source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  35 #include "../librpc/gen_ndr/open_files.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "rpc_server/rpc_ncacn_np.h"
  39 #include "libcli/security/security.h"
  40 #include "libsmb/nmblib.h"
  41 #include "auth.h"
  42 #include "smbprofile.h"
  43 #include "../lib/tsocket/tsocket.h"
  44 #include "lib/tevent_wait.h"
  45 #include "libcli/smb/smb_signing.h"
  46
  47 /****************************************************************************
  48  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  49  path or anything including wildcards.
  50  We're assuming here that '/' is not the second byte in any multibyte char
  51  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  52  set.
  53 ****************************************************************************/
  54
  55 /* Custom version for processing POSIX paths. */
  56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  57
  58 static NTSTATUS check_path_syntax_internal(char *path,
  59                                            bool posix_path,
  60                                            bool *p_last_component_contains_wcard)
  61 {
  62         char *d = path;
  63         const char *s = path;
  64         NTSTATUS ret = NT_STATUS_OK;
  65         bool start_of_name_component = True;
  66         bool stream_started = false;
  67
  68         *p_last_component_contains_wcard = False;
  69
  70         while (*s) {
  71                 if (stream_started) {
  72                         switch (*s) {
  73                         case '/':
  74                         case '\\':
  75                                 return NT_STATUS_OBJECT_NAME_INVALID;
  76                         case ':':
  77                                 if (s[1] == '\0') {
  78                                         return NT_STATUS_OBJECT_NAME_INVALID;
  79                                 }
  80                                 if (strchr_m(&s[1], ':')) {
  81                                         return NT_STATUS_OBJECT_NAME_INVALID;
  82                                 }
  83                                 break;
  84                         }
  85                 }
  86
  87                 if ((*s == ':') && !posix_path && !stream_started) {
  88                         if (*p_last_component_contains_wcard) {
  89                                 return NT_STATUS_OBJECT_NAME_INVALID;
  90                         }
  91                         /* Stream names allow more characters than file names.
  92                            We're overloading posix_path here to allow a wider
  93                            range of characters. If stream_started is true this
  94                            is still a Windows path even if posix_path is true.
  95                            JRA.
  96                         */
  97                         stream_started = true;
  98                         start_of_name_component = false;
  99                         posix_path = true;
 100
 101                         if (s[1] == '\0') {
 102                                 return NT_STATUS_OBJECT_NAME_INVALID;
 103                         }
 104                 }
 105
 106                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 107                         /*
 108                          * Safe to assume is not the second part of a mb char
 109                          * as this is handled below.
 110                          */
 111                         /* Eat multiple '/' or '\\' */
 112                         while (IS_PATH_SEP(*s,posix_path)) {
 113                                 s++;
 114                         }
 115                         if ((d != path) && (*s != '\0')) {
 116                                 /* We only care about non-leading or trailing '/' or '\\' */
 117                                 *d++ = '/';
 118                         }
 119
 120                         start_of_name_component = True;
 121                         /* New component. */
 122                         *p_last_component_contains_wcard = False;
 123                         continue;
 124                 }
 125
 126                 if (start_of_name_component) {
 127                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 128                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 129
 130                                 /*
 131                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 132                                  */
 133
 134                                 /* If  we just added a '/' - delete it */
 135                                 if ((d > path) && (*(d-1) == '/')) {
 136                                         *(d-1) = '\0';
 137                                         d--;
 138                                 }
 139
 140                                 /* Are we at the start ? Can't go back further if so. */
 141                                 if (d <= path) {
 142                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 143                                         break;
 144                                 }
 145                                 /* Go back one level... */
 146                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 147                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 148                                 /* Decrement d first as d points to the *next* char to write into. */
 149                                 for (d--; d > path; d--) {
 150                                         if (*d == '/')
 151                                                 break;
 152                                 }
 153                                 s += 2; /* Else go past the .. */
 154                                 /* We're still at the start of a name component, just the previous one. */
 155                                 continue;
 156
 157                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 158                                 if (posix_path) {
 159                                         /* Eat the '.' */
 160                                         s++;
 161                                         continue;
 162                                 }
 163                         }
 164
 165                 }
 166
 167                 if (!(*s & 0x80)) {
 168                         if (!posix_path) {
 169                                 if (*s <= 0x1f || *s == '|') {
 170                                         return NT_STATUS_OBJECT_NAME_INVALID;
 171                                 }
 172                                 switch (*s) {
 173                                         case '*':
 174                                         case '?':
 175                                         case '<':
 176                                         case '>':
 177                                         case '"':
 178                                                 *p_last_component_contains_wcard = True;
 179                                                 break;
 180                                         default:
 181                                                 break;
 182                                 }
 183                         }
 184                         *d++ = *s++;
 185                 } else {
 186                         size_t siz;
 187                         /* Get the size of the next MB character. */
 188                         next_codepoint(s,&siz);
 189                         switch(siz) {
 190                                 case 5:
 191                                         *d++ = *s++;
 192                                         /*fall through*/
 193                                 case 4:
 194                                         *d++ = *s++;
 195                                         /*fall through*/
 196                                 case 3:
 197                                         *d++ = *s++;
 198                                         /*fall through*/
 199                                 case 2:
 200                                         *d++ = *s++;
 201                                         /*fall through*/
 202                                 case 1:
 203                                         *d++ = *s++;
 204                                         break;
 205                                 default:
 206                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 207                                         *d = '\0';
 208                                         return NT_STATUS_INVALID_PARAMETER;
 209                         }
 210                 }
 211                 start_of_name_component = False;
 212         }
 213
 214         *d = '\0';
 215
 216         return ret;
 217 }
 218
 219 /****************************************************************************
 220  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 221  No wildcards allowed.
 222 ****************************************************************************/
 223
 224 NTSTATUS check_path_syntax(char *path)
 225 {
 226         bool ignore;
 227         return check_path_syntax_internal(path, False, &ignore);
 228 }
 229
 230 /****************************************************************************
 231  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 232  Wildcards allowed - p_contains_wcard returns true if the last component contained
 233  a wildcard.
 234 ****************************************************************************/
 235
 236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 237 {
 238         return check_path_syntax_internal(path, False, p_contains_wcard);
 239 }
 240
 241 /****************************************************************************
 242  Check the path for a POSIX client.
 243  We're assuming here that '/' is not the second byte in any multibyte char
 244  set (a safe assumption).
 245 ****************************************************************************/
 246
 247 NTSTATUS check_path_syntax_posix(char *path)
 248 {
 249         bool ignore;
 250         return check_path_syntax_internal(path, True, &ignore);
 251 }
 252
 253 /****************************************************************************
 254  Pull a string and check the path allowing a wilcard - provide for error return.
 255 ****************************************************************************/
 256
 257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 258                         const char *base_ptr,
 259                         uint16 smb_flags2,
 260                         char **pp_dest,
 261                         const char *src,
 262                         size_t src_len,
 263                         int flags,
 264                         NTSTATUS *err,
 265                         bool *contains_wcard)
 266 {
 267         size_t ret;
 268
 269         *pp_dest = NULL;
 270
 271         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 272                                  src_len, flags);
 273
 274         if (!*pp_dest) {
 275                 *err = NT_STATUS_INVALID_PARAMETER;
 276                 return ret;
 277         }
 278
 279         *contains_wcard = False;
 280
 281         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 282                 /*
 283                  * For a DFS path the function parse_dfs_path()
 284                  * will do the path processing, just make a copy.
 285                  */
 286                 *err = NT_STATUS_OK;
 287                 return ret;
 288         }
 289
 290         if (lp_posix_pathnames()) {
 291                 *err = check_path_syntax_posix(*pp_dest);
 292         } else {
 293                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 294         }
 295
 296         return ret;
 297 }
 298
 299 /****************************************************************************
 300  Pull a string and check the path - provide for error return.
 301 ****************************************************************************/
 302
 303 size_t srvstr_get_path(TALLOC_CTX *ctx,
 304                         const char *base_ptr,
 305                         uint16 smb_flags2,
 306                         char **pp_dest,
 307                         const char *src,
 308                         size_t src_len,
 309                         int flags,
 310                         NTSTATUS *err)
 311 {
 312         bool ignore;
 313         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 314                                      src_len, flags, err, &ignore);
 315 }
 316
 317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 318                                  char **pp_dest, const char *src, int flags,
 319                                  NTSTATUS *err, bool *contains_wcard)
 320 {
 321         ssize_t bufrem = smbreq_bufrem(req, src);
 322
 323         if (bufrem < 0) {
 324                 *err = NT_STATUS_INVALID_PARAMETER;
 325                 return 0;
 326         }
 327
 328         return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
 329                                      req->flags2, pp_dest, src, bufrem, flags,
 330                                      err, contains_wcard);
 331 }
 332
 333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 334                            char **pp_dest, const char *src, int flags,
 335                            NTSTATUS *err)
 336 {
 337         bool ignore;
 338         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 339                                          flags, err, &ignore);
 340 }
 341
 342 /**
 343  * pull a string from the smb_buf part of a packet. In this case the
 344  * string can either be null terminated or it can be terminated by the
 345  * end of the smbbuf area
 346  */
 347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
 348                               char **dest, const char *src, int flags)
 349 {
 350         ssize_t bufrem = smbreq_bufrem(req, src);
 351
 352         if (bufrem < 0) {
 353                 return 0;
 354         }
 355
 356         return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
 357                                   bufrem, flags);
 358 }
 359
 360 /****************************************************************************
 361  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 362 ****************************************************************************/
 363
 364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 365                     files_struct *fsp)
 366 {
 367         if ((fsp == NULL) || (conn == NULL)) {
 368                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 369                 return False;
 370         }
 371         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 372                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 373                 return False;
 374         }
 375         return True;
 376 }
 377
 378 /****************************************************************************
 379  Check if we have a correct fsp pointing to a file.
 380 ****************************************************************************/
 381
 382 bool check_fsp(connection_struct *conn, struct smb_request *req,
 383                files_struct *fsp)
 384 {
 385         if (!check_fsp_open(conn, req, fsp)) {
 386                 return False;
 387         }
 388         if (fsp->is_directory) {
 389                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 390                 return False;
 391         }
 392         if (fsp->fh->fd == -1) {
 393                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 394                 return False;
 395         }
 396         fsp->num_smb_operations++;
 397         return True;
 398 }
 399
 400 /****************************************************************************
 401  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 402  the CHECK_NTQUOTA_HANDLE_OK macro.
