source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  35 #include "../librpc/gen_ndr/open_files.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "rpc_server/rpc_ncacn_np.h"
  39 #include "libcli/security/security.h"
  40 #include "libsmb/nmblib.h"
  41 #include "auth.h"
  42 #include "smbprofile.h"
  43 #include "../lib/tsocket/tsocket.h"
  44 #include "lib/tevent_wait.h"
  45 #include "libcli/smb/smb_signing.h"
  46
  47 /****************************************************************************
  48  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  49  path or anything including wildcards.
  50  We're assuming here that '/' is not the second byte in any multibyte char
  51  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  52  set.
  53 ****************************************************************************/
  54
  55 /* Custom version for processing POSIX paths. */
  56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  57
  58 static NTSTATUS check_path_syntax_internal(char *path,
  59                                            bool posix_path,
  60                                            bool *p_last_component_contains_wcard)
  61 {
  62         char *d = path;
  63         const char *s = path;
  64         NTSTATUS ret = NT_STATUS_OK;
  65         bool start_of_name_component = True;
  66         bool stream_started = false;
  67
  68         *p_last_component_contains_wcard = False;
  69
  70         while (*s) {
  71                 if (stream_started) {
  72                         switch (*s) {
  73                         case '/':
  74                         case '\\':
  75                                 return NT_STATUS_OBJECT_NAME_INVALID;
  76                         case ':':
  77                                 if (s[1] == '\0') {
  78                                         return NT_STATUS_OBJECT_NAME_INVALID;
  79                                 }
  80                                 if (strchr_m(&s[1], ':')) {
  81                                         return NT_STATUS_OBJECT_NAME_INVALID;
  82                                 }
  83                                 break;
  84                         }
  85                 }
  86
  87                 if ((*s == ':') && !posix_path && !stream_started) {
  88                         if (*p_last_component_contains_wcard) {
  89                                 return NT_STATUS_OBJECT_NAME_INVALID;
  90                         }
  91                         /* Stream names allow more characters than file names.
  92                            We're overloading posix_path here to allow a wider
  93                            range of characters. If stream_started is true this
  94                            is still a Windows path even if posix_path is true.
  95                            JRA.
  96                         */
  97                         stream_started = true;
  98                         start_of_name_component = false;
  99                         posix_path = true;
 100
 101                         if (s[1] == '\0') {
 102                                 return NT_STATUS_OBJECT_NAME_INVALID;
 103                         }
 104                 }
 105
 106                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 107                         /*
 108                          * Safe to assume is not the second part of a mb char
 109                          * as this is handled below.
 110                          */
 111                         /* Eat multiple '/' or '\\' */
 112                         while (IS_PATH_SEP(*s,posix_path)) {
 113                                 s++;
 114                         }
 115                         if ((d != path) && (*s != '\0')) {
 116                                 /* We only care about non-leading or trailing '/' or '\\' */
 117                                 *d++ = '/';
 118                         }
 119
 120                         start_of_name_component = True;
 121                         /* New component. */
 122                         *p_last_component_contains_wcard = False;
 123                         continue;
 124                 }
 125
 126                 if (start_of_name_component) {
 127                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 128                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 129
 130                                 /*
 131                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 132                                  */
 133
 134                                 /* If  we just added a '/' - delete it */
 135                                 if ((d > path) && (*(d-1) == '/')) {
 136                                         *(d-1) = '\0';
 137                                         d--;
 138                                 }
 139
 140                                 /* Are we at the start ? Can't go back further if so. */
 141                                 if (d <= path) {
 142                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 143                                         break;
 144                                 }
 145                                 /* Go back one level... */
 146                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 147                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 148                                 /* Decrement d first as d points to the *next* char to write into. */
 149                                 for (d--; d > path; d--) {
 150                                         if (*d == '/')
 151                                                 break;
 152                                 }
 153                                 s += 2; /* Else go past the .. */
 154                                 /* We're still at the start of a name component, just the previous one. */
 155                                 continue;
 156
 157                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 158                                 if (posix_path) {
 159                                         /* Eat the '.' */
 160                                         s++;
 161                                         continue;
 162                                 }
 163                         }
 164
 165                 }
 166
 167                 if (!(*s & 0x80)) {
 168                         if (!posix_path) {
 169                                 if (*s <= 0x1f || *s == '|') {
 170                                         return NT_STATUS_OBJECT_NAME_INVALID;
 171                                 }
 172                                 switch (*s) {
 173                                         case '*':
 174                                         case '?':
 175                                         case '<':
 176                                         case '>':
 177                                         case '"':
 178                                                 *p_last_component_contains_wcard = True;
 179                                                 break;
 180                                         default:
 181                                                 break;
 182                                 }
 183                         }
 184                         *d++ = *s++;
 185                 } else {
 186                         size_t siz;
 187                         /* Get the size of the next MB character. */
 188                         next_codepoint(s,&siz);
 189                         switch(siz) {
 190                                 case 5:
 191                                         *d++ = *s++;
 192                                         /*fall through*/
 193                                 case 4:
 194                                         *d++ = *s++;
 195                                         /*fall through*/
 196                                 case 3:
 197                                         *d++ = *s++;
 198                                         /*fall through*/
 199                                 case 2:
 200                                         *d++ = *s++;
 201                                         /*fall through*/
 202                                 case 1:
 203                                         *d++ = *s++;
 204                                         break;
 205                                 default:
 206                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 207                                         *d = '\0';
 208                                         return NT_STATUS_INVALID_PARAMETER;
 209                         }
 210                 }
 211                 start_of_name_component = False;
 212         }
 213
 214         *d = '\0';
 215
 216         return ret;
 217 }
 218
 219 /****************************************************************************
 220  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 221  No wildcards allowed.
 222 ****************************************************************************/
 223
 224 NTSTATUS check_path_syntax(char *path)
 225 {
 226         bool ignore;
 227         return check_path_syntax_internal(path, False, &ignore);
 228 }
 229
 230 /****************************************************************************
 231  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 232  Wildcards allowed - p_contains_wcard returns true if the last component contained
 233  a wildcard.
 234 ****************************************************************************/
 235
 236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 237 {
 238         return check_path_syntax_internal(path, False, p_contains_wcard);
 239 }
 240
 241 /****************************************************************************
 242  Check the path for a POSIX client.
 243  We're assuming here that '/' is not the second byte in any multibyte char
 244  set (a safe assumption).
 245 ****************************************************************************/
 246
 247 NTSTATUS check_path_syntax_posix(char *path)
 248 {
 249         bool ignore;
 250         return check_path_syntax_internal(path, True, &ignore);
 251 }
 252
 253 /****************************************************************************
 254  Pull a string and check the path allowing a wilcard - provide for error return.
 255 ****************************************************************************/
 256
 257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 258                         const char *base_ptr,
 259                         uint16 smb_flags2,
 260                         char **pp_dest,
 261                         const char *src,
 262                         size_t src_len,
 263                         int flags,
 264                         NTSTATUS *err,
 265                         bool *contains_wcard)
 266 {
 267         size_t ret;
 268
 269         *pp_dest = NULL;
 270
 271         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 272                                  src_len, flags);
 273
 274         if (!*pp_dest) {
 275                 *err = NT_STATUS_INVALID_PARAMETER;
 276                 return ret;
 277         }
 278
 279         *contains_wcard = False;
 280
 281         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 282                 /*
 283                  * For a DFS path the function parse_dfs_path()
 284                  * will do the path processing, just make a copy.
 285                  */
 286                 *err = NT_STATUS_OK;
 287                 return ret;
 288         }
 289
 290         if (lp_posix_pathnames()) {
 291                 *err = check_path_syntax_posix(*pp_dest);
 292         } else {
 293                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 294         }
 295
 296         return ret;
 297 }
 298
 299 /****************************************************************************
 300  Pull a string and check the path - provide for error return.
 301 ****************************************************************************/
 302
 303 size_t srvstr_get_path(TALLOC_CTX *ctx,
 304                         const char *base_ptr,
 305                         uint16 smb_flags2,
 306                         char **pp_dest,
 307                         const char *src,
 308                         size_t src_len,
 309                         int flags,
 310                         NTSTATUS *err)
 311 {
 312         bool ignore;
 313         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 314                                      src_len, flags, err, &ignore);
 315 }
 316
 317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 318                                  char **pp_dest, const char *src, int flags,
 319                                  NTSTATUS *err, bool *contains_wcard)
 320 {
 321         ssize_t bufrem = smbreq_bufrem(req, src);
 322
 323         if (bufrem < 0) {
 324                 *err = NT_STATUS_INVALID_PARAMETER;
 325                 return 0;
 326         }
 327
 328         return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
 329                                      req->flags2, pp_dest, src, bufrem, flags,
 330                                      err, contains_wcard);
 331 }
 332
 333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 334                            char **pp_dest, const char *src, int flags,
 335                            NTSTATUS *err)
 336 {
 337         bool ignore;
 338         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 339                                          flags, err, &ignore);
 340 }
 341
 342 /**
 343  * pull a string from the smb_buf part of a packet. In this case the
 344  * string can either be null terminated or it can be terminated by the
 345  * end of the smbbuf area
 346  */
 347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
 348                               char **dest, const char *src, int flags)
 349 {
 350         ssize_t bufrem = smbreq_bufrem(req, src);
 351
 352         if (bufrem < 0) {
 353                 return 0;
 354         }
 355
 356         return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
 357                                   bufrem, flags);
 358 }
 359
 360 /****************************************************************************
 361  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 362 ****************************************************************************/
 363
 364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 365                     files_struct *fsp)
 366 {
 367         if ((fsp == NULL) || (conn == NULL)) {
 368                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 369                 return False;
 370         }
 371         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 372                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 373                 return False;
 374         }
 375         return True;
 376 }
 377
 378 /****************************************************************************
 379  Check if we have a correct fsp pointing to a file.
 380 ****************************************************************************/
 381
 382 bool check_fsp(connection_struct *conn, struct smb_request *req,
 383                files_struct *fsp)
 384 {
 385         if (!check_fsp_open(conn, req, fsp)) {
 386                 return False;
 387         }
 388         if (fsp->is_directory) {
 389                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 390                 return False;
 391         }
 392         if (fsp->fh->fd == -1) {
 393                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 394                 return False;
 395         }
 396         fsp->num_smb_operations++;
 397         return True;
 398 }
 399
 400 /****************************************************************************
 401  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 402  the CHECK_NTQUOTA_HANDLE_OK macro.
 403 ****************************************************************************/
 404
 405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 406                               files_struct *fsp)
 407 {
 408         if (!check_fsp_open(conn, req, fsp)) {
 409                 return false;
 410         }
 411
 412         if (fsp->is_directory) {
 413                 return false;
 414         }
 415
 416         if (fsp->fake_file_handle == NULL) {
 417                 return false;
 418         }
 419
 420         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 421                 return false;
 422         }
 423
 424         if (fsp->fake_file_handle->private_data == NULL) {
 425                 return false;
 426         }
 427
 428         return true;
 429 }
 430
 431 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 432                                      const char *name, int name_type)
 433 {
 434         char *trim_name;
 435         char *trim_name_type;
 436         const char *retarget_parm;
 437         char *retarget;
 438         char *p;
 439         int retarget_type = 0x20;
 440         int retarget_port = NBT_SMB_PORT;
 441         struct sockaddr_storage retarget_addr;
 442         struct sockaddr_in *in_addr;
 443         bool ret = false;
 444         uint8_t outbuf[10];
 445
 446         if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
 447                 return false;
 448         }
 449
 450         trim_name = talloc_strdup(talloc_tos(), name);
 451         if (trim_name == NULL) {
 452                 goto fail;
 453         }
 454         trim_char(trim_name, ' ', ' ');
 455
 456         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 457                                          name_type);
 458         if (trim_name_type == NULL) {
 459                 goto fail;
 460         }
 461
 462         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 463                                              trim_name_type, NULL);
 464         if (retarget_parm == NULL) {
 465                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 466                                                      trim_name, NULL);
 467         }
 468         if (retarget_parm == NULL) {
 469                 goto fail;
 470         }
 471
 472         retarget = talloc_strdup(trim_name, retarget_parm);
 473         if (retarget == NULL) {
 474                 goto fail;
 475         }
 476
 477         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 478
 479         p = strchr(retarget, ':');
 480         if (p != NULL) {
 481                 *p++ = '\0';
 482                 retarget_port = atoi(p);
 483         }
 484
 485         p = strchr_m(retarget, '#');
 486         if (p != NULL) {
 487                 *p++ = '\0';
 488                 if (sscanf(p, "%x", &retarget_type) != 1) {
 489                         goto fail;
 490                 }
 491         }
 492
 493         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 494         if (!ret) {
 495                 DEBUG(10, ("could not resolve %s\n", retarget));
 496                 goto fail;
 497         }
 498
 499         if (retarget_addr.ss_family != AF_INET) {
 500                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 501                 goto fail;
 502         }
 503
 504         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 505
 506         _smb_setlen(outbuf, 6);
 507         SCVAL(outbuf, 0, 0x84);
 508         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 509         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 510
 511         if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
 512                           NULL)) {
 513                 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
 514                                     "failed.");
 515         }
 516
 517         ret = true;
 518  fail:
 519         TALLOC_FREE(trim_name);
 520         return ret;
 521 }
 522
 523 static void reply_called_name_not_present(char *outbuf)
 524 {
 525         smb_setlen(outbuf, 1);
 526         SCVAL(outbuf, 0, 0x83);
 527         SCVAL(outbuf, 4, 0x82);
 528 }
 529
 530 /****************************************************************************
 531  Reply to a (netbios-level) special message.
 532 ****************************************************************************/
 533
 534 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
 535 {
 536         int msg_type = CVAL(inbuf,0);
 537         int msg_flags = CVAL(inbuf,1);
 538         /*
 539          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 540          * calculation & friends (srv_send_smb uses that) we need the full smb
 541          * header.
 542          */
 543         char outbuf[smb_size];
 544
 545         memset(outbuf, '\0', sizeof(outbuf));
 546
 547         smb_setlen(outbuf,0);
 548
 549         switch (msg_type) {
 550         case NBSSrequest: /* session request */
 551         {
 552                 /* inbuf_size is guarenteed to be at least 4. */
 553                 fstring name1,name2;
 554                 int name_type1, name_type2;
 555                 int name_len1, name_len2;
 556
 557                 *name1 = *name2 = 0;
 558
 559                 if (sconn->nbt.got_session) {
 560                         exit_server_cleanly("multiple session request not permitted");
 561                 }
 562
 563                 SCVAL(outbuf,0,NBSSpositive);
 564                 SCVAL(outbuf,3,0);
 565
 566                 /* inbuf_size is guaranteed to be at least 4. */
 567                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 568                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 569                         DEBUG(0,("Invalid name length in session request\n"));
 570                         reply_called_name_not_present(outbuf);
 571                         break;
 572                 }
 573                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 574                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 575                         DEBUG(0,("Invalid name length in session request\n"));
 576                         reply_called_name_not_present(outbuf);
 577                         break;
 578                 }
 579
 580                 name_type1 = name_extract((unsigned char *)inbuf,
 581                                 inbuf_size,(unsigned int)4,name1);
 582                 name_type2 = name_extract((unsigned char *)inbuf,
 583                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 584
 585                 if (name_type1 == -1 || name_type2 == -1) {
 586                         DEBUG(0,("Invalid name type in session request\n"));
 587                         reply_called_name_not_present(outbuf);
 588                         break;
 589                 }
 590
 591                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 592                          name1, name_type1, name2, name_type2));
 593
 594                 if (netbios_session_retarget(sconn, name1, name_type1)) {
 595                         exit_server_cleanly("retargeted client");
 596                 }
 597
 598                 /*
 599                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 600                  * "*SMBSERV" arrggg!!!
 601                  */
 602                 if (strequal(name1, "*SMBSERVER     ")
 603                     || strequal(name1, "*SMBSERV       "))  {
 604                         char *raddr;
 605
 606                         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
 607                                                                  talloc_tos());
 608                         if (raddr == NULL) {
 609                                 exit_server_cleanly("could not allocate raddr");
 610                         }
 611
 612                         fstrcpy(name1, raddr);
 613                 }
 614
 615                 set_local_machine_name(name1, True);
 616                 set_remote_machine_name(name2, True);
 617
 618                 if (is_ipaddress(sconn->remote_hostname)) {
 619                         char *p = discard_const_p(char, sconn->remote_hostname);
 620
 621                         talloc_free(p);
 622
 623                         sconn->remote_hostname = talloc_strdup(sconn,
 624                                                 get_remote_machine_name());
 625                         if (sconn->remote_hostname == NULL) {
 626                                 exit_server_cleanly("could not copy remote name");
 627                         }
 628                         sconn->conn->remote_hostname = sconn->remote_hostname;
 629                 }
 630
 631                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 632                          get_local_machine_name(), get_remote_machine_name(),
 633                          name_type2));
 634
 635                 if (name_type2 == 'R') {
 636                         /* We are being asked for a pathworks session ---
 637                            no thanks! */
 638                         reply_called_name_not_present(outbuf);
 639                         break;
 640                 }
 641
 642                 reload_services(sconn, conn_snum_used, true);
 643                 reopen_logs();
 644
 645                 sconn->nbt.got_session = true;
 646                 break;
 647         }
 648
 649         case 0x89: /* session keepalive request
 650                       (some old clients produce this?) */
 651                 SCVAL(outbuf,0,NBSSkeepalive);
 652                 SCVAL(outbuf,3,0);
 653                 break;
 654
 655         case NBSSpositive: /* positive session response */
 656         case NBSSnegative: /* negative session response */
 657         case NBSSretarget: /* retarget session response */
 658                 DEBUG(0,("Unexpected session response\n"));
 659                 break;
 660
 661         case NBSSkeepalive: /* session keepalive */
 662         default:
 663                 return;
 664         }
 665
 666         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 667                     msg_type, msg_flags));
 668
 669         srv_send_smb(sconn, outbuf, false, 0, false, NULL);
 670
 671         if (CVAL(outbuf, 0) != 0x82) {
 672                 exit_server_cleanly("invalid netbios session");
 673         }
 674         return;
 675 }
 676
 677 /****************************************************************************
 678  Reply to a tcon.
 679  conn POINTER CAN BE NULL HERE !
 680 ****************************************************************************/
 681
 682 void reply_tcon(struct smb_request *req)
 683 {
 684         connection_struct *conn = req->conn;
 685         const char *service;
 686         char *service_buf = NULL;
 687         char *password = NULL;
 688         char *dev = NULL;
 689         int pwlen=0;
 690         NTSTATUS nt_status;
 691         const char *p;
 692         TALLOC_CTX *ctx = talloc_tos();
 693         struct smbd_server_connection *sconn = req->sconn;
 694         NTTIME now = timeval_to_nttime(&req->request_time);
 695
 696         START_PROFILE(SMBtcon);
 697
 698         if (req->buflen < 4) {
 699                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 700                 END_PROFILE(SMBtcon);
 701                 return;
 702         }
 703
 704         p = (const char *)req->buf + 1;
 705         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 706         p += 1;
 707         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 708         p += pwlen+1;
 709         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 710         p += 1;
 711
 712         if (service_buf == NULL || password == NULL || dev == NULL) {
 713                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 714                 END_PROFILE(SMBtcon);
 715                 return;
 716         }
 717         p = strrchr_m(service_buf,'\\');
 718         if (p) {
 719                 service = p+1;
 720         } else {
 721                 service = service_buf;
 722         }
 723
 724         conn = make_connection(sconn, now, service, dev,
 725                                req->vuid,&nt_status);
 726         req->conn = conn;
 727
 728         if (!conn) {
 729                 reply_nterror(req, nt_status);
 730                 END_PROFILE(SMBtcon);
 731                 return;
 732         }
 733
 734         reply_outbuf(req, 2, 0);
 735         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 736         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 737         SSVAL(req->outbuf,smb_tid,conn->cnum);
 738
 739         DEBUG(3,("tcon service=%s cnum=%d\n",
 740                  service, conn->cnum));
 741
 742         END_PROFILE(SMBtcon);
 743         return;
 744 }
 745
 746 /****************************************************************************
 747  Reply to a tcon and X.
 748  conn POINTER CAN BE NULL HERE !
 749 ****************************************************************************/
 750
 751 void reply_tcon_and_X(struct smb_request *req)
 752 {
 753         connection_struct *conn = req->conn;
 754         const char *service = NULL;
 755         TALLOC_CTX *ctx = talloc_tos();
 756         /* what the cleint thinks the device is */
 757         char *client_devicetype = NULL;
 758         /* what the server tells the client the share represents */
 759         const char *server_devicetype;
 760         NTSTATUS nt_status;
 761         int passlen;
 762         char *path = NULL;
 763         const char *p, *q;
 764         uint16_t tcon_flags;
 765         struct smbXsrv_session *session = NULL;
 766         NTTIME now = timeval_to_nttime(&req->request_time);
 767         bool session_key_updated = false;
 768         uint16_t optional_support = 0;
 769         struct smbd_server_connection *sconn = req->sconn;
 770
 771         START_PROFILE(SMBtconX);
 772
 773         if (req->wct < 4) {
 774                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 775                 END_PROFILE(SMBtconX);
 776                 return;
 777         }
 778
 779         passlen = SVAL(req->vwv+3, 0);
 780         tcon_flags = SVAL(req->vwv+2, 0);
 781
 782         /* we might have to close an old one */
 783         if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
 784                 struct smbXsrv_tcon *tcon;
 785                 NTSTATUS status;
 786
 787                 tcon = conn->tcon;
 788                 req->conn = NULL;
 789                 conn = NULL;
 790
 791                 /*
 792                  * TODO: cancel all outstanding requests on the tcon
 793                  */
 794                 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
 795                 if (!NT_STATUS_IS_OK(status)) {
 796                         DEBUG(0, ("reply_tcon_and_X: "
 797                                   "smbXsrv_tcon_disconnect() failed: %s\n",
 798                                   nt_errstr(status)));
 799                         /*
 800                          * If we hit this case, there is something completely
 801                          * wrong, so we better disconnect the transport connection.
 802                          */
 803                         END_PROFILE(SMBtconX);
 804                         exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
 805                         return;
 806                 }
 807
 808                 TALLOC_FREE(tcon);
 809         }
 810
 811         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 812                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 813                 END_PROFILE(SMBtconX);
 814                 return;
 815         }
 816
 817         if (sconn->smb1.negprot.encrypted_passwords) {
 818                 p = (const char *)req->buf + passlen;
 819         } else {
 820                 p = (const char *)req->buf + passlen + 1;
 821         }
 822
 823         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 824
 825         if (path == NULL) {
 826                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 827                 END_PROFILE(SMBtconX);
 828                 return;
 829         }
 830
 831         /*
 832          * the service name can be either: \\server\share
 833          * or share directly like on the DELL PowerVault 705
 834          */
 835         if (*path=='\\') {
 836                 q = strchr_m(path+2,'\\');
 837                 if (!q) {
 838                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 839                         END_PROFILE(SMBtconX);
 840                         return;
 841                 }
 842                 service = q+1;
 843         } else {
 844                 service = path;
 845         }
 846
 847         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 848                                 &client_devicetype, p,
 849                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 850
 851         if (client_devicetype == NULL) {
 852                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 853                 END_PROFILE(SMBtconX);
 854                 return;
 855         }
 856
 857         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 858
 859         nt_status = smb1srv_session_lookup(req->sconn->conn,
 860                                            req->vuid, now, &session);
 861         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
 862                 reply_force_doserror(req, ERRSRV, ERRbaduid);
 863                 END_PROFILE(SMBtconX);
 864                 return;
 865         }
 866         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 867                 reply_nterror(req, nt_status);
 868                 END_PROFILE(SMBtconX);
 869                 return;
 870         }
 871         if (!NT_STATUS_IS_OK(nt_status)) {
 872                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 873                 END_PROFILE(SMBtconX);
 874                 return;
 875         }
 876
 877         if (session->global->auth_session_info == NULL) {
 878                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 879                 END_PROFILE(SMBtconX);
 880                 return;
 881         }
 882
 883         /*
 884          * If there is no application key defined yet
 885          * we create one.
 886          *
 887          * This means we setup the application key on the
 888          * first tcon that happens via the given session.
 889          *
 890          * Once the application key is defined, it does not
 891          * change any more.
 892          */
 893         if (session->global->application_key.length == 0 &&
 894             session->global->signing_key.length > 0)
 895         {
 896                 struct smbXsrv_session *x = session;
 897                 struct auth_session_info *session_info =
 898                         session->global->auth_session_info;
 899                 uint8_t session_key[16];
 900
 901                 ZERO_STRUCT(session_key);
 902                 memcpy(session_key, x->global->signing_key.data,
 903                        MIN(x->global->signing_key.length, sizeof(session_key)));
 904
 905                 /*
 906                  * The application key is truncated/padded to 16 bytes
 907                  */
 908                 x->global->application_key = data_blob_talloc(x->global,
 909                                                              session_key,
 910                                                              sizeof(session_key));
 911                 ZERO_STRUCT(session_key);
 912                 if (x->global->application_key.data == NULL) {
 913                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 914                         END_PROFILE(SMBtconX);
 915                         return;
 916                 }
 917
 918                 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
 919                         smb_key_derivation(x->global->application_key.data,
 920                                            x->global->application_key.length,
 921                                            x->global->application_key.data);
 922                         optional_support |= SMB_EXTENDED_SIGNATURES;
 923                 }
 924
 925                 /*
 926                  * Place the application key into the session_info
 927                  */
 928                 data_blob_clear_free(&session_info->session_key);
 929                 session_info->session_key = data_blob_dup_talloc(session_info,
 930                                                 x->global->application_key);
 931                 if (session_info->session_key.data == NULL) {
 932                         data_blob_clear_free(&x->global->application_key);
 933                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 934                         END_PROFILE(SMBtconX);
 935                         return;
 936                 }
 937                 session_key_updated = true;
 938         }
 939
 940         conn = make_connection(sconn, now, service, client_devicetype,
 941                                req->vuid, &nt_status);
 942         req->conn =conn;
 943
 944         if (!conn) {
 945                 if (session_key_updated) {
 946                         struct smbXsrv_session *x = session;
 947                         struct auth_session_info *session_info =
 948                                 session->global->auth_session_info;
 949                         data_blob_clear_free(&x->global->application_key);
 950                         data_blob_clear_free(&session_info->session_key);
 951                 }
 952                 reply_nterror(req, nt_status);
 953                 END_PROFILE(SMBtconX);
 954                 return;
 955         }
 956
 957         if ( IS_IPC(conn) )
 958                 server_devicetype = "IPC";
 959         else if ( IS_PRINT(conn) )
 960                 server_devicetype = "LPT1:";
 961         else
 962                 server_devicetype = "A:";
 963
 964         if (get_Protocol() < PROTOCOL_NT1) {
 965                 reply_outbuf(req, 2, 0);
 966                 if (message_push_string(&req->outbuf, server_devicetype,
 967                                         STR_TERMINATE|STR_ASCII) == -1) {
 968                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 969                         END_PROFILE(SMBtconX);
 970                         return;
 971                 }
 972         } else {
 973                 /* NT sets the fstype of IPC$ to the null string */
 974                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 975
 976                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 977                         /* Return permissions. */
 978                         uint32 perm1 = 0;
 979                         uint32 perm2 = 0;
 980
 981                         reply_outbuf(req, 7, 0);
 982
 983                         if (IS_IPC(conn)) {
 984                                 perm1 = FILE_ALL_ACCESS;
 985                                 perm2 = FILE_ALL_ACCESS;
 986                         } else {
 987                                 perm1 = conn->share_access;
 988                         }
 989
 990                         SIVAL(req->outbuf, smb_vwv3, perm1);
 991                         SIVAL(req->outbuf, smb_vwv5, perm2);
 992                 } else {
 993                         reply_outbuf(req, 3, 0);
 994                 }
 995
 996                 if ((message_push_string(&req->outbuf, server_devicetype,
 997                                          STR_TERMINATE|STR_ASCII) == -1)
 998                     || (message_push_string(&req->outbuf, fstype,
 999                                             STR_TERMINATE) == -1)) {
1000                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1001                         END_PROFILE(SMBtconX);
1002                         return;
1003                 }
1004
1005                 /* what does setting this bit do? It is set by NT4 and
1006                    may affect the ability to autorun mounted cdroms */
1007                 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1008                 optional_support |=
1009                         (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1010
1011                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1012                         DEBUG(2,("Serving %s as a Dfs root\n",
1013                                  lp_servicename(ctx, SNUM(conn)) ));
1014                         optional_support |= SMB_SHARE_IN_DFS;
1015                 }
1016
1017                 SSVAL(req->outbuf, smb_vwv2, optional_support);
1018         }
1019
1020         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1021         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
1022
1023         DEBUG(3,("tconX service=%s \n",
1024                  service));
1025
1026         /* set the incoming and outgoing tid to the just created one */
1027         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1028         SSVAL(req->outbuf,smb_tid,conn->cnum);
1029
1030         END_PROFILE(SMBtconX);
1031
1032         req->tid = conn->cnum;
1033 }
1034
1035 /****************************************************************************
1036  Reply to an unknown type.
1037 ****************************************************************************/
1038
1039 void reply_unknown_new(struct smb_request *req, uint8 type)
1040 {
1041         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1042                   smb_fn_name(type), type, type));
1043         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1044         return;
1045 }
1046
1047 /****************************************************************************
1048  Reply to an ioctl.
1049  conn POINTER CAN BE NULL HERE !
