
7870                                                         i,
7871                                                         e->smblctx,
7872                                                         e->brltype,
7873                                                         WINDOWS_LOCK,
7874                                                         e->offset,
7875                                                         e->count,
7876                                                         block_smblctx)) {
7877                                         TALLOC_FREE(br_lck);
7878                                         *async = true;
7879                                         return NT_STATUS_OK;
7880                                 }
7881                         }
7882
7883                         TALLOC_FREE(br_lck);
7884                 }
7885
7886                 if (!NT_STATUS_IS_OK(status)) {
7887                         break;
7888                 }
7889         }
7890
7891         /* If any of the above locks failed, then we must unlock
7892            all of the previous locks (X/Open spec). */
7893
7894         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7895
7896                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7897                         i = -1; /* we want to skip the for loop */
7898                 }
7899
7900                 /*
7901                  * Ensure we don't do a remove on the lock that just failed,
7902                  * as under POSIX rules, if we have a lock already there, we
7903                  * will delete it (and we shouldn't) .....
7904                  */
7905                 for(i--; i >= 0; i--) {
7906                         struct smbd_lock_element *e = &locks[i];
7907
7908                         do_unlock(req->sconn->msg_ctx,
7909                                 fsp,
7910                                 e->smblctx,
7911                                 e->count,
7912                                 e->offset,
7913                                 WINDOWS_LOCK);
7914                 }
7915                 return status;
7916         }
7917
7918         DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
7919                   fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
7920
7921         return NT_STATUS_OK;
7922 }
7923
7924 /****************************************************************************
7925  Reply to a lockingX request.
7926 ****************************************************************************/
7927
7928 void reply_lockingX(struct smb_request *req)
7929 {
7930         connection_struct *conn = req->conn;
7931         files_struct *fsp;
7932         unsigned char locktype;
7933         unsigned char oplocklevel;
7934         uint16 num_ulocks;
7935         uint16 num_locks;
7936         int32 lock_timeout;
7937         int i;
7938         const uint8_t *data;
7939         bool large_file_format;
7940         bool err;
7941         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7942         struct smbd_lock_element *ulocks;
7943         struct smbd_lock_element *locks;
7944         bool async = false;
7945
7946         START_PROFILE(SMBlockingX);
7947
7948         if (req->wct < 8) {
7949                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7950                 END_PROFILE(SMBlockingX);
7951                 return;
7952         }
7953
7954         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7955         locktype = CVAL(req->vwv+3, 0);
7956         oplocklevel = CVAL(req->vwv+3, 1);
7957         num_ulocks = SVAL(req->vwv+6, 0);
7958         num_locks = SVAL(req->vwv+7, 0);
7959         lock_timeout = IVAL(req->vwv+4, 0);
7960         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7961
7962         if (!check_fsp(conn, req, fsp)) {
7963                 END_PROFILE(SMBlockingX);
7964                 return;
7965         }
7966
7967         data = req->buf;
7968
7969         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7970                 /* we don't support these - and CANCEL_LOCK makes w2k
7971                    and XP reboot so I don't really want to be
7972                    compatible! (tridge) */
7973                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7974                 END_PROFILE(SMBlockingX);
7975                 return;
7976         }
7977
7978         /* Check if this is an oplock break on a file
7979            we have granted an oplock on.
7980         */
7981         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7982                 /* Client can insist on breaking to none. */
7983                 bool break_to_none = (oplocklevel == 0);
7984                 bool result;
7985
7986                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7987                          "for %s\n", (unsigned int)oplocklevel,
7988                          fsp_fnum_dbg(fsp)));
7989
7990                 /*
7991                  * Make sure we have granted an exclusive or batch oplock on
7992                  * this file.