 403 ****************************************************************************/
 404
 405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 406                               files_struct *fsp)
 407 {
 408         if (!check_fsp_open(conn, req, fsp)) {
 409                 return false;
 410         }
 411
 412         if (fsp->is_directory) {
 413                 return false;
 414         }
 415
 416         if (fsp->fake_file_handle == NULL) {
 417                 return false;
 418         }
 419
 420         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 421                 return false;
 422         }
 423
 424         if (fsp->fake_file_handle->private_data == NULL) {
 425                 return false;
 426         }
 427
 428         return true;
 429 }
 430
 431 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 432                                      const char *name, int name_type)
 433 {
 434         char *trim_name;
 435         char *trim_name_type;
 436         const char *retarget_parm;
 437         char *retarget;
 438         char *p;
 439         int retarget_type = 0x20;
 440         int retarget_port = NBT_SMB_PORT;
 441         struct sockaddr_storage retarget_addr;
 442         struct sockaddr_in *in_addr;
 443         bool ret = false;
 444         uint8_t outbuf[10];
 445
 446         if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
 447                 return false;
 448         }
 449
 450         trim_name = talloc_strdup(talloc_tos(), name);
 451         if (trim_name == NULL) {
 452                 goto fail;
 453         }
 454         trim_char(trim_name, ' ', ' ');
 455
 456         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 457                                          name_type);
 458         if (trim_name_type == NULL) {
 459                 goto fail;
 460         }
 461
 462         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 463                                              trim_name_type, NULL);
 464         if (retarget_parm == NULL) {
 465                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 466                                                      trim_name, NULL);
 467         }
 468         if (retarget_parm == NULL) {
 469                 goto fail;
 470         }
 471
 472         retarget = talloc_strdup(trim_name, retarget_parm);
 473         if (retarget == NULL) {
 474                 goto fail;
 475         }
 476
 477         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 478
 479         p = strchr(retarget, ':');
 480         if (p != NULL) {
 481                 *p++ = '\0';
 482                 retarget_port = atoi(p);
 483         }
 484
 485         p = strchr_m(retarget, '#');
 486         if (p != NULL) {
 487                 *p++ = '\0';
 488                 if (sscanf(p, "%x", &retarget_type) != 1) {
 489                         goto fail;
 490                 }
 491         }
 492
 493         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 494         if (!ret) {
 495                 DEBUG(10, ("could not resolve %s\n", retarget));
 496                 goto fail;
 497         }
 498
 499         if (retarget_addr.ss_family != AF_INET) {
 500                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 501                 goto fail;
 502         }
 503
 504         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 505
 506         _smb_setlen(outbuf, 6);
 507         SCVAL(outbuf, 0, 0x84);
 508         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 509         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 510
 511         if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
 512                           NULL)) {
 513                 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
 514                                     "failed.");
 515         }
 516
 517         ret = true;
 518  fail:
 519         TALLOC_FREE(trim_name);
 520         return ret;
 521 }
 522
 523 static void reply_called_name_not_present(char *outbuf)
 524 {
 525         smb_setlen(outbuf, 1);
 526         SCVAL(outbuf, 0, 0x83);
 527         SCVAL(outbuf, 4, 0x82);
 528 }
 529
 530 /****************************************************************************
 531  Reply to a (netbios-level) special message.
 532 ****************************************************************************/
 533
 534 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
 535 {
 536         int msg_type = CVAL(inbuf,0);
 537         int msg_flags = CVAL(inbuf,1);
 538         /*
 539          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 540          * calculation & friends (srv_send_smb uses that) we need the full smb
 541          * header.
 542          */
 543         char outbuf[smb_size];
 544
 545         memset(outbuf, '\0', sizeof(outbuf));
 546
 547         smb_setlen(outbuf,0);
 548
 549         switch (msg_type) {
 550         case NBSSrequest: /* session request */
 551         {
 552                 /* inbuf_size is guarenteed to be at least 4. */
 553                 fstring name1,name2;
 554                 int name_type1, name_type2;
 555                 int name_len1, name_len2;
 556
 557                 *name1 = *name2 = 0;
 558
 559                 if (sconn->nbt.got_session) {
 560                         exit_server_cleanly("multiple session request not permitted");
 561                 }
 562
 563                 SCVAL(outbuf,0,NBSSpositive);
 564                 SCVAL(outbuf,3,0);
 565
 566                 /* inbuf_size is guaranteed to be at least 4. */
 567                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 568                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 569                         DEBUG(0,("Invalid name length in session request\n"));
 570                         reply_called_name_not_present(outbuf);
 571                         break;
 572                 }
 573                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 574                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 575                         DEBUG(0,("Invalid name length in session request\n"));
 576                         reply_called_name_not_present(outbuf);
 577                         break;
 578                 }
 579
 580                 name_type1 = name_extract((unsigned char *)inbuf,
 581                                 inbuf_size,(unsigned int)4,name1);
 582                 name_type2 = name_extract((unsigned char *)inbuf,
 583                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 584
 585                 if (name_type1 == -1 || name_type2 == -1) {
 586                         DEBUG(0,("Invalid name type in session request\n"));
 587                         reply_called_name_not_present(outbuf);
 588                         break;
 589                 }
 590
 591                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 592                          name1, name_type1, name2, name_type2));
 593
 594                 if (netbios_session_retarget(sconn, name1, name_type1)) {
 595                         exit_server_cleanly("retargeted client");
 596                 }
 597
 598                 /*
 599                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 600                  * "*SMBSERV" arrggg!!!
 601                  */
 602                 if (strequal(name1, "*SMBSERVER     ")
 603                     || strequal(name1, "*SMBSERV       "))  {
 604                         char *raddr;
 605
 606                         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
 607                                                                  talloc_tos());
 608                         if (raddr == NULL) {
 609                                 exit_server_cleanly("could not allocate raddr");
 610                         }
 611
 612                         fstrcpy(name1, raddr);
 613                 }
 614
 615                 set_local_machine_name(name1, True);
 616                 set_remote_machine_name(name2, True);
 617
 618                 if (is_ipaddress(sconn->remote_hostname)) {
 619                         char *p = discard_const_p(char, sconn->remote_hostname);
 620
 621                         talloc_free(p);
 622
 623                         sconn->remote_hostname = talloc_strdup(sconn,
 624                                                 get_remote_machine_name());
 625                         if (sconn->remote_hostname == NULL) {
 626                                 exit_server_cleanly("could not copy remote name");
 627                         }
 628                         sconn->conn->remote_hostname = sconn->remote_hostname;
 629                 }
 630
 631                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 632                          get_local_machine_name(), get_remote_machine_name(),
 633                          name_type2));
 634
 635                 if (name_type2 == 'R') {
 636                         /* We are being asked for a pathworks session ---
 637                            no thanks! */
 638                         reply_called_name_not_present(outbuf);
 639                         break;
 640                 }
 641
 642                 reload_services(sconn, conn_snum_used, true);
 643                 reopen_logs();
 644
 645                 sconn->nbt.got_session = true;
 646                 break;
 647         }
 648
 649         case 0x89: /* session keepalive request
 650                       (some old clients produce this?) */
 651                 SCVAL(outbuf,0,NBSSkeepalive);
 652                 SCVAL(outbuf,3,0);
 653                 break;
 654
 655         case NBSSpositive: /* positive session response */
 656         case NBSSnegative: /* negative session response */
 657         case NBSSretarget: /* retarget session response */
 658                 DEBUG(0,("Unexpected session response\n"));
 659                 break;
 660
 661         case NBSSkeepalive: /* session keepalive */
 662         default:
 663                 return;
 664         }
 665
 666         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 667                     msg_type, msg_flags));
 668
 669         srv_send_smb(sconn, outbuf, false, 0, false, NULL);
 670
 671         if (CVAL(outbuf, 0) != 0x82) {
 672                 exit_server_cleanly("invalid netbios session");
 673         }
 674         return;
 675 }
 676
 677 /****************************************************************************
 678  Reply to a tcon.
 679  conn POINTER CAN BE NULL HERE !
 680 ****************************************************************************/
 681
 682 void reply_tcon(struct smb_request *req)
 683 {
 684         connection_struct *conn = req->conn;
 685         const char *service;
 686         char *service_buf = NULL;
 687         char *password = NULL;
 688         char *dev = NULL;
 689         int pwlen=0;
 690         NTSTATUS nt_status;
 691         const char *p;
 692         TALLOC_CTX *ctx = talloc_tos();
 693         struct smbd_server_connection *sconn = req->sconn;
 694         NTTIME now = timeval_to_nttime(&req->request_time);
 695
 696         START_PROFILE(SMBtcon);
 697
 698         if (req->buflen < 4) {
 699                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 700                 END_PROFILE(SMBtcon);
 701                 return;
 702         }
 703
 704         p = (const char *)req->buf + 1;
 705         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 706         p += 1;
 707         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 708         p += pwlen+1;
 709         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 710         p += 1;
 711
 712         if (service_buf == NULL || password == NULL || dev == NULL) {
 713                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 714                 END_PROFILE(SMBtcon);
 715                 return;
 716         }
 717         p = strrchr_m(service_buf,'\\');
 718         if (p) {
 719                 service = p+1;
 720         } else {
 721                 service = service_buf;
 722         }
 723
 724         conn = make_connection(sconn, now, service, dev,
 725                                req->vuid,&nt_status);
 726         req->conn = conn;
 727
 728         if (!conn) {
 729                 reply_nterror(req, nt_status);
 730                 END_PROFILE(SMBtcon);
 731                 return;
 732         }
 733
 734         reply_outbuf(req, 2, 0);
 735         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 736         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 737         SSVAL(req->outbuf,smb_tid,conn->cnum);
 738
 739         DEBUG(3,("tcon service=%s cnum=%d\n",
 740                  service, conn->cnum));
 741
 742         END_PROFILE(SMBtcon);
 743         return;
 744 }
 745
 746 /****************************************************************************
 747  Reply to a tcon and X.
 748  conn POINTER CAN BE NULL HERE !
 749 ****************************************************************************/
 750
 751 void reply_tcon_and_X(struct smb_request *req)
 752 {
 753         connection_struct *conn = req->conn;
 754         const char *service = NULL;
 755         TALLOC_CTX *ctx = talloc_tos();
 756         /* what the cleint thinks the device is */
 757         char *client_devicetype = NULL;
 758         /* what the server tells the client the share represents */
 759         const char *server_devicetype;
 760         NTSTATUS nt_status;
 761         int passlen;
 762         char *path = NULL;
 763         const char *p, *q;
 764         uint16_t tcon_flags;
 765         struct smbXsrv_session *session = NULL;
 766         NTTIME now = timeval_to_nttime(&req->request_time);
 767         bool session_key_updated = false;
 768         uint16_t optional_support = 0;
 769         struct smbd_server_connection *sconn = req->sconn;
 770
 771         START_PROFILE(SMBtconX);
 772
 773         if (req->wct < 4) {
 774                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 775                 END_PROFILE(SMBtconX);
 776                 return;
 777         }
 778
 779         passlen = SVAL(req->vwv+3, 0);
 780         tcon_flags = SVAL(req->vwv+2, 0);
 781
 782         /* we might have to close an old one */
 783         if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
 784                 struct smbXsrv_tcon *tcon;
 785                 NTSTATUS status;
 786
 787                 tcon = conn->tcon;
 788                 req->conn = NULL;
 789                 conn = NULL;
 790
 791                 /*
 792                  * TODO: cancel all outstanding requests on the tcon
 793                  */
 794                 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
 795                 if (!NT_STATUS_IS_OK(status)) {
 796                         DEBUG(0, ("reply_tcon_and_X: "
 797                                   "smbXsrv_tcon_disconnect() failed: %s\n",
 798                                   nt_errstr(status)));
 799                         /*
 800                          * If we hit this case, there is something completely
 801                          * wrong, so we better disconnect the transport connection.