1050 ****************************************************************************/
1051
1052 void reply_ioctl(struct smb_request *req)
1053 {
1054         connection_struct *conn = req->conn;
1055         uint16 device;
1056         uint16 function;
1057         uint32 ioctl_code;
1058         int replysize;
1059         char *p;
1060
1061         START_PROFILE(SMBioctl);
1062
1063         if (req->wct < 3) {
1064                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1065                 END_PROFILE(SMBioctl);
1066                 return;
1067         }
1068
1069         device     = SVAL(req->vwv+1, 0);
1070         function   = SVAL(req->vwv+2, 0);
1071         ioctl_code = (device << 16) + function;
1072
1073         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1074
1075         switch (ioctl_code) {
1076             case IOCTL_QUERY_JOB_INFO:
1077                     replysize = 32;
1078                     break;
1079             default:
1080                     reply_force_doserror(req, ERRSRV, ERRnosupport);
1081                     END_PROFILE(SMBioctl);
1082                     return;
1083         }
1084
1085         reply_outbuf(req, 8, replysize+1);
1086         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1087         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1088         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
1089         p = smb_buf(req->outbuf);
1090         memset(p, '\0', replysize+1); /* valgrind-safe. */
1091         p += 1;          /* Allow for alignment */
1092
1093         switch (ioctl_code) {
1094                 case IOCTL_QUERY_JOB_INFO:
1095                 {
1096                         files_struct *fsp = file_fsp(
1097                                 req, SVAL(req->vwv+0, 0));
1098                         if (!fsp) {
1099                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1100                                 END_PROFILE(SMBioctl);
1101                                 return;
1102                         }
1103                         /* Job number */
1104                         SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1105
1106                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
1107                                     lp_netbios_name(), 15,
1108                                     STR_TERMINATE|STR_ASCII);
1109                         if (conn) {
1110                                 srvstr_push((char *)req->outbuf, req->flags2,
1111                                             p+18,
1112                                             lp_servicename(talloc_tos(),
1113                                                            SNUM(conn)),
1114                                             13, STR_TERMINATE|STR_ASCII);
1115                         } else {
1116                                 memset(p+18, 0, 13);
1117                         }
1118                         break;
1119                 }
1120         }
1121
1122         END_PROFILE(SMBioctl);
1123         return;
1124 }
1125
1126 /****************************************************************************
1127  Strange checkpath NTSTATUS mapping.
1128 ****************************************************************************/
1129
1130 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1131 {
1132         /* Strange DOS error code semantics only for checkpath... */
1133         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1134                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1135                         /* We need to map to ERRbadpath */
1136                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1137                 }
1138         }
1139         return status;
1140 }
1141
1142 /****************************************************************************
1143  Reply to a checkpath.
1144 ****************************************************************************/
1145
1146 void reply_checkpath(struct smb_request *req)
1147 {
1148         connection_struct *conn = req->conn;
1149         struct smb_filename *smb_fname = NULL;
1150         char *name = NULL;
1151         NTSTATUS status;
1152         TALLOC_CTX *ctx = talloc_tos();
1153
1154         START_PROFILE(SMBcheckpath);
1155
1156         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1157                             STR_TERMINATE, &status);
1158
1159         if (!NT_STATUS_IS_OK(status)) {
1160                 status = map_checkpath_error(req->flags2, status);
1161                 reply_nterror(req, status);
1162                 END_PROFILE(SMBcheckpath);
1163                 return;
1164         }
1165
1166         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1167
1168         status = filename_convert(ctx,
1169                                 conn,
1170                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1171                                 name,
1172                                 0,
1173                                 NULL,
1174                                 &smb_fname);
1175
1176         if (!NT_STATUS_IS_OK(status)) {
1177                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1178                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1179                                         ERRSRV, ERRbadpath);
1180                         END_PROFILE(SMBcheckpath);
1181                         return;
1182                 }
1183                 goto path_err;
1184         }
1185
1186         if (!VALID_STAT(smb_fname->st) &&
1187             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1188                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1189                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1190                 status = map_nt_error_from_unix(errno);
1191                 goto path_err;
1192         }
1193
1194         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1195                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1196                                 ERRDOS, ERRbadpath);
1197                 goto out;
1198         }
1199
1200         reply_outbuf(req, 0, 0);
1201
1202  path_err:
1203         /* We special case this - as when a Windows machine
1204                 is parsing a path is steps through the components
1205                 one at a time - if a component fails it expects
1206                 ERRbadpath, not ERRbadfile.
1207         */
1208         status = map_checkpath_error(req->flags2, status);
1209         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1210                 /*
1211                  * Windows returns different error codes if
1212                  * the parent directory is valid but not the
1213                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1214                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1215                  * if the path is invalid.
1216                  */
1217                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1218                                 ERRDOS, ERRbadpath);
1219                 goto out;
1220         }
1221
1222         reply_nterror(req, status);
1223
1224  out:
1225         TALLOC_FREE(smb_fname);
1226         END_PROFILE(SMBcheckpath);
1227         return;
1228 }
1229
1230 /****************************************************************************
1231  Reply to a getatr.
1232 ****************************************************************************/
1233
1234 void reply_getatr(struct smb_request *req)
1235 {
1236         connection_struct *conn = req->conn;
1237         struct smb_filename *smb_fname = NULL;
1238         char *fname = NULL;
1239         int mode=0;
1240         off_t size=0;
1241         time_t mtime=0;
1242         const char *p;
1243         NTSTATUS status;
1244         TALLOC_CTX *ctx = talloc_tos();
1245         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1246
1247         START_PROFILE(SMBgetatr);
1248
1249         p = (const char *)req->buf + 1;
1250         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1251         if (!NT_STATUS_IS_OK(status)) {
1252                 reply_nterror(req, status);
1253                 goto out;
1254         }
1255
1256         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1257                 under WfWg - weird! */
1258         if (*fname == '\0') {
1259                 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1260                 if (!CAN_WRITE(conn)) {
1261                         mode |= FILE_ATTRIBUTE_READONLY;
1262                 }
1263                 size = 0;
1264                 mtime = 0;
1265         } else {
1266                 status = filename_convert(ctx,
1267                                 conn,
1268                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1269                                 fname,
1270                                 0,
1271                                 NULL,
1272                                 &smb_fname);
1273                 if (!NT_STATUS_IS_OK(status)) {
1274                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1275                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1276                                                 ERRSRV, ERRbadpath);
1277                                 goto out;
1278                         }
1279                         reply_nterror(req, status);
1280                         goto out;
1281                 }
1282                 if (!VALID_STAT(smb_fname->st) &&
1283                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1284                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1285                                  smb_fname_str_dbg(smb_fname),
1286                                  strerror(errno)));
1287                         reply_nterror(req,  map_nt_error_from_unix(errno));
1288                         goto out;
1289                 }
1290
1291                 mode = dos_mode(conn, smb_fname);
1292                 size = smb_fname->st.st_ex_size;
1293
1294                 if (ask_sharemode) {
1295                         struct timespec write_time_ts;
1296                         struct file_id fileid;
1297
1298                         ZERO_STRUCT(write_time_ts);
1299                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1300                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1301                         if (!null_timespec(write_time_ts)) {
1302                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1303                         }
1304                 }
1305
1306                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1307                 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1308                         size = 0;
1309                 }
1310         }
1311
1312         reply_outbuf(req, 10, 0);
1313
1314         SSVAL(req->outbuf,smb_vwv0,mode);
1315         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1316                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1317         } else {
1318                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1319         }
1320         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1321
1322         if (get_Protocol() >= PROTOCOL_NT1) {
1323                 SSVAL(req->outbuf, smb_flg2,
1324                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1325         }
1326
1327         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1328                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1329
1330  out:
1331         TALLOC_FREE(smb_fname);
1332         TALLOC_FREE(fname);
1333         END_PROFILE(SMBgetatr);
1334         return;
1335 }
1336
1337 /****************************************************************************
1338  Reply to a setatr.
1339 ****************************************************************************/
1340
1341 void reply_setatr(struct smb_request *req)
1342 {
1343         struct smb_file_time ft;
1344         connection_struct *conn = req->conn;
1345         struct smb_filename *smb_fname = NULL;
1346         char *fname = NULL;
1347         int mode;
1348         time_t mtime;
1349         const char *p;
1350         NTSTATUS status;
1351         TALLOC_CTX *ctx = talloc_tos();
1352
1353         START_PROFILE(SMBsetatr);
1354
1355         ZERO_STRUCT(ft);
1356
1357         if (req->wct < 2) {
1358                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1359                 goto out;
1360         }
1361
1362         p = (const char *)req->buf + 1;
1363         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1364         if (!NT_STATUS_IS_OK(status)) {
1365                 reply_nterror(req, status);
1366                 goto out;
1367         }
1368
1369         status = filename_convert(ctx,
1370                                 conn,
1371                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1372                                 fname,
1373                                 0,
1374                                 NULL,
1375                                 &smb_fname);
1376         if (!NT_STATUS_IS_OK(status)) {
1377                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1378                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1379                                         ERRSRV, ERRbadpath);
1380                         goto out;
1381                 }
1382                 reply_nterror(req, status);
1383                 goto out;
1384         }
1385
1386         if (smb_fname->base_name[0] == '.' &&
1387             smb_fname->base_name[1] == '\0') {
1388                 /*
1389                  * Not sure here is the right place to catch this
1390                  * condition. Might be moved to somewhere else later -- vl
1391                  */
1392                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1393                 goto out;
1394         }
1395
1396         mode = SVAL(req->vwv+0, 0);
1397         mtime = srv_make_unix_date3(req->vwv+1);
1398
1399         if (mode != FILE_ATTRIBUTE_NORMAL) {
1400                 if (VALID_STAT_OF_DIR(smb_fname->st))
1401                         mode |= FILE_ATTRIBUTE_DIRECTORY;
1402                 else
1403                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1404
1405                 status = check_access(conn, NULL, smb_fname,
1406                                         FILE_WRITE_ATTRIBUTES);
1407                 if (!NT_STATUS_IS_OK(status)) {
1408                         reply_nterror(req, status);
1409                         goto out;
1410                 }
1411
1412                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1413                                      false) != 0) {
1414                         reply_nterror(req, map_nt_error_from_unix(errno));
1415                         goto out;
1416                 }
1417         }
1418
1419         ft.mtime = convert_time_t_to_timespec(mtime);
1420         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1421         if (!NT_STATUS_IS_OK(status)) {
1422                 reply_nterror(req, status);
1423                 goto out;
1424         }
1425
1426         reply_outbuf(req, 0, 0);
1427
1428         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1429                  mode));
1430  out:
1431         TALLOC_FREE(smb_fname);
1432         END_PROFILE(SMBsetatr);
1433         return;
1434 }
1435
1436 /****************************************************************************
1437  Reply to a dskattr.
1438 ****************************************************************************/
1439
1440 void reply_dskattr(struct smb_request *req)
1441 {
1442         connection_struct *conn = req->conn;
1443         uint64_t dfree,dsize,bsize;
1444         START_PROFILE(SMBdskattr);
1445
1446         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1447                 reply_nterror(req, map_nt_error_from_unix(errno));
1448                 END_PROFILE(SMBdskattr);
1449                 return;
1450         }
1451
1452         reply_outbuf(req, 5, 0);
1453
1454         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1455                 double total_space, free_space;
1456                 /* we need to scale this to a number that DOS6 can handle. We
1457                    use floating point so we can handle large drives on systems
1458                    that don't have 64 bit integers
1459
1460                    we end up displaying a maximum of 2G to DOS systems
1461                 */
1462                 total_space = dsize * (double)bsize;
1463                 free_space = dfree * (double)bsize;
1464
1465                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1466                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1467
1468                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1469                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1470
1471                 SSVAL(req->outbuf,smb_vwv0,dsize);
1472                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1473                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1474                 SSVAL(req->outbuf,smb_vwv3,dfree);
1475         } else {
1476                 SSVAL(req->outbuf,smb_vwv0,dsize);
1477                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1478                 SSVAL(req->outbuf,smb_vwv2,512);
1479                 SSVAL(req->outbuf,smb_vwv3,dfree);
1480         }
1481
1482         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1483
1484         END_PROFILE(SMBdskattr);
1485         return;
1486 }
1487
1488 /*
1489  * Utility function to split the filename from the directory.
1490  */
1491 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1492                                      char **fname_dir_out,
1493                                      char **fname_mask_out)
1494 {
1495         const char *p = NULL;
1496         char *fname_dir = NULL;
1497         char *fname_mask = NULL;
1498
1499         p = strrchr_m(fname_in, '/');
1500         if (!p) {
1501                 fname_dir = talloc_strdup(ctx, ".");
1502                 fname_mask = talloc_strdup(ctx, fname_in);
1503         } else {
1504                 fname_dir = talloc_strndup(ctx, fname_in,
1505                     PTR_DIFF(p, fname_in));
1506                 fname_mask = talloc_strdup(ctx, p+1);
1507         }
1508
1509         if (!fname_dir || !fname_mask) {
1510                 TALLOC_FREE(fname_dir);
1511                 TALLOC_FREE(fname_mask);
1512                 return NT_STATUS_NO_MEMORY;
1513         }
1514
1515         *fname_dir_out = fname_dir;
1516         *fname_mask_out = fname_mask;
1517         return NT_STATUS_OK;
1518 }
1519
1520 /****************************************************************************
1521  Reply to a search.
1522  Can be called from SMBsearch, SMBffirst or SMBfunique.
1523 ****************************************************************************/
1524
1525 void reply_search(struct smb_request *req)
1526 {
1527         connection_struct *conn = req->conn;
1528         char *path = NULL;
1529         const char *mask = NULL;
1530         char *directory = NULL;
1531         struct smb_filename *smb_fname = NULL;
1532         char *fname = NULL;
1533         off_t size;
1534         uint32 mode;
1535         struct timespec date;
1536         uint32 dirtype;
1537         unsigned int numentries = 0;
1538         unsigned int maxentries = 0;
1539         bool finished = False;
1540         const char *p;
1541         int status_len;
1542         char status[21];
1543         int dptr_num= -1;
1544         bool check_descend = False;
1545         bool expect_close = False;
1546         NTSTATUS nt_status;
1547         bool mask_contains_wcard = False;
1548         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1549         TALLOC_CTX *ctx = talloc_tos();
1550         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1551         struct dptr_struct *dirptr = NULL;
1552         struct smbd_server_connection *sconn = req->sconn;
1553
1554         START_PROFILE(SMBsearch);
1555
1556         if (req->wct < 2) {
1557                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1558                 goto out;
1559         }
1560
1561         if (lp_posix_pathnames()) {
1562                 reply_unknown_new(req, req->cmd);
1563                 goto out;
1564         }
1565
1566         /* If we were called as SMBffirst then we must expect close. */
1567         if(req->cmd == SMBffirst) {
1568                 expect_close = True;
1569         }
1570
1571         reply_outbuf(req, 1, 3);
1572         maxentries = SVAL(req->vwv+0, 0);
1573         dirtype = SVAL(req->vwv+1, 0);
1574         p = (const char *)req->buf + 1;
1575         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1576                                        &nt_status, &mask_contains_wcard);
1577         if (!NT_STATUS_IS_OK(nt_status)) {
1578                 reply_nterror(req, nt_status);
1579                 goto out;
1580         }
1581
1582         p++;
1583         status_len = SVAL(p, 0);
1584         p += 2;
1585
1586         /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1587
1588         if (status_len == 0) {
1589                 nt_status = filename_convert(ctx, conn,
1590                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1591                                              path,
1592                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1593                                              &mask_contains_wcard,
1594                                              &smb_fname);
1595                 if (!NT_STATUS_IS_OK(nt_status)) {
1596                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1597                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1598                                                 ERRSRV, ERRbadpath);
1599                                 goto out;
1600                         }
1601                         reply_nterror(req, nt_status);
1602                         goto out;
1603                 }
1604
1605                 directory = smb_fname->base_name;
1606
1607                 p = strrchr_m(directory,'/');
1608                 if ((p != NULL) && (*directory != '/')) {
1609                         mask = p + 1;
1610                         directory = talloc_strndup(ctx, directory,
1611                                                    PTR_DIFF(p, directory));
1612                 } else {
1613                         mask = directory;
1614                         directory = talloc_strdup(ctx,".");
1615                 }
1616
1617                 if (!directory) {
1618                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1619                         goto out;
1620                 }
1621
1622                 memset((char *)status,'\0',21);
1623                 SCVAL(status,0,(dirtype & 0x1F));
1624
1625                 nt_status = dptr_create(conn,
1626                                         NULL, /* req */
1627                                         NULL, /* fsp */
1628                                         directory,
1629                                         True,
1630                                         expect_close,
1631                                         req->smbpid,
1632                                         mask,
1633                                         mask_contains_wcard,
1634                                         dirtype,
1635                                         &dirptr);
1636                 if (!NT_STATUS_IS_OK(nt_status)) {
1637                         reply_nterror(req, nt_status);
1638                         goto out;
1639                 }
1640                 dptr_num = dptr_dnum(dirptr);
1641         } else {
1642                 int status_dirtype;
1643                 const char *dirpath;
1644
1645                 memcpy(status,p,21);
1646                 status_dirtype = CVAL(status,0) & 0x1F;
1647                 if (status_dirtype != (dirtype & 0x1F)) {
1648                         dirtype = status_dirtype;
1649                 }
1650
1651                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1652                 if (!dirptr) {
1653                         goto SearchEmpty;
1654                 }
1655                 dirpath = dptr_path(sconn, dptr_num);
1656                 directory = talloc_strdup(ctx, dirpath);
1657                 if (!directory) {
1658                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1659                         goto out;
1660                 }
1661
1662                 mask = dptr_wcard(sconn, dptr_num);
1663                 if (!mask) {
1664                         goto SearchEmpty;
1665                 }
1666                 /*
1667                  * For a 'continue' search we have no string. So
1668                  * check from the initial saved string.
1669                  */
1670                 mask_contains_wcard = ms_has_wild(mask);
1671                 dirtype = dptr_attr(sconn, dptr_num);
1672         }
1673
1674         DEBUG(4,("dptr_num is %d\n",dptr_num));
1675
1676         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1677         dptr_init_search_op(dirptr);
1678
1679         if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1680                 char buf[DIR_STRUCT_SIZE];
1681                 memcpy(buf,status,21);
1682                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1683                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1684                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1685                         goto out;
1686                 }
1687                 dptr_fill(sconn, buf+12,dptr_num);
1688                 if (dptr_zero(buf+12) && (status_len==0)) {
1689                         numentries = 1;
1690                 } else {
1691                         numentries = 0;
1692                 }
1693                 if (message_push_blob(&req->outbuf,
1694                                       data_blob_const(buf, sizeof(buf)))
1695                     == -1) {
1696                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1697                         goto out;
1698                 }
1699         } else {
1700                 unsigned int i;
1701                 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1702                 size_t available_space = sconn->smb1.sessions.max_send - hdr_size;
1703
1704                 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1705
1706                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1707                          directory,lp_dont_descend(ctx, SNUM(conn))));
1708                 if (in_list(directory, lp_dont_descend(ctx, SNUM(conn)),True)) {
1709                         check_descend = True;
1710                 }
1711
1712                 for (i=numentries;(i<maxentries) && !finished;i++) {
1713                         finished = !get_dir_entry(ctx,
1714                                                   dirptr,
1715                                                   mask,
1716                                                   dirtype,
1717                                                   &fname,
1718                                                   &size,
1719                                                   &mode,
1720                                                   &date,
1721                                                   check_descend,
1722                                                   ask_sharemode);
1723                         if (!finished) {
1724                                 char buf[DIR_STRUCT_SIZE];
1725                                 memcpy(buf,status,21);
1726                                 if (!make_dir_struct(ctx,
1727                                                 buf,
1728                                                 mask,
1729                                                 fname,
1730                                                 size,
1731                                                 mode,
1732                                                 convert_timespec_to_time_t(date),
1733                                                 !allow_long_path_components)) {
1734                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1735                                         goto out;
1736                                 }
1737                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1738                                         break;
1739                                 }
1740                                 if (message_push_blob(&req->outbuf,
1741                                                       data_blob_const(buf, sizeof(buf)))
1742                                     == -1) {
1743                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1744                                         goto out;
1745                                 }
1746                                 numentries++;
1747                         }
1748                 }
1749         }
1750
1751   SearchEmpty:
1752
1753         /* If we were called as SMBffirst with smb_search_id == NULL
1754                 and no entries were found then return error and close dirptr
1755                 (X/Open spec) */
1756
1757         if (numentries == 0) {
1758                 dptr_close(sconn, &dptr_num);
1759         } else if(expect_close && status_len == 0) {
1760                 /* Close the dptr - we know it's gone */
1761                 dptr_close(sconn, &dptr_num);
1762         }
1763
1764         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1765         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1766                 dptr_close(sconn, &dptr_num);
1767         }
1768
1769         if ((numentries == 0) && !mask_contains_wcard) {
1770                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1771                 goto out;
1772         }
1773
1774         SSVAL(req->outbuf,smb_vwv0,numentries);
1775         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1776         SCVAL(smb_buf(req->outbuf),0,5);
1777         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1778
1779         /* The replies here are never long name. */
1780         SSVAL(req->outbuf, smb_flg2,
1781               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1782         if (!allow_long_path_components) {
1783                 SSVAL(req->outbuf, smb_flg2,
1784                       SVAL(req->outbuf, smb_flg2)
1785                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1786         }
1787
1788         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1789         SSVAL(req->outbuf, smb_flg2,
1790               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1791
1792         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1793                 smb_fn_name(req->cmd),
1794                 mask,
1795                 directory,
1796                 dirtype,
1797                 numentries,
1798                 maxentries ));
1799  out:
1800         TALLOC_FREE(directory);
1801         TALLOC_FREE(smb_fname);
1802         END_PROFILE(SMBsearch);
1803         return;
1804 }
1805
1806 /****************************************************************************
1807  Reply to a fclose (stop directory search).
1808 ****************************************************************************/
1809
1810 void reply_fclose(struct smb_request *req)
1811 {
1812         int status_len;
1813         char status[21];
1814         int dptr_num= -2;
1815         const char *p;
1816         char *path = NULL;
1817         NTSTATUS err;
1818         bool path_contains_wcard = False;
1819         TALLOC_CTX *ctx = talloc_tos();
1820         struct smbd_server_connection *sconn = req->sconn;
1821
1822         START_PROFILE(SMBfclose);
1823
1824         if (lp_posix_pathnames()) {
1825                 reply_unknown_new(req, req->cmd);
1826                 END_PROFILE(SMBfclose);
1827                 return;
1828         }
1829
1830         p = (const char *)req->buf + 1;
1831         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1832                                        &err, &path_contains_wcard);
1833         if (!NT_STATUS_IS_OK(err)) {
1834                 reply_nterror(req, err);
1835                 END_PROFILE(SMBfclose);
1836                 return;
1837         }
1838         p++;
1839         status_len = SVAL(p,0);
1840         p += 2;
1841
1842         if (status_len == 0) {
1843                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1844                 END_PROFILE(SMBfclose);
1845                 return;
1846         }
1847
1848         memcpy(status,p,21);
1849
1850         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1851                 /*  Close the dptr - we know it's gone */
1852                 dptr_close(sconn, &dptr_num);
1853         }
1854
1855         reply_outbuf(req, 1, 0);
1856         SSVAL(req->outbuf,smb_vwv0,0);
1857
1858         DEBUG(3,("search close\n"));
1859
1860         END_PROFILE(SMBfclose);
1861         return;
1862 }
1863
1864 /****************************************************************************
1865  Reply to an open.
1866 ****************************************************************************/
1867
1868 void reply_open(struct smb_request *req)
1869 {
1870         connection_struct *conn = req->conn;
1871         struct smb_filename *smb_fname = NULL;
1872         char *fname = NULL;
1873         uint32 fattr=0;
1874         off_t size = 0;
1875         time_t mtime=0;
1876         int info;
1877         files_struct *fsp;
1878         int oplock_request;
1879         int deny_mode;
1880         uint32 dos_attr;
1881         uint32 access_mask;
1882         uint32 share_mode;
1883         uint32 create_disposition;
1884         uint32 create_options = 0;
1885         uint32_t private_flags = 0;
1886         NTSTATUS status;
1887         TALLOC_CTX *ctx = talloc_tos();
1888
1889         START_PROFILE(SMBopen);
1890
1891         if (req->wct < 2) {
1892                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1893                 goto out;
1894         }
1895
1896         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1897         deny_mode = SVAL(req->vwv+0, 0);
1898         dos_attr = SVAL(req->vwv+1, 0);
1899
1900         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1901                             STR_TERMINATE, &status);
1902         if (!NT_STATUS_IS_OK(status)) {
1903                 reply_nterror(req, status);
1904                 goto out;
1905         }
1906
1907         if (!map_open_params_to_ntcreate(fname, deny_mode,
1908                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1909                                          &share_mode, &create_disposition,
1910                                          &create_options, &private_flags)) {
1911                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1912                 goto out;
1913         }
1914
1915         status = filename_convert(ctx,
1916                                 conn,
1917                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1918                                 fname,
1919                                 UCF_PREP_CREATEFILE,
1920                                 NULL,
1921                                 &smb_fname);
1922         if (!NT_STATUS_IS_OK(status)) {
1923                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1924                         reply_botherror(req,
1925                                         NT_STATUS_PATH_NOT_COVERED,
1926                                         ERRSRV, ERRbadpath);
1927                         goto out;
1928                 }
1929                 reply_nterror(req, status);
1930                 goto out;
1931         }
1932
1933         status = SMB_VFS_CREATE_FILE(
1934                 conn,                                   /* conn */
1935                 req,                                    /* req */
1936                 0,                                      /* root_dir_fid */
1937                 smb_fname,                              /* fname */
1938                 access_mask,                            /* access_mask */
1939                 share_mode,                             /* share_access */
1940                 create_disposition,                     /* create_disposition*/
1941                 create_options,                         /* create_options */
1942                 dos_attr,                               /* file_attributes */
1943                 oplock_request,                         /* oplock_request */
1944                 0,                                      /* allocation_size */
1945                 private_flags,
1946                 NULL,                                   /* sd */
1947                 NULL,                                   /* ea_list */
1948                 &fsp,                                   /* result */
1949                 &info);                                 /* pinfo */
1950
1951         if (!NT_STATUS_IS_OK(status)) {
1952                 if (open_was_deferred(req->sconn, req->mid)) {
1953                         /* We have re-scheduled this call. */
1954                         goto out;
1955                 }
1956                 reply_openerror(req, status);
1957                 goto out;
1958         }
1959
1960         /* Ensure we're pointing at the correct stat struct. */
1961         TALLOC_FREE(smb_fname);
1962         smb_fname = fsp->fsp_name;
1963
1964         size = smb_fname->st.st_ex_size;
1965         fattr = dos_mode(conn, smb_fname);
1966
1967         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1968
1969         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1970                 DEBUG(3,("attempt to open a directory %s\n",
1971                          fsp_str_dbg(fsp)));
1972                 close_file(req, fsp, ERROR_CLOSE);
1973                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1974                         ERRDOS, ERRnoaccess);
1975                 goto out;
1976         }
1977
1978         reply_outbuf(req, 7, 0);
1979         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1980         SSVAL(req->outbuf,smb_vwv1,fattr);
1981         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1982                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1983         } else {
1984                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1985         }
1986         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1987         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1988
1989         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1990                 SCVAL(req->outbuf,smb_flg,
1991                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1992         }
1993
1994         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1995                 SCVAL(req->outbuf,smb_flg,
1996                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1997         }
1998  out:
1999         END_PROFILE(SMBopen);
2000         return;
2001 }
2002
2003 /****************************************************************************
2004  Reply to an open and X.
2005 ****************************************************************************/
2006
2007 void reply_open_and_X(struct smb_request *req)
2008 {
2009         connection_struct *conn = req->conn;
2010         struct smb_filename *smb_fname = NULL;
2011         char *fname = NULL;
2012         uint16 open_flags;
2013         int deny_mode;
2014         uint32 smb_attr;
2015         /* Breakout the oplock request bits so we can set the
2016                 reply bits separately. */
2017         int ex_oplock_request;
2018         int core_oplock_request;
2019         int oplock_request;
2020 #if 0
2021         int smb_sattr = SVAL(req->vwv+4, 0);
2022         uint32 smb_time = make_unix_date3(req->vwv+6);
2023 #endif
2024         int smb_ofun;
2025         uint32 fattr=0;
2026         int mtime=0;
2027         int smb_action = 0;
2028         files_struct *fsp;
2029         NTSTATUS status;
2030         uint64_t allocation_size;
2031         ssize_t retval = -1;
2032         uint32 access_mask;
2033         uint32 share_mode;
2034         uint32 create_disposition;
2035         uint32 create_options = 0;
2036         uint32_t private_flags = 0;
2037         TALLOC_CTX *ctx = talloc_tos();
2038
2039         START_PROFILE(SMBopenX);
2040
2041         if (req->wct < 15) {
2042                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2043                 goto out;
2044         }
2045
2046         open_flags = SVAL(req->vwv+2, 0);
2047         deny_mode = SVAL(req->vwv+3, 0);
2048         smb_attr = SVAL(req->vwv+5, 0);
2049         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2050         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2051         oplock_request = ex_oplock_request | core_oplock_request;
2052         smb_ofun = SVAL(req->vwv+8, 0);
2053         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2054
2055         /* If it's an IPC, pass off the pipe handler. */
2056         if (IS_IPC(conn)) {
2057                 if (lp_nt_pipe_support()) {
2058                         reply_open_pipe_and_X(conn, req);
2059                 } else {
2060                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2061                 }
2062                 goto out;
2063         }
2064
2065         /* XXXX we need to handle passed times, sattr and flags */
2066         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2067                         STR_TERMINATE, &status);
2068         if (!NT_STATUS_IS_OK(status)) {
2069                 reply_nterror(req, status);
2070                 goto out;
2071         }
2072
2073         if (!map_open_params_to_ntcreate(fname, deny_mode,
2074                                          smb_ofun,
2075                                          &access_mask, &share_mode,
2076                                          &create_disposition,
2077                                          &create_options,
2078                                          &private_flags)) {
2079                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2080                 goto out;
2081         }
2082
2083         status = filename_convert(ctx,
2084                                 conn,
2085                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2086                                 fname,
2087                                 UCF_PREP_CREATEFILE,
2088                                 NULL,
2089                                 &smb_fname);
2090         if (!NT_STATUS_IS_OK(status)) {
2091                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2092                         reply_botherror(req,
2093                                         NT_STATUS_PATH_NOT_COVERED,
2094                                         ERRSRV, ERRbadpath);
2095                         goto out;
2096                 }
2097                 reply_nterror(req, status);
2098                 goto out;
2099         }
2100
2101         status = SMB_VFS_CREATE_FILE(
2102                 conn,                                   /* conn */
2103                 req,                                    /* req */
2104                 0,                                      /* root_dir_fid */
2105                 smb_fname,                              /* fname */
2106                 access_mask,                            /* access_mask */
2107                 share_mode,                             /* share_access */
2108                 create_disposition,                     /* create_disposition*/
2109                 create_options,                         /* create_options */
2110                 smb_attr,                               /* file_attributes */
2111                 oplock_request,                         /* oplock_request */
2112                 0,                                      /* allocation_size */
2113                 private_flags,
2114                 NULL,                                   /* sd */
2115                 NULL,                                   /* ea_list */
2116                 &fsp,                                   /* result */
2117                 &smb_action);                           /* pinfo */
2118
2119         if (!NT_STATUS_IS_OK(status)) {
2120                 if (open_was_deferred(req->sconn, req->mid)) {
2121                         /* We have re-scheduled this call. */
2122                         goto out;
2123                 }
2124                 reply_openerror(req, status);
2125                 goto out;
2126         }
2127
2128         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2129            if the file is truncated or created. */
2130         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2131                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2132                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2133                         close_file(req, fsp, ERROR_CLOSE);
2134                         reply_nterror(req, NT_STATUS_DISK_FULL);
2135                         goto out;
2136                 }
2137                 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2138                 if (retval < 0) {
2139                         close_file(req, fsp, ERROR_CLOSE);
2140                         reply_nterror(req, NT_STATUS_DISK_FULL);
2141                         goto out;
2142                 }
2143                 status = vfs_stat_fsp(fsp);
2144                 if (!NT_STATUS_IS_OK(status)) {
2145                         close_file(req, fsp, ERROR_CLOSE);
2146                         reply_nterror(req, status);
2147                         goto out;
2148                 }
2149         }
2150
2151         fattr = dos_mode(conn, fsp->fsp_name);
2152         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2153         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2154                 close_file(req, fsp, ERROR_CLOSE);
2155                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2156                 goto out;
2157         }
2158
2159         /* If the caller set the extended oplock request bit
2160                 and we granted one (by whatever means) - set the
2161                 correct bit for extended oplock reply.