7993                  */
7994
7995                 if (fsp->oplock_type == 0) {
7996
7997                         /* The Samba4 nbench simulator doesn't understand
7998                            the difference between break to level2 and break
7999                            to none from level2 - it sends oplock break
8000                            replies in both cases. Don't keep logging an error
8001                            message here - just ignore it. JRA. */
8002
8003                         DEBUG(5,("reply_lockingX: Error : oplock break from "
8004                                  "client for %s (oplock=%d) and no "
8005                                  "oplock granted on this file (%s).\n",
8006                                  fsp_fnum_dbg(fsp), fsp->oplock_type,
8007                                  fsp_str_dbg(fsp)));
8008
8009                         /* if this is a pure oplock break request then don't
8010                          * send a reply */
8011                         if (num_locks == 0 && num_ulocks == 0) {
8012                                 END_PROFILE(SMBlockingX);
8013                                 return;
8014                         } else {
8015                                 END_PROFILE(SMBlockingX);
8016                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8017                                 return;
8018                         }
8019                 }
8020
8021                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8022                     (break_to_none)) {
8023                         result = remove_oplock(fsp);
8024                 } else {
8025                         result = downgrade_oplock(fsp);
8026                 }
8027
8028                 if (!result) {
8029                         DEBUG(0, ("reply_lockingX: error in removing "
8030                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
8031                         /* Hmmm. Is this panic justified? */
8032                         smb_panic("internal tdb error");
8033                 }
8034
8035                 /* if this is a pure oplock break request then don't send a
8036                  * reply */
8037                 if (num_locks == 0 && num_ulocks == 0) {
8038                         /* Sanity check - ensure a pure oplock break is not a
8039                            chained request. */
8040                         if(CVAL(req->vwv+0, 0) != 0xff)
8041                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
8042                                          "break is a chained %d request !\n",
8043                                          (unsigned int)CVAL(req->vwv+0, 0)));
8044                         END_PROFILE(SMBlockingX);
8045                         return;
8046                 }
8047         }
8048
8049         if (req->buflen <
8050             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8051                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8052                 END_PROFILE(SMBlockingX);
8053                 return;
8054         }
8055
8056         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8057         if (ulocks == NULL) {
8058                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8059                 END_PROFILE(SMBlockingX);
8060                 return;
8061         }
8062
8063         locks = talloc_array(req, struct smbd_lock_element, num_locks);
8064         if (locks == NULL) {
8065                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8066                 END_PROFILE(SMBlockingX);
8067                 return;
8068         }
8069
8070         /* Data now points at the beginning of the list
8071            of smb_unlkrng structs */
8072         for(i = 0; i < (int)num_ulocks; i++) {
8073                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8074                 ulocks[i].count = get_lock_count(data, i, large_file_format);
8075                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8076                 ulocks[i].brltype = UNLOCK_LOCK;
8077
8078                 /*
8079                  * There is no error code marked "stupid client bug".... :-).
8080                  */
8081                 if(err) {
8082                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8083                         END_PROFILE(SMBlockingX);
8084                         return;
8085                 }
8086         }
8087
8088         /* Now do any requested locks */
8089         data += ((large_file_format ? 20 : 10)*num_ulocks);
8090
8091         /* Data now points at the beginning of the list
8092            of smb_lkrng structs */
8093
8094         for(i = 0; i < (int)num_locks; i++) {
8095                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8096                 locks[i].count = get_lock_count(data, i, large_file_format);
8097                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8098
8099                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8100                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8101                                 locks[i].brltype = PENDING_READ_LOCK;
8102                         } else {
8103                                 locks[i].brltype = READ_LOCK;
8104                         }
8105                 } else {
8106                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8107                                 locks[i].brltype = PENDING_WRITE_LOCK;
8108                         } else {
8109                                 locks[i].brltype = WRITE_LOCK;
8110                         }
8111                 }
8112
8113                 /*
8114                  * There is no error code marked "stupid client bug".... :-).
8115                  */
8116                 if(err) {
8117                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8118                         END_PROFILE(SMBlockingX);
8119                         return;
8120                 }
8121         }
8122
8123         status = smbd_do_locking(req, fsp,
8124                                  locktype, lock_timeout,
8125                                  num_ulocks, ulocks,
8126                                  num_locks, locks,
8127                                  &async);
8128         if (!NT_STATUS_IS_OK(status)) {
8129                 END_PROFILE(SMBlockingX);
8130                 reply_nterror(req, status);
8131                 return;
8132         }
8133         if (async) {
8134                 END_PROFILE(SMBlockingX);
8135                 return;
8136         }
8137
8138         reply_outbuf(req, 2, 0);
8139         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8140         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
8141
8142         DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8143                   fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8144
8145         END_PROFILE(SMBlockingX);
8146 }
8147
8148 #undef DBGC_CLASS
8149 #define DBGC_CLASS DBGC_ALL
8150
8151 /****************************************************************************
8152  Reply to a SMBreadbmpx (read block multiplex) request.
8153  Always reply with an error, if someone has a platform really needs this,
8154  please contact vl@samba.org
8155 ****************************************************************************/
8156
8157 void reply_readbmpx(struct smb_request *req)
8158 {
8159         START_PROFILE(SMBreadBmpx);
8160         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8161         END_PROFILE(SMBreadBmpx);
8162         return;
8163 }
8164
8165 /****************************************************************************
8166  Reply to a SMBreadbs (read block multiplex secondary) request.
8167  Always reply with an error, if someone has a platform really needs this,
8168  please contact vl@samba.org
8169 ****************************************************************************/
8170
8171 void reply_readbs(struct smb_request *req)
8172 {
8173         START_PROFILE(SMBreadBs);
8174         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8175         END_PROFILE(SMBreadBs);
8176         return;
8177 }
8178
8179 /****************************************************************************
8180  Reply to a SMBsetattrE.
8181 ****************************************************************************/
8182
8183 void reply_setattrE(struct smb_request *req)
8184 {
8185         connection_struct *conn = req->conn;
8186         struct smb_file_time ft;
8187         files_struct *fsp;
8188         NTSTATUS status;
8189
8190         START_PROFILE(SMBsetattrE);
8191         ZERO_STRUCT(ft);
8192
8193         if (req->wct < 7) {
8194                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8195                 goto out;
8196         }
8197
8198         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8199
8200         if(!fsp || (fsp->conn != conn)) {
8201                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8202                 goto out;
8203         }
8204
8205         /*
8206          * Convert the DOS times into unix times.