 802                          */
 803                         END_PROFILE(SMBtconX);
 804                         exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
 805                         return;
 806                 }
 807
 808                 TALLOC_FREE(tcon);
 809         }
 810
 811         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 812                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 813                 END_PROFILE(SMBtconX);
 814                 return;
 815         }
 816
 817         if (sconn->smb1.negprot.encrypted_passwords) {
 818                 p = (const char *)req->buf + passlen;
 819         } else {
 820                 p = (const char *)req->buf + passlen + 1;
 821         }
 822
 823         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 824
 825         if (path == NULL) {
 826                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 827                 END_PROFILE(SMBtconX);
 828                 return;
 829         }
 830
 831         /*
 832          * the service name can be either: \\server\share
 833          * or share directly like on the DELL PowerVault 705
 834          */
 835         if (*path=='\\') {
 836                 q = strchr_m(path+2,'\\');
 837                 if (!q) {
 838                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 839                         END_PROFILE(SMBtconX);
 840                         return;
 841                 }
 842                 service = q+1;
 843         } else {
 844                 service = path;
 845         }
 846
 847         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 848                                 &client_devicetype, p,
 849                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 850
 851         if (client_devicetype == NULL) {
 852                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 853                 END_PROFILE(SMBtconX);
 854                 return;
 855         }
 856
 857         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 858
 859         nt_status = smb1srv_session_lookup(req->sconn->conn,
 860                                            req->vuid, now, &session);
 861         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
 862                 reply_force_doserror(req, ERRSRV, ERRbaduid);
 863                 END_PROFILE(SMBtconX);
 864                 return;
 865         }
 866         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 867                 reply_nterror(req, nt_status);
 868                 END_PROFILE(SMBtconX);
 869                 return;
 870         }
 871         if (!NT_STATUS_IS_OK(nt_status)) {
 872                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 873                 END_PROFILE(SMBtconX);
 874                 return;
 875         }
 876
 877         if (session->global->auth_session_info == NULL) {
 878                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 879                 END_PROFILE(SMBtconX);
 880                 return;
 881         }
 882
 883         /*
 884          * If there is no application key defined yet
 885          * we create one.
 886          *
 887          * This means we setup the application key on the
 888          * first tcon that happens via the given session.
 889          *
 890          * Once the application key is defined, it does not
 891          * change any more.
 892          */
 893         if (session->global->application_key.length == 0 &&
 894             session->global->signing_key.length > 0)
 895         {
 896                 struct smbXsrv_session *x = session;
 897                 struct auth_session_info *session_info =
 898                         session->global->auth_session_info;
 899                 uint8_t session_key[16];
 900
 901                 ZERO_STRUCT(session_key);
 902                 memcpy(session_key, x->global->signing_key.data,
 903                        MIN(x->global->signing_key.length, sizeof(session_key)));
 904
 905                 /*
 906                  * The application key is truncated/padded to 16 bytes
 907                  */
 908                 x->global->application_key = data_blob_talloc(x->global,
 909                                                              session_key,
 910                                                              sizeof(session_key));
 911                 ZERO_STRUCT(session_key);
 912                 if (x->global->application_key.data == NULL) {
 913                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 914                         END_PROFILE(SMBtconX);
 915                         return;
 916                 }
 917
 918                 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
 919                         smb_key_derivation(x->global->application_key.data,
 920                                            x->global->application_key.length,
 921                                            x->global->application_key.data);
 922                         optional_support |= SMB_EXTENDED_SIGNATURES;
 923                 }
 924
 925                 /*
 926                  * Place the application key into the session_info
 927                  */
 928                 data_blob_clear_free(&session_info->session_key);
 929                 session_info->session_key = data_blob_dup_talloc(session_info,
 930                                                 x->global->application_key);
 931                 if (session_info->session_key.data == NULL) {
 932                         data_blob_clear_free(&x->global->application_key);
 933                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 934                         END_PROFILE(SMBtconX);
 935                         return;
 936                 }
 937                 session_key_updated = true;
 938         }
 939
 940         conn = make_connection(sconn, now, service, client_devicetype,
 941                                req->vuid, &nt_status);
 942         req->conn =conn;
 943
 944         if (!conn) {
 945                 if (session_key_updated) {
 946                         struct smbXsrv_session *x = session;
 947                         struct auth_session_info *session_info =
 948                                 session->global->auth_session_info;
 949                         data_blob_clear_free(&x->global->application_key);
 950                         data_blob_clear_free(&session_info->session_key);
 951                 }
 952                 reply_nterror(req, nt_status);
 953                 END_PROFILE(SMBtconX);
 954                 return;
 955         }
 956
 957         if ( IS_IPC(conn) )
 958                 server_devicetype = "IPC";
 959         else if ( IS_PRINT(conn) )
 960                 server_devicetype = "LPT1:";
 961         else
 962                 server_devicetype = "A:";
 963
 964         if (get_Protocol() < PROTOCOL_NT1) {
 965                 reply_outbuf(req, 2, 0);
 966                 if (message_push_string(&req->outbuf, server_devicetype,
 967                                         STR_TERMINATE|STR_ASCII) == -1) {
 968                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 969                         END_PROFILE(SMBtconX);
 970                         return;
 971                 }
 972         } else {
 973                 /* NT sets the fstype of IPC$ to the null string */
 974                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(ctx, SNUM(conn));
 975
 976                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 977                         /* Return permissions. */
 978                         uint32 perm1 = 0;
 979                         uint32 perm2 = 0;
 980
 981                         reply_outbuf(req, 7, 0);
 982
 983                         if (IS_IPC(conn)) {
 984                                 perm1 = FILE_ALL_ACCESS;
 985                                 perm2 = FILE_ALL_ACCESS;
 986                         } else {
 987                                 perm1 = conn->share_access;
 988                         }
 989
 990                         SIVAL(req->outbuf, smb_vwv3, perm1);
 991                         SIVAL(req->outbuf, smb_vwv5, perm2);
 992                 } else {
 993                         reply_outbuf(req, 3, 0);
 994                 }
 995
 996                 if ((message_push_string(&req->outbuf, server_devicetype,
 997                                          STR_TERMINATE|STR_ASCII) == -1)
 998                     || (message_push_string(&req->outbuf, fstype,
 999                                             STR_TERMINATE) == -1)) {
1000                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1001                         END_PROFILE(SMBtconX);
1002                         return;
1003                 }
1004
1005                 /* what does setting this bit do? It is set by NT4 and
1006                    may affect the ability to autorun mounted cdroms */
1007                 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1008                 optional_support |=
1009                         (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1010
1011                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1012                         DEBUG(2,("Serving %s as a Dfs root\n",
1013                                  lp_servicename(ctx, SNUM(conn)) ));
1014                         optional_support |= SMB_SHARE_IN_DFS;
1015                 }
1016
1017                 SSVAL(req->outbuf, smb_vwv2, optional_support);
1018         }
1019
1020         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1021         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
1022
1023         DEBUG(3,("tconX service=%s \n",
1024                  service));
1025
1026         /* set the incoming and outgoing tid to the just created one */
1027         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1028         SSVAL(req->outbuf,smb_tid,conn->cnum);
1029
1030         END_PROFILE(SMBtconX);
1031
1032         req->tid = conn->cnum;
1033 }
1034
1035 /****************************************************************************
1036  Reply to an unknown type.
1037 ****************************************************************************/
1038
1039 void reply_unknown_new(struct smb_request *req, uint8 type)
1040 {
1041         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1042                   smb_fn_name(type), type, type));
1043         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1044         return;
1045 }
1046
1047 /****************************************************************************
1048  Reply to an ioctl.
1049  conn POINTER CAN BE NULL HERE !
1050 ****************************************************************************/
1051
1052 void reply_ioctl(struct smb_request *req)
1053 {
1054         connection_struct *conn = req->conn;
1055         uint16 device;
1056         uint16 function;
1057         uint32 ioctl_code;
1058         int replysize;
1059         char *p;
1060
1061         START_PROFILE(SMBioctl);
1062
1063         if (req->wct < 3) {
1064                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1065                 END_PROFILE(SMBioctl);
1066                 return;
1067         }
1068
1069         device     = SVAL(req->vwv+1, 0);
1070         function   = SVAL(req->vwv+2, 0);
1071         ioctl_code = (device << 16) + function;
1072
1073         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1074
1075         switch (ioctl_code) {
1076             case IOCTL_QUERY_JOB_INFO:
1077                     replysize = 32;
1078                     break;
1079             default:
1080                     reply_force_doserror(req, ERRSRV, ERRnosupport);
1081                     END_PROFILE(SMBioctl);
1082                     return;
1083         }
1084
1085         reply_outbuf(req, 8, replysize+1);
1086         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1087         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1088         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
1089         p = smb_buf(req->outbuf);
1090         memset(p, '\0', replysize+1); /* valgrind-safe. */
1091         p += 1;          /* Allow for alignment */
1092
1093         switch (ioctl_code) {
1094                 case IOCTL_QUERY_JOB_INFO:
1095                 {
1096                         files_struct *fsp = file_fsp(
1097                                 req, SVAL(req->vwv+0, 0));
1098                         if (!fsp) {
1099                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1100                                 END_PROFILE(SMBioctl);
1101                                 return;
1102                         }
1103                         /* Job number */
1104                         SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1105
1106                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
1107                                     lp_netbios_name(), 15,
1108                                     STR_TERMINATE|STR_ASCII);
1109                         if (conn) {
1110                                 srvstr_push((char *)req->outbuf, req->flags2,
1111                                             p+18,
1112                                             lp_servicename(talloc_tos(),
1113                                                            SNUM(conn)),
1114                                             13, STR_TERMINATE|STR_ASCII);
1115                         } else {
1116                                 memset(p+18, 0, 13);
1117                         }
1118                         break;
1119                 }
1120         }
1121
1122         END_PROFILE(SMBioctl);
1123         return;
1124 }
1125
1126 /****************************************************************************
1127  Strange checkpath NTSTATUS mapping.
1128 ****************************************************************************/
1129
1130 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1131 {
1132         /* Strange DOS error code semantics only for checkpath... */
1133         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1134                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1135                         /* We need to map to ERRbadpath */
1136                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1137                 }
1138         }
1139         return status;
1140 }
1141
1142 /****************************************************************************
1143  Reply to a checkpath.
1144 ****************************************************************************/
1145
1146 void reply_checkpath(struct smb_request *req)
1147 {
1148         connection_struct *conn = req->conn;
1149         struct smb_filename *smb_fname = NULL;
1150         char *name = NULL;
1151         NTSTATUS status;
1152         TALLOC_CTX *ctx = talloc_tos();
1153
1154         START_PROFILE(SMBcheckpath);
1155
1156         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1157                             STR_TERMINATE, &status);
1158
1159         if (!NT_STATUS_IS_OK(status)) {
1160                 status = map_checkpath_error(req->flags2, status);
1161                 reply_nterror(req, status);
1162                 END_PROFILE(SMBcheckpath);
1163                 return;
1164         }
1165
1166         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1167
1168         status = filename_convert(ctx,
1169                                 conn,
1170                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1171                                 name,
1172                                 0,
1173                                 NULL,
1174                                 &smb_fname);
1175
1176         if (!NT_STATUS_IS_OK(status)) {
1177                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1178                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1179                                         ERRSRV, ERRbadpath);
1180                         END_PROFILE(SMBcheckpath);
1181                         return;
1182                 }
1183                 goto path_err;
1184         }
1185
1186         if (!VALID_STAT(smb_fname->st) &&
1187             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1188                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1189                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1190                 status = map_nt_error_from_unix(errno);
1191                 goto path_err;
1192         }
1193
1194         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1195                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1196                                 ERRDOS, ERRbadpath);
1197                 goto out;
1198         }
1199
1200         reply_outbuf(req, 0, 0);
1201
1202  path_err:
1203         /* We special case this - as when a Windows machine
1204                 is parsing a path is steps through the components
1205                 one at a time - if a component fails it expects
1206                 ERRbadpath, not ERRbadfile.
1207         */
1208         status = map_checkpath_error(req->flags2, status);
1209         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1210                 /*
1211                  * Windows returns different error codes if
1212                  * the parent directory is valid but not the
1213                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1214                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1215                  * if the path is invalid.