2162         */
2163
2164         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2165                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2166         }
2167
2168         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2169                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2170         }
2171
2172         /* If the caller set the core oplock request bit
2173                 and we granted one (by whatever means) - set the
2174                 correct bit for core oplock reply.
2175         */
2176
2177         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2178                 reply_outbuf(req, 19, 0);
2179         } else {
2180                 reply_outbuf(req, 15, 0);
2181         }
2182
2183         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2184         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2185
2186         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2187                 SCVAL(req->outbuf, smb_flg,
2188                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2189         }
2190
2191         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2192                 SCVAL(req->outbuf, smb_flg,
2193                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2194         }
2195
2196         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2197         SSVAL(req->outbuf,smb_vwv3,fattr);
2198         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2199                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2200         } else {
2201                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2202         }
2203         SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2204         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2205         SSVAL(req->outbuf,smb_vwv11,smb_action);
2206
2207         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2208                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2209         }
2210
2211  out:
2212         TALLOC_FREE(smb_fname);
2213         END_PROFILE(SMBopenX);
2214         return;
2215 }
2216
2217 /****************************************************************************
2218  Reply to a SMBulogoffX.
2219 ****************************************************************************/
2220
2221 void reply_ulogoffX(struct smb_request *req)
2222 {
2223         struct smbd_server_connection *sconn = req->sconn;
2224         struct user_struct *vuser;
2225         struct smbXsrv_session *session = NULL;
2226         NTSTATUS status;
2227
2228         START_PROFILE(SMBulogoffX);
2229
2230         vuser = get_valid_user_struct(sconn, req->vuid);
2231
2232         if(vuser == NULL) {
2233                 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2234                          (unsigned long long)req->vuid));
2235
2236                 req->vuid = UID_FIELD_INVALID;
2237                 reply_force_doserror(req, ERRSRV, ERRbaduid);
2238                 END_PROFILE(SMBulogoffX);
2239                 return;
2240         }
2241
2242         session = vuser->session;
2243         vuser = NULL;
2244
2245         /*
2246          * TODO: cancel all outstanding requests on the session
2247          */
2248         status = smbXsrv_session_logoff(session);
2249         if (!NT_STATUS_IS_OK(status)) {
2250                 DEBUG(0, ("reply_ulogoff: "
2251                           "smbXsrv_session_logoff() failed: %s\n",
2252                           nt_errstr(status)));
2253                 /*
2254                  * If we hit this case, there is something completely
2255                  * wrong, so we better disconnect the transport connection.
2256                  */
2257                 END_PROFILE(SMBulogoffX);
2258                 exit_server(__location__ ": smbXsrv_session_logoff failed");
2259                 return;
2260         }
2261
2262         TALLOC_FREE(session);
2263
2264         reply_outbuf(req, 2, 0);
2265         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2266         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2267
2268         DEBUG(3, ("ulogoffX vuid=%llu\n",
2269                   (unsigned long long)req->vuid));
2270
2271         END_PROFILE(SMBulogoffX);
2272         req->vuid = UID_FIELD_INVALID;
2273 }
2274
2275 /****************************************************************************
2276  Reply to a mknew or a create.
2277 ****************************************************************************/
2278
2279 void reply_mknew(struct smb_request *req)
2280 {
2281         connection_struct *conn = req->conn;
2282         struct smb_filename *smb_fname = NULL;
2283         char *fname = NULL;
2284         uint32 fattr = 0;
2285         struct smb_file_time ft;
2286         files_struct *fsp;
2287         int oplock_request = 0;
2288         NTSTATUS status;
2289         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2290         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2291         uint32 create_disposition;
2292         uint32 create_options = 0;
2293         TALLOC_CTX *ctx = talloc_tos();
2294
2295         START_PROFILE(SMBcreate);
2296         ZERO_STRUCT(ft);
2297
2298         if (req->wct < 3) {
2299                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2300                 goto out;
2301         }
2302
2303         fattr = SVAL(req->vwv+0, 0);
2304         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2305
2306         /* mtime. */
2307         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2308
2309         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2310                             STR_TERMINATE, &status);
2311         if (!NT_STATUS_IS_OK(status)) {
2312                 reply_nterror(req, status);
2313                 goto out;
2314         }
2315
2316         status = filename_convert(ctx,
2317                                 conn,
2318                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2319                                 fname,
2320                                 UCF_PREP_CREATEFILE,
2321                                 NULL,
2322                                 &smb_fname);
2323         if (!NT_STATUS_IS_OK(status)) {
2324                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2325                         reply_botherror(req,
2326                                         NT_STATUS_PATH_NOT_COVERED,
2327                                         ERRSRV, ERRbadpath);
2328                         goto out;
2329                 }
2330                 reply_nterror(req, status);
2331                 goto out;
2332         }
2333
2334         if (fattr & FILE_ATTRIBUTE_VOLUME) {
2335                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2336                          "please report this\n",
2337                          smb_fname_str_dbg(smb_fname)));
2338         }
2339
2340         if(req->cmd == SMBmknew) {
2341                 /* We should fail if file exists. */
2342                 create_disposition = FILE_CREATE;
2343         } else {
2344                 /* Create if file doesn't exist, truncate if it does. */
2345                 create_disposition = FILE_OVERWRITE_IF;
2346         }
2347
2348         status = SMB_VFS_CREATE_FILE(
2349                 conn,                                   /* conn */
2350                 req,                                    /* req */
2351                 0,                                      /* root_dir_fid */
2352                 smb_fname,                              /* fname */
2353                 access_mask,                            /* access_mask */
2354                 share_mode,                             /* share_access */
2355                 create_disposition,                     /* create_disposition*/
2356                 create_options,                         /* create_options */
2357                 fattr,                                  /* file_attributes */
2358                 oplock_request,                         /* oplock_request */
2359                 0,                                      /* allocation_size */
2360                 0,                                      /* private_flags */
2361                 NULL,                                   /* sd */
2362                 NULL,                                   /* ea_list */
2363                 &fsp,                                   /* result */
2364                 NULL);                                  /* pinfo */
2365
2366         if (!NT_STATUS_IS_OK(status)) {
2367                 if (open_was_deferred(req->sconn, req->mid)) {
2368                         /* We have re-scheduled this call. */
2369                         goto out;
2370                 }
2371                 reply_openerror(req, status);
2372                 goto out;
2373         }
2374
2375         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2376         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2377         if (!NT_STATUS_IS_OK(status)) {
2378                 END_PROFILE(SMBcreate);
2379                 goto out;
2380         }
2381
2382         reply_outbuf(req, 1, 0);
2383         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2384
2385         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2386                 SCVAL(req->outbuf,smb_flg,
2387                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2388         }
2389
2390         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2391                 SCVAL(req->outbuf,smb_flg,
2392                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2393         }
2394
2395         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2396         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2397                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2398                   (unsigned int)fattr));
2399
2400  out:
2401         TALLOC_FREE(smb_fname);
2402         END_PROFILE(SMBcreate);
2403         return;
2404 }
2405
2406 /****************************************************************************
2407  Reply to a create temporary file.
2408 ****************************************************************************/
2409
2410 void reply_ctemp(struct smb_request *req)
2411 {
2412         connection_struct *conn = req->conn;
2413         struct smb_filename *smb_fname = NULL;
2414         char *wire_name = NULL;
2415         char *fname = NULL;
2416         uint32 fattr;
2417         files_struct *fsp;
2418         int oplock_request;
2419         char *s;
2420         NTSTATUS status;
2421         int i;
2422         TALLOC_CTX *ctx = talloc_tos();
2423
2424         START_PROFILE(SMBctemp);
2425
2426         if (req->wct < 3) {
2427                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2428                 goto out;
2429         }
2430
2431         fattr = SVAL(req->vwv+0, 0);
2432         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2433
2434         srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2435                             STR_TERMINATE, &status);
2436         if (!NT_STATUS_IS_OK(status)) {
2437                 reply_nterror(req, status);
2438                 goto out;
2439         }
2440
2441         for (i = 0; i < 10; i++) {
2442                 if (*wire_name) {
2443                         fname = talloc_asprintf(ctx,
2444                                         "%s/TMP%s",
2445                                         wire_name,
2446                                         generate_random_str_list(ctx, 5, "0123456789"));
2447                 } else {
2448                         fname = talloc_asprintf(ctx,
2449                                         "TMP%s",
2450                                         generate_random_str_list(ctx, 5, "0123456789"));
2451                 }
2452
2453                 if (!fname) {
2454                         reply_nterror(req, NT_STATUS_NO_MEMORY);
2455                         goto out;
2456                 }
2457
2458                 status = filename_convert(ctx, conn,
2459                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2460                                 fname,
2461                                 UCF_PREP_CREATEFILE,
2462                                 NULL,
2463                                 &smb_fname);
2464                 if (!NT_STATUS_IS_OK(status)) {
2465                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2466                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2467                                         ERRSRV, ERRbadpath);
2468                                 goto out;
2469                         }
2470                         reply_nterror(req, status);
2471                         goto out;
2472                 }
2473
2474                 /* Create the file. */
2475                 status = SMB_VFS_CREATE_FILE(
2476                         conn,                                   /* conn */
2477                         req,                                    /* req */
2478                         0,                                      /* root_dir_fid */
2479                         smb_fname,                              /* fname */
2480                         FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2481                         FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2482                         FILE_CREATE,                            /* create_disposition*/
2483                         0,                                      /* create_options */
2484                         fattr,                                  /* file_attributes */
2485                         oplock_request,                         /* oplock_request */
2486                         0,                                      /* allocation_size */
2487                         0,                                      /* private_flags */
2488                         NULL,                                   /* sd */
2489                         NULL,                                   /* ea_list */
2490                         &fsp,                                   /* result */
2491                         NULL);                                  /* pinfo */
2492
2493                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2494                         TALLOC_FREE(fname);
2495                         TALLOC_FREE(smb_fname);
2496                         continue;
2497                 }
2498
2499                 if (!NT_STATUS_IS_OK(status)) {
2500                         if (open_was_deferred(req->sconn, req->mid)) {
2501                                 /* We have re-scheduled this call. */
2502                                 goto out;
2503                         }
2504                         reply_openerror(req, status);
2505                         goto out;
2506                 }
2507
2508                 break;
2509         }
2510
2511         if (i == 10) {
2512                 /* Collision after 10 times... */
2513                 reply_nterror(req, status);
2514                 goto out;
2515         }
2516
2517         reply_outbuf(req, 1, 0);
2518         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2519
2520         /* the returned filename is relative to the directory */
2521         s = strrchr_m(fsp->fsp_name->base_name, '/');
2522         if (!s) {
2523                 s = fsp->fsp_name->base_name;
2524         } else {
2525                 s++;
2526         }
2527
2528 #if 0
2529         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2530            thing in the byte section. JRA */
2531         SSVALS(p, 0, -1); /* what is this? not in spec */
2532 #endif
2533         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2534             == -1) {
2535                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2536                 goto out;
2537         }
2538
2539         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2540                 SCVAL(req->outbuf, smb_flg,
2541                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2542         }
2543
2544         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2545                 SCVAL(req->outbuf, smb_flg,
2546                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2547         }
2548
2549         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2550         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2551                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2552  out:
2553         TALLOC_FREE(smb_fname);
2554         TALLOC_FREE(wire_name);
2555         END_PROFILE(SMBctemp);
2556         return;
2557 }
2558
2559 /*******************************************************************
2560  Check if a user is allowed to rename a file.
2561 ********************************************************************/
2562
2563 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2564                         uint16 dirtype)
2565 {
2566         if (!CAN_WRITE(conn)) {
2567                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2568         }
2569
2570         if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2571                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2572                 /* Only bother to read the DOS attribute if we might deny the
2573                    rename on the grounds of attribute missmatch. */
2574                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2575                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2576                         return NT_STATUS_NO_SUCH_FILE;
2577                 }
2578         }
2579
2580         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2581                 if (fsp->posix_open) {
2582                         return NT_STATUS_OK;
2583                 }
2584
2585                 /* If no pathnames are open below this
2586                    directory, allow the rename. */
2587
2588                 if (file_find_subpath(fsp)) {
2589                         return NT_STATUS_ACCESS_DENIED;
2590                 }
2591                 return NT_STATUS_OK;
2592         }
2593
2594         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2595                 return NT_STATUS_OK;
2596         }
2597
2598         return NT_STATUS_ACCESS_DENIED;
2599 }
2600
2601 /*******************************************************************
2602  * unlink a file with all relevant access checks
2603  *******************************************************************/
2604
2605 static NTSTATUS do_unlink(connection_struct *conn,
2606                         struct smb_request *req,
2607                         struct smb_filename *smb_fname,
2608                         uint32 dirtype)
2609 {
2610         uint32 fattr;
2611         files_struct *fsp;
2612         uint32 dirtype_orig = dirtype;
2613         NTSTATUS status;
2614         int ret;
2615         bool posix_paths = lp_posix_pathnames();
2616
2617         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2618                   smb_fname_str_dbg(smb_fname),
2619                   dirtype));
2620
2621         if (!CAN_WRITE(conn)) {
2622                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2623         }
2624
2625         if (posix_paths) {
2626                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2627         } else {
2628                 ret = SMB_VFS_STAT(conn, smb_fname);
2629         }
2630         if (ret != 0) {
2631                 return map_nt_error_from_unix(errno);
2632         }
2633
2634         fattr = dos_mode(conn, smb_fname);
2635
2636         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2637                 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2638         }
2639
2640         dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2641         if (!dirtype) {
2642                 return NT_STATUS_NO_SUCH_FILE;
2643         }
2644
2645         if (!dir_check_ftype(fattr, dirtype)) {
2646                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2647                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2648                 }
2649                 return NT_STATUS_NO_SUCH_FILE;
2650         }
2651
2652         if (dirtype_orig & 0x8000) {
2653                 /* These will never be set for POSIX. */
2654                 return NT_STATUS_NO_SUCH_FILE;
2655         }
2656
2657 #if 0
2658         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2659                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2660         }
2661
2662         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2663                 return NT_STATUS_NO_SUCH_FILE;
2664         }
2665
2666         if (dirtype & 0xFF00) {
2667                 /* These will never be set for POSIX. */
2668                 return NT_STATUS_NO_SUCH_FILE;
2669         }
2670
2671         dirtype &= 0xFF;
2672         if (!dirtype) {
2673                 return NT_STATUS_NO_SUCH_FILE;
2674         }
2675
2676         /* Can't delete a directory. */
2677         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2678                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2679         }
2680 #endif
2681
2682 #if 0 /* JRATEST */
2683         else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2684                 return NT_STATUS_OBJECT_NAME_INVALID;
2685 #endif /* JRATEST */
2686
2687         /* On open checks the open itself will check the share mode, so
2688            don't do it here as we'll get it wrong. */
2689
2690         status = SMB_VFS_CREATE_FILE
2691                 (conn,                  /* conn */
2692                  req,                   /* req */
2693                  0,                     /* root_dir_fid */
2694                  smb_fname,             /* fname */
2695                  DELETE_ACCESS,         /* access_mask */
2696                  FILE_SHARE_NONE,       /* share_access */
2697                  FILE_OPEN,             /* create_disposition*/
2698                  FILE_NON_DIRECTORY_FILE, /* create_options */
2699                                         /* file_attributes */
2700                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2701                                 FILE_ATTRIBUTE_NORMAL,
2702                  0,                     /* oplock_request */
2703                  0,                     /* allocation_size */
2704                  0,                     /* private_flags */
2705                  NULL,                  /* sd */
2706                  NULL,                  /* ea_list */
2707                  &fsp,                  /* result */
2708                  NULL);                 /* pinfo */
2709
2710         if (!NT_STATUS_IS_OK(status)) {
2711                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2712                            nt_errstr(status)));
2713                 return status;
2714         }
2715
2716         status = can_set_delete_on_close(fsp, fattr);
2717         if (!NT_STATUS_IS_OK(status)) {
2718                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2719                         "(%s)\n",
2720                         smb_fname_str_dbg(smb_fname),
2721                         nt_errstr(status)));
2722                 close_file(req, fsp, NORMAL_CLOSE);
2723                 return status;
2724         }
2725
2726         /* The set is across all open files on this dev/inode pair. */
2727         if (!set_delete_on_close(fsp, True,
2728                                 conn->session_info->security_token,
2729                                 conn->session_info->unix_token)) {
2730                 close_file(req, fsp, NORMAL_CLOSE);
2731                 return NT_STATUS_ACCESS_DENIED;
2732         }
2733
2734         return close_file(req, fsp, NORMAL_CLOSE);
2735 }
2736
2737 /****************************************************************************
2738  The guts of the unlink command, split out so it may be called by the NT SMB
2739  code.
2740 ****************************************************************************/
2741
2742 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2743                           uint32 dirtype, struct smb_filename *smb_fname,
2744                           bool has_wild)
2745 {
2746         char *fname_dir = NULL;
2747         char *fname_mask = NULL;
2748         int count=0;
2749         NTSTATUS status = NT_STATUS_OK;
2750         TALLOC_CTX *ctx = talloc_tos();
2751
2752         /* Split up the directory from the filename/mask. */
2753         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2754                                       &fname_dir, &fname_mask);
2755         if (!NT_STATUS_IS_OK(status)) {
2756                 goto out;
2757         }
2758
2759         /*
2760          * We should only check the mangled cache
2761          * here if unix_convert failed. This means
2762          * that the path in 'mask' doesn't exist
2763          * on the file system and so we need to look
2764          * for a possible mangle. This patch from
2765          * Tine Smukavec <valentin.smukavec@hermes.si>.
2766          */
2767
2768         if (!VALID_STAT(smb_fname->st) &&
2769             mangle_is_mangled(fname_mask, conn->params)) {
2770                 char *new_mask = NULL;
2771                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2772                                             &new_mask, conn->params);
2773                 if (new_mask) {
2774                         TALLOC_FREE(fname_mask);
2775                         fname_mask = new_mask;
2776                 }
2777         }
2778
2779         if (!has_wild) {
2780
2781                 /*
2782                  * Only one file needs to be unlinked. Append the mask back
2783                  * onto the directory.
2784                  */
2785                 TALLOC_FREE(smb_fname->base_name);
2786                 if (ISDOT(fname_dir)) {
2787                         /* Ensure we use canonical names on open. */
2788                         smb_fname->base_name = talloc_asprintf(smb_fname,
2789                                                         "%s",
2790                                                         fname_mask);
2791                 } else {
2792                         smb_fname->base_name = talloc_asprintf(smb_fname,
2793                                                         "%s/%s",
2794                                                         fname_dir,
2795                                                         fname_mask);
2796                 }
2797                 if (!smb_fname->base_name) {
2798                         status = NT_STATUS_NO_MEMORY;
2799                         goto out;
2800                 }
2801                 if (dirtype == 0) {
2802                         dirtype = FILE_ATTRIBUTE_NORMAL;
2803                 }
2804
2805                 status = check_name(conn, smb_fname->base_name);
2806                 if (!NT_STATUS_IS_OK(status)) {
2807                         goto out;
2808                 }
2809
2810                 status = do_unlink(conn, req, smb_fname, dirtype);
2811                 if (!NT_STATUS_IS_OK(status)) {
2812                         goto out;
2813                 }
2814
2815                 count++;
2816         } else {
2817                 struct smb_Dir *dir_hnd = NULL;
2818                 long offset = 0;
2819                 const char *dname = NULL;
2820                 char *talloced = NULL;
2821
2822                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2823                         status = NT_STATUS_OBJECT_NAME_INVALID;
2824                         goto out;
2825                 }
2826
2827                 if (strequal(fname_mask,"????????.???")) {
2828                         TALLOC_FREE(fname_mask);
2829                         fname_mask = talloc_strdup(ctx, "*");
2830                         if (!fname_mask) {
2831                                 status = NT_STATUS_NO_MEMORY;
2832                                 goto out;
2833                         }
2834                 }
2835
2836                 status = check_name(conn, fname_dir);
2837                 if (!NT_STATUS_IS_OK(status)) {
2838                         goto out;
2839                 }
2840
2841                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2842                                   dirtype);
2843                 if (dir_hnd == NULL) {
2844                         status = map_nt_error_from_unix(errno);
2845                         goto out;
2846                 }
2847
2848                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2849                    the pattern matches against the long name, otherwise the short name
2850                    We don't implement this yet XXXX
2851                 */
2852
2853                 status = NT_STATUS_NO_SUCH_FILE;
2854
2855                 while ((dname = ReadDirName(dir_hnd, &offset,
2856                                             &smb_fname->st, &talloced))) {
2857                         TALLOC_CTX *frame = talloc_stackframe();
2858
2859                         if (!is_visible_file(conn, fname_dir, dname,
2860                                              &smb_fname->st, true)) {
2861                                 TALLOC_FREE(frame);
2862                                 TALLOC_FREE(talloced);
2863                                 continue;
2864                         }
2865
2866                         /* Quick check for "." and ".." */
2867                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2868                                 TALLOC_FREE(frame);
2869                                 TALLOC_FREE(talloced);
2870                                 continue;
2871                         }
2872
2873                         if(!mask_match(dname, fname_mask,
2874                                        conn->case_sensitive)) {
2875                                 TALLOC_FREE(frame);
2876                                 TALLOC_FREE(talloced);
2877                                 continue;
2878                         }
2879
2880                         TALLOC_FREE(smb_fname->base_name);
2881                         if (ISDOT(fname_dir)) {
2882                                 /* Ensure we use canonical names on open. */
2883                                 smb_fname->base_name =
2884                                         talloc_asprintf(smb_fname, "%s",
2885                                                 dname);
2886                         } else {
2887                                 smb_fname->base_name =
2888                                         talloc_asprintf(smb_fname, "%s/%s",
2889                                                 fname_dir, dname);
2890                         }
2891
2892                         if (!smb_fname->base_name) {
2893                                 TALLOC_FREE(dir_hnd);
2894                                 status = NT_STATUS_NO_MEMORY;
2895                                 TALLOC_FREE(frame);
2896                                 TALLOC_FREE(talloced);
2897                                 goto out;
2898                         }
2899
2900                         status = check_name(conn, smb_fname->base_name);
2901                         if (!NT_STATUS_IS_OK(status)) {
2902                                 TALLOC_FREE(dir_hnd);
2903                                 TALLOC_FREE(frame);
2904                                 TALLOC_FREE(talloced);
2905                                 goto out;
2906                         }
2907
2908                         status = do_unlink(conn, req, smb_fname, dirtype);
2909                         if (!NT_STATUS_IS_OK(status)) {
2910                                 TALLOC_FREE(frame);
2911                                 TALLOC_FREE(talloced);
2912                                 continue;
2913                         }
2914
2915                         count++;
2916                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2917                                  smb_fname->base_name));
2918
2919                         TALLOC_FREE(frame);
2920                         TALLOC_FREE(talloced);
2921                 }
2922                 TALLOC_FREE(dir_hnd);
2923         }
2924
2925         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2926                 status = map_nt_error_from_unix(errno);
2927         }
2928
2929  out:
2930         TALLOC_FREE(fname_dir);
2931         TALLOC_FREE(fname_mask);
2932         return status;
2933 }
2934
2935 /****************************************************************************
2936  Reply to a unlink
2937 ****************************************************************************/
2938
2939 void reply_unlink(struct smb_request *req)
2940 {
2941         connection_struct *conn = req->conn;
2942         char *name = NULL;
2943         struct smb_filename *smb_fname = NULL;
2944         uint32 dirtype;
2945         NTSTATUS status;
2946         bool path_contains_wcard = False;
2947         TALLOC_CTX *ctx = talloc_tos();
2948
2949         START_PROFILE(SMBunlink);
2950
2951         if (req->wct < 1) {
2952                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2953                 goto out;
2954         }
2955
2956         dirtype = SVAL(req->vwv+0, 0);
2957
2958         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2959                                   STR_TERMINATE, &status,
2960                                   &path_contains_wcard);
2961         if (!NT_STATUS_IS_OK(status)) {
2962                 reply_nterror(req, status);
2963                 goto out;
2964         }
2965
2966         status = filename_convert(ctx, conn,
2967                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2968                                   name,
2969                                   UCF_COND_ALLOW_WCARD_LCOMP,
2970                                   &path_contains_wcard,
2971                                   &smb_fname);
2972         if (!NT_STATUS_IS_OK(status)) {
2973                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2974                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2975                                         ERRSRV, ERRbadpath);
2976                         goto out;
2977                 }
2978                 reply_nterror(req, status);
2979                 goto out;
2980         }
2981
2982         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2983
2984         status = unlink_internals(conn, req, dirtype, smb_fname,
2985                                   path_contains_wcard);
2986         if (!NT_STATUS_IS_OK(status)) {
2987                 if (open_was_deferred(req->sconn, req->mid)) {
2988                         /* We have re-scheduled this call. */
2989                         goto out;
2990                 }
2991                 reply_nterror(req, status);
2992                 goto out;
2993         }
2994
2995         reply_outbuf(req, 0, 0);
2996  out:
2997         TALLOC_FREE(smb_fname);
2998         END_PROFILE(SMBunlink);
2999         return;
3000 }
3001
3002 /****************************************************************************
3003  Fail for readbraw.
3004 ****************************************************************************/
3005
3006 static void fail_readraw(void)
3007 {
3008         const char *errstr = talloc_asprintf(talloc_tos(),
3009                         "FAIL ! reply_readbraw: socket write fail (%s)",
3010                         strerror(errno));
3011         if (!errstr) {
3012                 errstr = "";
3013         }
3014         exit_server_cleanly(errstr);
3015 }
3016
3017 /****************************************************************************
3018  Fake (read/write) sendfile. Returns -1 on read or write fail.
3019 ****************************************************************************/
3020
3021 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
3022 {
3023         size_t bufsize;
3024         size_t tosend = nread;
3025         char *buf;
3026
3027         if (nread == 0) {
3028                 return 0;
3029         }
3030
3031         bufsize = MIN(nread, 65536);
3032
3033         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3034                 return -1;
3035         }
3036
3037         while (tosend > 0) {
3038                 ssize_t ret;
3039                 size_t cur_read;
3040
3041                 if (tosend > bufsize) {
3042                         cur_read = bufsize;
3043                 } else {
3044                         cur_read = tosend;
3045                 }
3046                 ret = read_file(fsp,buf,startpos,cur_read);
3047                 if (ret == -1) {
3048                         SAFE_FREE(buf);
3049                         return -1;
3050                 }
3051
3052                 /* If we had a short read, fill with zeros. */
3053                 if (ret < cur_read) {
3054                         memset(buf + ret, '\0', cur_read - ret);
3055                 }
3056
3057                 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
3058                     != cur_read) {
3059                         char addr[INET6_ADDRSTRLEN];
3060                         /*
3061                          * Try and give an error message saying what
3062                          * client failed.
3063                          */
3064                         DEBUG(0, ("write_data failed for client %s. "
3065                                   "Error %s\n",
3066                                   get_peer_addr(fsp->conn->sconn->sock, addr,
3067                                                 sizeof(addr)),
3068                                   strerror(errno)));
3069                         SAFE_FREE(buf);
3070                         return -1;
3071                 }
3072                 tosend -= cur_read;
3073                 startpos += cur_read;
3074         }
3075
3076         SAFE_FREE(buf);
3077         return (ssize_t)nread;
3078 }
3079
3080 /****************************************************************************
3081  Deal with the case of sendfile reading less bytes from the file than
3082  requested. Fill with zeros (all we can do).
3083 ****************************************************************************/
3084
3085 void sendfile_short_send(files_struct *fsp,
3086                                 ssize_t nread,
3087                                 size_t headersize,
3088                                 size_t smb_maxcnt)
3089 {
3090 #define SHORT_SEND_BUFSIZE 1024
3091         if (nread < headersize) {
3092                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3093                         "header for file %s (%s). Terminating\n",
3094                         fsp_str_dbg(fsp), strerror(errno)));
3095                 exit_server_cleanly("sendfile_short_send failed");
3096         }
3097
3098         nread -= headersize;
3099
3100         if (nread < smb_maxcnt) {
3101                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3102                 if (!buf) {
3103                         exit_server_cleanly("sendfile_short_send: "
3104                                 "malloc failed");
3105                 }
3106
3107                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3108                         "with zeros !\n", fsp_str_dbg(fsp)));
3109
3110                 while (nread < smb_maxcnt) {
3111                         /*
3112                          * We asked for the real file size and told sendfile
3113                          * to not go beyond the end of the file. But it can
3114                          * happen that in between our fstat call and the
3115                          * sendfile call the file was truncated. This is very
3116                          * bad because we have already announced the larger
3117                          * number of bytes to the client.
3118                          *
3119                          * The best we can do now is to send 0-bytes, just as
3120                          * a read from a hole in a sparse file would do.
3121                          *
3122                          * This should happen rarely enough that I don't care
3123                          * about efficiency here :-)
3124                          */
3125                         size_t to_write;
3126
3127                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3128                         if (write_data(fsp->conn->sconn->sock, buf, to_write)
3129                             != to_write) {
3130                                 char addr[INET6_ADDRSTRLEN];
3131                                 /*
3132                                  * Try and give an error message saying what
3133                                  * client failed.