8207          */
8208
8209         ft.atime = convert_time_t_to_timespec(
8210             srv_make_unix_date2(req->vwv+3));
8211         ft.mtime = convert_time_t_to_timespec(
8212             srv_make_unix_date2(req->vwv+5));
8213         ft.create_time = convert_time_t_to_timespec(
8214             srv_make_unix_date2(req->vwv+1));
8215
8216         reply_outbuf(req, 0, 0);
8217
8218         /*
8219          * Patch from Ray Frush <frush@engr.colostate.edu>
8220          * Sometimes times are sent as zero - ignore them.
8221          */
8222
8223         /* Ensure we have a valid stat struct for the source. */
8224         status = vfs_stat_fsp(fsp);
8225         if (!NT_STATUS_IS_OK(status)) {
8226                 reply_nterror(req, status);
8227                 goto out;
8228         }
8229
8230         if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8231                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8232                 goto out;
8233         }
8234
8235         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8236         if (!NT_STATUS_IS_OK(status)) {
8237                 reply_nterror(req, status);
8238                 goto out;
8239         }
8240
8241         DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8242                " createtime=%u\n",
8243                 fsp_fnum_dbg(fsp),
8244                 (unsigned int)ft.atime.tv_sec,
8245                 (unsigned int)ft.mtime.tv_sec,
8246                 (unsigned int)ft.create_time.tv_sec
8247                 ));
8248  out:
8249         END_PROFILE(SMBsetattrE);
8250         return;
8251 }
8252
8253
8254 /* Back from the dead for OS/2..... JRA. */
8255
8256 /****************************************************************************
8257  Reply to a SMBwritebmpx (write block multiplex primary) request.
8258  Always reply with an error, if someone has a platform really needs this,
8259  please contact vl@samba.org
8260 ****************************************************************************/
8261
8262 void reply_writebmpx(struct smb_request *req)
8263 {
8264         START_PROFILE(SMBwriteBmpx);
8265         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8266         END_PROFILE(SMBwriteBmpx);
8267         return;
8268 }
8269
8270 /****************************************************************************
8271  Reply to a SMBwritebs (write block multiplex secondary) request.
8272  Always reply with an error, if someone has a platform really needs this,
8273  please contact vl@samba.org
8274 ****************************************************************************/
8275
8276 void reply_writebs(struct smb_request *req)
8277 {
8278         START_PROFILE(SMBwriteBs);
8279         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8280         END_PROFILE(SMBwriteBs);
8281         return;
8282 }
8283
8284 /****************************************************************************
8285  Reply to a SMBgetattrE.
8286 ****************************************************************************/
8287
8288 void reply_getattrE(struct smb_request *req)
8289 {
8290         connection_struct *conn = req->conn;
8291         int mode;
8292         files_struct *fsp;
8293         struct timespec create_ts;
8294
8295         START_PROFILE(SMBgetattrE);
8296
8297         if (req->wct < 1) {
8298                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8299                 END_PROFILE(SMBgetattrE);
8300                 return;
8301         }
8302
8303         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8304
8305         if(!fsp || (fsp->conn != conn)) {
8306                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8307                 END_PROFILE(SMBgetattrE);
8308                 return;
8309         }
8310
8311         /* Do an fstat on this file */
8312         if(fsp_stat(fsp)) {
8313                 reply_nterror(req, map_nt_error_from_unix(errno));
8314                 END_PROFILE(SMBgetattrE);
8315                 return;
8316         }
8317
8318         mode = dos_mode(conn, fsp->fsp_name);
8319
8320         /*
8321          * Convert the times into dos times. Set create
8322          * date to be last modify date as UNIX doesn't save
8323          * this.
8324          */
8325
8326         reply_outbuf(req, 11, 0);
8327
8328         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8329         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8330         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8331                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8332         /* Should we check pending modtime here ? JRA */
8333         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8334                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8335
8336         if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8337                 SIVAL(req->outbuf, smb_vwv6, 0);
8338                 SIVAL(req->outbuf, smb_vwv8, 0);
8339         } else {
8340                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8341                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8342                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8343         }
8344         SSVAL(req->outbuf,smb_vwv10, mode);
8345
8346         DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8347
8348         END_PROFILE(SMBgetattrE);
8349         return;
8350 }