1216                  */
1217                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1218                                 ERRDOS, ERRbadpath);
1219                 goto out;
1220         }
1221
1222         reply_nterror(req, status);
1223
1224  out:
1225         TALLOC_FREE(smb_fname);
1226         END_PROFILE(SMBcheckpath);
1227         return;
1228 }
1229
1230 /****************************************************************************
1231  Reply to a getatr.
1232 ****************************************************************************/
1233
1234 void reply_getatr(struct smb_request *req)
1235 {
1236         connection_struct *conn = req->conn;
1237         struct smb_filename *smb_fname = NULL;
1238         char *fname = NULL;
1239         int mode=0;
1240         off_t size=0;
1241         time_t mtime=0;
1242         const char *p;
1243         NTSTATUS status;
1244         TALLOC_CTX *ctx = talloc_tos();
1245         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1246
1247         START_PROFILE(SMBgetatr);
1248
1249         p = (const char *)req->buf + 1;
1250         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1251         if (!NT_STATUS_IS_OK(status)) {
1252                 reply_nterror(req, status);
1253                 goto out;
1254         }
1255
1256         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1257                 under WfWg - weird! */
1258         if (*fname == '\0') {
1259                 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1260                 if (!CAN_WRITE(conn)) {
1261                         mode |= FILE_ATTRIBUTE_READONLY;
1262                 }
1263                 size = 0;
1264                 mtime = 0;
1265         } else {
1266                 status = filename_convert(ctx,
1267                                 conn,
1268                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1269                                 fname,
1270                                 0,
1271                                 NULL,
1272                                 &smb_fname);
1273                 if (!NT_STATUS_IS_OK(status)) {
1274                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1275                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1276                                                 ERRSRV, ERRbadpath);
1277                                 goto out;
1278                         }
1279                         reply_nterror(req, status);
1280                         goto out;
1281                 }
1282                 if (!VALID_STAT(smb_fname->st) &&
1283                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1284                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1285                                  smb_fname_str_dbg(smb_fname),
1286                                  strerror(errno)));
1287                         reply_nterror(req,  map_nt_error_from_unix(errno));
1288                         goto out;
1289                 }
1290
1291                 mode = dos_mode(conn, smb_fname);
1292                 size = smb_fname->st.st_ex_size;
1293
1294                 if (ask_sharemode) {
1295                         struct timespec write_time_ts;
1296                         struct file_id fileid;
1297
1298                         ZERO_STRUCT(write_time_ts);
1299                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1300                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1301                         if (!null_timespec(write_time_ts)) {
1302                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1303                         }
1304                 }
1305
1306                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1307                 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1308                         size = 0;
1309                 }
1310         }
1311
1312         reply_outbuf(req, 10, 0);
1313
1314         SSVAL(req->outbuf,smb_vwv0,mode);
1315         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1316                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1317         } else {
1318                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1319         }
1320         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1321
1322         if (get_Protocol() >= PROTOCOL_NT1) {
1323                 SSVAL(req->outbuf, smb_flg2,
1324                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1325         }
1326
1327         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1328                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1329
1330  out:
1331         TALLOC_FREE(smb_fname);
1332         TALLOC_FREE(fname);
1333         END_PROFILE(SMBgetatr);
1334         return;
1335 }
1336
1337 /****************************************************************************
1338  Reply to a setatr.
1339 ****************************************************************************/
1340
1341 void reply_setatr(struct smb_request *req)
1342 {
1343         struct smb_file_time ft;
1344         connection_struct *conn = req->conn;
1345         struct smb_filename *smb_fname = NULL;
1346         char *fname = NULL;
1347         int mode;
1348         time_t mtime;
1349         const char *p;
1350         NTSTATUS status;
1351         TALLOC_CTX *ctx = talloc_tos();
1352
1353         START_PROFILE(SMBsetatr);
1354
1355         ZERO_STRUCT(ft);
1356
1357         if (req->wct < 2) {
1358                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1359                 goto out;
1360         }
1361
1362         p = (const char *)req->buf + 1;
1363         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1364         if (!NT_STATUS_IS_OK(status)) {
1365                 reply_nterror(req, status);
1366                 goto out;
1367         }
1368
1369         status = filename_convert(ctx,
1370                                 conn,
1371                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1372                                 fname,
1373                                 0,
1374                                 NULL,
1375                                 &smb_fname);
1376         if (!NT_STATUS_IS_OK(status)) {
1377                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1378                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1379                                         ERRSRV, ERRbadpath);
1380                         goto out;
1381                 }
1382                 reply_nterror(req, status);
1383                 goto out;
1384         }
1385
1386         if (smb_fname->base_name[0] == '.' &&
1387             smb_fname->base_name[1] == '\0') {
1388                 /*
1389                  * Not sure here is the right place to catch this
1390                  * condition. Might be moved to somewhere else later -- vl
1391                  */
1392                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1393                 goto out;
1394         }
1395
1396         mode = SVAL(req->vwv+0, 0);
1397         mtime = srv_make_unix_date3(req->vwv+1);
1398
1399         if (mode != FILE_ATTRIBUTE_NORMAL) {
1400                 if (VALID_STAT_OF_DIR(smb_fname->st))
1401                         mode |= FILE_ATTRIBUTE_DIRECTORY;
1402                 else
1403                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1404
1405                 status = check_access(conn, NULL, smb_fname,
1406                                         FILE_WRITE_ATTRIBUTES);
1407                 if (!NT_STATUS_IS_OK(status)) {
1408                         reply_nterror(req, status);
1409                         goto out;
1410                 }
1411
1412                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1413                                      false) != 0) {
1414                         reply_nterror(req, map_nt_error_from_unix(errno));
1415                         goto out;
1416                 }
1417         }
1418
1419         ft.mtime = convert_time_t_to_timespec(mtime);
1420         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1421         if (!NT_STATUS_IS_OK(status)) {
1422                 reply_nterror(req, status);
1423                 goto out;
1424         }
1425
1426         reply_outbuf(req, 0, 0);
1427
1428         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1429                  mode));
1430  out:
1431         TALLOC_FREE(smb_fname);
1432         END_PROFILE(SMBsetatr);
1433         return;
1434 }
1435
1436 /****************************************************************************
1437  Reply to a dskattr.
1438 ****************************************************************************/
1439
1440 void reply_dskattr(struct smb_request *req)
1441 {
1442         connection_struct *conn = req->conn;
1443         uint64_t dfree,dsize,bsize;
1444         START_PROFILE(SMBdskattr);
1445
1446         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1447                 reply_nterror(req, map_nt_error_from_unix(errno));
1448                 END_PROFILE(SMBdskattr);
1449                 return;
1450         }
1451
1452         reply_outbuf(req, 5, 0);
1453
1454         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1455                 double total_space, free_space;
1456                 /* we need to scale this to a number that DOS6 can handle. We
1457                    use floating point so we can handle large drives on systems
1458                    that don't have 64 bit integers
1459
1460                    we end up displaying a maximum of 2G to DOS systems
1461                 */
1462                 total_space = dsize * (double)bsize;
1463                 free_space = dfree * (double)bsize;
1464
1465                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1466                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1467
1468                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1469                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1470
1471                 SSVAL(req->outbuf,smb_vwv0,dsize);
1472                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1473                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1474                 SSVAL(req->outbuf,smb_vwv3,dfree);
1475         } else {
1476                 SSVAL(req->outbuf,smb_vwv0,dsize);
1477                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1478                 SSVAL(req->outbuf,smb_vwv2,512);
1479                 SSVAL(req->outbuf,smb_vwv3,dfree);
1480         }
1481
1482         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1483
1484         END_PROFILE(SMBdskattr);
1485         return;
1486 }
1487
1488 /*
1489  * Utility function to split the filename from the directory.
1490  */
1491 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1492                                      char **fname_dir_out,
1493                                      char **fname_mask_out)
1494 {
1495         const char *p = NULL;
1496         char *fname_dir = NULL;
1497         char *fname_mask = NULL;
1498
1499         p = strrchr_m(fname_in, '/');
1500         if (!p) {
1501                 fname_dir = talloc_strdup(ctx, ".");
1502                 fname_mask = talloc_strdup(ctx, fname_in);
1503         } else {
1504                 fname_dir = talloc_strndup(ctx, fname_in,
1505                     PTR_DIFF(p, fname_in));
1506                 fname_mask = talloc_strdup(ctx, p+1);
1507         }
1508
1509         if (!fname_dir || !fname_mask) {
1510                 TALLOC_FREE(fname_dir);
1511                 TALLOC_FREE(fname_mask);
1512                 return NT_STATUS_NO_MEMORY;
1513         }
1514
1515         *fname_dir_out = fname_dir;
1516         *fname_mask_out = fname_mask;
1517         return NT_STATUS_OK;
1518 }
1519
1520 /****************************************************************************