3134                                  */
3135                                 DEBUG(0, ("write_data failed for client %s. "
3136                                           "Error %s\n",
3137                                           get_peer_addr(
3138                                                   fsp->conn->sconn->sock, addr,
3139                                                   sizeof(addr)),
3140                                           strerror(errno)));
3141                                 exit_server_cleanly("sendfile_short_send: "
3142                                                     "write_data failed");
3143                         }
3144                         nread += to_write;
3145                 }
3146                 SAFE_FREE(buf);
3147         }
3148 }
3149
3150 /****************************************************************************
3151  Return a readbraw error (4 bytes of zero).
3152 ****************************************************************************/
3153
3154 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3155 {
3156         char header[4];
3157
3158         SIVAL(header,0,0);
3159
3160         smbd_lock_socket(sconn);
3161         if (write_data(sconn->sock,header,4) != 4) {
3162                 char addr[INET6_ADDRSTRLEN];
3163                 /*
3164                  * Try and give an error message saying what
3165                  * client failed.
3166                  */
3167                 DEBUG(0, ("write_data failed for client %s. "
3168                           "Error %s\n",
3169                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
3170                           strerror(errno)));
3171
3172                 fail_readraw();
3173         }
3174         smbd_unlock_socket(sconn);
3175 }
3176
3177 /****************************************************************************
3178  Use sendfile in readbraw.
3179 ****************************************************************************/
3180
3181 static void send_file_readbraw(connection_struct *conn,
3182                                struct smb_request *req,
3183                                files_struct *fsp,
3184                                off_t startpos,
3185                                size_t nread,
3186                                ssize_t mincount)
3187 {
3188         struct smbd_server_connection *sconn = req->sconn;
3189         char *outbuf = NULL;
3190         ssize_t ret=0;
3191
3192         /*
3193          * We can only use sendfile on a non-chained packet
3194          * but we can use on a non-oplocked file. tridge proved this
3195          * on a train in Germany :-). JRA.
3196          * reply_readbraw has already checked the length.
3197          */
3198
3199         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3200             (fsp->wcp == NULL) &&
3201             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3202                 ssize_t sendfile_read = -1;
3203                 char header[4];
3204                 DATA_BLOB header_blob;
3205
3206                 _smb_setlen(header,nread);
3207                 header_blob = data_blob_const(header, 4);
3208
3209                 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3210                                                  &header_blob, startpos,
3211                                                  nread);
3212                 if (sendfile_read == -1) {
3213                         /* Returning ENOSYS means no data at all was sent.
3214                          * Do this as a normal read. */
3215                         if (errno == ENOSYS) {
3216                                 goto normal_readbraw;
3217                         }
3218
3219                         /*
3220                          * Special hack for broken Linux with no working sendfile. If we
3221                          * return EINTR we sent the header but not the rest of the data.
3222                          * Fake this up by doing read/write calls.
3223                          */
3224                         if (errno == EINTR) {
3225                                 /* Ensure we don't do this again. */
3226                                 set_use_sendfile(SNUM(conn), False);
3227                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3228
3229                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
3230                                         DEBUG(0,("send_file_readbraw: "
3231                                                  "fake_sendfile failed for "
3232                                                  "file %s (%s).\n",
3233                                                  fsp_str_dbg(fsp),
3234                                                  strerror(errno)));
3235                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3236                                 }
3237                                 return;
3238                         }
3239
3240                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3241                                  "file %s (%s). Terminating\n",
3242                                  fsp_str_dbg(fsp), strerror(errno)));
3243                         exit_server_cleanly("send_file_readbraw sendfile failed");
3244                 } else if (sendfile_read == 0) {
3245                         /*
3246                          * Some sendfile implementations return 0 to indicate
3247                          * that there was a short read, but nothing was
3248                          * actually written to the socket.  In this case,
3249                          * fallback to the normal read path so the header gets
3250                          * the correct byte count.
3251                          */
3252                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3253                                   "bytes falling back to the normal read: "
3254                                   "%s\n", fsp_str_dbg(fsp)));
3255                         goto normal_readbraw;
3256                 }
3257
3258                 /* Deal with possible short send. */
3259                 if (sendfile_read != 4+nread) {
3260                         sendfile_short_send(fsp, sendfile_read, 4, nread);
3261                 }
3262                 return;
3263         }
3264
3265 normal_readbraw:
3266
3267         outbuf = talloc_array(NULL, char, nread+4);
3268         if (!outbuf) {
3269                 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3270                         (unsigned)(nread+4)));
3271                 reply_readbraw_error(sconn);
3272                 return;
3273         }
3274
3275         if (nread > 0) {
3276                 ret = read_file(fsp,outbuf+4,startpos,nread);
3277 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3278                 if (ret < mincount)
3279                         ret = 0;
3280 #else
3281                 if (ret < nread)
3282                         ret = 0;
3283 #endif
3284         }
3285
3286         _smb_setlen(outbuf,ret);
3287         if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3288                 char addr[INET6_ADDRSTRLEN];
3289                 /*
3290                  * Try and give an error message saying what
3291                  * client failed.
3292                  */
3293                 DEBUG(0, ("write_data failed for client %s. "
3294                           "Error %s\n",
3295                           get_peer_addr(fsp->conn->sconn->sock, addr,
3296                                         sizeof(addr)),
3297                           strerror(errno)));
3298
3299                 fail_readraw();
3300         }
3301
3302         TALLOC_FREE(outbuf);
3303 }
3304
3305 /****************************************************************************
3306  Reply to a readbraw (core+ protocol).
3307 ****************************************************************************/
3308
3309 void reply_readbraw(struct smb_request *req)
3310 {
3311         connection_struct *conn = req->conn;
3312         struct smbd_server_connection *sconn = req->sconn;
3313         ssize_t maxcount,mincount;
3314         size_t nread = 0;
3315         off_t startpos;
3316         files_struct *fsp;
3317         struct lock_struct lock;
3318         off_t size = 0;
3319
3320         START_PROFILE(SMBreadbraw);
3321
3322         if (srv_is_signing_active(sconn) || req->encrypted) {
3323                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3324                         "raw reads/writes are disallowed.");
3325         }
3326
3327         if (req->wct < 8) {
3328                 reply_readbraw_error(sconn);
3329                 END_PROFILE(SMBreadbraw);
3330                 return;
3331         }
3332
3333         if (sconn->smb1.echo_handler.trusted_fde) {
3334                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3335                          "'async smb echo handler = yes'\n"));
3336                 reply_readbraw_error(sconn);
3337                 END_PROFILE(SMBreadbraw);
3338                 return;
3339         }
3340
3341         /*
3342          * Special check if an oplock break has been issued
3343          * and the readraw request croses on the wire, we must
3344          * return a zero length response here.
3345          */
3346
3347         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3348
3349         /*
3350          * We have to do a check_fsp by hand here, as
3351          * we must always return 4 zero bytes on error,
3352          * not a NTSTATUS.
3353          */
3354
3355         if (!fsp || !conn || conn != fsp->conn ||
3356                         req->vuid != fsp->vuid ||
3357                         fsp->is_directory || fsp->fh->fd == -1) {
3358                 /*
3359                  * fsp could be NULL here so use the value from the packet. JRA.
3360                  */
3361                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3362                         "- cache prime?\n",
3363                         (int)SVAL(req->vwv+0, 0)));
3364                 reply_readbraw_error(sconn);
3365                 END_PROFILE(SMBreadbraw);
3366                 return;
3367         }
3368
3369         /* Do a "by hand" version of CHECK_READ. */
3370         if (!(fsp->can_read ||
3371                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3372                                 (fsp->access_mask & FILE_EXECUTE)))) {
3373                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3374                                 (int)SVAL(req->vwv+0, 0)));
3375                 reply_readbraw_error(sconn);
3376                 END_PROFILE(SMBreadbraw);
3377                 return;
3378         }
3379
3380         flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
3381
3382         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3383         if(req->wct == 10) {
3384                 /*
3385                  * This is a large offset (64 bit) read.
3386                  */
3387
3388                 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3389
3390                 if(startpos < 0) {
3391                         DEBUG(0,("reply_readbraw: negative 64 bit "
3392                                 "readraw offset (%.0f) !\n",
3393                                 (double)startpos ));
3394                         reply_readbraw_error(sconn);
3395                         END_PROFILE(SMBreadbraw);
3396                         return;
3397                 }
3398         }
3399
3400         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3401         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3402
3403         /* ensure we don't overrun the packet size */
3404         maxcount = MIN(65535,maxcount);
3405
3406         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3407             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3408             &lock);
3409
3410         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3411                 reply_readbraw_error(sconn);
3412                 END_PROFILE(SMBreadbraw);
3413                 return;
3414         }
3415
3416         if (fsp_stat(fsp) == 0) {
3417                 size = fsp->fsp_name->st.st_ex_size;
3418         }
3419
3420         if (startpos >= size) {
3421                 nread = 0;
3422         } else {
3423                 nread = MIN(maxcount,(size - startpos));
3424         }
3425
3426 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3427         if (nread < mincount)
3428                 nread = 0;
3429 #endif
3430
3431         DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3432                 "min=%lu nread=%lu\n",
3433                 fsp_fnum_dbg(fsp), (double)startpos,
3434                 (unsigned long)maxcount,
3435                 (unsigned long)mincount,
3436                 (unsigned long)nread ) );
3437
3438         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3439
3440         DEBUG(5,("reply_readbraw finished\n"));
3441
3442         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3443
3444         END_PROFILE(SMBreadbraw);
3445         return;
3446 }
3447
3448 #undef DBGC_CLASS
3449 #define DBGC_CLASS DBGC_LOCKING
3450
3451 /****************************************************************************
3452  Reply to a lockread (core+ protocol).
3453 ****************************************************************************/
3454
3455 void reply_lockread(struct smb_request *req)
3456 {
3457         connection_struct *conn = req->conn;
3458         ssize_t nread = -1;
3459         char *data;
3460         off_t startpos;
3461         size_t numtoread;
3462         size_t maxtoread;
3463         NTSTATUS status;
3464         files_struct *fsp;
3465         struct byte_range_lock *br_lck = NULL;
3466         char *p = NULL;
3467         struct smbd_server_connection *sconn = req->sconn;
3468
3469         START_PROFILE(SMBlockread);
3470
3471         if (req->wct < 5) {
3472                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3473                 END_PROFILE(SMBlockread);
3474                 return;
3475         }
3476
3477         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3478
3479         if (!check_fsp(conn, req, fsp)) {
3480                 END_PROFILE(SMBlockread);
3481                 return;
3482         }
3483
3484         if (!CHECK_READ(fsp,req)) {
3485                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3486                 END_PROFILE(SMBlockread);
3487                 return;
3488         }
3489
3490         numtoread = SVAL(req->vwv+1, 0);
3491         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3492
3493         /*
3494          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3495          * protocol request that predates the read/write lock concept.
3496          * Thus instead of asking for a read lock here we need to ask
3497          * for a write lock. JRA.
3498          * Note that the requested lock size is unaffected by max_send.
3499          */
3500
3501         br_lck = do_lock(req->sconn->msg_ctx,
3502                         fsp,
3503                         (uint64_t)req->smbpid,
3504                         (uint64_t)numtoread,
3505                         (uint64_t)startpos,
3506                         WRITE_LOCK,
3507                         WINDOWS_LOCK,
3508                         False, /* Non-blocking lock. */
3509                         &status,
3510                         NULL,
3511                         NULL);
3512         TALLOC_FREE(br_lck);
3513
3514         if (NT_STATUS_V(status)) {
3515                 reply_nterror(req, status);
3516                 END_PROFILE(SMBlockread);
3517                 return;
3518         }
3519
3520         /*
3521          * However the requested READ size IS affected by max_send. Insanity.... JRA.
3522          */
3523         maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3524
3525         if (numtoread > maxtoread) {
3526                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3527 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3528                         (unsigned int)numtoread, (unsigned int)maxtoread,
3529                         (unsigned int)sconn->smb1.sessions.max_send));
3530                 numtoread = maxtoread;
3531         }
3532
3533         reply_outbuf(req, 5, numtoread + 3);
3534
3535         data = smb_buf(req->outbuf) + 3;
3536
3537         nread = read_file(fsp,data,startpos,numtoread);
3538
3539         if (nread < 0) {
3540                 reply_nterror(req, map_nt_error_from_unix(errno));
3541                 END_PROFILE(SMBlockread);
3542                 return;
3543         }
3544
3545         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3546
3547         SSVAL(req->outbuf,smb_vwv0,nread);
3548         SSVAL(req->outbuf,smb_vwv5,nread+3);
3549         p = smb_buf(req->outbuf);
3550         SCVAL(p,0,0); /* pad byte. */
3551         SSVAL(p,1,nread);
3552
3553         DEBUG(3,("lockread %s num=%d nread=%d\n",
3554                  fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3555
3556         END_PROFILE(SMBlockread);
3557         return;
3558 }
3559
3560 #undef DBGC_CLASS
3561 #define DBGC_CLASS DBGC_ALL
3562
3563 /****************************************************************************
3564  Reply to a read.
3565 ****************************************************************************/
3566
3567 void reply_read(struct smb_request *req)
3568 {
3569         connection_struct *conn = req->conn;
3570         size_t numtoread;
3571         size_t maxtoread;
3572         ssize_t nread = 0;
3573         char *data;
3574         off_t startpos;
3575         files_struct *fsp;
3576         struct lock_struct lock;
3577         struct smbd_server_connection *sconn = req->sconn;
3578
3579         START_PROFILE(SMBread);
3580
3581         if (req->wct < 3) {
3582                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3583                 END_PROFILE(SMBread);
3584                 return;
3585         }
3586
3587         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3588
3589         if (!check_fsp(conn, req, fsp)) {
3590                 END_PROFILE(SMBread);
3591                 return;
3592         }
3593
3594         if (!CHECK_READ(fsp,req)) {
3595                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3596                 END_PROFILE(SMBread);
3597                 return;
3598         }
3599
3600         numtoread = SVAL(req->vwv+1, 0);
3601         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3602
3603         /*
3604          * The requested read size cannot be greater than max_send. JRA.
3605          */
3606         maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3607
3608         if (numtoread > maxtoread) {
3609                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3610 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3611                         (unsigned int)numtoread, (unsigned int)maxtoread,
3612                         (unsigned int)sconn->smb1.sessions.max_send));
3613                 numtoread = maxtoread;
3614         }
3615
3616         reply_outbuf(req, 5, numtoread+3);
3617
3618         data = smb_buf(req->outbuf) + 3;
3619
3620         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3621             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3622             &lock);
3623
3624         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3625                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3626                 END_PROFILE(SMBread);
3627                 return;
3628         }
3629
3630         if (numtoread > 0)
3631                 nread = read_file(fsp,data,startpos,numtoread);
3632
3633         if (nread < 0) {
3634                 reply_nterror(req, map_nt_error_from_unix(errno));
3635                 goto strict_unlock;
3636         }
3637
3638         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3639
3640         SSVAL(req->outbuf,smb_vwv0,nread);
3641         SSVAL(req->outbuf,smb_vwv5,nread+3);
3642         SCVAL(smb_buf(req->outbuf),0,1);
3643         SSVAL(smb_buf(req->outbuf),1,nread);
3644
3645         DEBUG(3, ("read %s num=%d nread=%d\n",
3646                   fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3647
3648 strict_unlock:
3649         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3650
3651         END_PROFILE(SMBread);
3652         return;
3653 }
3654
3655 /****************************************************************************
3656  Setup readX header.
3657 ****************************************************************************/
3658
3659 static int setup_readX_header(struct smb_request *req, char *outbuf,
3660                               size_t smb_maxcnt)
3661 {
3662         int outsize;
3663
3664         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3665
3666         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3667
3668         SCVAL(outbuf,smb_vwv0,0xFF);
3669         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3670         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3671         SSVAL(outbuf,smb_vwv6,
3672               (smb_wct - 4)     /* offset from smb header to wct */
3673               + 1               /* the wct field */
3674               + 12 * sizeof(uint16_t) /* vwv */
3675               + 2);             /* the buflen field */
3676         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3677         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3678         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3679         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3680         return outsize;
3681 }
3682
3683 /****************************************************************************
3684  Reply to a read and X - possibly using sendfile.
3685 ****************************************************************************/
3686
3687 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3688                             files_struct *fsp, off_t startpos,
3689                             size_t smb_maxcnt)
3690 {
3691         ssize_t nread = -1;
3692         struct lock_struct lock;
3693         int saved_errno = 0;
3694
3695         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3696             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3697             &lock);
3698
3699         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3700                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3701                 return;
3702         }
3703
3704         /*
3705          * We can only use sendfile on a non-chained packet
3706          * but we can use on a non-oplocked file. tridge proved this
3707          * on a train in Germany :-). JRA.
3708          */
3709
3710         if (!req_is_in_chain(req) &&
3711             !req->encrypted &&
3712             (fsp->base_fsp == NULL) &&
3713             (fsp->wcp == NULL) &&
3714             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3715                 uint8 headerbuf[smb_size + 12 * 2];
3716                 DATA_BLOB header;
3717
3718                 if(fsp_stat(fsp) == -1) {
3719                         reply_nterror(req, map_nt_error_from_unix(errno));
3720                         goto strict_unlock;
3721                 }
3722
3723                 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3724                     (startpos > fsp->fsp_name->st.st_ex_size) ||
3725                     (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3726                         /*
3727                          * We already know that we would do a short read, so don't
3728                          * try the sendfile() path.
3729                          */
3730                         goto nosendfile_read;
3731                 }
3732
3733                 /*
3734                  * Set up the packet header before send. We
3735                  * assume here the sendfile will work (get the
3736                  * correct amount of data).
3737                  */
3738
3739                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3740
3741                 construct_reply_common_req(req, (char *)headerbuf);
3742                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3743
3744                 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3745                                          startpos, smb_maxcnt);
3746                 if (nread == -1) {
3747                         /* Returning ENOSYS means no data at all was sent.
3748                            Do this as a normal read. */
3749                         if (errno == ENOSYS) {
3750                                 goto normal_read;
3751                         }
3752
3753                         /*
3754                          * Special hack for broken Linux with no working sendfile. If we
3755                          * return EINTR we sent the header but not the rest of the data.
3756                          * Fake this up by doing read/write calls.
3757                          */
3758
3759                         if (errno == EINTR) {
3760                                 /* Ensure we don't do this again. */
3761                                 set_use_sendfile(SNUM(conn), False);
3762                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3763                                 nread = fake_sendfile(fsp, startpos,
3764                                                       smb_maxcnt);
3765                                 if (nread == -1) {
3766                                         DEBUG(0,("send_file_readX: "
3767                                                  "fake_sendfile failed for "
3768                                                  "file %s (%s).\n",
3769                                                  fsp_str_dbg(fsp),
3770                                                  strerror(errno)));
3771                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3772                                 }
3773                                 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3774                                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3775                                 /* No outbuf here means successful sendfile. */
3776                                 goto strict_unlock;
3777                         }
3778
3779                         DEBUG(0,("send_file_readX: sendfile failed for file "
3780                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3781                                  strerror(errno)));
3782                         exit_server_cleanly("send_file_readX sendfile failed");
3783                 } else if (nread == 0) {
3784                         /*
3785                          * Some sendfile implementations return 0 to indicate
3786                          * that there was a short read, but nothing was
3787                          * actually written to the socket.  In this case,
3788                          * fallback to the normal read path so the header gets
3789                          * the correct byte count.
3790                          */
3791                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3792                                   "falling back to the normal read: %s\n",
3793                                   fsp_str_dbg(fsp)));
3794                         goto normal_read;
3795                 }
3796
3797                 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3798                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3799
3800                 /* Deal with possible short send. */
3801                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3802                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3803                 }
3804                 /* No outbuf here means successful sendfile. */
3805                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3806                 SMB_PERFCOUNT_END(&req->pcd);
3807                 goto strict_unlock;
3808         }
3809
3810 normal_read:
3811
3812         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3813                 uint8 headerbuf[smb_size + 2*12];
3814
3815                 construct_reply_common_req(req, (char *)headerbuf);
3816                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3817
3818                 /* Send out the header. */
3819                 if (write_data(req->sconn->sock, (char *)headerbuf,
3820                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3821
3822                         char addr[INET6_ADDRSTRLEN];
3823                         /*
3824                          * Try and give an error message saying what
3825                          * client failed.
3826                          */
3827                         DEBUG(0, ("write_data failed for client %s. "
3828                                   "Error %s\n",
3829                                   get_peer_addr(req->sconn->sock, addr,
3830                                                 sizeof(addr)),
3831                                   strerror(errno)));
3832
3833                         DEBUG(0,("send_file_readX: write_data failed for file "
3834                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3835                                  strerror(errno)));
3836                         exit_server_cleanly("send_file_readX sendfile failed");
3837                 }
3838                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3839                 if (nread == -1) {
3840                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3841                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3842                                  strerror(errno)));
3843                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3844                 }
3845                 goto strict_unlock;
3846         }
3847
3848 nosendfile_read:
3849
3850         reply_outbuf(req, 12, smb_maxcnt);
3851         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3852         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
3853
3854         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3855         saved_errno = errno;
3856
3857         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3858
3859         if (nread < 0) {
3860                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3861                 return;
3862         }
3863
3864         setup_readX_header(req, (char *)req->outbuf, nread);
3865
3866         DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3867                   fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3868         return;
3869
3870  strict_unlock:
3871         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3872         TALLOC_FREE(req->outbuf);
3873         return;
3874 }
3875
3876 /****************************************************************************
3877  Work out how much space we have for a read return.
3878 ****************************************************************************/
3879
3880 static size_t calc_max_read_pdu(const struct smb_request *req)
3881 {
3882         if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3883                 return req->sconn->smb1.sessions.max_send;
3884         }
3885
3886         if (!lp_large_readwrite()) {
3887                 return req->sconn->smb1.sessions.max_send;
3888         }
3889
3890         if (req_is_in_chain(req)) {
3891                 return req->sconn->smb1.sessions.max_send;
3892         }
3893
3894         if (req->encrypted) {
3895                 /*
3896                  * Don't take encrypted traffic up to the
3897                  * limit. There are padding considerations
3898                  * that make that tricky.
3899                  */
3900                 return req->sconn->smb1.sessions.max_send;
3901         }
3902
3903         if (srv_is_signing_active(req->sconn)) {
3904                 return 0x1FFFF;
3905         }
3906
3907         if (!lp_unix_extensions()) {
3908                 return 0x1FFFF;
3909         }
3910
3911         /*
3912          * We can do ultra-large POSIX reads.
3913          */
3914         return 0xFFFFFF;
3915 }
3916
3917 /****************************************************************************
3918  Calculate how big a read can be. Copes with all clients. It's always
3919  safe to return a short read - Windows does this.
3920 ****************************************************************************/
3921
3922 static size_t calc_read_size(const struct smb_request *req,
3923                              size_t upper_size,
3924                              size_t lower_size)
3925 {
3926         size_t max_pdu = calc_max_read_pdu(req);
3927         size_t total_size = 0;
3928         size_t hdr_len = MIN_SMB_SIZE + VWV(12);
3929         size_t max_len = max_pdu - hdr_len;
3930
3931         /*
3932          * Windows explicitly ignores upper size of 0xFFFF.
3933          * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3934          * We must do the same as these will never fit even in
3935          * an extended size NetBIOS packet.
3936          */
3937         if (upper_size == 0xFFFF) {
3938                 upper_size = 0;
3939         }
3940
3941         if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3942                 upper_size = 0;
3943         }
3944
3945         total_size = ((upper_size<<16) | lower_size);
3946
3947         /*
3948          * LARGE_READX test shows it's always safe to return
3949          * a short read. Windows does so.
3950          */
3951         return MIN(total_size, max_len);
3952 }
3953
3954 /****************************************************************************
3955  Reply to a read and X.
3956 ****************************************************************************/
3957
3958 void reply_read_and_X(struct smb_request *req)
3959 {
3960         connection_struct *conn = req->conn;
3961         files_struct *fsp;
3962         off_t startpos;
3963         size_t smb_maxcnt;
3964         size_t upper_size;
3965         bool big_readX = False;
3966 #if 0
3967         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3968 #endif
3969
3970         START_PROFILE(SMBreadX);
3971
3972         if ((req->wct != 10) && (req->wct != 12)) {
3973                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3974                 return;
3975         }
3976
3977         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3978         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3979         smb_maxcnt = SVAL(req->vwv+5, 0);
3980
3981         /* If it's an IPC, pass off the pipe handler. */
3982         if (IS_IPC(conn)) {
3983                 reply_pipe_read_and_X(req);
3984                 END_PROFILE(SMBreadX);
3985                 return;
3986         }
3987
3988         if (!check_fsp(conn, req, fsp)) {
3989                 END_PROFILE(SMBreadX);
3990                 return;
3991         }
3992
3993         if (!CHECK_READ(fsp,req)) {
3994                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3995                 END_PROFILE(SMBreadX);
3996                 return;
3997         }
3998
3999         upper_size = SVAL(req->vwv+7, 0);
4000         smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4001         if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4002                 /*
4003                  * This is a heuristic to avoid keeping large
4004                  * outgoing buffers around over long-lived aio
4005                  * requests.
4006                  */
4007                 big_readX = True;
4008         }
4009
4010         if (req->wct == 12) {
4011                 /*
4012                  * This is a large offset (64 bit) read.
4013                  */
4014                 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4015
4016         }
4017
4018         if (!big_readX) {
4019                 NTSTATUS status = schedule_aio_read_and_X(conn,
4020                                         req,
4021                                         fsp,
4022                                         startpos,
4023                                         smb_maxcnt);
4024                 if (NT_STATUS_IS_OK(status)) {
4025                         /* Read scheduled - we're done. */
4026                         goto out;
4027                 }
4028                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4029                         /* Real error - report to client. */
4030                         END_PROFILE(SMBreadX);
4031                         reply_nterror(req, status);
4032                         return;
4033                 }
4034                 /* NT_STATUS_RETRY - fall back to sync read. */
4035         }
4036
4037         smbd_lock_socket(req->sconn);
4038         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4039         smbd_unlock_socket(req->sconn);
4040
4041  out:
4042         END_PROFILE(SMBreadX);
4043         return;
4044 }
4045
4046 /****************************************************************************
4047  Error replies to writebraw must have smb_wct == 1. Fix this up.
4048 ****************************************************************************/
4049
4050 void error_to_writebrawerr(struct smb_request *req)
4051 {
4052         uint8 *old_outbuf = req->outbuf;
4053
4054         reply_outbuf(req, 1, 0);
4055
4056         memcpy(req->outbuf, old_outbuf, smb_size);
4057         TALLOC_FREE(old_outbuf);
4058 }
4059
4060 /****************************************************************************
4061  Read 4 bytes of a smb packet and return the smb length of the packet.
4062  Store the result in the buffer. This version of the function will
4063  never return a session keepalive (length of zero).
4064  Timeout is in milliseconds.
4065 ****************************************************************************/
4066
4067 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4068                                 size_t *len)
4069 {
4070         uint8_t msgtype = NBSSkeepalive;
4071
4072         while (msgtype == NBSSkeepalive) {
4073                 NTSTATUS status;
4074
4075                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4076                                                           len);
4077                 if (!NT_STATUS_IS_OK(status)) {
4078                         char addr[INET6_ADDRSTRLEN];
4079                         /* Try and give an error message
4080                          * saying what client failed. */
4081                         DEBUG(0, ("read_fd_with_timeout failed for "
4082                                   "client %s read error = %s.\n",
4083                                   get_peer_addr(fd,addr,sizeof(addr)),
4084                                   nt_errstr(status)));
4085                         return status;
4086                 }
4087
4088                 msgtype = CVAL(inbuf, 0);
4089         }
4090
4091         DEBUG(10,("read_smb_length: got smb length of %lu\n",
4092                   (unsigned long)len));
4093
4094         return NT_STATUS_OK;
4095 }
4096
4097 /****************************************************************************
4098  Reply to a writebraw (core+ or LANMAN1.0 protocol).
4099 ****************************************************************************/
4100
4101 void reply_writebraw(struct smb_request *req)
4102 {
4103         connection_struct *conn = req->conn;
4104         char *buf = NULL;
4105         ssize_t nwritten=0;
4106         ssize_t total_written=0;
4107         size_t numtowrite=0;
4108         size_t tcount;
4109         off_t startpos;
4110         const char *data=NULL;
4111         bool write_through;
4112         files_struct *fsp;
4113         struct lock_struct lock;
4114         NTSTATUS status;
4115
4116         START_PROFILE(SMBwritebraw);
4117
4118         /*
4119          * If we ever reply with an error, it must have the SMB command
4120          * type of SMBwritec, not SMBwriteBraw, as this tells the client
4121          * we're finished.