1521  Reply to a search.
1522  Can be called from SMBsearch, SMBffirst or SMBfunique.
1523 ****************************************************************************/
1524
1525 void reply_search(struct smb_request *req)
1526 {
1527         connection_struct *conn = req->conn;
1528         char *path = NULL;
1529         const char *mask = NULL;
1530         char *directory = NULL;
1531         struct smb_filename *smb_fname = NULL;
1532         char *fname = NULL;
1533         off_t size;
1534         uint32 mode;
1535         struct timespec date;
1536         uint32 dirtype;
1537         unsigned int numentries = 0;
1538         unsigned int maxentries = 0;
1539         bool finished = False;
1540         const char *p;
1541         int status_len;
1542         char status[21];
1543         int dptr_num= -1;
1544         bool check_descend = False;
1545         bool expect_close = False;
1546         NTSTATUS nt_status;
1547         bool mask_contains_wcard = False;
1548         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1549         TALLOC_CTX *ctx = talloc_tos();
1550         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1551         struct dptr_struct *dirptr = NULL;
1552         struct smbd_server_connection *sconn = req->sconn;
1553
1554         START_PROFILE(SMBsearch);
1555
1556         if (req->wct < 2) {
1557                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1558                 goto out;
1559         }
1560
1561         if (lp_posix_pathnames()) {
1562                 reply_unknown_new(req, req->cmd);
1563                 goto out;
1564         }
1565
1566         /* If we were called as SMBffirst then we must expect close. */
1567         if(req->cmd == SMBffirst) {
1568                 expect_close = True;
1569         }
1570
1571         reply_outbuf(req, 1, 3);
1572         maxentries = SVAL(req->vwv+0, 0);
1573         dirtype = SVAL(req->vwv+1, 0);
1574         p = (const char *)req->buf + 1;
1575         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1576                                        &nt_status, &mask_contains_wcard);
1577         if (!NT_STATUS_IS_OK(nt_status)) {
1578                 reply_nterror(req, nt_status);
1579                 goto out;
1580         }
1581
1582         p++;
1583         status_len = SVAL(p, 0);
1584         p += 2;
1585
1586         /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1587
1588         if (status_len == 0) {
1589                 nt_status = filename_convert(ctx, conn,
1590                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1591                                              path,
1592                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1593                                              &mask_contains_wcard,
1594                                              &smb_fname);
1595                 if (!NT_STATUS_IS_OK(nt_status)) {
1596                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1597                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1598                                                 ERRSRV, ERRbadpath);
1599                                 goto out;
1600                         }
1601                         reply_nterror(req, nt_status);
1602                         goto out;
1603                 }
1604
1605                 directory = smb_fname->base_name;
1606
1607                 p = strrchr_m(directory,'/');
1608                 if ((p != NULL) && (*directory != '/')) {
1609                         mask = p + 1;
1610                         directory = talloc_strndup(ctx, directory,
1611                                                    PTR_DIFF(p, directory));
1612                 } else {
1613                         mask = directory;
1614                         directory = talloc_strdup(ctx,".");
1615                 }
1616
1617                 if (!directory) {
1618                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1619                         goto out;
1620                 }
1621
1622                 memset((char *)status,'\0',21);
1623                 SCVAL(status,0,(dirtype & 0x1F));
1624
1625                 nt_status = dptr_create(conn,
1626                                         NULL, /* req */
1627                                         NULL, /* fsp */
1628                                         directory,
1629                                         True,
1630                                         expect_close,
1631                                         req->smbpid,
1632                                         mask,
1633                                         mask_contains_wcard,
1634                                         dirtype,
1635                                         &dirptr);
1636                 if (!NT_STATUS_IS_OK(nt_status)) {
1637                         reply_nterror(req, nt_status);
1638                         goto out;
1639                 }
1640                 dptr_num = dptr_dnum(dirptr);
1641         } else {
1642                 int status_dirtype;
1643                 const char *dirpath;
1644
1645                 memcpy(status,p,21);
1646                 status_dirtype = CVAL(status,0) & 0x1F;
1647                 if (status_dirtype != (dirtype & 0x1F)) {
1648                         dirtype = status_dirtype;
1649                 }
1650
1651                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1652                 if (!dirptr) {
1653                         goto SearchEmpty;
1654                 }
1655                 dirpath = dptr_path(sconn, dptr_num);
1656                 directory = talloc_strdup(ctx, dirpath);
1657                 if (!directory) {
1658                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1659                         goto out;
1660                 }
1661
1662                 mask = dptr_wcard(sconn, dptr_num);
1663                 if (!mask) {
1664                         goto SearchEmpty;
1665                 }
1666                 /*
1667                  * For a 'continue' search we have no string. So
1668                  * check from the initial saved string.
1669                  */
1670                 mask_contains_wcard = ms_has_wild(mask);
1671                 dirtype = dptr_attr(sconn, dptr_num);
1672         }
1673
1674         DEBUG(4,("dptr_num is %d\n",dptr_num));
1675
1676         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1677         dptr_init_search_op(dirptr);
1678
1679         if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1680                 char buf[DIR_STRUCT_SIZE];
1681                 memcpy(buf,status,21);
1682                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1683                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1684                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1685                         goto out;
1686                 }
1687                 dptr_fill(sconn, buf+12,dptr_num);
1688                 if (dptr_zero(buf+12) && (status_len==0)) {
1689                         numentries = 1;
1690                 } else {
1691                         numentries = 0;
1692                 }
1693                 if (message_push_blob(&req->outbuf,
1694                                       data_blob_const(buf, sizeof(buf)))
1695                     == -1) {
1696                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1697                         goto out;
1698                 }
1699         } else {
1700                 unsigned int i;
1701                 maxentries = MIN(
1702                         maxentries,
1703                         ((BUFFER_SIZE -
1704                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1705                          /DIR_STRUCT_SIZE));
1706
1707                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1708                          directory,lp_dontdescend(ctx, SNUM(conn))));
1709                 if (in_list(directory, lp_dontdescend(ctx, SNUM(conn)),True)) {
1710                         check_descend = True;
1711                 }
1712
1713                 for (i=numentries;(i<maxentries) && !finished;i++) {
1714                         finished = !get_dir_entry(ctx,
1715                                                   dirptr,
1716                                                   mask,
1717                                                   dirtype,
1718                                                   &fname,
1719                                                   &size,
1720                                                   &mode,
1721                                                   &date,
1722                                                   check_descend,
1723                                                   ask_sharemode);
1724                         if (!finished) {
1725                                 char buf[DIR_STRUCT_SIZE];
1726                                 memcpy(buf,status,21);
1727                                 if (!make_dir_struct(ctx,
1728                                                 buf,
1729                                                 mask,
1730                                                 fname,
1731                                                 size,
1732                                                 mode,
1733                                                 convert_timespec_to_time_t(date),
1734                                                 !allow_long_path_components)) {
1735                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1736                                         goto out;
1737                                 }
1738                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1739                                         break;
1740                                 }
1741                                 if (message_push_blob(&req->outbuf,
1742                                                       data_blob_const(buf, sizeof(buf)))
1743                                     == -1) {
1744                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1745                                         goto out;
1746                                 }
1747                                 numentries++;
1748                         }
1749                 }
1750         }
1751
1752   SearchEmpty:
1753
1754         /* If we were called as SMBffirst with smb_search_id == NULL
1755                 and no entries were found then return error and close dirptr
1756                 (X/Open spec) */
1757
1758         if (numentries == 0) {
1759                 dptr_close(sconn, &dptr_num);
1760         } else if(expect_close && status_len == 0) {
1761                 /* Close the dptr - we know it's gone */
1762                 dptr_close(sconn, &dptr_num);
1763         }
1764
1765         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1766         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1767                 dptr_close(sconn, &dptr_num);
1768         }
1769
1770         if ((numentries == 0) && !mask_contains_wcard) {
1771                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1772                 goto out;
1773         }
1774
1775         SSVAL(req->outbuf,smb_vwv0,numentries);
1776         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1777         SCVAL(smb_buf(req->outbuf),0,5);
1778         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1779
1780         /* The replies here are never long name. */
1781         SSVAL(req->outbuf, smb_flg2,
1782               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1783         if (!allow_long_path_components) {
1784                 SSVAL(req->outbuf, smb_flg2,
1785                       SVAL(req->outbuf, smb_flg2)
1786                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1787         }
1788
1789         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1790         SSVAL(req->outbuf, smb_flg2,
1791               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1792
1793         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1794                 smb_fn_name(req->cmd),
1795                 mask,
1796                 directory,
1797                 dirtype,
1798                 numentries,
1799                 maxentries ));
1800  out:
1801         TALLOC_FREE(directory);
1802         TALLOC_FREE(smb_fname);
1803         END_PROFILE(SMBsearch);
1804         return;
1805 }
1806
1807 /****************************************************************************
1808  Reply to a fclose (stop directory search).
1809 ****************************************************************************/
1810
1811 void reply_fclose(struct smb_request *req)
1812 {
1813         int status_len;
1814         char status[21];
1815         int dptr_num= -2;
1816         const char *p;
1817         char *path = NULL;
1818         NTSTATUS err;
1819         bool path_contains_wcard = False;
1820         TALLOC_CTX *ctx = talloc_tos();
1821         struct smbd_server_connection *sconn = req->sconn;
1822
1823         START_PROFILE(SMBfclose);
1824
1825         if (lp_posix_pathnames()) {
1826                 reply_unknown_new(req, req->cmd);
1827                 END_PROFILE(SMBfclose);
1828                 return;
1829         }
1830
1831         p = (const char *)req->buf + 1;
1832         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1833                                        &err, &path_contains_wcard);
1834         if (!NT_STATUS_IS_OK(err)) {
1835                 reply_nterror(req, err);
1836                 END_PROFILE(SMBfclose);
1837                 return;
1838         }
1839         p++;
1840         status_len = SVAL(p,0);
1841         p += 2;
1842
1843         if (status_len == 0) {
1844                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1845                 END_PROFILE(SMBfclose);
1846                 return;
1847         }
1848
1849         memcpy(status,p,21);
1850
1851         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1852                 /*  Close the dptr - we know it's gone */
1853                 dptr_close(sconn, &dptr_num);
1854         }
1855
1856         reply_outbuf(req, 1, 0);
1857         SSVAL(req->outbuf,smb_vwv0,0);
1858
1859         DEBUG(3,("search close\n"));
1860
1861         END_PROFILE(SMBfclose);
1862         return;
1863 }
1864
1865 /****************************************************************************