4122          */
4123         SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4124
4125         if (srv_is_signing_active(req->sconn)) {
4126                 END_PROFILE(SMBwritebraw);
4127                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4128                                 "raw reads/writes are disallowed.");
4129         }
4130
4131         if (req->wct < 12) {
4132                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4133                 error_to_writebrawerr(req);
4134                 END_PROFILE(SMBwritebraw);
4135                 return;
4136         }
4137
4138         if (req->sconn->smb1.echo_handler.trusted_fde) {
4139                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4140                          "'async smb echo handler = yes'\n"));
4141                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4142                 error_to_writebrawerr(req);
4143                 END_PROFILE(SMBwritebraw);
4144                 return;
4145         }
4146
4147         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4148         if (!check_fsp(conn, req, fsp)) {
4149                 error_to_writebrawerr(req);
4150                 END_PROFILE(SMBwritebraw);
4151                 return;
4152         }
4153
4154         if (!CHECK_WRITE(fsp)) {
4155                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4156                 error_to_writebrawerr(req);
4157                 END_PROFILE(SMBwritebraw);
4158                 return;
4159         }
4160
4161         tcount = IVAL(req->vwv+1, 0);
4162         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4163         write_through = BITSETW(req->vwv+7,0);
4164
4165         /* We have to deal with slightly different formats depending
4166                 on whether we are using the core+ or lanman1.0 protocol */
4167
4168         if(get_Protocol() <= PROTOCOL_COREPLUS) {
4169                 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4170                 data = smb_buf_const(req->inbuf);
4171         } else {
4172                 numtowrite = SVAL(req->vwv+10, 0);
4173                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4174         }
4175
4176         /* Ensure we don't write bytes past the end of this packet. */
4177         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4178                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4179                 error_to_writebrawerr(req);
4180                 END_PROFILE(SMBwritebraw);
4181                 return;
4182         }
4183
4184         if (!fsp->print_file) {
4185                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4186                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4187                     &lock);
4188
4189                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4190                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4191                         error_to_writebrawerr(req);
4192                         END_PROFILE(SMBwritebraw);
4193                         return;
4194                 }
4195         }
4196
4197         if (numtowrite>0) {
4198                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4199         }
4200
4201         DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4202                         "wrote=%d sync=%d\n",
4203                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4204                 (int)nwritten, (int)write_through));
4205
4206         if (nwritten < (ssize_t)numtowrite)  {
4207                 reply_nterror(req, NT_STATUS_DISK_FULL);
4208                 error_to_writebrawerr(req);
4209                 goto strict_unlock;
4210         }
4211
4212         total_written = nwritten;
4213
4214         /* Allocate a buffer of 64k + length. */
4215         buf = talloc_array(NULL, char, 65540);
4216         if (!buf) {
4217                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4218                 error_to_writebrawerr(req);
4219                 goto strict_unlock;
4220         }
4221
4222         /* Return a SMBwritebraw message to the redirector to tell
4223          * it to send more bytes */
4224
4225         memcpy(buf, req->inbuf, smb_size);
4226         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4227         SCVAL(buf,smb_com,SMBwritebraw);
4228         SSVALS(buf,smb_vwv0,0xFFFF);
4229         show_msg(buf);
4230         if (!srv_send_smb(req->sconn,
4231                           buf,
4232                           false, 0, /* no signing */
4233                           IS_CONN_ENCRYPTED(conn),
4234                           &req->pcd)) {
4235                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4236                         "failed.");
4237         }
4238
4239         /* Now read the raw data into the buffer and write it */
4240         status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4241                                  &numtowrite);
4242         if (!NT_STATUS_IS_OK(status)) {
4243                 exit_server_cleanly("secondary writebraw failed");
4244         }
4245
4246         /* Set up outbuf to return the correct size */
4247         reply_outbuf(req, 1, 0);
4248
4249         if (numtowrite != 0) {
4250
4251                 if (numtowrite > 0xFFFF) {
4252                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4253                                 "raw requested (%u). Terminating\n",
4254                                 (unsigned int)numtowrite ));
4255                         exit_server_cleanly("secondary writebraw failed");
4256                 }
4257
4258                 if (tcount > nwritten+numtowrite) {
4259                         DEBUG(3,("reply_writebraw: Client overestimated the "
4260                                 "write %d %d %d\n",
4261                                 (int)tcount,(int)nwritten,(int)numtowrite));
4262                 }
4263
4264                 status = read_data(req->sconn->sock, buf+4, numtowrite);
4265
4266                 if (!NT_STATUS_IS_OK(status)) {
4267                         char addr[INET6_ADDRSTRLEN];
4268                         /* Try and give an error message
4269                          * saying what client failed. */
4270                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4271                                   "raw read failed (%s) for client %s. "
4272                                   "Terminating\n", nt_errstr(status),
4273                                   get_peer_addr(req->sconn->sock, addr,
4274                                                 sizeof(addr))));
4275                         exit_server_cleanly("secondary writebraw failed");
4276                 }
4277
4278                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4279                 if (nwritten == -1) {
4280                         TALLOC_FREE(buf);
4281                         reply_nterror(req, map_nt_error_from_unix(errno));
4282                         error_to_writebrawerr(req);
4283                         goto strict_unlock;
4284                 }
4285
4286                 if (nwritten < (ssize_t)numtowrite) {
4287                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4288                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4289                 }
4290
4291                 if (nwritten > 0) {
4292                         total_written += nwritten;
4293                 }
4294         }
4295
4296         TALLOC_FREE(buf);
4297         SSVAL(req->outbuf,smb_vwv0,total_written);
4298
4299         status = sync_file(conn, fsp, write_through);
4300         if (!NT_STATUS_IS_OK(status)) {
4301                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4302                          fsp_str_dbg(fsp), nt_errstr(status)));
4303                 reply_nterror(req, status);
4304                 error_to_writebrawerr(req);
4305                 goto strict_unlock;
4306         }
4307
4308         DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4309                 "wrote=%d\n",
4310                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4311                 (int)total_written));
4312
4313         if (!fsp->print_file) {
4314                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4315         }
4316
4317         /* We won't return a status if write through is not selected - this
4318          * follows what WfWg does */
4319         END_PROFILE(SMBwritebraw);
4320
4321         if (!write_through && total_written==tcount) {
4322
4323 #if RABBIT_PELLET_FIX
4324                 /*
4325                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4326                  * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4327                  * JRA.
4328                  */
4329                 if (!send_keepalive(req->sconn->sock)) {
4330                         exit_server_cleanly("reply_writebraw: send of "
4331                                 "keepalive failed");
4332                 }
4333 #endif
4334                 TALLOC_FREE(req->outbuf);
4335         }
4336         return;
4337
4338 strict_unlock:
4339         if (!fsp->print_file) {
4340                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4341         }
4342
4343         END_PROFILE(SMBwritebraw);
4344         return;
4345 }
4346
4347 #undef DBGC_CLASS
4348 #define DBGC_CLASS DBGC_LOCKING
4349
4350 /****************************************************************************
4351  Reply to a writeunlock (core+).
4352 ****************************************************************************/
4353
4354 void reply_writeunlock(struct smb_request *req)
4355 {
4356         connection_struct *conn = req->conn;
4357         ssize_t nwritten = -1;
4358         size_t numtowrite;
4359         off_t startpos;
4360         const char *data;
4361         NTSTATUS status = NT_STATUS_OK;
4362         files_struct *fsp;
4363         struct lock_struct lock;
4364         int saved_errno = 0;
4365
4366         START_PROFILE(SMBwriteunlock);
4367
4368         if (req->wct < 5) {
4369                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4370                 END_PROFILE(SMBwriteunlock);
4371                 return;
4372         }
4373
4374         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4375
4376         if (!check_fsp(conn, req, fsp)) {
4377                 END_PROFILE(SMBwriteunlock);
4378                 return;
4379         }
4380
4381         if (!CHECK_WRITE(fsp)) {
4382                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4383                 END_PROFILE(SMBwriteunlock);
4384                 return;
4385         }
4386
4387         numtowrite = SVAL(req->vwv+1, 0);
4388         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4389         data = (const char *)req->buf + 3;
4390
4391         if (!fsp->print_file && numtowrite > 0) {
4392                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4393                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4394                     &lock);
4395
4396                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4397                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4398                         END_PROFILE(SMBwriteunlock);
4399                         return;
4400                 }
4401         }
4402
4403         /* The special X/Open SMB protocol handling of
4404            zero length writes is *NOT* done for
4405            this call */
4406         if(numtowrite == 0) {
4407                 nwritten = 0;
4408         } else {
4409                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4410                 saved_errno = errno;
4411         }
4412
4413         status = sync_file(conn, fsp, False /* write through */);
4414         if (!NT_STATUS_IS_OK(status)) {
4415                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4416                          fsp_str_dbg(fsp), nt_errstr(status)));
4417                 reply_nterror(req, status);
4418                 goto strict_unlock;
4419         }
4420
4421         if(nwritten < 0) {
4422                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4423                 goto strict_unlock;
4424         }
4425
4426         if((nwritten < numtowrite) && (numtowrite != 0)) {
4427                 reply_nterror(req, NT_STATUS_DISK_FULL);
4428                 goto strict_unlock;
4429         }
4430
4431         if (numtowrite && !fsp->print_file) {
4432                 status = do_unlock(req->sconn->msg_ctx,
4433                                 fsp,
4434                                 (uint64_t)req->smbpid,
4435                                 (uint64_t)numtowrite,
4436                                 (uint64_t)startpos,
4437                                 WINDOWS_LOCK);
4438
4439                 if (NT_STATUS_V(status)) {
4440                         reply_nterror(req, status);
4441                         goto strict_unlock;
4442                 }
4443         }
4444
4445         reply_outbuf(req, 1, 0);
4446
4447         SSVAL(req->outbuf,smb_vwv0,nwritten);
4448
4449         DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4450                   fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4451
4452 strict_unlock:
4453         if (numtowrite && !fsp->print_file) {
4454                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4455         }
4456
4457         END_PROFILE(SMBwriteunlock);
4458         return;
4459 }
4460
4461 #undef DBGC_CLASS
4462 #define DBGC_CLASS DBGC_ALL
4463
4464 /****************************************************************************
4465  Reply to a write.
4466 ****************************************************************************/
4467
4468 void reply_write(struct smb_request *req)
4469 {
4470         connection_struct *conn = req->conn;
4471         size_t numtowrite;
4472         ssize_t nwritten = -1;
4473         off_t startpos;
4474         const char *data;
4475         files_struct *fsp;
4476         struct lock_struct lock;
4477         NTSTATUS status;
4478         int saved_errno = 0;
4479
4480         START_PROFILE(SMBwrite);
4481
4482         if (req->wct < 5) {
4483                 END_PROFILE(SMBwrite);
4484                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4485                 return;
4486         }
4487
4488         /* If it's an IPC, pass off the pipe handler. */
4489         if (IS_IPC(conn)) {
4490                 reply_pipe_write(req);
4491                 END_PROFILE(SMBwrite);
4492                 return;
4493         }
4494
4495         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4496
4497         if (!check_fsp(conn, req, fsp)) {
4498                 END_PROFILE(SMBwrite);
4499                 return;
4500         }
4501
4502         if (!CHECK_WRITE(fsp)) {
4503                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4504                 END_PROFILE(SMBwrite);
4505                 return;
4506         }
4507
4508         numtowrite = SVAL(req->vwv+1, 0);
4509         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4510         data = (const char *)req->buf + 3;
4511
4512         if (!fsp->print_file) {
4513                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4514                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4515                         &lock);
4516
4517                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4518                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4519                         END_PROFILE(SMBwrite);
4520                         return;
4521                 }
4522         }
4523
4524         /*
4525          * X/Open SMB protocol says that if smb_vwv1 is
4526          * zero then the file size should be extended or
4527          * truncated to the size given in smb_vwv[2-3].
4528          */
4529
4530         if(numtowrite == 0) {
4531                 /*
4532                  * This is actually an allocate call, and set EOF. JRA.
4533                  */
4534                 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4535                 if (nwritten < 0) {
4536                         reply_nterror(req, NT_STATUS_DISK_FULL);
4537                         goto strict_unlock;
4538                 }
4539                 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4540                 if (nwritten < 0) {
4541                         reply_nterror(req, NT_STATUS_DISK_FULL);
4542                         goto strict_unlock;
4543                 }
4544                 trigger_write_time_update_immediate(fsp);
4545         } else {
4546                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4547         }
4548
4549         status = sync_file(conn, fsp, False);
4550         if (!NT_STATUS_IS_OK(status)) {
4551                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4552                          fsp_str_dbg(fsp), nt_errstr(status)));
4553                 reply_nterror(req, status);
4554                 goto strict_unlock;
4555         }
4556
4557         if(nwritten < 0) {
4558                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4559                 goto strict_unlock;
4560         }
4561
4562         if((nwritten == 0) && (numtowrite != 0)) {
4563                 reply_nterror(req, NT_STATUS_DISK_FULL);
4564                 goto strict_unlock;
4565         }
4566
4567         reply_outbuf(req, 1, 0);
4568
4569         SSVAL(req->outbuf,smb_vwv0,nwritten);
4570
4571         if (nwritten < (ssize_t)numtowrite) {
4572                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4573                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4574         }
4575
4576         DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4577
4578 strict_unlock:
4579         if (!fsp->print_file) {
4580                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4581         }
4582
4583         END_PROFILE(SMBwrite);
4584         return;
4585 }
4586
4587 /****************************************************************************
4588  Ensure a buffer is a valid writeX for recvfile purposes.
4589 ****************************************************************************/
4590
4591 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4592                                                 (2*14) + /* word count (including bcc) */ \
4593                                                 1 /* pad byte */)
4594
4595 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4596                             const uint8_t *inbuf)
4597 {
4598         size_t numtowrite;
4599         connection_struct *conn = NULL;
4600         unsigned int doff = 0;
4601         size_t len = smb_len_large(inbuf);
4602         struct smbXsrv_tcon *tcon;
4603         NTSTATUS status;
4604         NTTIME now = 0;
4605
4606         if (is_encrypted_packet(sconn, inbuf)) {
4607                 /* Can't do this on encrypted
4608                  * connections. */
4609                 return false;
4610         }
4611
4612         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4613                 return false;
4614         }
4615
4616         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4617                         CVAL(inbuf,smb_wct) != 14) {
4618                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4619                         "invalid word length.\n"));
4620                 return false;
4621         }
4622
4623         status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
4624                                      now, &tcon);
4625         if (!NT_STATUS_IS_OK(status)) {
4626                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4627                 return false;
4628         }
4629         conn = tcon->compat;
4630
4631         if (IS_IPC(conn)) {
4632                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4633                 return false;
4634         }
4635         if (IS_PRINT(conn)) {
4636                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4637                 return false;
4638         }
4639         doff = SVAL(inbuf,smb_vwv11);
4640
4641         numtowrite = SVAL(inbuf,smb_vwv10);
4642
4643         if (len > doff && len - doff > 0xFFFF) {
4644                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4645         }
4646
4647         if (numtowrite == 0) {
4648                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4649                 return false;
4650         }
4651
4652         /* Ensure the sizes match up. */
4653         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4654                 /* no pad byte...old smbclient :-( */
4655                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4656                         (unsigned int)doff,
4657                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4658                 return false;
4659         }
4660
4661         if (len - doff != numtowrite) {
4662                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4663                         "len = %u, doff = %u, numtowrite = %u\n",
4664                         (unsigned int)len,
4665                         (unsigned int)doff,
4666                         (unsigned int)numtowrite ));
4667                 return false;
4668         }
4669
4670         DEBUG(10,("is_valid_writeX_buffer: true "
4671                 "len = %u, doff = %u, numtowrite = %u\n",
4672                 (unsigned int)len,
4673                 (unsigned int)doff,
4674                 (unsigned int)numtowrite ));
4675
4676         return true;
4677 }
4678
4679 /****************************************************************************
4680  Reply to a write and X.
4681 ****************************************************************************/
4682
4683 void reply_write_and_X(struct smb_request *req)
4684 {
4685         connection_struct *conn = req->conn;
4686         files_struct *fsp;
4687         struct lock_struct lock;
4688         off_t startpos;
4689         size_t numtowrite;
4690         bool write_through;
4691         ssize_t nwritten;
4692         unsigned int smb_doff;
4693         unsigned int smblen;
4694         const char *data;
4695         NTSTATUS status;
4696         int saved_errno = 0;
4697
4698         START_PROFILE(SMBwriteX);
4699
4700         if ((req->wct != 12) && (req->wct != 14)) {
4701                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4702                 goto out;
4703         }
4704
4705         numtowrite = SVAL(req->vwv+10, 0);
4706         smb_doff = SVAL(req->vwv+11, 0);
4707         smblen = smb_len(req->inbuf);
4708
4709         if (req->unread_bytes > 0xFFFF ||
4710                         (smblen > smb_doff &&
4711                                 smblen - smb_doff > 0xFFFF)) {
4712                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4713         }
4714
4715         if (req->unread_bytes) {
4716                 /* Can't do a recvfile write on IPC$ */
4717                 if (IS_IPC(conn)) {
4718                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4719                         goto out;
4720                 }
4721                 if (numtowrite != req->unread_bytes) {
4722                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4723                         goto out;
4724                 }
4725         } else {
4726                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4727                                 smb_doff + numtowrite > smblen) {
4728                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4729                         goto out;
4730                 }
4731         }
4732
4733         /* If it's an IPC, pass off the pipe handler. */
4734         if (IS_IPC(conn)) {
4735                 if (req->unread_bytes) {
4736                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4737                         goto out;
4738                 }
4739                 reply_pipe_write_and_X(req);
4740                 goto out;
4741         }
4742
4743         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4744         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4745         write_through = BITSETW(req->vwv+7,0);
4746
4747         if (!check_fsp(conn, req, fsp)) {
4748                 goto out;
4749         }
4750
4751         if (!CHECK_WRITE(fsp)) {
4752                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4753                 goto out;
4754         }
4755
4756         data = smb_base(req->inbuf) + smb_doff;
4757
4758         if(req->wct == 14) {
4759                 /*
4760                  * This is a large offset (64 bit) write.
4761                  */
4762                 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4763
4764         }
4765
4766         /* X/Open SMB protocol says that, unlike SMBwrite
4767         if the length is zero then NO truncation is
4768         done, just a write of zero. To truncate a file,
4769         use SMBwrite. */
4770
4771         if(numtowrite == 0) {
4772                 nwritten = 0;
4773         } else {
4774                 if (req->unread_bytes == 0) {
4775                         status = schedule_aio_write_and_X(conn,
4776                                                 req,
4777                                                 fsp,
4778                                                 data,
4779                                                 startpos,
4780                                                 numtowrite);
4781
4782                         if (NT_STATUS_IS_OK(status)) {
4783                                 /* write scheduled - we're done. */
4784                                 goto out;
4785                         }
4786                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4787                                 /* Real error - report to client. */
4788                                 reply_nterror(req, status);
4789                                 goto out;
4790                         }
4791                         /* NT_STATUS_RETRY - fall through to sync write. */
4792                 }
4793
4794                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4795                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4796                     &lock);
4797
4798                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4799                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4800                         goto out;
4801                 }
4802
4803                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4804                 saved_errno = errno;
4805
4806                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4807         }
4808
4809         if(nwritten < 0) {
4810                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4811                 goto out;
4812         }
4813
4814         if((nwritten == 0) && (numtowrite != 0)) {
4815                 reply_nterror(req, NT_STATUS_DISK_FULL);
4816                 goto out;
4817         }
4818
4819         reply_outbuf(req, 6, 0);
4820         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4821         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
4822         SSVAL(req->outbuf,smb_vwv2,nwritten);
4823         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4824
4825         DEBUG(3,("writeX %s num=%d wrote=%d\n",
4826                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4827
4828         status = sync_file(conn, fsp, write_through);
4829         if (!NT_STATUS_IS_OK(status)) {
4830                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4831                          fsp_str_dbg(fsp), nt_errstr(status)));
4832                 reply_nterror(req, status);
4833                 goto out;
4834         }
4835
4836         END_PROFILE(SMBwriteX);
4837         return;
4838
4839 out:
4840         if (req->unread_bytes) {
4841                 /* writeX failed. drain socket. */
4842                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4843                                 req->unread_bytes) {
4844                         smb_panic("failed to drain pending bytes");
4845                 }
4846                 req->unread_bytes = 0;
4847         }
4848
4849         END_PROFILE(SMBwriteX);
4850         return;
4851 }
4852
4853 /****************************************************************************
4854  Reply to a lseek.
4855 ****************************************************************************/
4856
4857 void reply_lseek(struct smb_request *req)
4858 {
4859         connection_struct *conn = req->conn;
4860         off_t startpos;
4861         off_t res= -1;
4862         int mode,umode;
4863         files_struct *fsp;
4864
4865         START_PROFILE(SMBlseek);
4866
4867         if (req->wct < 4) {
4868                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4869                 END_PROFILE(SMBlseek);
4870                 return;
4871         }
4872
4873         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4874
4875         if (!check_fsp(conn, req, fsp)) {
4876                 return;
4877         }
4878
4879         flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
4880
4881         mode = SVAL(req->vwv+1, 0) & 3;
4882         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4883         startpos = (off_t)IVALS(req->vwv+2, 0);
4884
4885         switch (mode) {
4886                 case 0:
4887                         umode = SEEK_SET;
4888                         res = startpos;
4889                         break;
4890                 case 1:
4891                         umode = SEEK_CUR;
4892                         res = fsp->fh->pos + startpos;
4893                         break;
4894                 case 2:
4895                         umode = SEEK_END;
4896                         break;
4897                 default:
4898                         umode = SEEK_SET;
4899                         res = startpos;
4900                         break;
4901         }
4902
4903         if (umode == SEEK_END) {
4904                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4905                         if(errno == EINVAL) {
4906                                 off_t current_pos = startpos;
4907
4908                                 if(fsp_stat(fsp) == -1) {
4909                                         reply_nterror(req,
4910                                                 map_nt_error_from_unix(errno));
4911                                         END_PROFILE(SMBlseek);
4912                                         return;
4913                                 }
4914
4915                                 current_pos += fsp->fsp_name->st.st_ex_size;
4916                                 if(current_pos < 0)
4917                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4918                         }
4919                 }
4920
4921                 if(res == -1) {
4922                         reply_nterror(req, map_nt_error_from_unix(errno));
4923                         END_PROFILE(SMBlseek);
4924                         return;
4925                 }
4926         }
4927
4928         fsp->fh->pos = res;
4929
4930         reply_outbuf(req, 2, 0);
4931         SIVAL(req->outbuf,smb_vwv0,res);
4932
4933         DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4934                 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4935
4936         END_PROFILE(SMBlseek);
4937         return;
4938 }
4939
4940 /****************************************************************************
4941  Reply to a flush.
4942 ****************************************************************************/
4943
4944 void reply_flush(struct smb_request *req)
4945 {
4946         connection_struct *conn = req->conn;
4947         uint16 fnum;
4948         files_struct *fsp;
4949
4950         START_PROFILE(SMBflush);
4951
4952         if (req->wct < 1) {
4953                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4954                 return;
4955         }
4956
4957         fnum = SVAL(req->vwv+0, 0);
4958         fsp = file_fsp(req, fnum);
4959
4960         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4961                 return;
4962         }
4963
4964         if (!fsp) {
4965                 file_sync_all(conn);
4966         } else {
4967                 NTSTATUS status = sync_file(conn, fsp, True);
4968                 if (!NT_STATUS_IS_OK(status)) {
4969                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4970                                 fsp_str_dbg(fsp), nt_errstr(status)));
4971                         reply_nterror(req, status);
4972                         END_PROFILE(SMBflush);
4973                         return;
4974                 }
4975         }
4976
4977         reply_outbuf(req, 0, 0);
4978
4979         DEBUG(3,("flush\n"));
4980         END_PROFILE(SMBflush);
4981         return;
4982 }
4983
4984 /****************************************************************************
4985  Reply to a exit.
4986  conn POINTER CAN BE NULL HERE !
4987 ****************************************************************************/
4988
4989 void reply_exit(struct smb_request *req)
4990 {
4991         START_PROFILE(SMBexit);
4992
4993         file_close_pid(req->sconn, req->smbpid, req->vuid);
4994
4995         reply_outbuf(req, 0, 0);
4996
4997         DEBUG(3,("exit\n"));
4998
4999         END_PROFILE(SMBexit);
5000         return;
5001 }
5002
5003 struct reply_close_state {
5004         files_struct *fsp;
5005         struct smb_request *smbreq;
5006 };
5007
5008 static void do_smb1_close(struct tevent_req *req);
5009
5010 void reply_close(struct smb_request *req)
5011 {
5012         connection_struct *conn = req->conn;
5013         NTSTATUS status = NT_STATUS_OK;
5014         files_struct *fsp = NULL;
5015         START_PROFILE(SMBclose);
5016
5017         if (req->wct < 3) {
5018                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5019                 END_PROFILE(SMBclose);
5020                 return;
5021         }
5022
5023         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5024
5025         /*
5026          * We can only use check_fsp if we know it's not a directory.
5027          */
5028
5029         if (!check_fsp_open(conn, req, fsp)) {
5030                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5031                 END_PROFILE(SMBclose);
5032                 return;
5033         }
5034
5035         DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5036                   fsp->is_directory ? "directory" : "file",
5037                   fsp->fh->fd, fsp_fnum_dbg(fsp),
5038                   conn->num_files_open));
5039
5040         if (!fsp->is_directory) {
5041                 time_t t;
5042
5043                 /*
5044                  * Take care of any time sent in the close.
5045                  */
5046
5047                 t = srv_make_unix_date3(req->vwv+1);
5048                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5049         }
5050
5051         if (fsp->num_aio_requests != 0) {
5052
5053                 struct reply_close_state *state;
5054
5055                 DEBUG(10, ("closing with aio %u requests pending\n",
5056                            fsp->num_aio_requests));
5057
5058                 /*
5059                  * We depend on the aio_extra destructor to take care of this
5060                  * close request once fsp->num_aio_request drops to 0.
5061                  */
5062
5063                 fsp->deferred_close = tevent_wait_send(
5064                         fsp, fsp->conn->sconn->ev_ctx);
5065                 if (fsp->deferred_close == NULL) {
5066                         status = NT_STATUS_NO_MEMORY;
5067                         goto done;
5068                 }
5069
5070                 state = talloc(fsp, struct reply_close_state);
5071                 if (state == NULL) {
5072                         TALLOC_FREE(fsp->deferred_close);
5073                         status = NT_STATUS_NO_MEMORY;
5074                         goto done;
5075                 }
5076                 state->fsp = fsp;
5077                 state->smbreq = talloc_move(fsp, &req);
5078                 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5079                                         state);
5080                 END_PROFILE(SMBclose);
5081                 return;
5082         }
5083
5084         /*
5085          * close_file() returns the unix errno if an error was detected on
5086          * close - normally this is due to a disk full error. If not then it
5087          * was probably an I/O error.
5088          */
5089
5090         status = close_file(req, fsp, NORMAL_CLOSE);
5091 done:
5092         if (!NT_STATUS_IS_OK(status)) {
5093                 reply_nterror(req, status);
5094                 END_PROFILE(SMBclose);
5095                 return;
5096         }
5097
5098         reply_outbuf(req, 0, 0);
5099         END_PROFILE(SMBclose);
5100         return;
5101 }
5102
5103 static void do_smb1_close(struct tevent_req *req)
5104 {
5105         struct reply_close_state *state = tevent_req_callback_data(
5106                 req, struct reply_close_state);
5107         struct smb_request *smbreq;
5108         NTSTATUS status;
5109         int ret;
5110
5111         ret = tevent_wait_recv(req);
5112         TALLOC_FREE(req);
5113         if (ret != 0) {
5114                 DEBUG(10, ("tevent_wait_recv returned %s\n",
5115                            strerror(ret)));
5116                 /*
5117                  * Continue anyway, this should never happen
5118                  */
5119         }
5120
5121         /*
5122          * fsp->smb2_close_request right now is a talloc grandchild of
5123          * fsp. When we close_file(fsp), it would go with it. No chance to
5124          * reply...
5125          */
5126         smbreq = talloc_move(talloc_tos(), &state->smbreq);
5127
5128         status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5129         if (NT_STATUS_IS_OK(status)) {
5130                 reply_outbuf(smbreq, 0, 0);
5131         } else {
5132                 reply_nterror(smbreq, status);
5133         }
5134         if (!srv_send_smb(smbreq->sconn,
5135                         (char *)smbreq->outbuf,
5136                         true,
5137                         smbreq->seqnum+1,
5138                         IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5139                         NULL)) {
5140                 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5141                                     "failed.");
5142         }
5143         TALLOC_FREE(smbreq);
5144 }
5145
5146 /****************************************************************************
5147  Reply to a writeclose (Core+ protocol).
5148 ****************************************************************************/
5149
5150 void reply_writeclose(struct smb_request *req)
5151 {
5152         connection_struct *conn = req->conn;
5153         size_t numtowrite;
5154         ssize_t nwritten = -1;
5155         NTSTATUS close_status = NT_STATUS_OK;
5156         off_t startpos;
5157         const char *data;
5158         struct timespec mtime;
5159         files_struct *fsp;
5160         struct lock_struct lock;
5161
5162         START_PROFILE(SMBwriteclose);
5163
5164         if (req->wct < 6) {
5165                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5166                 END_PROFILE(SMBwriteclose);
5167                 return;
5168         }
5169
5170         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5171
5172         if (!check_fsp(conn, req, fsp)) {
5173                 END_PROFILE(SMBwriteclose);
5174                 return;
5175         }
5176         if (!CHECK_WRITE(fsp)) {
5177                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5178                 END_PROFILE(SMBwriteclose);
5179                 return;
5180         }
5181
5182         numtowrite = SVAL(req->vwv+1, 0);
5183         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5184         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5185         data = (const char *)req->buf + 1;
5186
5187         if (fsp->print_file == NULL) {
5188                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5189                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5190                     &lock);
5191
5192                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5193                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5194                         END_PROFILE(SMBwriteclose);
5195                         return;
5196                 }
5197         }
5198
5199         nwritten = write_file(req,fsp,data,startpos,numtowrite);
5200
5201         if (fsp->print_file == NULL) {
5202                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5203         }
5204
5205         set_close_write_time(fsp, mtime);
5206
5207         /*
5208          * More insanity. W2K only closes the file if writelen > 0.
5209          * JRA.
5210          */
5211
5212         DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5213                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5214                 (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
5215
5216         if (numtowrite) {
5217                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5218                          "file %s\n", fsp_str_dbg(fsp)));
5219                 close_status = close_file(req, fsp, NORMAL_CLOSE);
5220                 fsp = NULL;
5221         }
5222
5223         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5224                 reply_nterror(req, NT_STATUS_DISK_FULL);
5225                 goto out;
5226         }
5227
5228         if(!NT_STATUS_IS_OK(close_status)) {
5229                 reply_nterror(req, close_status);
5230                 goto out;
5231         }
5232
5233         reply_outbuf(req, 1, 0);
5234
5235         SSVAL(req->outbuf,smb_vwv0,nwritten);
5236
5237 out:
5238
5239         END_PROFILE(SMBwriteclose);
5240         return;
5241 }
5242
5243 #undef DBGC_CLASS
5244 #define DBGC_CLASS DBGC_LOCKING
5245
5246 /****************************************************************************
5247  Reply to a lock.
5248 ****************************************************************************/
5249
5250 void reply_lock(struct smb_request *req)
5251 {
5252         connection_struct *conn = req->conn;
5253         uint64_t count,offset;
5254         NTSTATUS status;
5255         files_struct *fsp;
5256         struct byte_range_lock *br_lck = NULL;
5257
5258         START_PROFILE(SMBlock);
5259
5260         if (req->wct < 5) {
5261                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5262                 END_PROFILE(SMBlock);
5263                 return;
5264         }
5265
5266         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5267
5268         if (!check_fsp(conn, req, fsp)) {
5269                 END_PROFILE(SMBlock);
5270                 return;
5271         }
5272
5273         count = (uint64_t)IVAL(req->vwv+1, 0);
5274         offset = (uint64_t)IVAL(req->vwv+3, 0);
5275
5276         DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5277                  fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5278
5279         br_lck = do_lock(req->sconn->msg_ctx,
5280                         fsp,
5281                         (uint64_t)req->smbpid,
5282                         count,
5283                         offset,
5284                         WRITE_LOCK,
5285                         WINDOWS_LOCK,
5286                         False, /* Non-blocking lock. */
5287                         &status,
5288                         NULL,
5289                         NULL);
5290
5291         TALLOC_FREE(br_lck);
5292
5293         if (NT_STATUS_V(status)) {
5294                 reply_nterror(req, status);
5295                 END_PROFILE(SMBlock);
5296                 return;
5297         }
5298
5299         reply_outbuf(req, 0, 0);
5300
5301         END_PROFILE(SMBlock);
5302         return;
5303 }
5304
5305 /****************************************************************************
5306  Reply to a unlock.
5307 ****************************************************************************/
5308
5309 void reply_unlock(struct smb_request *req)
5310 {
5311         connection_struct *conn = req->conn;
5312         uint64_t count,offset;
5313         NTSTATUS status;
5314         files_struct *fsp;
5315
5316         START_PROFILE(SMBunlock);
5317
5318         if (req->wct < 5) {
5319                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5320                 END_PROFILE(SMBunlock);
5321                 return;
5322         }
5323
5324         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5325
5326         if (!check_fsp(conn, req, fsp)) {
5327                 END_PROFILE(SMBunlock);
5328                 return;
5329         }
5330
5331         count = (uint64_t)IVAL(req->vwv+1, 0);
5332         offset = (uint64_t)IVAL(req->vwv+3, 0);
5333
5334         status = do_unlock(req->sconn->msg_ctx,
5335                         fsp,
5336                         (uint64_t)req->smbpid,
5337                         count,
5338                         offset,
5339                         WINDOWS_LOCK);
5340
5341         if (NT_STATUS_V(status)) {
5342                 reply_nterror(req, status);
5343                 END_PROFILE(SMBunlock);
5344                 return;
5345         }
5346
5347         DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5348                     fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5349
5350         reply_outbuf(req, 0, 0);
5351
5352         END_PROFILE(SMBunlock);
5353         return;
5354 }
5355
5356 #undef DBGC_CLASS
5357 #define DBGC_CLASS DBGC_ALL
5358
5359 /****************************************************************************
5360  Reply to a tdis.
5361  conn POINTER CAN BE NULL HERE !