1866  Reply to an open.
1867 ****************************************************************************/
1868
1869 void reply_open(struct smb_request *req)
1870 {
1871         connection_struct *conn = req->conn;
1872         struct smb_filename *smb_fname = NULL;
1873         char *fname = NULL;
1874         uint32 fattr=0;
1875         off_t size = 0;
1876         time_t mtime=0;
1877         int info;
1878         files_struct *fsp;
1879         int oplock_request;
1880         int deny_mode;
1881         uint32 dos_attr;
1882         uint32 access_mask;
1883         uint32 share_mode;
1884         uint32 create_disposition;
1885         uint32 create_options = 0;
1886         uint32_t private_flags = 0;
1887         NTSTATUS status;
1888         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1889         TALLOC_CTX *ctx = talloc_tos();
1890
1891         START_PROFILE(SMBopen);
1892
1893         if (req->wct < 2) {
1894                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1895                 goto out;
1896         }
1897
1898         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1899         deny_mode = SVAL(req->vwv+0, 0);
1900         dos_attr = SVAL(req->vwv+1, 0);
1901
1902         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1903                             STR_TERMINATE, &status);
1904         if (!NT_STATUS_IS_OK(status)) {
1905                 reply_nterror(req, status);
1906                 goto out;
1907         }
1908
1909         if (!map_open_params_to_ntcreate(fname, deny_mode,
1910                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1911                                          &share_mode, &create_disposition,
1912                                          &create_options, &private_flags)) {
1913                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1914                 goto out;
1915         }
1916
1917         status = filename_convert(ctx,
1918                                 conn,
1919                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1920                                 fname,
1921                                 UCF_PREP_CREATEFILE,
1922                                 NULL,
1923                                 &smb_fname);
1924         if (!NT_STATUS_IS_OK(status)) {
1925                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1926                         reply_botherror(req,
1927                                         NT_STATUS_PATH_NOT_COVERED,
1928                                         ERRSRV, ERRbadpath);
1929                         goto out;
1930                 }
1931                 reply_nterror(req, status);
1932                 goto out;
1933         }
1934
1935         status = SMB_VFS_CREATE_FILE(
1936                 conn,                                   /* conn */
1937                 req,                                    /* req */
1938                 0,                                      /* root_dir_fid */
1939                 smb_fname,                              /* fname */
1940                 access_mask,                            /* access_mask */
1941                 share_mode,                             /* share_access */
1942                 create_disposition,                     /* create_disposition*/
1943                 create_options,                         /* create_options */
1944                 dos_attr,                               /* file_attributes */
1945                 oplock_request,                         /* oplock_request */
1946                 0,                                      /* allocation_size */
1947                 private_flags,
1948                 NULL,                                   /* sd */
1949                 NULL,                                   /* ea_list */
1950                 &fsp,                                   /* result */
1951                 &info);                                 /* pinfo */
1952
1953         if (!NT_STATUS_IS_OK(status)) {
1954                 if (open_was_deferred(req->sconn, req->mid)) {
1955                         /* We have re-scheduled this call. */
1956                         goto out;
1957                 }
1958                 reply_openerror(req, status);
1959                 goto out;
1960         }
1961
1962         size = smb_fname->st.st_ex_size;
1963         fattr = dos_mode(conn, smb_fname);
1964
1965         /* Deal with other possible opens having a modified
1966            write time. JRA. */
1967         if (ask_sharemode) {
1968                 struct timespec write_time_ts;
1969
1970                 ZERO_STRUCT(write_time_ts);
1971                 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1972                 if (!null_timespec(write_time_ts)) {
1973                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1974                 }
1975         }
1976
1977         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1978
1979         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1980                 DEBUG(3,("attempt to open a directory %s\n",
1981                          fsp_str_dbg(fsp)));
1982                 close_file(req, fsp, ERROR_CLOSE);
1983                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1984                         ERRDOS, ERRnoaccess);
1985                 goto out;
1986         }
1987
1988         reply_outbuf(req, 7, 0);
1989         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1990         SSVAL(req->outbuf,smb_vwv1,fattr);
1991         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1992                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1993         } else {
1994                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1995         }
1996         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1997         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1998
1999         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2000                 SCVAL(req->outbuf,smb_flg,
2001                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2002         }
2003
2004         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2005                 SCVAL(req->outbuf,smb_flg,
2006                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2007         }
2008  out:
2009         TALLOC_FREE(smb_fname);
2010         END_PROFILE(SMBopen);
2011         return;
2012 }
2013
2014 /****************************************************************************
2015  Reply to an open and X.
2016 ****************************************************************************/
2017
2018 void reply_open_and_X(struct smb_request *req)
2019 {
2020         connection_struct *conn = req->conn;
2021         struct smb_filename *smb_fname = NULL;
2022         char *fname = NULL;
2023         uint16 open_flags;
2024         int deny_mode;
2025         uint32 smb_attr;
2026         /* Breakout the oplock request bits so we can set the
2027                 reply bits separately. */
2028         int ex_oplock_request;
2029         int core_oplock_request;
2030         int oplock_request;
2031 #if 0
2032         int smb_sattr = SVAL(req->vwv+4, 0);
2033         uint32 smb_time = make_unix_date3(req->vwv+6);
2034 #endif
2035         int smb_ofun;
2036         uint32 fattr=0;
2037         int mtime=0;
2038         int smb_action = 0;
2039         files_struct *fsp;
2040         NTSTATUS status;
2041         uint64_t allocation_size;
2042         ssize_t retval = -1;
2043         uint32 access_mask;
2044         uint32 share_mode;
2045         uint32 create_disposition;
2046         uint32 create_options = 0;
2047         uint32_t private_flags = 0;
2048         TALLOC_CTX *ctx = talloc_tos();
2049
2050         START_PROFILE(SMBopenX);
2051
2052         if (req->wct < 15) {
2053                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2054                 goto out;
2055         }
2056
2057         open_flags = SVAL(req->vwv+2, 0);
2058         deny_mode = SVAL(req->vwv+3, 0);
2059         smb_attr = SVAL(req->vwv+5, 0);
2060         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2061         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2062         oplock_request = ex_oplock_request | core_oplock_request;
2063         smb_ofun = SVAL(req->vwv+8, 0);
2064         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2065
2066         /* If it's an IPC, pass off the pipe handler. */
2067         if (IS_IPC(conn)) {
2068                 if (lp_nt_pipe_support()) {
2069                         reply_open_pipe_and_X(conn, req);
2070                 } else {
2071                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2072                 }
2073                 goto out;
2074         }
2075
2076         /* XXXX we need to handle passed times, sattr and flags */
2077         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2078                         STR_TERMINATE, &status);
2079         if (!NT_STATUS_IS_OK(status)) {
2080                 reply_nterror(req, status);
2081                 goto out;
2082         }
2083
2084         if (!map_open_params_to_ntcreate(fname, deny_mode,
2085                                          smb_ofun,
2086                                          &access_mask, &share_mode,
2087                                          &create_disposition,
2088                                          &create_options,
2089                                          &private_flags)) {
2090                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2091                 goto out;
2092         }
2093
2094         status = filename_convert(ctx,
2095                                 conn,
2096                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2097                                 fname,
2098                                 UCF_PREP_CREATEFILE,
2099                                 NULL,
2100                                 &smb_fname);
2101         if (!NT_STATUS_IS_OK(status)) {
2102                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2103                         reply_botherror(req,
2104                                         NT_STATUS_PATH_NOT_COVERED,
2105                                         ERRSRV, ERRbadpath);
2106                         goto out;
2107                 }
2108                 reply_nterror(req, status);
2109                 goto out;
2110         }
2111
2112         status = SMB_VFS_CREATE_FILE(
2113                 conn,                                   /* conn */
2114                 req,                                    /* req */
2115                 0,                                      /* root_dir_fid */
2116                 smb_fname,                              /* fname */
2117                 access_mask,                            /* access_mask */
2118                 share_mode,                             /* share_access */
2119                 create_disposition,                     /* create_disposition*/
2120                 create_options,                         /* create_options */
2121                 smb_attr,                               /* file_attributes */
2122                 oplock_request,                         /* oplock_request */
2123                 0,                                      /* allocation_size */
2124                 private_flags,
2125                 NULL,                                   /* sd */
2126                 NULL,                                   /* ea_list */
2127                 &fsp,                                   /* result */
2128                 &smb_action);                           /* pinfo */
2129
2130         if (!NT_STATUS_IS_OK(status)) {
2131                 if (open_was_deferred(req->sconn, req->mid)) {
2132                         /* We have re-scheduled this call. */
2133                         goto out;
2134                 }
2135                 reply_openerror(req, status);
2136                 goto out;
2137         }
2138
2139         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2140            if the file is truncated or created. */
2141         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2142                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2143                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2144                         close_file(req, fsp, ERROR_CLOSE);
2145                         reply_nterror(req, NT_STATUS_DISK_FULL);
2146                         goto out;
2147                 }
2148                 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2149                 if (retval < 0) {
2150                         close_file(req, fsp, ERROR_CLOSE);
2151                         reply_nterror(req, NT_STATUS_DISK_FULL);
2152                         goto out;
2153                 }
2154                 status = vfs_stat_fsp(fsp);
2155                 if (!NT_STATUS_IS_OK(status)) {
2156                         close_file(req, fsp, ERROR_CLOSE);
2157                         reply_nterror(req, status);
2158                         goto out;
2159                 }
2160         }
2161
2162         fattr = dos_mode(conn, fsp->fsp_name);
2163         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2164         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2165                 close_file(req, fsp, ERROR_CLOSE);
2166                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2167                 goto out;
2168         }
2169
2170         /* If the caller set the extended oplock request bit
2171                 and we granted one (by whatever means) - set the
2172                 correct bit for extended oplock reply.
2173         */
2174
2175         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2176                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2177         }
2178
2179         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2180                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2181         }
2182
2183         /* If the caller set the core oplock request bit
2184                 and we granted one (by whatever means) - set the
2185                 correct bit for core oplock reply.
2186         */
2187
2188         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2189                 reply_outbuf(req, 19, 0);
2190         } else {
2191                 reply_outbuf(req, 15, 0);
2192         }
2193
2194         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2195         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2196
2197         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2198                 SCVAL(req->outbuf, smb_flg,
2199                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2200         }
2201
2202         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2203                 SCVAL(req->outbuf, smb_flg,
2204                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2205         }
2206
2207         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2208         SSVAL(req->outbuf,smb_vwv3,fattr);
2209         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2210                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2211         } else {
2212                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2213         }
2214         SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2215         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2216         SSVAL(req->outbuf,smb_vwv11,smb_action);
2217
2218         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2219                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2220         }
2221
2222  out:
2223         TALLOC_FREE(smb_fname);
2224         END_PROFILE(SMBopenX);
2225         return;
2226 }
2227
2228 /****************************************************************************
2229  Reply to a SMBulogoffX.
2230 ****************************************************************************/
2231
2232 void reply_ulogoffX(struct smb_request *req)
2233 {
2234         struct smbd_server_connection *sconn = req->sconn;
2235         struct user_struct *vuser;
2236         struct smbXsrv_session *session = NULL;
2237         NTSTATUS status;
2238
2239         START_PROFILE(SMBulogoffX);
2240
2241         vuser = get_valid_user_struct(sconn, req->vuid);
2242
2243         if(vuser == NULL) {
2244                 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2245                          (unsigned long long)req->vuid));
2246
2247                 req->vuid = UID_FIELD_INVALID;
2248                 reply_force_doserror(req, ERRSRV, ERRbaduid);
2249                 END_PROFILE(SMBulogoffX);
2250                 return;
2251         }
2252
2253         session = vuser->session;
2254         vuser = NULL;
2255
2256         /*
2257          * TODO: cancel all outstanding requests on the session
2258          */
2259         status = smbXsrv_session_logoff(session);
2260         if (!NT_STATUS_IS_OK(status)) {
2261                 DEBUG(0, ("reply_ulogoff: "
2262                           "smbXsrv_session_logoff() failed: %s\n",
2263                           nt_errstr(status)));
2264                 /*
2265                  * If we hit this case, there is something completely
2266                  * wrong, so we better disconnect the transport connection.