5362 ****************************************************************************/
5363
5364 void reply_tdis(struct smb_request *req)
5365 {
5366         NTSTATUS status;
5367         connection_struct *conn = req->conn;
5368         struct smbXsrv_tcon *tcon;
5369
5370         START_PROFILE(SMBtdis);
5371
5372         if (!conn) {
5373                 DEBUG(4,("Invalid connection in tdis\n"));
5374                 reply_force_doserror(req, ERRSRV, ERRinvnid);
5375                 END_PROFILE(SMBtdis);
5376                 return;
5377         }
5378
5379         tcon = conn->tcon;
5380         req->conn = NULL;
5381
5382         /*
5383          * TODO: cancel all outstanding requests on the tcon
5384          */
5385         status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5386         if (!NT_STATUS_IS_OK(status)) {
5387                 DEBUG(0, ("reply_tdis: "
5388                           "smbXsrv_tcon_disconnect() failed: %s\n",
5389                           nt_errstr(status)));
5390                 /*
5391                  * If we hit this case, there is something completely
5392                  * wrong, so we better disconnect the transport connection.
5393                  */
5394                 END_PROFILE(SMBtdis);
5395                 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5396                 return;
5397         }
5398
5399         TALLOC_FREE(tcon);
5400
5401         reply_outbuf(req, 0, 0);
5402         END_PROFILE(SMBtdis);
5403         return;
5404 }
5405
5406 /****************************************************************************
5407  Reply to a echo.
5408  conn POINTER CAN BE NULL HERE !
5409 ****************************************************************************/
5410
5411 void reply_echo(struct smb_request *req)
5412 {
5413         connection_struct *conn = req->conn;
5414         struct smb_perfcount_data local_pcd;
5415         struct smb_perfcount_data *cur_pcd;
5416         int smb_reverb;
5417         int seq_num;
5418
5419         START_PROFILE(SMBecho);
5420
5421         smb_init_perfcount_data(&local_pcd);
5422
5423         if (req->wct < 1) {
5424                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5425                 END_PROFILE(SMBecho);
5426                 return;
5427         }
5428
5429         smb_reverb = SVAL(req->vwv+0, 0);
5430
5431         reply_outbuf(req, 1, req->buflen);
5432
5433         /* copy any incoming data back out */
5434         if (req->buflen > 0) {
5435                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5436         }
5437
5438         if (smb_reverb > 100) {
5439                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5440                 smb_reverb = 100;
5441         }
5442
5443         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5444
5445                 /* this makes sure we catch the request pcd */
5446                 if (seq_num == smb_reverb) {
5447                         cur_pcd = &req->pcd;
5448                 } else {
5449                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5450                         cur_pcd = &local_pcd;
5451                 }
5452
5453                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5454
5455                 show_msg((char *)req->outbuf);
5456                 if (!srv_send_smb(req->sconn,
5457                                 (char *)req->outbuf,
5458                                 true, req->seqnum+1,
5459                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5460                                 cur_pcd))
5461                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5462         }
5463
5464         DEBUG(3,("echo %d times\n", smb_reverb));
5465
5466         TALLOC_FREE(req->outbuf);
5467
5468         END_PROFILE(SMBecho);
5469         return;
5470 }
5471
5472 /****************************************************************************
5473  Reply to a printopen.
5474 ****************************************************************************/
5475
5476 void reply_printopen(struct smb_request *req)
5477 {
5478         connection_struct *conn = req->conn;
5479         files_struct *fsp;
5480         NTSTATUS status;
5481
5482         START_PROFILE(SMBsplopen);
5483
5484         if (req->wct < 2) {
5485                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5486                 END_PROFILE(SMBsplopen);
5487                 return;
5488         }
5489
5490         if (!CAN_PRINT(conn)) {
5491                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5492                 END_PROFILE(SMBsplopen);
5493                 return;
5494         }
5495
5496         status = file_new(req, conn, &fsp);
5497         if(!NT_STATUS_IS_OK(status)) {
5498                 reply_nterror(req, status);
5499                 END_PROFILE(SMBsplopen);
5500                 return;
5501         }
5502
5503         /* Open for exclusive use, write only. */
5504         status = print_spool_open(fsp, NULL, req->vuid);
5505
5506         if (!NT_STATUS_IS_OK(status)) {
5507                 file_free(req, fsp);
5508                 reply_nterror(req, status);
5509                 END_PROFILE(SMBsplopen);
5510                 return;
5511         }
5512
5513         reply_outbuf(req, 1, 0);
5514         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5515
5516         DEBUG(3,("openprint fd=%d %s\n",
5517                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5518
5519         END_PROFILE(SMBsplopen);
5520         return;
5521 }
5522
5523 /****************************************************************************
5524  Reply to a printclose.
5525 ****************************************************************************/
5526
5527 void reply_printclose(struct smb_request *req)
5528 {
5529         connection_struct *conn = req->conn;
5530         files_struct *fsp;
5531         NTSTATUS status;
5532
5533         START_PROFILE(SMBsplclose);
5534
5535         if (req->wct < 1) {
5536                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5537                 END_PROFILE(SMBsplclose);
5538                 return;
5539         }
5540
5541         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5542
5543         if (!check_fsp(conn, req, fsp)) {
5544                 END_PROFILE(SMBsplclose);
5545                 return;
5546         }
5547
5548         if (!CAN_PRINT(conn)) {
5549                 reply_force_doserror(req, ERRSRV, ERRerror);
5550                 END_PROFILE(SMBsplclose);
5551                 return;
5552         }
5553
5554         DEBUG(3,("printclose fd=%d %s\n",
5555                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5556
5557         status = close_file(req, fsp, NORMAL_CLOSE);
5558
5559         if(!NT_STATUS_IS_OK(status)) {
5560                 reply_nterror(req, status);
5561                 END_PROFILE(SMBsplclose);
5562                 return;
5563         }
5564
5565         reply_outbuf(req, 0, 0);
5566
5567         END_PROFILE(SMBsplclose);
5568         return;
5569 }
5570
5571 /****************************************************************************
5572  Reply to a printqueue.
5573 ****************************************************************************/
5574
5575 void reply_printqueue(struct smb_request *req)
5576 {
5577         connection_struct *conn = req->conn;
5578         int max_count;
5579         int start_index;
5580
5581         START_PROFILE(SMBsplretq);
5582
5583         if (req->wct < 2) {
5584                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5585                 END_PROFILE(SMBsplretq);
5586                 return;
5587         }
5588
5589         max_count = SVAL(req->vwv+0, 0);
5590         start_index = SVAL(req->vwv+1, 0);
5591
5592         /* we used to allow the client to get the cnum wrong, but that
5593            is really quite gross and only worked when there was only
5594            one printer - I think we should now only accept it if they
5595            get it right (tridge) */
5596         if (!CAN_PRINT(conn)) {
5597                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5598                 END_PROFILE(SMBsplretq);
5599                 return;
5600         }
5601
5602         reply_outbuf(req, 2, 3);
5603         SSVAL(req->outbuf,smb_vwv0,0);
5604         SSVAL(req->outbuf,smb_vwv1,0);
5605         SCVAL(smb_buf(req->outbuf),0,1);
5606         SSVAL(smb_buf(req->outbuf),1,0);
5607
5608         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5609                  start_index, max_count));
5610
5611         {
5612                 TALLOC_CTX *mem_ctx = talloc_tos();
5613                 NTSTATUS status;
5614                 WERROR werr;
5615                 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5616                 struct rpc_pipe_client *cli = NULL;
5617                 struct dcerpc_binding_handle *b = NULL;
5618                 struct policy_handle handle;
5619                 struct spoolss_DevmodeContainer devmode_ctr;
5620                 union spoolss_JobInfo *info;
5621                 uint32_t count;
5622                 uint32_t num_to_get;
5623                 uint32_t first;
5624                 uint32_t i;
5625
5626                 ZERO_STRUCT(handle);
5627
5628                 status = rpc_pipe_open_interface(conn,
5629                                                  &ndr_table_spoolss,
5630                                                  conn->session_info,
5631                                                  conn->sconn->remote_address,
5632                                                  conn->sconn->msg_ctx,
5633                                                  &cli);
5634                 if (!NT_STATUS_IS_OK(status)) {
5635                         DEBUG(0, ("reply_printqueue: "
5636                                   "could not connect to spoolss: %s\n",
5637                                   nt_errstr(status)));
5638                         reply_nterror(req, status);
5639                         goto out;
5640                 }
5641                 b = cli->binding_handle;
5642
5643                 ZERO_STRUCT(devmode_ctr);
5644
5645                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5646                                                 sharename,
5647                                                 NULL, devmode_ctr,
5648                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5649                                                 &handle,
5650                                                 &werr);
5651                 if (!NT_STATUS_IS_OK(status)) {
5652                         reply_nterror(req, status);
5653                         goto out;
5654                 }
5655                 if (!W_ERROR_IS_OK(werr)) {
5656                         reply_nterror(req, werror_to_ntstatus(werr));
5657                         goto out;
5658                 }
5659
5660                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5661                                                &handle,
5662                                                0, /* firstjob */
5663                                                0xff, /* numjobs */
5664                                                2, /* level */
5665                                                0, /* offered */
5666                                                &count,
5667                                                &info);
5668                 if (!W_ERROR_IS_OK(werr)) {
5669                         reply_nterror(req, werror_to_ntstatus(werr));
5670                         goto out;
5671                 }
5672
5673                 if (max_count > 0) {
5674                         first = start_index;
5675                 } else {
5676                         first = start_index + max_count + 1;
5677                 }
5678
5679                 if (first >= count) {
5680                         num_to_get = first;
5681                 } else {
5682                         num_to_get = first + MIN(ABS(max_count), count - first);
5683                 }
5684
5685                 for (i = first; i < num_to_get; i++) {
5686                         char blob[28];
5687                         char *p = blob;
5688                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5689                         int qstatus;
5690                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5691                                                         info[i].info2.job_id);
5692
5693                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5694                                 qstatus = 2;
5695                         } else {
5696                                 qstatus = 3;
5697                         }
5698
5699                         srv_put_dos_date2(p, 0, qtime);
5700                         SCVAL(p, 4, qstatus);
5701                         SSVAL(p, 5, qrapjobid);
5702                         SIVAL(p, 7, info[i].info2.size);
5703                         SCVAL(p, 11, 0);
5704                         srvstr_push(blob, req->flags2, p+12,
5705                                     info[i].info2.notify_name, 16, STR_ASCII);
5706
5707                         if (message_push_blob(
5708                                     &req->outbuf,
5709                                     data_blob_const(
5710                                             blob, sizeof(blob))) == -1) {
5711                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5712                                 goto out;
5713                         }
5714                 }
5715
5716                 if (count > 0) {
5717                         SSVAL(req->outbuf,smb_vwv0,count);
5718                         SSVAL(req->outbuf,smb_vwv1,
5719                               (max_count>0?first+count:first-1));
5720                         SCVAL(smb_buf(req->outbuf),0,1);
5721                         SSVAL(smb_buf(req->outbuf),1,28*count);
5722                 }
5723
5724
5725                 DEBUG(3, ("%u entries returned in queue\n",
5726                           (unsigned)count));
5727
5728 out:
5729                 if (b && is_valid_policy_hnd(&handle)) {
5730                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5731                 }
5732
5733         }
5734
5735         END_PROFILE(SMBsplretq);
5736         return;
5737 }
5738
5739 /****************************************************************************
5740  Reply to a printwrite.
5741 ****************************************************************************/
5742
5743 void reply_printwrite(struct smb_request *req)
5744 {
5745         connection_struct *conn = req->conn;
5746         int numtowrite;
5747         const char *data;
5748         files_struct *fsp;
5749
5750         START_PROFILE(SMBsplwr);
5751
5752         if (req->wct < 1) {
5753                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5754                 END_PROFILE(SMBsplwr);
5755                 return;
5756         }
5757
5758         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5759
5760         if (!check_fsp(conn, req, fsp)) {
5761                 END_PROFILE(SMBsplwr);
5762                 return;
5763         }
5764
5765         if (!fsp->print_file) {
5766                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5767                 END_PROFILE(SMBsplwr);
5768                 return;
5769         }
5770
5771         if (!CHECK_WRITE(fsp)) {
5772                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5773                 END_PROFILE(SMBsplwr);
5774                 return;
5775         }
5776
5777         numtowrite = SVAL(req->buf, 1);
5778
5779         if (req->buflen < numtowrite + 3) {
5780                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5781                 END_PROFILE(SMBsplwr);
5782                 return;
5783         }
5784
5785         data = (const char *)req->buf + 3;
5786
5787         if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5788                 reply_nterror(req, map_nt_error_from_unix(errno));
5789                 END_PROFILE(SMBsplwr);
5790                 return;
5791         }
5792
5793         DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5794
5795         END_PROFILE(SMBsplwr);
5796         return;
5797 }
5798
5799 /****************************************************************************
5800  Reply to a mkdir.
5801 ****************************************************************************/
5802
5803 void reply_mkdir(struct smb_request *req)
5804 {
5805         connection_struct *conn = req->conn;
5806         struct smb_filename *smb_dname = NULL;
5807         char *directory = NULL;
5808         NTSTATUS status;
5809         TALLOC_CTX *ctx = talloc_tos();
5810
5811         START_PROFILE(SMBmkdir);
5812
5813         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5814                             STR_TERMINATE, &status);
5815         if (!NT_STATUS_IS_OK(status)) {
5816                 reply_nterror(req, status);
5817                 goto out;
5818         }
5819
5820         status = filename_convert(ctx, conn,
5821                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5822                                  directory,
5823                                  UCF_PREP_CREATEFILE,
5824                                  NULL,
5825                                  &smb_dname);
5826         if (!NT_STATUS_IS_OK(status)) {
5827                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5828                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5829                                         ERRSRV, ERRbadpath);
5830                         goto out;
5831                 }
5832                 reply_nterror(req, status);
5833                 goto out;
5834         }
5835
5836         status = create_directory(conn, req, smb_dname);
5837
5838         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5839
5840         if (!NT_STATUS_IS_OK(status)) {
5841
5842                 if (!use_nt_status()
5843                     && NT_STATUS_EQUAL(status,
5844                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5845                         /*
5846                          * Yes, in the DOS error code case we get a
5847                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5848                          * samba4 torture test.
5849                          */
5850                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5851                 }
5852
5853                 reply_nterror(req, status);
5854                 goto out;
5855         }
5856
5857         reply_outbuf(req, 0, 0);
5858
5859         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5860  out:
5861         TALLOC_FREE(smb_dname);
5862         END_PROFILE(SMBmkdir);
5863         return;
5864 }
5865
5866 /****************************************************************************
5867  Reply to a rmdir.
5868 ****************************************************************************/
5869
5870 void reply_rmdir(struct smb_request *req)
5871 {
5872         connection_struct *conn = req->conn;
5873         struct smb_filename *smb_dname = NULL;
5874         char *directory = NULL;
5875         NTSTATUS status;
5876         TALLOC_CTX *ctx = talloc_tos();
5877         files_struct *fsp = NULL;
5878         int info = 0;
5879         struct smbd_server_connection *sconn = req->sconn;
5880
5881         START_PROFILE(SMBrmdir);
5882
5883         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5884                             STR_TERMINATE, &status);
5885         if (!NT_STATUS_IS_OK(status)) {
5886                 reply_nterror(req, status);
5887                 goto out;
5888         }
5889
5890         status = filename_convert(ctx, conn,
5891                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5892                                  directory,
5893                                  0,
5894                                  NULL,
5895                                  &smb_dname);
5896         if (!NT_STATUS_IS_OK(status)) {
5897                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5898                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5899                                         ERRSRV, ERRbadpath);
5900                         goto out;
5901                 }
5902                 reply_nterror(req, status);
5903                 goto out;
5904         }
5905
5906         if (is_ntfs_stream_smb_fname(smb_dname)) {
5907                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5908                 goto out;
5909         }
5910
5911         status = SMB_VFS_CREATE_FILE(
5912                 conn,                                   /* conn */
5913                 req,                                    /* req */
5914                 0,                                      /* root_dir_fid */
5915                 smb_dname,                              /* fname */
5916                 DELETE_ACCESS,                          /* access_mask */
5917                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5918                         FILE_SHARE_DELETE),
5919                 FILE_OPEN,                              /* create_disposition*/
5920                 FILE_DIRECTORY_FILE,                    /* create_options */
5921                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5922                 0,                                      /* oplock_request */
5923                 0,                                      /* allocation_size */
5924                 0,                                      /* private_flags */
5925                 NULL,                                   /* sd */
5926                 NULL,                                   /* ea_list */
5927                 &fsp,                                   /* result */
5928                 &info);                                 /* pinfo */
5929
5930         if (!NT_STATUS_IS_OK(status)) {
5931                 if (open_was_deferred(req->sconn, req->mid)) {
5932                         /* We have re-scheduled this call. */
5933                         goto out;
5934                 }
5935                 reply_nterror(req, status);
5936                 goto out;
5937         }
5938
5939         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5940         if (!NT_STATUS_IS_OK(status)) {
5941                 close_file(req, fsp, ERROR_CLOSE);
5942                 reply_nterror(req, status);
5943                 goto out;
5944         }
5945
5946         if (!set_delete_on_close(fsp, true,
5947                         conn->session_info->security_token,
5948                         conn->session_info->unix_token)) {
5949                 close_file(req, fsp, ERROR_CLOSE);
5950                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5951                 goto out;
5952         }
5953
5954         status = close_file(req, fsp, NORMAL_CLOSE);
5955         if (!NT_STATUS_IS_OK(status)) {
5956                 reply_nterror(req, status);
5957         } else {
5958                 reply_outbuf(req, 0, 0);
5959         }
5960
5961         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5962
5963         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5964  out:
5965         TALLOC_FREE(smb_dname);
5966         END_PROFILE(SMBrmdir);
5967         return;
5968 }
5969
5970 /*******************************************************************
5971  Resolve wildcards in a filename rename.
5972 ********************************************************************/
5973
5974 static bool resolve_wildcards(TALLOC_CTX *ctx,
5975                                 const char *name1,
5976                                 const char *name2,
5977                                 char **pp_newname)
5978 {
5979         char *name2_copy = NULL;
5980         char *root1 = NULL;
5981         char *root2 = NULL;
5982         char *ext1 = NULL;
5983         char *ext2 = NULL;
5984         char *p,*p2, *pname1, *pname2;
5985
5986         name2_copy = talloc_strdup(ctx, name2);
5987         if (!name2_copy) {
5988                 return False;
5989         }
5990
5991         pname1 = strrchr_m(name1,'/');
5992         pname2 = strrchr_m(name2_copy,'/');
5993
5994         if (!pname1 || !pname2) {
5995                 return False;
5996         }
5997
5998         /* Truncate the copy of name2 at the last '/' */
5999         *pname2 = '\0';
6000
6001         /* Now go past the '/' */
6002         pname1++;
6003         pname2++;
6004
6005         root1 = talloc_strdup(ctx, pname1);
6006         root2 = talloc_strdup(ctx, pname2);
6007
6008         if (!root1 || !root2) {
6009                 return False;
6010         }
6011
6012         p = strrchr_m(root1,'.');
6013         if (p) {
6014                 *p = 0;
6015                 ext1 = talloc_strdup(ctx, p+1);
6016         } else {
6017                 ext1 = talloc_strdup(ctx, "");
6018         }
6019         p = strrchr_m(root2,'.');
6020         if (p) {
6021                 *p = 0;
6022                 ext2 = talloc_strdup(ctx, p+1);
6023         } else {
6024                 ext2 = talloc_strdup(ctx, "");
6025         }
6026
6027         if (!ext1 || !ext2) {
6028                 return False;
6029         }
6030
6031         p = root1;
6032         p2 = root2;
6033         while (*p2) {
6034                 if (*p2 == '?') {
6035                         /* Hmmm. Should this be mb-aware ? */
6036                         *p2 = *p;
6037                         p2++;
6038                 } else if (*p2 == '*') {
6039                         *p2 = '\0';
6040                         root2 = talloc_asprintf(ctx, "%s%s",
6041                                                 root2,
6042                                                 p);
6043                         if (!root2) {
6044                                 return False;
6045                         }
6046                         break;
6047                 } else {
6048                         p2++;
6049                 }
6050                 if (*p) {
6051                         p++;
6052                 }
6053         }
6054
6055         p = ext1;
6056         p2 = ext2;
6057         while (*p2) {
6058                 if (*p2 == '?') {
6059                         /* Hmmm. Should this be mb-aware ? */
6060                         *p2 = *p;
6061                         p2++;
6062                 } else if (*p2 == '*') {
6063                         *p2 = '\0';
6064                         ext2 = talloc_asprintf(ctx, "%s%s",
6065                                                 ext2,
6066                                                 p);
6067                         if (!ext2) {
6068                                 return False;
6069                         }
6070                         break;
6071                 } else {
6072                         p2++;
6073                 }
6074                 if (*p) {
6075                         p++;
6076                 }
6077         }
6078
6079         if (*ext2) {
6080                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6081                                 name2_copy,
6082                                 root2,
6083                                 ext2);
6084         } else {
6085                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6086                                 name2_copy,
6087                                 root2);
6088         }
6089
6090         if (!*pp_newname) {
6091                 return False;
6092         }
6093
6094         return True;
6095 }
6096
6097 /****************************************************************************
6098  Ensure open files have their names updated. Updated to notify other smbd's
6099  asynchronously.
6100 ****************************************************************************/
6101
6102 static void rename_open_files(connection_struct *conn,
6103                               struct share_mode_lock *lck,
6104                               uint32_t orig_name_hash,
6105                               const struct smb_filename *smb_fname_dst)
6106 {
6107         files_struct *fsp;
6108         bool did_rename = False;
6109         NTSTATUS status;
6110         uint32_t new_name_hash = 0;
6111
6112         for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
6113             fsp = file_find_di_next(fsp)) {
6114                 /* fsp_name is a relative path under the fsp. To change this for other
6115                    sharepaths we need to manipulate relative paths. */
6116                 /* TODO - create the absolute path and manipulate the newname
6117                    relative to the sharepath. */
6118                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6119                         continue;
6120                 }
6121                 if (fsp->name_hash != orig_name_hash) {
6122                         continue;
6123                 }
6124                 DEBUG(10, ("rename_open_files: renaming file %s "
6125                            "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6126                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6127                            smb_fname_str_dbg(smb_fname_dst)));
6128
6129                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6130                 if (NT_STATUS_IS_OK(status)) {
6131                         did_rename = True;
6132                         new_name_hash = fsp->name_hash;
6133                 }
6134         }
6135
6136         if (!did_rename) {
6137                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6138                            "for %s\n", file_id_string_tos(&lck->data->id),
6139                            smb_fname_str_dbg(smb_fname_dst)));
6140         }
6141
6142         /* Send messages to all smbd's (not ourself) that the name has changed. */
6143         rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
6144                               orig_name_hash, new_name_hash,
6145                               smb_fname_dst);
6146
6147 }
6148
6149 /****************************************************************************
6150  We need to check if the source path is a parent directory of the destination
6151  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6152  refuse the rename with a sharing violation. Under UNIX the above call can
6153  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6154  probably need to check that the client is a Windows one before disallowing
6155  this as a UNIX client (one with UNIX extensions) can know the source is a
6156  symlink and make this decision intelligently. Found by an excellent bug
6157  report from <AndyLiebman@aol.com>.
6158 ****************************************************************************/
6159
6160 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6161                                      const struct smb_filename *smb_fname_dst)
6162 {
6163         const char *psrc = smb_fname_src->base_name;
6164         const char *pdst = smb_fname_dst->base_name;
6165         size_t slen;
6166
6167         if (psrc[0] == '.' && psrc[1] == '/') {
6168                 psrc += 2;
6169         }
6170         if (pdst[0] == '.' && pdst[1] == '/') {
6171                 pdst += 2;
6172         }
6173         if ((slen = strlen(psrc)) > strlen(pdst)) {
6174                 return False;
6175         }
6176         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6177 }
6178
6179 /*
6180  * Do the notify calls from a rename
6181  */
6182
6183 static void notify_rename(connection_struct *conn, bool is_dir,
6184                           const struct smb_filename *smb_fname_src,
6185                           const struct smb_filename *smb_fname_dst)
6186 {
6187         char *parent_dir_src = NULL;
6188         char *parent_dir_dst = NULL;
6189         uint32 mask;
6190
6191         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6192                 : FILE_NOTIFY_CHANGE_FILE_NAME;
6193
6194         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6195                             &parent_dir_src, NULL) ||
6196             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6197                             &parent_dir_dst, NULL)) {
6198                 goto out;
6199         }
6200
6201         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6202                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6203                              smb_fname_src->base_name);
6204                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6205                              smb_fname_dst->base_name);
6206         }
6207         else {
6208                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6209                              smb_fname_src->base_name);
6210                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6211                              smb_fname_dst->base_name);
6212         }
6213
6214         /* this is a strange one. w2k3 gives an additional event for
6215            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6216            files, but not directories */
6217         if (!is_dir) {
6218                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6219                              FILE_NOTIFY_CHANGE_ATTRIBUTES
6220                              |FILE_NOTIFY_CHANGE_CREATION,
6221                              smb_fname_dst->base_name);
6222         }
6223  out:
6224         TALLOC_FREE(parent_dir_src);
6225         TALLOC_FREE(parent_dir_dst);
6226 }
6227
6228 /****************************************************************************
6229  Returns an error if the parent directory for a filename is open in an
6230  incompatible way.
6231 ****************************************************************************/
6232
6233 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6234                                         const struct smb_filename *smb_fname_dst_in)
6235 {
6236         char *parent_dir = NULL;
6237         struct smb_filename smb_fname_parent;
6238         struct file_id id;
6239         files_struct *fsp = NULL;
6240         int ret;
6241
6242         if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6243                         &parent_dir, NULL)) {
6244                 return NT_STATUS_NO_MEMORY;
6245         }
6246         ZERO_STRUCT(smb_fname_parent);
6247         smb_fname_parent.base_name = parent_dir;
6248
6249         ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6250         if (ret == -1) {
6251                 return map_nt_error_from_unix(errno);
6252         }
6253
6254         /*
6255          * We're only checking on this smbd here, mostly good
6256          * enough.. and will pass tests.
6257          */
6258
6259         id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6260         for (fsp = file_find_di_first(conn->sconn, id); fsp;
6261                         fsp = file_find_di_next(fsp)) {
6262                 if (fsp->access_mask & DELETE_ACCESS) {
6263                         return NT_STATUS_SHARING_VIOLATION;
6264                 }
6265         }
6266         return NT_STATUS_OK;
6267 }
6268
6269 /****************************************************************************
6270  Rename an open file - given an fsp.
6271 ****************************************************************************/
6272
6273 NTSTATUS rename_internals_fsp(connection_struct *conn,
6274                         files_struct *fsp,
6275                         const struct smb_filename *smb_fname_dst_in,
6276                         uint32 attrs,
6277                         bool replace_if_exists)
6278 {
6279         TALLOC_CTX *ctx = talloc_tos();
6280         struct smb_filename *smb_fname_dst = NULL;
6281         NTSTATUS status = NT_STATUS_OK;
6282         struct share_mode_lock *lck = NULL;
6283         bool dst_exists, old_is_stream, new_is_stream;
6284
6285         status = check_name(conn, smb_fname_dst_in->base_name);
6286         if (!NT_STATUS_IS_OK(status)) {
6287                 return status;
6288         }
6289
6290         status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6291         if (!NT_STATUS_IS_OK(status)) {
6292                 return status;
6293         }
6294
6295         /* Make a copy of the dst smb_fname structs */
6296
6297         smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6298         if (smb_fname_dst == NULL) {
6299                 status = NT_STATUS_NO_MEMORY;
6300                 goto out;
6301         }
6302
6303         /*
6304          * Check for special case with case preserving and not
6305          * case sensitive. If the old last component differs from the original
6306          * last component only by case, then we should allow
6307          * the rename (user is trying to change the case of the
6308          * filename).
6309          */
6310         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6311             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6312             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6313                 char *last_slash;
6314                 char *fname_dst_lcomp_base_mod = NULL;
6315                 struct smb_filename *smb_fname_orig_lcomp = NULL;
6316
6317                 /*
6318                  * Get the last component of the destination name.
6319                  */
6320                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6321                 if (last_slash) {
6322                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6323                 } else {
6324                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6325                 }
6326                 if (!fname_dst_lcomp_base_mod) {
6327                         status = NT_STATUS_NO_MEMORY;
6328                         goto out;
6329                 }
6330
6331                 /*
6332                  * Create an smb_filename struct using the original last
6333                  * component of the destination.
6334                  */
6335                 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6336                         ctx, smb_fname_dst->original_lcomp, NULL);
6337                 if (smb_fname_orig_lcomp == NULL) {
6338                         status = NT_STATUS_NO_MEMORY;
6339                         TALLOC_FREE(fname_dst_lcomp_base_mod);
6340                         goto out;
6341                 }
6342
6343                 /* If the base names only differ by case, use original. */
6344                 if(!strcsequal(fname_dst_lcomp_base_mod,
6345                                smb_fname_orig_lcomp->base_name)) {
6346                         char *tmp;
6347                         /*
6348                          * Replace the modified last component with the
6349                          * original.