2267                  */
2268                 END_PROFILE(SMBulogoffX);
2269                 exit_server(__location__ ": smbXsrv_session_logoff failed");
2270                 return;
2271         }
2272
2273         TALLOC_FREE(session);
2274
2275         reply_outbuf(req, 2, 0);
2276         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2277         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2278
2279         DEBUG(3, ("ulogoffX vuid=%llu\n",
2280                   (unsigned long long)req->vuid));
2281
2282         END_PROFILE(SMBulogoffX);
2283         req->vuid = UID_FIELD_INVALID;
2284 }
2285
2286 /****************************************************************************
2287  Reply to a mknew or a create.
2288 ****************************************************************************/
2289
2290 void reply_mknew(struct smb_request *req)
2291 {
2292         connection_struct *conn = req->conn;
2293         struct smb_filename *smb_fname = NULL;
2294         char *fname = NULL;
2295         uint32 fattr = 0;
2296         struct smb_file_time ft;
2297         files_struct *fsp;
2298         int oplock_request = 0;
2299         NTSTATUS status;
2300         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2301         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2302         uint32 create_disposition;
2303         uint32 create_options = 0;
2304         TALLOC_CTX *ctx = talloc_tos();
2305
2306         START_PROFILE(SMBcreate);
2307         ZERO_STRUCT(ft);
2308
2309         if (req->wct < 3) {
2310                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2311                 goto out;
2312         }
2313
2314         fattr = SVAL(req->vwv+0, 0);
2315         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2316
2317         /* mtime. */
2318         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2319
2320         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2321                             STR_TERMINATE, &status);
2322         if (!NT_STATUS_IS_OK(status)) {
2323                 reply_nterror(req, status);
2324                 goto out;
2325         }
2326
2327         status = filename_convert(ctx,
2328                                 conn,
2329                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2330                                 fname,
2331                                 UCF_PREP_CREATEFILE,
2332                                 NULL,
2333                                 &smb_fname);
2334         if (!NT_STATUS_IS_OK(status)) {
2335                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2336                         reply_botherror(req,
2337                                         NT_STATUS_PATH_NOT_COVERED,
2338                                         ERRSRV, ERRbadpath);
2339                         goto out;
2340                 }
2341                 reply_nterror(req, status);
2342                 goto out;
2343         }
2344
2345         if (fattr & FILE_ATTRIBUTE_VOLUME) {
2346                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2347                          "please report this\n",
2348                          smb_fname_str_dbg(smb_fname)));
2349         }
2350
2351         if(req->cmd == SMBmknew) {
2352                 /* We should fail if file exists. */
2353                 create_disposition = FILE_CREATE;
2354         } else {
2355                 /* Create if file doesn't exist, truncate if it does. */
2356                 create_disposition = FILE_OVERWRITE_IF;
2357         }
2358
2359         status = SMB_VFS_CREATE_FILE(
2360                 conn,                                   /* conn */
2361                 req,                                    /* req */
2362                 0,                                      /* root_dir_fid */
2363                 smb_fname,                              /* fname */
2364                 access_mask,                            /* access_mask */
2365                 share_mode,                             /* share_access */
2366                 create_disposition,                     /* create_disposition*/
2367                 create_options,                         /* create_options */
2368                 fattr,                                  /* file_attributes */
2369                 oplock_request,                         /* oplock_request */
2370                 0,                                      /* allocation_size */
2371                 0,                                      /* private_flags */
2372                 NULL,                                   /* sd */
2373                 NULL,                                   /* ea_list */
2374                 &fsp,                                   /* result */
2375                 NULL);                                  /* pinfo */
2376
2377         if (!NT_STATUS_IS_OK(status)) {
2378                 if (open_was_deferred(req->sconn, req->mid)) {
2379                         /* We have re-scheduled this call. */
2380                         goto out;
2381                 }
2382                 reply_openerror(req, status);
2383                 goto out;
2384         }
2385
2386         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2387         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2388         if (!NT_STATUS_IS_OK(status)) {
2389                 END_PROFILE(SMBcreate);
2390                 goto out;
2391         }
2392
2393         reply_outbuf(req, 1, 0);
2394         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2395
2396         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2397                 SCVAL(req->outbuf,smb_flg,
2398                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2399         }
2400
2401         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2402                 SCVAL(req->outbuf,smb_flg,
2403                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2404         }
2405
2406         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2407         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2408                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2409                   (unsigned int)fattr));
2410
2411  out:
2412         TALLOC_FREE(smb_fname);
2413         END_PROFILE(SMBcreate);
2414         return;
2415 }
2416
2417 /****************************************************************************
2418  Reply to a create temporary file.
2419 ****************************************************************************/
2420
2421 void reply_ctemp(struct smb_request *req)
2422 {
2423         connection_struct *conn = req->conn;
2424         struct smb_filename *smb_fname = NULL;
2425         char *wire_name = NULL;
2426         char *fname = NULL;
2427         uint32 fattr;
2428         files_struct *fsp;
2429         int oplock_request;
2430         char *s;
2431         NTSTATUS status;
2432         int i;
2433         TALLOC_CTX *ctx = talloc_tos();
2434
2435         START_PROFILE(SMBctemp);
2436
2437         if (req->wct < 3) {
2438                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2439                 goto out;
2440         }
2441
2442         fattr = SVAL(req->vwv+0, 0);
2443         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2444
2445         srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2446                             STR_TERMINATE, &status);
2447         if (!NT_STATUS_IS_OK(status)) {
2448                 reply_nterror(req, status);
2449                 goto out;
2450         }
2451
2452         for (i = 0; i < 10; i++) {
2453                 if (*wire_name) {
2454                         fname = talloc_asprintf(ctx,
2455                                         "%s/TMP%s",
2456                                         wire_name,
2457                                         generate_random_str_list(ctx, 5, "0123456789"));
2458                 } else {
2459                         fname = talloc_asprintf(ctx,
2460                                         "TMP%s",
2461                                         generate_random_str_list(ctx, 5, "0123456789"));
2462                 }
2463
2464                 if (!fname) {
2465                         reply_nterror(req, NT_STATUS_NO_MEMORY);
2466                         goto out;
2467                 }
2468
2469                 status = filename_convert(ctx, conn,
2470                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2471                                 fname,
2472                                 UCF_PREP_CREATEFILE,
2473                                 NULL,
2474                                 &smb_fname);
2475                 if (!NT_STATUS_IS_OK(status)) {
2476                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2477                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2478                                         ERRSRV, ERRbadpath);
2479                                 goto out;
2480                         }
2481                         reply_nterror(req, status);
2482                         goto out;
2483                 }
2484
2485                 /* Create the file. */
2486                 status = SMB_VFS_CREATE_FILE(
2487                         conn,                                   /* conn */
2488                         req,                                    /* req */
2489                         0,                                      /* root_dir_fid */
2490                         smb_fname,                              /* fname */
2491                         FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2492                         FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2493                         FILE_CREATE,                            /* create_disposition*/
2494                         0,                                      /* create_options */
2495                         fattr,                                  /* file_attributes */
2496                         oplock_request,                         /* oplock_request */
2497                         0,                                      /* allocation_size */
2498                         0,                                      /* private_flags */
2499                         NULL,                                   /* sd */
2500                         NULL,                                   /* ea_list */
2501                         &fsp,                                   /* result */
2502                         NULL);                                  /* pinfo */
2503
2504                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2505                         TALLOC_FREE(fname);
2506                         TALLOC_FREE(smb_fname);
2507                         continue;
2508                 }
2509
2510                 if (!NT_STATUS_IS_OK(status)) {
2511                         if (open_was_deferred(req->sconn, req->mid)) {
2512                                 /* We have re-scheduled this call. */
2513                                 goto out;
2514                         }
2515                         reply_openerror(req, status);
2516                         goto out;
2517                 }
2518
2519                 break;
2520         }
2521
2522         if (i == 10) {
2523                 /* Collision after 10 times... */
2524                 reply_nterror(req, status);
2525                 goto out;
2526         }
2527
2528         reply_outbuf(req, 1, 0);
2529         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2530
2531         /* the returned filename is relative to the directory */
2532         s = strrchr_m(fsp->fsp_name->base_name, '/');
2533         if (!s) {
2534                 s = fsp->fsp_name->base_name;
2535         } else {
2536                 s++;
2537         }
2538
2539 #if 0
2540         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2541            thing in the byte section. JRA */
2542         SSVALS(p, 0, -1); /* what is this? not in spec */
2543 #endif
2544         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2545             == -1) {
2546                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2547                 goto out;
2548         }
2549
2550         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2551                 SCVAL(req->outbuf, smb_flg,
2552                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2553         }
2554
2555         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2556                 SCVAL(req->outbuf, smb_flg,
2557                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2558         }
2559
2560         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2561         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2562                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2563  out:
2564         TALLOC_FREE(smb_fname);
2565         TALLOC_FREE(wire_name);
2566         END_PROFILE(SMBctemp);
2567         return;
2568 }
2569
2570 /*******************************************************************
2571  Check if a user is allowed to rename a file.
2572 ********************************************************************/
2573
2574 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2575                         uint16 dirtype)
2576 {
2577         if (!CAN_WRITE(conn)) {
2578                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2579         }
2580
2581         if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2582                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2583                 /* Only bother to read the DOS attribute if we might deny the
2584                    rename on the grounds of attribute missmatch. */
2585                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2586                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2587                         return NT_STATUS_NO_SUCH_FILE;
2588                 }
2589         }
2590
2591         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2592                 if (fsp->posix_open) {
2593                         return NT_STATUS_OK;
2594                 }
2595
2596                 /* If no pathnames are open below this
2597                    directory, allow the rename. */
2598
2599                 if (file_find_subpath(fsp)) {
2600                         return NT_STATUS_ACCESS_DENIED;
2601                 }
2602                 return NT_STATUS_OK;
2603         }
2604
2605         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2606                 return NT_STATUS_OK;
2607         }
2608
2609         return NT_STATUS_ACCESS_DENIED;
2610 }
2611
2612 /*******************************************************************
2613  * unlink a file with all relevant access checks
2614  *******************************************************************/
2615
2616 static NTSTATUS do_unlink(connection_struct *conn,
2617                         struct smb_request *req,
2618                         struct smb_filename *smb_fname,
2619                         uint32 dirtype)
2620 {
2621         uint32 fattr;
2622         files_struct *fsp;
2623         uint32 dirtype_orig = dirtype;
2624         NTSTATUS status;
2625         int ret;
2626         bool posix_paths = lp_posix_pathnames();
2627
2628         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2629                   smb_fname_str_dbg(smb_fname),
2630                   dirtype));
2631
2632         if (!CAN_WRITE(conn)) {
2633                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2634         }
2635
2636         if (posix_paths) {
2637                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2638         } else {
2639                 ret = SMB_VFS_STAT(conn, smb_fname);
2640         }
2641         if (ret != 0) {
2642                 return map_nt_error_from_unix(errno);
2643         }
2644
2645         fattr = dos_mode(conn, smb_fname);
2646
2647         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2648                 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2649         }
2650
2651         dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2652         if (!dirtype) {
2653                 return NT_STATUS_NO_SUCH_FILE;
2654         }
2655
2656         if (!dir_check_ftype(fattr, dirtype)) {
2657                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2658                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2659                 }
2660                 return NT_STATUS_NO_SUCH_FILE;
2661         }
2662
2663         if (dirtype_orig & 0x8000) {
2664                 /* These will never be set for POSIX. */
2665                 return NT_STATUS_NO_SUCH_FILE;
2666         }
2667
2668 #if 0
2669         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2670                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2671         }
2672
2673         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2674                 return NT_STATUS_NO_SUCH_FILE;
2675         }
2676
2677         if (dirtype & 0xFF00) {
2678                 /* These will never be set for POSIX. */
2679                 return NT_STATUS_NO_SUCH_FILE;
2680         }
2681
2682         dirtype &= 0xFF;
2683         if (!dirtype) {
2684                 return NT_STATUS_NO_SUCH_FILE;
2685         }
2686
2687         /* Can't delete a directory. */
2688         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2689                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2690         }
2691 #endif
2692
2693 #if 0 /* JRATEST */
2694         else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2695                 return NT_STATUS_OBJECT_NAME_INVALID;
2696 #endif /* JRATEST */
2697
2698         /* On open checks the open itself will check the share mode, so
2699            don't do it here as we'll get it wrong. */
2700
2701         status = SMB_VFS_CREATE_FILE
2702                 (conn,                  /* conn */
2703                  req,                   /* req */
2704                  0,                     /* root_dir_fid */
2705                  smb_fname,             /* fname */
2706                  DELETE_ACCESS,         /* access_mask */
2707                  FILE_SHARE_NONE,       /* share_access */
2708                  FILE_OPEN,             /* create_disposition*/
2709                  FILE_NON_DIRECTORY_FILE, /* create_options */
2710                                         /* file_attributes */
2711                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2712                                 FILE_ATTRIBUTE_NORMAL,
2713                  0,                     /* oplock_request */
2714                  0,                     /* allocation_size */
2715                  0,                     /* private_flags */
2716                  NULL,                  /* sd */
2717                  NULL,                  /* ea_list */
2718                  &fsp,                  /* result */
2719                  NULL);                 /* pinfo */
2720
2721         if (!NT_STATUS_IS_OK(status)) {
2722                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2723                            nt_errstr(status)));
2724                 return status;
2725         }
2726
2727         status = can_set_delete_on_close(fsp, fattr);
2728         if (!NT_STATUS_IS_OK(status)) {
2729                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2730                         "(%s)\n",
2731                         smb_fname_str_dbg(smb_fname),
2732                         nt_errstr(status)));
2733                 close_file(req, fsp, NORMAL_CLOSE);
2734                 return status;
2735         }
2736
2737         /* The set is across all open files on this dev/inode pair. */
2738         if (!set_delete_on_close(fsp, True,
2739                                 conn->session_info->security_token,
2740                                 conn->session_info->unix_token)) {
2741                 close_file(req, fsp, NORMAL_CLOSE);
2742                 return NT_STATUS_ACCESS_DENIED;
2743         }
2744
2745         return close_file(req, fsp, NORMAL_CLOSE);
2746 }
2747
2748 /****************************************************************************
2749  The guts of the unlink command, split out so it may be called by the NT SMB
2750  code.