6350                          */
6351                         if (last_slash) {
6352                                 *last_slash = '\0'; /* Truncate at the '/' */
6353                                 tmp = talloc_asprintf(smb_fname_dst,
6354                                         "%s/%s",
6355                                         smb_fname_dst->base_name,
6356                                         smb_fname_orig_lcomp->base_name);
6357                         } else {
6358                                 tmp = talloc_asprintf(smb_fname_dst,
6359                                         "%s",
6360                                         smb_fname_orig_lcomp->base_name);
6361                         }
6362                         if (tmp == NULL) {
6363                                 status = NT_STATUS_NO_MEMORY;
6364                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6365                                 TALLOC_FREE(smb_fname_orig_lcomp);
6366                                 goto out;
6367                         }
6368                         TALLOC_FREE(smb_fname_dst->base_name);
6369                         smb_fname_dst->base_name = tmp;
6370                 }
6371
6372                 /* If the stream_names only differ by case, use original. */
6373                 if(!strcsequal(smb_fname_dst->stream_name,
6374                                smb_fname_orig_lcomp->stream_name)) {
6375                         char *tmp = NULL;
6376                         /* Use the original stream. */
6377                         tmp = talloc_strdup(smb_fname_dst,
6378                                             smb_fname_orig_lcomp->stream_name);
6379                         if (tmp == NULL) {
6380                                 status = NT_STATUS_NO_MEMORY;
6381                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6382                                 TALLOC_FREE(smb_fname_orig_lcomp);
6383                                 goto out;
6384                         }
6385                         TALLOC_FREE(smb_fname_dst->stream_name);
6386                         smb_fname_dst->stream_name = tmp;
6387                 }
6388                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6389                 TALLOC_FREE(smb_fname_orig_lcomp);
6390         }
6391
6392         /*
6393          * If the src and dest names are identical - including case,
6394          * don't do the rename, just return success.
6395          */
6396
6397         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6398             strcsequal(fsp->fsp_name->stream_name,
6399                        smb_fname_dst->stream_name)) {
6400                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6401                           "- returning success\n",
6402                           smb_fname_str_dbg(smb_fname_dst)));
6403                 status = NT_STATUS_OK;
6404                 goto out;
6405         }
6406
6407         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6408         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6409
6410         /* Return the correct error code if both names aren't streams. */
6411         if (!old_is_stream && new_is_stream) {
6412                 status = NT_STATUS_OBJECT_NAME_INVALID;
6413                 goto out;
6414         }
6415
6416         if (old_is_stream && !new_is_stream) {
6417                 status = NT_STATUS_INVALID_PARAMETER;
6418                 goto out;
6419         }
6420
6421         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6422
6423         if(!replace_if_exists && dst_exists) {
6424                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6425                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6426                           smb_fname_str_dbg(smb_fname_dst)));
6427                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6428                 goto out;
6429         }
6430
6431         if (dst_exists) {
6432                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6433                     &smb_fname_dst->st);
6434                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6435                                                            fileid);
6436                 /* The file can be open when renaming a stream */
6437                 if (dst_fsp && !new_is_stream) {
6438                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6439                         status = NT_STATUS_ACCESS_DENIED;
6440                         goto out;
6441                 }
6442         }
6443
6444         /* Ensure we have a valid stat struct for the source. */
6445         status = vfs_stat_fsp(fsp);
6446         if (!NT_STATUS_IS_OK(status)) {
6447                 goto out;
6448         }
6449
6450         status = can_rename(conn, fsp, attrs);
6451
6452         if (!NT_STATUS_IS_OK(status)) {
6453                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6454                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6455                           smb_fname_str_dbg(smb_fname_dst)));
6456                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6457                         status = NT_STATUS_ACCESS_DENIED;
6458                 goto out;
6459         }
6460
6461         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6462                 status = NT_STATUS_ACCESS_DENIED;
6463         }
6464
6465         lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6466
6467         /*
6468          * We have the file open ourselves, so not being able to get the
6469          * corresponding share mode lock is a fatal error.
6470          */
6471
6472         SMB_ASSERT(lck != NULL);
6473
6474         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6475                 uint32 create_options = fsp->fh->private_options;
6476
6477                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6478                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6479                           smb_fname_str_dbg(smb_fname_dst)));
6480
6481                 if (!fsp->is_directory &&
6482                     !lp_posix_pathnames() &&
6483                     (lp_map_archive(SNUM(conn)) ||
6484                     lp_store_dos_attributes(SNUM(conn)))) {
6485                         /* We must set the archive bit on the newly
6486                            renamed file. */
6487                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6488                                 uint32_t old_dosmode = dos_mode(conn,
6489                                                         smb_fname_dst);
6490                                 file_set_dosmode(conn,
6491                                         smb_fname_dst,
6492                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6493                                         NULL,
6494                                         true);
6495                         }
6496                 }
6497
6498                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6499                               smb_fname_dst);
6500
6501                 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6502
6503                 /*
6504                  * A rename acts as a new file create w.r.t. allowing an initial delete
6505                  * on close, probably because in Windows there is a new handle to the
6506                  * new file. If initial delete on close was requested but not
6507                  * originally set, we need to set it here. This is probably not 100% correct,
6508                  * but will work for the CIFSFS client which in non-posix mode
6509                  * depends on these semantics. JRA.
6510                  */
6511
6512                 if (create_options & FILE_DELETE_ON_CLOSE) {
6513                         status = can_set_delete_on_close(fsp, 0);
6514
6515                         if (NT_STATUS_IS_OK(status)) {
6516                                 /* Note that here we set the *inital* delete on close flag,
6517                                  * not the regular one. The magic gets handled in close. */
6518                                 fsp->initial_delete_on_close = True;
6519                         }
6520                 }
6521                 TALLOC_FREE(lck);
6522                 status = NT_STATUS_OK;
6523                 goto out;
6524         }
6525
6526         TALLOC_FREE(lck);
6527
6528         if (errno == ENOTDIR || errno == EISDIR) {
6529                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6530         } else {
6531                 status = map_nt_error_from_unix(errno);
6532         }
6533
6534         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6535                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6536                   smb_fname_str_dbg(smb_fname_dst)));
6537
6538  out:
6539         TALLOC_FREE(smb_fname_dst);
6540
6541         return status;
6542 }
6543
6544 /****************************************************************************
6545  The guts of the rename command, split out so it may be called by the NT SMB
6546  code.
6547 ****************************************************************************/
6548
6549 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6550                         connection_struct *conn,
6551                         struct smb_request *req,
6552                         struct smb_filename *smb_fname_src,
6553                         struct smb_filename *smb_fname_dst,
6554                         uint32 attrs,
6555                         bool replace_if_exists,
6556                         bool src_has_wild,
6557                         bool dest_has_wild,
6558                         uint32_t access_mask)
6559 {
6560         char *fname_src_dir = NULL;
6561         char *fname_src_mask = NULL;
6562         int count=0;
6563         NTSTATUS status = NT_STATUS_OK;
6564         struct smb_Dir *dir_hnd = NULL;
6565         const char *dname = NULL;
6566         char *talloced = NULL;
6567         long offset = 0;
6568         int create_options = 0;
6569         bool posix_pathnames = lp_posix_pathnames();
6570         int rc;
6571
6572         /*
6573          * Split the old name into directory and last component
6574          * strings. Note that unix_convert may have stripped off a
6575          * leading ./ from both name and newname if the rename is
6576          * at the root of the share. We need to make sure either both
6577          * name and newname contain a / character or neither of them do
6578          * as this is checked in resolve_wildcards().
6579          */
6580
6581         /* Split up the directory from the filename/mask. */
6582         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6583                                       &fname_src_dir, &fname_src_mask);
6584         if (!NT_STATUS_IS_OK(status)) {
6585                 status = NT_STATUS_NO_MEMORY;
6586                 goto out;
6587         }
6588
6589         /*
6590          * We should only check the mangled cache
6591          * here if unix_convert failed. This means
6592          * that the path in 'mask' doesn't exist
6593          * on the file system and so we need to look
6594          * for a possible mangle. This patch from
6595          * Tine Smukavec <valentin.smukavec@hermes.si>.
6596          */
6597
6598         if (!VALID_STAT(smb_fname_src->st) &&
6599             mangle_is_mangled(fname_src_mask, conn->params)) {
6600                 char *new_mask = NULL;
6601                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6602                                             conn->params);
6603                 if (new_mask) {
6604                         TALLOC_FREE(fname_src_mask);
6605                         fname_src_mask = new_mask;
6606                 }
6607         }
6608
6609         if (!src_has_wild) {
6610                 files_struct *fsp;
6611
6612                 /*
6613                  * Only one file needs to be renamed. Append the mask back
6614                  * onto the directory.
6615                  */
6616                 TALLOC_FREE(smb_fname_src->base_name);
6617                 if (ISDOT(fname_src_dir)) {
6618                         /* Ensure we use canonical names on open. */
6619                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6620                                                         "%s",
6621                                                         fname_src_mask);
6622                 } else {
6623                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6624                                                         "%s/%s",
6625                                                         fname_src_dir,
6626                                                         fname_src_mask);
6627                 }
6628                 if (!smb_fname_src->base_name) {
6629                         status = NT_STATUS_NO_MEMORY;
6630                         goto out;
6631                 }
6632
6633                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6634                           "case_preserve = %d, short case preserve = %d, "
6635                           "directory = %s, newname = %s, "
6636                           "last_component_dest = %s\n",
6637                           conn->case_sensitive, conn->case_preserve,
6638                           conn->short_case_preserve,
6639                           smb_fname_str_dbg(smb_fname_src),
6640                           smb_fname_str_dbg(smb_fname_dst),
6641                           smb_fname_dst->original_lcomp));
6642
6643                 /* The dest name still may have wildcards. */
6644                 if (dest_has_wild) {
6645                         char *fname_dst_mod = NULL;
6646                         if (!resolve_wildcards(smb_fname_dst,
6647                                                smb_fname_src->base_name,
6648                                                smb_fname_dst->base_name,
6649                                                &fname_dst_mod)) {
6650                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6651                                           "%s %s failed\n",
6652                                           smb_fname_src->base_name,
6653                                           smb_fname_dst->base_name));
6654                                 status = NT_STATUS_NO_MEMORY;
6655                                 goto out;
6656                         }
6657                         TALLOC_FREE(smb_fname_dst->base_name);
6658                         smb_fname_dst->base_name = fname_dst_mod;
6659                 }
6660
6661                 ZERO_STRUCT(smb_fname_src->st);
6662                 if (posix_pathnames) {
6663                         rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6664                 } else {
6665                         rc = SMB_VFS_STAT(conn, smb_fname_src);
6666                 }
6667                 if (rc == -1) {
6668                         status = map_nt_error_from_unix_common(errno);
6669                         goto out;
6670                 }
6671
6672                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6673                         create_options |= FILE_DIRECTORY_FILE;
6674                 }
6675
6676                 status = SMB_VFS_CREATE_FILE(
6677                         conn,                           /* conn */
6678                         req,                            /* req */
6679                         0,                              /* root_dir_fid */
6680                         smb_fname_src,                  /* fname */
6681                         access_mask,                    /* access_mask */
6682                         (FILE_SHARE_READ |              /* share_access */
6683                             FILE_SHARE_WRITE),
6684                         FILE_OPEN,                      /* create_disposition*/
6685                         create_options,                 /* create_options */
6686                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6687                         0,                              /* oplock_request */
6688                         0,                              /* allocation_size */
6689                         0,                              /* private_flags */
6690                         NULL,                           /* sd */
6691                         NULL,                           /* ea_list */
6692                         &fsp,                           /* result */
6693                         NULL);                          /* pinfo */
6694
6695                 if (!NT_STATUS_IS_OK(status)) {
6696                         DEBUG(3, ("Could not open rename source %s: %s\n",
6697                                   smb_fname_str_dbg(smb_fname_src),
6698                                   nt_errstr(status)));
6699                         goto out;
6700                 }
6701
6702                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6703                                               attrs, replace_if_exists);
6704
6705                 close_file(req, fsp, NORMAL_CLOSE);
6706
6707                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6708                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6709                           smb_fname_str_dbg(smb_fname_dst)));
6710
6711                 goto out;
6712         }
6713
6714         /*
6715          * Wildcards - process each file that matches.
6716          */
6717         if (strequal(fname_src_mask, "????????.???")) {
6718                 TALLOC_FREE(fname_src_mask);
6719                 fname_src_mask = talloc_strdup(ctx, "*");
6720                 if (!fname_src_mask) {
6721                         status = NT_STATUS_NO_MEMORY;
6722                         goto out;
6723                 }
6724         }
6725
6726         status = check_name(conn, fname_src_dir);
6727         if (!NT_STATUS_IS_OK(status)) {
6728                 goto out;
6729         }
6730
6731         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6732                           attrs);
6733         if (dir_hnd == NULL) {
6734                 status = map_nt_error_from_unix(errno);
6735                 goto out;
6736         }
6737
6738         status = NT_STATUS_NO_SUCH_FILE;
6739         /*
6740          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6741          * - gentest fix. JRA
6742          */
6743
6744         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6745                                     &talloced))) {
6746                 files_struct *fsp = NULL;
6747                 char *destname = NULL;
6748                 bool sysdir_entry = False;
6749
6750                 /* Quick check for "." and ".." */
6751                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6752                         if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6753                                 sysdir_entry = True;
6754                         } else {
6755                                 TALLOC_FREE(talloced);
6756                                 continue;
6757                         }
6758                 }
6759
6760                 if (!is_visible_file(conn, fname_src_dir, dname,
6761                                      &smb_fname_src->st, false)) {
6762                         TALLOC_FREE(talloced);
6763                         continue;
6764                 }
6765
6766                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6767                         TALLOC_FREE(talloced);
6768                         continue;
6769                 }
6770
6771                 if (sysdir_entry) {
6772                         status = NT_STATUS_OBJECT_NAME_INVALID;
6773                         break;
6774                 }
6775
6776                 TALLOC_FREE(smb_fname_src->base_name);
6777                 if (ISDOT(fname_src_dir)) {
6778                         /* Ensure we use canonical names on open. */
6779                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6780                                                         "%s",
6781                                                         dname);
6782                 } else {
6783                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6784                                                         "%s/%s",
6785                                                         fname_src_dir,
6786                                                         dname);
6787                 }
6788                 if (!smb_fname_src->base_name) {
6789                         status = NT_STATUS_NO_MEMORY;
6790                         goto out;
6791                 }
6792
6793                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6794                                        smb_fname_dst->base_name,
6795                                        &destname)) {
6796                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6797                                   smb_fname_src->base_name, destname));
6798                         TALLOC_FREE(talloced);
6799                         continue;
6800                 }
6801                 if (!destname) {
6802                         status = NT_STATUS_NO_MEMORY;
6803                         goto out;
6804                 }
6805
6806                 TALLOC_FREE(smb_fname_dst->base_name);
6807                 smb_fname_dst->base_name = destname;
6808
6809                 ZERO_STRUCT(smb_fname_src->st);
6810                 if (posix_pathnames) {
6811                         SMB_VFS_LSTAT(conn, smb_fname_src);
6812                 } else {
6813                         SMB_VFS_STAT(conn, smb_fname_src);
6814                 }
6815
6816                 create_options = 0;
6817
6818                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6819                         create_options |= FILE_DIRECTORY_FILE;
6820                 }
6821
6822                 status = SMB_VFS_CREATE_FILE(
6823                         conn,                           /* conn */
6824                         req,                            /* req */
6825                         0,                              /* root_dir_fid */
6826                         smb_fname_src,                  /* fname */
6827                         access_mask,                    /* access_mask */
6828                         (FILE_SHARE_READ |              /* share_access */
6829                             FILE_SHARE_WRITE),
6830                         FILE_OPEN,                      /* create_disposition*/
6831                         create_options,                 /* create_options */
6832                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6833                         0,                              /* oplock_request */
6834                         0,                              /* allocation_size */
6835                         0,                              /* private_flags */
6836                         NULL,                           /* sd */
6837                         NULL,                           /* ea_list */
6838                         &fsp,                           /* result */
6839                         NULL);                          /* pinfo */
6840
6841                 if (!NT_STATUS_IS_OK(status)) {
6842                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6843                                  "returned %s rename %s -> %s\n",
6844                                  nt_errstr(status),
6845                                  smb_fname_str_dbg(smb_fname_src),
6846                                  smb_fname_str_dbg(smb_fname_dst)));
6847                         break;
6848                 }
6849
6850                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6851                                                               dname);
6852                 if (!smb_fname_dst->original_lcomp) {
6853                         status = NT_STATUS_NO_MEMORY;
6854                         goto out;
6855                 }
6856
6857                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6858                                               attrs, replace_if_exists);
6859
6860                 close_file(req, fsp, NORMAL_CLOSE);
6861
6862                 if (!NT_STATUS_IS_OK(status)) {
6863                         DEBUG(3, ("rename_internals_fsp returned %s for "
6864                                   "rename %s -> %s\n", nt_errstr(status),
6865                                   smb_fname_str_dbg(smb_fname_src),
6866                                   smb_fname_str_dbg(smb_fname_dst)));
6867                         break;
6868                 }
6869
6870                 count++;
6871
6872                 DEBUG(3,("rename_internals: doing rename on %s -> "
6873                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6874                          smb_fname_str_dbg(smb_fname_src)));
6875                 TALLOC_FREE(talloced);
6876         }
6877         TALLOC_FREE(dir_hnd);
6878
6879         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6880                 status = map_nt_error_from_unix(errno);
6881         }
6882
6883  out:
6884         TALLOC_FREE(talloced);
6885         TALLOC_FREE(fname_src_dir);
6886         TALLOC_FREE(fname_src_mask);
6887         return status;
6888 }
6889
6890 /****************************************************************************
6891  Reply to a mv.
6892 ****************************************************************************/
6893
6894 void reply_mv(struct smb_request *req)
6895 {
6896         connection_struct *conn = req->conn;
6897         char *name = NULL;
6898         char *newname = NULL;
6899         const char *p;
6900         uint32 attrs;
6901         NTSTATUS status;
6902         bool src_has_wcard = False;
6903         bool dest_has_wcard = False;
6904         TALLOC_CTX *ctx = talloc_tos();
6905         struct smb_filename *smb_fname_src = NULL;
6906         struct smb_filename *smb_fname_dst = NULL;
6907         uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6908         uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6909         bool stream_rename = false;
6910
6911         START_PROFILE(SMBmv);
6912
6913         if (req->wct < 1) {
6914                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6915                 goto out;
6916         }
6917
6918         attrs = SVAL(req->vwv+0, 0);
6919
6920         p = (const char *)req->buf + 1;
6921         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6922                                        &status, &src_has_wcard);
6923         if (!NT_STATUS_IS_OK(status)) {
6924                 reply_nterror(req, status);
6925                 goto out;
6926         }
6927         p++;
6928         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6929                                        &status, &dest_has_wcard);
6930         if (!NT_STATUS_IS_OK(status)) {
6931                 reply_nterror(req, status);
6932                 goto out;
6933         }
6934
6935         if (!lp_posix_pathnames()) {
6936                 /* The newname must begin with a ':' if the
6937                    name contains a ':'. */
6938                 if (strchr_m(name, ':')) {
6939                         if (newname[0] != ':') {
6940                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6941                                 goto out;
6942                         }
6943                         stream_rename = true;
6944                 }
6945         }
6946
6947         status = filename_convert(ctx,
6948                                   conn,
6949                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6950                                   name,
6951                                   src_ucf_flags,
6952                                   &src_has_wcard,
6953                                   &smb_fname_src);
6954
6955         if (!NT_STATUS_IS_OK(status)) {
6956                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6957                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6958                                         ERRSRV, ERRbadpath);
6959                         goto out;
6960                 }
6961                 reply_nterror(req, status);
6962                 goto out;
6963         }
6964
6965         status = filename_convert(ctx,
6966                                   conn,
6967                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6968                                   newname,
6969                                   dst_ucf_flags,
6970                                   &dest_has_wcard,
6971                                   &smb_fname_dst);
6972
6973         if (!NT_STATUS_IS_OK(status)) {
6974                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6975                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6976                                         ERRSRV, ERRbadpath);
6977                         goto out;
6978                 }
6979                 reply_nterror(req, status);
6980                 goto out;
6981         }
6982
6983         if (stream_rename) {
6984                 /* smb_fname_dst->base_name must be the same as
6985                    smb_fname_src->base_name. */
6986                 TALLOC_FREE(smb_fname_dst->base_name);
6987                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6988                                                 smb_fname_src->base_name);
6989                 if (!smb_fname_dst->base_name) {
6990                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6991                         goto out;
6992                 }
6993         }
6994
6995         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6996                  smb_fname_str_dbg(smb_fname_dst)));
6997
6998         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6999                                   attrs, False, src_has_wcard, dest_has_wcard,
7000                                   DELETE_ACCESS);
7001         if (!NT_STATUS_IS_OK(status)) {
7002                 if (open_was_deferred(req->sconn, req->mid)) {
7003                         /* We have re-scheduled this call. */
7004                         goto out;
7005                 }
7006                 reply_nterror(req, status);
7007                 goto out;
7008         }
7009
7010         reply_outbuf(req, 0, 0);
7011  out:
7012         TALLOC_FREE(smb_fname_src);
7013         TALLOC_FREE(smb_fname_dst);
7014         END_PROFILE(SMBmv);
7015         return;
7016 }
7017
7018 /*******************************************************************
7019  Copy a file as part of a reply_copy.
7020 ******************************************************************/
7021
7022 /*
7023  * TODO: check error codes on all callers
7024  */
7025
7026 NTSTATUS copy_file(TALLOC_CTX *ctx,
7027                         connection_struct *conn,
7028                         struct smb_filename *smb_fname_src,
7029                         struct smb_filename *smb_fname_dst,
7030                         int ofun,
7031                         int count,
7032                         bool target_is_directory)
7033 {
7034         struct smb_filename *smb_fname_dst_tmp = NULL;
7035         off_t ret=-1;
7036         files_struct *fsp1,*fsp2;
7037         uint32 dosattrs;
7038         uint32 new_create_disposition;
7039         NTSTATUS status;
7040
7041
7042         smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7043         if (smb_fname_dst_tmp == NULL) {
7044                 return NT_STATUS_NO_MEMORY;
7045         }
7046
7047         /*
7048          * If the target is a directory, extract the last component from the
7049          * src filename and append it to the dst filename
7050          */
7051         if (target_is_directory) {
7052                 const char *p;
7053
7054                 /* dest/target can't be a stream if it's a directory. */
7055                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7056
7057                 p = strrchr_m(smb_fname_src->base_name,'/');
7058                 if (p) {
7059                         p++;
7060                 } else {
7061                         p = smb_fname_src->base_name;
7062                 }
7063                 smb_fname_dst_tmp->base_name =
7064                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7065                                            p);
7066                 if (!smb_fname_dst_tmp->base_name) {
7067                         status = NT_STATUS_NO_MEMORY;
7068                         goto out;
7069                 }
7070         }
7071
7072         status = vfs_file_exist(conn, smb_fname_src);
7073         if (!NT_STATUS_IS_OK(status)) {
7074                 goto out;
7075         }
7076
7077         if (!target_is_directory && count) {
7078                 new_create_disposition = FILE_OPEN;
7079         } else {
7080                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7081                                                  0, ofun,
7082                                                  NULL, NULL,
7083                                                  &new_create_disposition,
7084                                                  NULL,
7085                                                  NULL)) {
7086                         status = NT_STATUS_INVALID_PARAMETER;
7087                         goto out;
7088                 }
7089         }
7090
7091         /* Open the src file for reading. */
7092         status = SMB_VFS_CREATE_FILE(
7093                 conn,                                   /* conn */
7094                 NULL,                                   /* req */
7095                 0,                                      /* root_dir_fid */
7096                 smb_fname_src,                          /* fname */
7097                 FILE_GENERIC_READ,                      /* access_mask */
7098                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7099                 FILE_OPEN,                              /* create_disposition*/
7100                 0,                                      /* create_options */
7101                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
7102                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7103                 0,                                      /* allocation_size */
7104                 0,                                      /* private_flags */
7105                 NULL,                                   /* sd */
7106                 NULL,                                   /* ea_list */
7107                 &fsp1,                                  /* result */
7108                 NULL);                                  /* psbuf */
7109
7110         if (!NT_STATUS_IS_OK(status)) {
7111                 goto out;
7112         }
7113
7114         dosattrs = dos_mode(conn, smb_fname_src);
7115
7116         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7117                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7118         }
7119
7120         /* Open the dst file for writing. */
7121         status = SMB_VFS_CREATE_FILE(
7122                 conn,                                   /* conn */
7123                 NULL,                                   /* req */
7124                 0,                                      /* root_dir_fid */
7125                 smb_fname_dst,                          /* fname */
7126                 FILE_GENERIC_WRITE,                     /* access_mask */
7127                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7128                 new_create_disposition,                 /* create_disposition*/
7129                 0,                                      /* create_options */
7130                 dosattrs,                               /* file_attributes */
7131                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7132                 0,                                      /* allocation_size */
7133                 0,                                      /* private_flags */
7134                 NULL,                                   /* sd */
7135                 NULL,                                   /* ea_list */
7136                 &fsp2,                                  /* result */
7137                 NULL);                                  /* psbuf */
7138
7139         if (!NT_STATUS_IS_OK(status)) {
7140                 close_file(NULL, fsp1, ERROR_CLOSE);
7141                 goto out;
7142         }
7143
7144         if (ofun & OPENX_FILE_EXISTS_OPEN) {
7145                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7146                 if (ret == -1) {
7147                         DEBUG(0, ("error - vfs lseek returned error %s\n",
7148                                 strerror(errno)));
7149                         status = map_nt_error_from_unix(errno);
7150                         close_file(NULL, fsp1, ERROR_CLOSE);
7151                         close_file(NULL, fsp2, ERROR_CLOSE);
7152                         goto out;
7153                 }
7154         }
7155
7156         /* Do the actual copy. */
7157         if (smb_fname_src->st.st_ex_size) {
7158                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7159         } else {
7160                 ret = 0;
7161         }
7162
7163         close_file(NULL, fsp1, NORMAL_CLOSE);
7164
7165         /* Ensure the modtime is set correctly on the destination file. */
7166         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7167
7168         /*
7169          * As we are opening fsp1 read-only we only expect
7170          * an error on close on fsp2 if we are out of space.
7171          * Thus we don't look at the error return from the
7172          * close of fsp1.
7173          */
7174         status = close_file(NULL, fsp2, NORMAL_CLOSE);
7175
7176         if (!NT_STATUS_IS_OK(status)) {
7177                 goto out;
7178         }
7179
7180         if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7181                 status = NT_STATUS_DISK_FULL;
7182                 goto out;
7183         }
7184
7185         status = NT_STATUS_OK;
7186
7187  out:
7188         TALLOC_FREE(smb_fname_dst_tmp);
7189         return status;
7190 }
7191
7192 /****************************************************************************
7193  Reply to a file copy.
7194 ****************************************************************************/
7195
7196 void reply_copy(struct smb_request *req)
7197 {
7198         connection_struct *conn = req->conn;
7199         struct smb_filename *smb_fname_src = NULL;
7200         struct smb_filename *smb_fname_dst = NULL;
7201         char *fname_src = NULL;
7202         char *fname_dst = NULL;
7203         char *fname_src_mask = NULL;
7204         char *fname_src_dir = NULL;
7205         const char *p;
7206         int count=0;
7207         int error = ERRnoaccess;
7208         int tid2;
7209         int ofun;
7210         int flags;
7211         bool target_is_directory=False;
7212         bool source_has_wild = False;
7213         bool dest_has_wild = False;
7214         NTSTATUS status;
7215         TALLOC_CTX *ctx = talloc_tos();
7216
7217         START_PROFILE(SMBcopy);
7218
7219         if (req->wct < 3) {
7220                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7221                 goto out;
7222         }
7223
7224         tid2 = SVAL(req->vwv+0, 0);
7225         ofun = SVAL(req->vwv+1, 0);
7226         flags = SVAL(req->vwv+2, 0);
7227
7228         p = (const char *)req->buf;
7229         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7230                                        &status, &source_has_wild);
7231         if (!NT_STATUS_IS_OK(status)) {
7232                 reply_nterror(req, status);
7233                 goto out;
7234         }
7235         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7236                                        &status, &dest_has_wild);
7237         if (!NT_STATUS_IS_OK(status)) {
7238                 reply_nterror(req, status);
7239                 goto out;
7240         }
7241
7242         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7243
7244         if (tid2 != conn->cnum) {
7245                 /* can't currently handle inter share copies XXXX */
7246                 DEBUG(3,("Rejecting inter-share copy\n"));
7247                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7248                 goto out;
7249         }
7250
7251         status = filename_convert(ctx, conn,
7252                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7253                                   fname_src,
7254                                   UCF_COND_ALLOW_WCARD_LCOMP,
7255                                   &source_has_wild,
7256                                   &smb_fname_src);
7257         if (!NT_STATUS_IS_OK(status)) {
7258                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7259                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7260                                         ERRSRV, ERRbadpath);
7261                         goto out;
7262                 }
7263                 reply_nterror(req, status);
7264                 goto out;
7265         }
7266
7267         status = filename_convert(ctx, conn,
7268                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7269                                   fname_dst,
7270                                   UCF_COND_ALLOW_WCARD_LCOMP,
7271                                   &dest_has_wild,
7272                                   &smb_fname_dst);
7273         if (!NT_STATUS_IS_OK(status)) {
7274                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7275                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7276                                         ERRSRV, ERRbadpath);
7277                         goto out;
7278                 }
7279                 reply_nterror(req, status);
7280                 goto out;
7281         }
7282
7283         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7284
7285         if ((flags&1) && target_is_directory) {
7286                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7287                 goto out;
7288         }
7289
7290         if ((flags&2) && !target_is_directory) {
7291                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7292                 goto out;
7293         }
7294
7295         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7296                 /* wants a tree copy! XXXX */
7297                 DEBUG(3,("Rejecting tree copy\n"));
7298                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7299                 goto out;
7300         }
7301
7302         /* Split up the directory from the filename/mask. */
7303         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7304                                       &fname_src_dir, &fname_src_mask);
7305         if (!NT_STATUS_IS_OK(status)) {
7306                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7307                 goto out;
7308         }
7309
7310         /*
7311          * We should only check the mangled cache
7312          * here if unix_convert failed. This means
7313          * that the path in 'mask' doesn't exist
7314          * on the file system and so we need to look
7315          * for a possible mangle. This patch from
7316          * Tine Smukavec <valentin.smukavec@hermes.si>.
7317          */
7318         if (!VALID_STAT(smb_fname_src->st) &&
7319             mangle_is_mangled(fname_src_mask, conn->params)) {
7320                 char *new_mask = NULL;
7321                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7322                                             &new_mask, conn->params);
7323
7324                 /* Use demangled name if one was successfully found. */
7325                 if (new_mask) {
7326                         TALLOC_FREE(fname_src_mask);
7327                         fname_src_mask = new_mask;
7328                 }
7329         }
7330
7331         if (!source_has_wild) {
7332
7333                 /*
7334                  * Only one file needs to be copied. Append the mask back onto
7335                  * the directory.
7336                  */
7337                 TALLOC_FREE(smb_fname_src->base_name);
7338                 if (ISDOT(fname_src_dir)) {
7339                         /* Ensure we use canonical names on open. */
7340                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7341                                                         "%s",
7342                                                         fname_src_mask);
7343                 } else {
7344                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7345                                                         "%s/%s",
7346                                                         fname_src_dir,
7347                                                         fname_src_mask);
7348                 }
7349                 if (!smb_fname_src->base_name) {
7350                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7351                         goto out;
7352                 }
7353
7354                 if (dest_has_wild) {
7355                         char *fname_dst_mod = NULL;
7356                         if (!resolve_wildcards(smb_fname_dst,
7357                                                smb_fname_src->base_name,
7358                                                smb_fname_dst->base_name,
7359                                                &fname_dst_mod)) {
7360                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7361                                 goto out;
7362                         }
7363                         TALLOC_FREE(smb_fname_dst->base_name);
7364                         smb_fname_dst->base_name = fname_dst_mod;
7365                 }
7366
7367                 status = check_name(conn, smb_fname_src->base_name);
7368                 if (!NT_STATUS_IS_OK(status)) {
7369                         reply_nterror(req, status);
7370                         goto out;
7371                 }
7372
7373                 status = check_name(conn, smb_fname_dst->base_name);
7374                 if (!NT_STATUS_IS_OK(status)) {
7375                         reply_nterror(req, status);
7376                         goto out;
7377                 }
7378
7379                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7380                                    ofun, count, target_is_directory);
7381
7382                 if(!NT_STATUS_IS_OK(status)) {
7383                         reply_nterror(req, status);
7384                         goto out;
7385                 } else {
7386                         count++;
7387                 }
7388         } else {
7389                 struct smb_Dir *dir_hnd = NULL;
7390                 const char *dname = NULL;
7391                 char *talloced = NULL;
7392                 long offset = 0;
7393
7394                 /*
7395                  * There is a wildcard that requires us to actually read the
7396                  * src dir and copy each file matching the mask to the dst.
7397                  * Right now streams won't be copied, but this could
7398                  * presumably be added with a nested loop for reach dir entry.
7399                  */
7400                 SMB_ASSERT(!smb_fname_src->stream_name);
7401                 SMB_ASSERT(!smb_fname_dst->stream_name);
7402
7403                 smb_fname_src->stream_name = NULL;
7404                 smb_fname_dst->stream_name = NULL;
7405
7406                 if (strequal(fname_src_mask,"????????.???")) {
7407                         TALLOC_FREE(fname_src_mask);
7408                         fname_src_mask = talloc_strdup(ctx, "*");
7409                         if (!fname_src_mask) {
7410                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7411                                 goto out;
7412                         }
7413                 }
7414
7415                 status = check_name(conn, fname_src_dir);
7416                 if (!NT_STATUS_IS_OK(status)) {
7417                         reply_nterror(req, status);
7418                         goto out;
7419                 }
7420
7421                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7422                 if (dir_hnd == NULL) {
7423                         status = map_nt_error_from_unix(errno);
7424                         reply_nterror(req, status);
7425                         goto out;
7426                 }
7427
7428                 error = ERRbadfile;
7429
7430                 /* Iterate over the src dir copying each entry to the dst. */
7431                 while ((dname = ReadDirName(dir_hnd, &offset,
7432                                             &smb_fname_src->st, &talloced))) {
7433                         char *destname = NULL;
7434
7435                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7436                                 TALLOC_FREE(talloced);
7437                                 continue;
7438                         }
7439
7440                         if (!is_visible_file(conn, fname_src_dir, dname,
7441                                              &smb_fname_src->st, false)) {
7442                                 TALLOC_FREE(talloced);
7443                                 continue;
7444                         }
7445
7446                         if(!mask_match(dname, fname_src_mask,
7447                                        conn->case_sensitive)) {
7448                                 TALLOC_FREE(talloced);
7449                                 continue;
7450                         }
7451
7452                         error = ERRnoaccess;
7453
7454                         /* Get the src smb_fname struct setup. */
7455                         TALLOC_FREE(smb_fname_src->base_name);
7456                         if (ISDOT(fname_src_dir)) {
7457                                 /* Ensure we use canonical names on open. */
7458                                 smb_fname_src->base_name =
7459                                         talloc_asprintf(smb_fname_src, "%s",
7460                                                 dname);
7461                         } else {
7462                                 smb_fname_src->base_name =
7463                                         talloc_asprintf(smb_fname_src, "%s/%s",
7464                                                 fname_src_dir, dname);
7465                         }
7466
7467                         if (!smb_fname_src->base_name) {
7468                                 TALLOC_FREE(dir_hnd);
7469                                 TALLOC_FREE(talloced);
7470                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7471                                 goto out;
7472                         }
7473
7474                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7475                                                smb_fname_dst->base_name,
7476                                                &destname)) {
7477                                 TALLOC_FREE(talloced);
7478                                 continue;
7479                         }
7480                         if (!destname) {
7481                                 TALLOC_FREE(dir_hnd);
7482                                 TALLOC_FREE(talloced);
7483                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7484                                 goto out;
7485                         }
7486
7487                         TALLOC_FREE(smb_fname_dst->base_name);
7488                         smb_fname_dst->base_name = destname;
7489
7490                         status = check_name(conn, smb_fname_src->base_name);
7491                         if (!NT_STATUS_IS_OK(status)) {
7492                                 TALLOC_FREE(dir_hnd);
7493                                 TALLOC_FREE(talloced);
7494                                 reply_nterror(req, status);
7495                                 goto out;
7496                         }
7497
7498                         status = check_name(conn, smb_fname_dst->base_name);
7499                         if (!NT_STATUS_IS_OK(status)) {
7500                                 TALLOC_FREE(dir_hnd);
7501                                 TALLOC_FREE(talloced);
7502                                 reply_nterror(req, status);
7503                                 goto out;
7504                         }
7505
7506                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7507                                 smb_fname_src->base_name,
7508                                 smb_fname_dst->base_name));
7509
7510                         status = copy_file(ctx, conn, smb_fname_src,
7511                                            smb_fname_dst, ofun, count,
7512                                            target_is_directory);
7513                         if (NT_STATUS_IS_OK(status)) {
7514                                 count++;
7515                         }
7516
7517                         TALLOC_FREE(talloced);
7518                 }
7519                 TALLOC_FREE(dir_hnd);
7520         }
7521
7522         if (count == 0) {
7523                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7524                 goto out;
7525         }
7526
7527         reply_outbuf(req, 1, 0);
7528         SSVAL(req->outbuf,smb_vwv0,count);
7529  out:
7530         TALLOC_FREE(smb_fname_src);
7531         TALLOC_FREE(smb_fname_dst);
7532         TALLOC_FREE(fname_src);
7533         TALLOC_FREE(fname_dst);
7534         TALLOC_FREE(fname_src_mask);
7535         TALLOC_FREE(fname_src_dir);
7536
7537         END_PROFILE(SMBcopy);
7538         return;
7539 }
7540
7541 #undef DBGC_CLASS
7542 #define DBGC_CLASS DBGC_LOCKING
7543
7544 /****************************************************************************
7545  Get a lock pid, dealing with large count requests.
7546 ****************************************************************************/
7547
7548 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7549                     bool large_file_format)
7550 {
7551         if(!large_file_format)
7552                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7553         else
7554                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7555 }
7556
7557 /****************************************************************************
7558  Get a lock count, dealing with large count requests.
7559 ****************************************************************************/
7560
7561 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7562                         bool large_file_format)
7563 {
7564         uint64_t count = 0;
7565
7566         if(!large_file_format) {
7567                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7568         } else {
7569
7570 #if defined(HAVE_LONGLONG)
7571                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7572                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7573 #else /* HAVE_LONGLONG */
7574
7575                 /*
7576                  * NT4.x seems to be broken in that it sends large file (64 bit)
7577                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7578                  * negotiated. For boxes without large unsigned ints truncate the
7579                  * lock count by dropping the top 32 bits.
7580                  */
7581
7582                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7583                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7584                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7585                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7586                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7587                 }
7588
7589                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7590 #endif /* HAVE_LONGLONG */
7591         }
7592
7593         return count;
7594 }
7595
7596 #if !defined(HAVE_LONGLONG)
7597 /****************************************************************************
7598  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7599 ****************************************************************************/
7600
7601 static uint32 map_lock_offset(uint32 high, uint32 low)
7602 {
7603         unsigned int i;
7604         uint32 mask = 0;
7605         uint32 highcopy = high;
7606
7607         /*
7608          * Try and find out how many significant bits there are in high.
7609          */
7610
7611         for(i = 0; highcopy; i++)
7612                 highcopy >>= 1;
7613
7614         /*
7615          * We use 31 bits not 32 here as POSIX
7616          * lock offsets may not be negative.
7617          */
7618
7619         mask = (~0) << (31 - i);
7620
7621         if(low & mask)
7622                 return 0; /* Fail. */
7623
7624         high <<= (31 - i);
7625
7626         return (high|low);
7627 }
7628 #endif /* !defined(HAVE_LONGLONG) */
7629
7630 /****************************************************************************
7631  Get a lock offset, dealing with large offset requests.
7632 ****************************************************************************/
7633
7634 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7635                          bool large_file_format, bool *err)
7636 {
7637         uint64_t offset = 0;
7638
7639         *err = False;
7640
7641         if(!large_file_format) {
7642                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7643         } else {
7644
7645 #if defined(HAVE_LONGLONG)
7646                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7647                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7648 #else /* HAVE_LONGLONG */
7649
7650                 /*
7651                  * NT4.x seems to be broken in that it sends large file (64 bit)
7652                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7653                  * negotiated. For boxes without large unsigned ints mangle the
7654                  * lock offset by mapping the top 32 bits onto the lower 32.
7655                  */
7656
7657                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7658                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7659                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7660                         uint32 new_low = 0;
7661
7662                         if((new_low = map_lock_offset(high, low)) == 0) {
7663                                 *err = True;
7664                                 return (uint64_t)-1;
7665                         }
7666
7667                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7668                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7669                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7670                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7671                 }
7672
7673                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7674 #endif /* HAVE_LONGLONG */
7675         }
7676
7677         return offset;
7678 }
7679
7680 NTSTATUS smbd_do_locking(struct smb_request *req,
7681                          files_struct *fsp,
7682                          uint8_t type,
7683                          int32_t timeout,
7684                          uint16_t num_ulocks,
7685                          struct smbd_lock_element *ulocks,
7686                          uint16_t num_locks,
7687                          struct smbd_lock_element *locks,
7688                          bool *async)
7689 {
7690         connection_struct *conn = req->conn;
7691         int i;
7692         NTSTATUS status = NT_STATUS_OK;
7693
7694         *async = false;
7695
7696         /* Data now points at the beginning of the list
7697            of smb_unlkrng structs */
7698         for(i = 0; i < (int)num_ulocks; i++) {
7699                 struct smbd_lock_element *e = &ulocks[i];
7700
7701                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7702                           "pid %u, file %s\n",
7703                           (double)e->offset,
7704                           (double)e->count,
7705                           (unsigned int)e->smblctx,
7706                           fsp_str_dbg(fsp)));
7707
7708                 if (e->brltype != UNLOCK_LOCK) {
7709                         /* this can only happen with SMB2 */
7710                         return NT_STATUS_INVALID_PARAMETER;
7711                 }
7712
7713                 status = do_unlock(req->sconn->msg_ctx,
7714                                 fsp,
7715                                 e->smblctx,
7716                                 e->count,
7717                                 e->offset,
7718                                 WINDOWS_LOCK);
7719
7720                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7721                     nt_errstr(status)));
7722
7723                 if (!NT_STATUS_IS_OK(status)) {
7724                         return status;
7725                 }
7726         }
7727
7728         /* Setup the timeout in seconds. */
7729
7730         if (!lp_blocking_locks(SNUM(conn))) {
7731                 timeout = 0;
7732         }
7733
7734         /* Data now points at the beginning of the list
7735            of smb_lkrng structs */
7736
7737         for(i = 0; i < (int)num_locks; i++) {
7738                 struct smbd_lock_element *e = &locks[i];
7739
7740                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7741                           "%llu, file %s timeout = %d\n",
7742                           (double)e->offset,
7743                           (double)e->count,
7744                           (unsigned long long)e->smblctx,
7745                           fsp_str_dbg(fsp),
7746                           (int)timeout));
7747
7748                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7749                         struct blocking_lock_record *blr = NULL;
7750
7751                         if (num_locks > 1) {
7752                                 /*
7753                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7754                                  * if the lock vector contains one entry. When given mutliple cancel
7755                                  * requests in a single PDU we expect the server to return an
7756                                  * error. Windows servers seem to accept the request but only
7757                                  * cancel the first lock.
7758                                  * JRA - Do what Windows does (tm) :-).
7759                                  */
7760
7761 #if 0
7762                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7763                                 return NT_STATUS_DOS(ERRDOS,
7764                                                 ERRcancelviolation);
7765 #else
7766                                 /* Windows behavior. */
7767                                 if (i != 0) {
7768                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7769                                                 "cancel request\n"));
7770                                         continue;
7771                                 }
7772 #endif
7773                         }
7774
7775                         if (lp_blocking_locks(SNUM(conn))) {
7776
7777                                 /* Schedule a message to ourselves to
7778                                    remove the blocking lock record and
7779                                    return the right error. */
7780
7781                                 blr = blocking_lock_cancel_smb1(fsp,
7782                                                 e->smblctx,
7783                                                 e->offset,
7784                                                 e->count,
7785                                                 WINDOWS_LOCK,
7786                                                 type,
7787                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7788                                 if (blr == NULL) {
7789                                         return NT_STATUS_DOS(
7790                                                         ERRDOS,
7791                                                         ERRcancelviolation);
7792                                 }
7793                         }
7794                         /* Remove a matching pending lock. */
7795                         status = do_lock_cancel(fsp,
7796                                                 e->smblctx,
7797                                                 e->count,
7798                                                 e->offset,
7799                                                 WINDOWS_LOCK,
7800                                                 blr);
7801                 } else {
7802                         bool blocking_lock = timeout ? true : false;
7803                         bool defer_lock = false;
7804                         struct byte_range_lock *br_lck;
7805                         uint64_t block_smblctx;
7806
7807                         br_lck = do_lock(req->sconn->msg_ctx,
7808                                         fsp,
7809                                         e->smblctx,
7810                                         e->count,
7811                                         e->offset,
7812                                         e->brltype,
7813                                         WINDOWS_LOCK,
7814                                         blocking_lock,
7815                                         &status,
7816                                         &block_smblctx,
7817                                         NULL);
7818
7819                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7820                                 /* Windows internal resolution for blocking locks seems
7821                                    to be about 200ms... Don't wait for less than that. JRA. */
7822                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7823                                         timeout = lp_lock_spin_time();
7824                                 }
7825                                 defer_lock = true;
7826                         }
7827
7828                         /* If a lock sent with timeout of zero would fail, and
7829                          * this lock has been requested multiple times,
7830                          * according to brl_lock_failed() we convert this
7831                          * request to a blocking lock with a timeout of between
7832                          * 150 - 300 milliseconds.
7833                          *
7834                          * If lp_lock_spin_time() has been set to 0, we skip
7835                          * this blocking retry and fail immediately.
7836                          *
7837                          * Replacement for do_lock_spin(). JRA. */
7838
7839                         if (!req->sconn->using_smb2 &&
7840                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7841                             lp_lock_spin_time() && !blocking_lock &&
7842                             NT_STATUS_EQUAL((status),
7843                                 NT_STATUS_FILE_LOCK_CONFLICT))
7844                         {
7845                                 defer_lock = true;
7846                                 timeout = lp_lock_spin_time();
7847                         }
7848
7849                         if (br_lck && defer_lock) {
7850                                 /*
7851                                  * A blocking lock was requested. Package up
7852                                  * this smb into a queued request and push it
7853                                  * onto the blocking lock queue.
7854                                  */
7855                                 if(push_blocking_lock_request(br_lck,
7856                                                         req,
7857                                                         fsp,
7858                                                         timeout,
7859                                                         i,
7860                                                         e->smblctx,
7861                                                         e->brltype,
7862                                                         WINDOWS_LOCK,
7863                                                         e->offset,
7864                                                         e->count,
7865                                                         block_smblctx)) {
7866                                         TALLOC_FREE(br_lck);
7867                                         *async = true;
7868                                         return NT_STATUS_OK;
7869                                 }
7870                         }
7871
7872                         TALLOC_FREE(br_lck);
7873                 }
7874
7875                 if (!NT_STATUS_IS_OK(status)) {
7876                         break;
7877                 }
7878         }
7879
7880         /* If any of the above locks failed, then we must unlock
7881            all of the previous locks (X/Open spec). */
7882
7883         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7884
7885                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7886                         i = -1; /* we want to skip the for loop */
7887                 }
7888
7889                 /*
7890                  * Ensure we don't do a remove on the lock that just failed,
7891                  * as under POSIX rules, if we have a lock already there, we
7892                  * will delete it (and we shouldn't) .....
7893                  */
7894                 for(i--; i >= 0; i--) {
7895                         struct smbd_lock_element *e = &locks[i];
7896
7897                         do_unlock(req->sconn->msg_ctx,
7898                                 fsp,
7899                                 e->smblctx,
7900                                 e->count,
7901                                 e->offset,
7902                                 WINDOWS_LOCK);
7903                 }
7904                 return status;
7905         }
7906
7907         DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
7908                   fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
7909
7910         return NT_STATUS_OK;
7911 }
7912
7913 /****************************************************************************
7914  Reply to a lockingX request.
7915 ****************************************************************************/
7916
7917 void reply_lockingX(struct smb_request *req)
7918 {
7919         connection_struct *conn = req->conn;
7920         files_struct *fsp;
7921         unsigned char locktype;
7922         unsigned char oplocklevel;
7923         uint16 num_ulocks;
7924         uint16 num_locks;
7925         int32 lock_timeout;
7926         int i;
7927         const uint8_t *data;
7928         bool large_file_format;
7929         bool err;
7930         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7931         struct smbd_lock_element *ulocks;
7932         struct smbd_lock_element *locks;
7933         bool async = false;
7934
7935         START_PROFILE(SMBlockingX);
7936
7937         if (req->wct < 8) {
7938                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7939                 END_PROFILE(SMBlockingX);
7940                 return;
7941         }
7942
7943         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7944         locktype = CVAL(req->vwv+3, 0);
7945         oplocklevel = CVAL(req->vwv+3, 1);
7946         num_ulocks = SVAL(req->vwv+6, 0);
7947         num_locks = SVAL(req->vwv+7, 0);
7948         lock_timeout = IVAL(req->vwv+4, 0);
7949         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7950
7951         if (!check_fsp(conn, req, fsp)) {
7952                 END_PROFILE(SMBlockingX);
7953                 return;
7954         }
7955
7956         data = req->buf;
7957
7958         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7959                 /* we don't support these - and CANCEL_LOCK makes w2k
7960                    and XP reboot so I don't really want to be
7961                    compatible! (tridge) */
7962                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7963                 END_PROFILE(SMBlockingX);
7964                 return;
7965         }
7966
7967         /* Check if this is an oplock break on a file
7968            we have granted an oplock on.
7969         */
7970         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7971                 /* Client can insist on breaking to none. */
7972                 bool break_to_none = (oplocklevel == 0);
7973                 bool result;
7974
7975                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7976                          "for %s\n", (unsigned int)oplocklevel,
7977                          fsp_fnum_dbg(fsp)));
7978
7979                 /*
7980                  * Make sure we have granted an exclusive or batch oplock on
7981                  * this file.
7982                  */
7983
7984                 if (fsp->oplock_type == 0) {
7985
7986                         /* The Samba4 nbench simulator doesn't understand
7987                            the difference between break to level2 and break
7988                            to none from level2 - it sends oplock break
7989                            replies in both cases. Don't keep logging an error
7990                            message here - just ignore it. JRA. */
7991
7992                         DEBUG(5,("reply_lockingX: Error : oplock break from "
7993                                  "client for %s (oplock=%d) and no "
7994                                  "oplock granted on this file (%s).\n",
7995                                  fsp_fnum_dbg(fsp), fsp->oplock_type,
7996                                  fsp_str_dbg(fsp)));
7997
7998                         /* if this is a pure oplock break request then don't
7999                          * send a reply */
8000                         if (num_locks == 0 && num_ulocks == 0) {
8001                                 END_PROFILE(SMBlockingX);
8002                                 return;
8003                         } else {
8004                                 END_PROFILE(SMBlockingX);
8005                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8006                                 return;
8007                         }
8008                 }
8009
8010                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8011                     (break_to_none)) {
8012                         result = remove_oplock(fsp);
8013                 } else {
8014                         result = downgrade_oplock(fsp);
8015                 }
8016
8017                 if (!result) {
8018                         DEBUG(0, ("reply_lockingX: error in removing "
8019                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
8020                         /* Hmmm. Is this panic justified? */
8021                         smb_panic("internal tdb error");
8022                 }
8023
8024                 /* if this is a pure oplock break request then don't send a
8025                  * reply */
8026                 if (num_locks == 0 && num_ulocks == 0) {
8027                         /* Sanity check - ensure a pure oplock break is not a
8028                            chained request. */
8029                         if(CVAL(req->vwv+0, 0) != 0xff)
8030                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
8031                                          "break is a chained %d request !\n",
8032                                          (unsigned int)CVAL(req->vwv+0, 0)));
8033                         END_PROFILE(SMBlockingX);
8034                         return;
8035                 }
8036         }
8037
8038         if (req->buflen <
8039             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8040                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8041                 END_PROFILE(SMBlockingX);
8042                 return;
8043         }
8044
8045         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8046         if (ulocks == NULL) {
8047                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8048                 END_PROFILE(SMBlockingX);
8049                 return;
8050         }
8051
8052         locks = talloc_array(req, struct smbd_lock_element, num_locks);
8053         if (locks == NULL) {
8054                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8055                 END_PROFILE(SMBlockingX);
8056                 return;
8057         }
8058
8059         /* Data now points at the beginning of the list
8060            of smb_unlkrng structs */
8061         for(i = 0; i < (int)num_ulocks; i++) {
8062                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8063                 ulocks[i].count = get_lock_count(data, i, large_file_format);
8064                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8065                 ulocks[i].brltype = UNLOCK_LOCK;
8066
8067                 /*
8068                  * There is no error code marked "stupid client bug".... :-).
8069                  */
8070                 if(err) {
8071                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8072                         END_PROFILE(SMBlockingX);
8073                         return;
8074                 }
8075         }
8076
8077         /* Now do any requested locks */
8078         data += ((large_file_format ? 20 : 10)*num_ulocks);
8079
8080         /* Data now points at the beginning of the list
8081            of smb_lkrng structs */
8082
8083         for(i = 0; i < (int)num_locks; i++) {
8084                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8085                 locks[i].count = get_lock_count(data, i, large_file_format);
8086                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8087
8088                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8089                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8090                                 locks[i].brltype = PENDING_READ_LOCK;
8091                         } else {
8092                                 locks[i].brltype = READ_LOCK;
8093                         }
8094                 } else {
8095                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8096                                 locks[i].brltype = PENDING_WRITE_LOCK;
8097                         } else {
8098                                 locks[i].brltype = WRITE_LOCK;
8099                         }
8100                 }
8101
8102                 /*
8103                  * There is no error code marked "stupid client bug".... :-).
8104                  */
8105                 if(err) {
8106                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8107                         END_PROFILE(SMBlockingX);
8108                         return;
8109                 }
8110         }
8111
8112         status = smbd_do_locking(req, fsp,
8113                                  locktype, lock_timeout,
8114                                  num_ulocks, ulocks,
8115                                  num_locks, locks,
8116                                  &async);
8117         if (!NT_STATUS_IS_OK(status)) {
8118                 END_PROFILE(SMBlockingX);
8119                 reply_nterror(req, status);
8120                 return;
8121         }
8122         if (async) {
8123                 END_PROFILE(SMBlockingX);
8124                 return;
8125         }
8126
8127         reply_outbuf(req, 2, 0);
8128         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8129         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
8130
8131         DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8132                   fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8133
8134         END_PROFILE(SMBlockingX);
8135 }
8136
8137 #undef DBGC_CLASS
8138 #define DBGC_CLASS DBGC_ALL
8139
8140 /****************************************************************************
8141  Reply to a SMBreadbmpx (read block multiplex) request.
8142  Always reply with an error, if someone has a platform really needs this,
8143  please contact vl@samba.org
8144 ****************************************************************************/
8145
8146 void reply_readbmpx(struct smb_request *req)
8147 {
8148         START_PROFILE(SMBreadBmpx);
8149         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8150         END_PROFILE(SMBreadBmpx);
8151         return;
8152 }
8153
8154 /****************************************************************************
8155  Reply to a SMBreadbs (read block multiplex secondary) request.
8156  Always reply with an error, if someone has a platform really needs this,
8157  please contact vl@samba.org
8158 ****************************************************************************/
8159
8160 void reply_readbs(struct smb_request *req)
8161 {
8162         START_PROFILE(SMBreadBs);
8163         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8164         END_PROFILE(SMBreadBs);
8165         return;
8166 }
8167
8168 /****************************************************************************
8169  Reply to a SMBsetattrE.
8170 ****************************************************************************/
8171
8172 void reply_setattrE(struct smb_request *req)
8173 {
8174         connection_struct *conn = req->conn;
8175         struct smb_file_time ft;
8176         files_struct *fsp;
8177         NTSTATUS status;
8178
8179         START_PROFILE(SMBsetattrE);
8180         ZERO_STRUCT(ft);
8181
8182         if (req->wct < 7) {
8183                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8184                 goto out;
8185         }
8186
8187         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8188
8189         if(!fsp || (fsp->conn != conn)) {
8190                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8191                 goto out;
8192         }
8193
8194         /*
8195          * Convert the DOS times into unix times.
8196          */
8197
8198         ft.atime = convert_time_t_to_timespec(
8199             srv_make_unix_date2(req->vwv+3));
8200         ft.mtime = convert_time_t_to_timespec(
8201             srv_make_unix_date2(req->vwv+5));
8202         ft.create_time = convert_time_t_to_timespec(
8203             srv_make_unix_date2(req->vwv+1));
8204
8205         reply_outbuf(req, 0, 0);
8206
8207         /*
8208          * Patch from Ray Frush <frush@engr.colostate.edu>
8209          * Sometimes times are sent as zero - ignore them.
8210          */
8211
8212         /* Ensure we have a valid stat struct for the source. */
8213         status = vfs_stat_fsp(fsp);
8214         if (!NT_STATUS_IS_OK(status)) {
8215                 reply_nterror(req, status);
8216                 goto out;
8217         }
8218
8219         if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8220                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8221                 goto out;
8222         }
8223
8224         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8225         if (!NT_STATUS_IS_OK(status)) {
8226                 reply_nterror(req, status);
8227                 goto out;
8228         }
8229
8230         DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8231                " createtime=%u\n",
8232                 fsp_fnum_dbg(fsp),
8233                 (unsigned int)ft.atime.tv_sec,
8234                 (unsigned int)ft.mtime.tv_sec,
8235                 (unsigned int)ft.create_time.tv_sec
8236                 ));
8237  out:
8238         END_PROFILE(SMBsetattrE);
8239         return;
8240 }
8241
8242
8243 /* Back from the dead for OS/2..... JRA. */
8244
8245 /****************************************************************************
8246  Reply to a SMBwritebmpx (write block multiplex primary) request.
8247  Always reply with an error, if someone has a platform really needs this,
8248  please contact vl@samba.org
8249 ****************************************************************************/
8250
8251 void reply_writebmpx(struct smb_request *req)
8252 {
8253         START_PROFILE(SMBwriteBmpx);
8254         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8255         END_PROFILE(SMBwriteBmpx);
8256         return;
8257 }
8258
8259 /****************************************************************************
8260  Reply to a SMBwritebs (write block multiplex secondary) request.
8261  Always reply with an error, if someone has a platform really needs this,
8262  please contact vl@samba.org
8263 ****************************************************************************/
8264
8265 void reply_writebs(struct smb_request *req)
8266 {
8267         START_PROFILE(SMBwriteBs);
8268         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8269         END_PROFILE(SMBwriteBs);
8270         return;
8271 }
8272
8273 /****************************************************************************
8274  Reply to a SMBgetattrE.
8275 ****************************************************************************/
8276
8277 void reply_getattrE(struct smb_request *req)
8278 {
8279         connection_struct *conn = req->conn;
8280         int mode;
8281         files_struct *fsp;
8282         struct timespec create_ts;
8283
8284         START_PROFILE(SMBgetattrE);
8285
8286         if (req->wct < 1) {
8287                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8288                 END_PROFILE(SMBgetattrE);
8289                 return;
8290         }
8291
8292         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8293
8294         if(!fsp || (fsp->conn != conn)) {
8295                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8296                 END_PROFILE(SMBgetattrE);
8297                 return;
8298         }
8299
8300         /* Do an fstat on this file */
8301         if(fsp_stat(fsp)) {
8302                 reply_nterror(req, map_nt_error_from_unix(errno));
8303                 END_PROFILE(SMBgetattrE);
8304                 return;
8305         }
8306
8307         mode = dos_mode(conn, fsp->fsp_name);
8308
8309         /*
8310          * Convert the times into dos times. Set create
8311          * date to be last modify date as UNIX doesn't save
8312          * this.
8313          */
8314
8315         reply_outbuf(req, 11, 0);
8316
8317         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8318         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8319         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8320                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8321         /* Should we check pending modtime here ? JRA */
8322         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8323                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8324
8325         if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8326                 SIVAL(req->outbuf, smb_vwv6, 0);
8327                 SIVAL(req->outbuf, smb_vwv8, 0);
8328         } else {
8329                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8330                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8331                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8332         }
8333         SSVAL(req->outbuf,smb_vwv10, mode);
8334
8335         DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8336
8337         END_PROFILE(SMBgetattrE);
8338         return;
8339 }