2751 ****************************************************************************/
2752
2753 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2754                           uint32 dirtype, struct smb_filename *smb_fname,
2755                           bool has_wild)
2756 {
2757         char *fname_dir = NULL;
2758         char *fname_mask = NULL;
2759         int count=0;
2760         NTSTATUS status = NT_STATUS_OK;
2761         TALLOC_CTX *ctx = talloc_tos();
2762
2763         /* Split up the directory from the filename/mask. */
2764         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2765                                       &fname_dir, &fname_mask);
2766         if (!NT_STATUS_IS_OK(status)) {
2767                 goto out;
2768         }
2769
2770         /*
2771          * We should only check the mangled cache
2772          * here if unix_convert failed. This means
2773          * that the path in 'mask' doesn't exist
2774          * on the file system and so we need to look
2775          * for a possible mangle. This patch from
2776          * Tine Smukavec <valentin.smukavec@hermes.si>.
2777          */
2778
2779         if (!VALID_STAT(smb_fname->st) &&
2780             mangle_is_mangled(fname_mask, conn->params)) {
2781                 char *new_mask = NULL;
2782                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2783                                             &new_mask, conn->params);
2784                 if (new_mask) {
2785                         TALLOC_FREE(fname_mask);
2786                         fname_mask = new_mask;
2787                 }
2788         }
2789
2790         if (!has_wild) {
2791
2792                 /*
2793                  * Only one file needs to be unlinked. Append the mask back
2794                  * onto the directory.
2795                  */
2796                 TALLOC_FREE(smb_fname->base_name);
2797                 if (ISDOT(fname_dir)) {
2798                         /* Ensure we use canonical names on open. */
2799                         smb_fname->base_name = talloc_asprintf(smb_fname,
2800                                                         "%s",
2801                                                         fname_mask);
2802                 } else {
2803                         smb_fname->base_name = talloc_asprintf(smb_fname,
2804                                                         "%s/%s",
2805                                                         fname_dir,
2806                                                         fname_mask);
2807                 }
2808                 if (!smb_fname->base_name) {
2809                         status = NT_STATUS_NO_MEMORY;
2810                         goto out;
2811                 }
2812                 if (dirtype == 0) {
2813                         dirtype = FILE_ATTRIBUTE_NORMAL;
2814                 }
2815
2816                 status = check_name(conn, smb_fname->base_name);
2817                 if (!NT_STATUS_IS_OK(status)) {
2818                         goto out;
2819                 }
2820
2821                 status = do_unlink(conn, req, smb_fname, dirtype);
2822                 if (!NT_STATUS_IS_OK(status)) {
2823                         goto out;
2824                 }
2825
2826                 count++;
2827         } else {
2828                 struct smb_Dir *dir_hnd = NULL;
2829                 long offset = 0;
2830                 const char *dname = NULL;
2831                 char *talloced = NULL;
2832
2833                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2834                         status = NT_STATUS_OBJECT_NAME_INVALID;
2835                         goto out;
2836                 }
2837
2838                 if (strequal(fname_mask,"????????.???")) {
2839                         TALLOC_FREE(fname_mask);
2840                         fname_mask = talloc_strdup(ctx, "*");
2841                         if (!fname_mask) {
2842                                 status = NT_STATUS_NO_MEMORY;
2843                                 goto out;
2844                         }
2845                 }
2846
2847                 status = check_name(conn, fname_dir);
2848                 if (!NT_STATUS_IS_OK(status)) {
2849                         goto out;
2850                 }
2851
2852                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2853                                   dirtype);
2854                 if (dir_hnd == NULL) {
2855                         status = map_nt_error_from_unix(errno);
2856                         goto out;
2857                 }
2858
2859                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2860                    the pattern matches against the long name, otherwise the short name
2861                    We don't implement this yet XXXX
2862                 */
2863
2864                 status = NT_STATUS_NO_SUCH_FILE;
2865
2866                 while ((dname = ReadDirName(dir_hnd, &offset,
2867                                             &smb_fname->st, &talloced))) {
2868                         TALLOC_CTX *frame = talloc_stackframe();
2869
2870                         if (!is_visible_file(conn, fname_dir, dname,
2871                                              &smb_fname->st, true)) {
2872                                 TALLOC_FREE(frame);
2873                                 TALLOC_FREE(talloced);
2874                                 continue;
2875                         }
2876
2877                         /* Quick check for "." and ".." */
2878                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2879                                 TALLOC_FREE(frame);
2880                                 TALLOC_FREE(talloced);
2881                                 continue;
2882                         }
2883
2884                         if(!mask_match(dname, fname_mask,
2885                                        conn->case_sensitive)) {
2886                                 TALLOC_FREE(frame);
2887                                 TALLOC_FREE(talloced);
2888                                 continue;
2889                         }
2890
2891                         TALLOC_FREE(smb_fname->base_name);
2892                         if (ISDOT(fname_dir)) {
2893                                 /* Ensure we use canonical names on open. */
2894                                 smb_fname->base_name =
2895                                         talloc_asprintf(smb_fname, "%s",
2896                                                 dname);
2897                         } else {
2898                                 smb_fname->base_name =
2899                                         talloc_asprintf(smb_fname, "%s/%s",
2900                                                 fname_dir, dname);
2901                         }
2902
2903                         if (!smb_fname->base_name) {
2904                                 TALLOC_FREE(dir_hnd);
2905                                 status = NT_STATUS_NO_MEMORY;
2906                                 TALLOC_FREE(frame);
2907                                 TALLOC_FREE(talloced);
2908                                 goto out;
2909                         }
2910
2911                         status = check_name(conn, smb_fname->base_name);
2912                         if (!NT_STATUS_IS_OK(status)) {
2913                                 TALLOC_FREE(dir_hnd);
2914                                 TALLOC_FREE(frame);
2915                                 TALLOC_FREE(talloced);
2916                                 goto out;
2917                         }
2918
2919                         status = do_unlink(conn, req, smb_fname, dirtype);
2920                         if (!NT_STATUS_IS_OK(status)) {
2921                                 TALLOC_FREE(frame);
2922                                 TALLOC_FREE(talloced);
2923                                 continue;
2924                         }
2925
2926                         count++;
2927                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2928                                  smb_fname->base_name));
2929
2930                         TALLOC_FREE(frame);
2931                         TALLOC_FREE(talloced);
2932                 }
2933                 TALLOC_FREE(dir_hnd);
2934         }
2935
2936         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2937                 status = map_nt_error_from_unix(errno);
2938         }
2939
2940  out:
2941         TALLOC_FREE(fname_dir);
2942         TALLOC_FREE(fname_mask);
2943         return status;
2944 }
2945
2946 /****************************************************************************
2947  Reply to a unlink
2948 ****************************************************************************/
2949
2950 void reply_unlink(struct smb_request *req)
2951 {
2952         connection_struct *conn = req->conn;
2953         char *name = NULL;
2954         struct smb_filename *smb_fname = NULL;
2955         uint32 dirtype;
2956         NTSTATUS status;
2957         bool path_contains_wcard = False;
2958         TALLOC_CTX *ctx = talloc_tos();
2959
2960         START_PROFILE(SMBunlink);
2961
2962         if (req->wct < 1) {
2963                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2964                 goto out;
2965         }
2966
2967         dirtype = SVAL(req->vwv+0, 0);
2968
2969         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2970                                   STR_TERMINATE, &status,
2971                                   &path_contains_wcard);
2972         if (!NT_STATUS_IS_OK(status)) {
2973                 reply_nterror(req, status);
2974                 goto out;
2975         }
2976
2977         status = filename_convert(ctx, conn,
2978                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2979                                   name,
2980                                   UCF_COND_ALLOW_WCARD_LCOMP,
2981                                   &path_contains_wcard,
2982                                   &smb_fname);
2983         if (!NT_STATUS_IS_OK(status)) {
2984                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2985                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2986                                         ERRSRV, ERRbadpath);
2987                         goto out;
2988                 }
2989                 reply_nterror(req, status);
2990                 goto out;
2991         }
2992
2993         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2994
2995         status = unlink_internals(conn, req, dirtype, smb_fname,
2996                                   path_contains_wcard);
2997         if (!NT_STATUS_IS_OK(status)) {
2998                 if (open_was_deferred(req->sconn, req->mid)) {
2999                         /* We have re-scheduled this call. */
3000                         goto out;
3001                 }
3002                 reply_nterror(req, status);
3003                 goto out;
3004         }
3005
3006         reply_outbuf(req, 0, 0);
3007  out:
3008         TALLOC_FREE(smb_fname);
3009         END_PROFILE(SMBunlink);
3010         return;
3011 }
3012
3013 /****************************************************************************
3014  Fail for readbraw.
3015 ****************************************************************************/
3016
3017 static void fail_readraw(void)
3018 {
3019         const char *errstr = talloc_asprintf(talloc_tos(),
3020                         "FAIL ! reply_readbraw: socket write fail (%s)",
3021                         strerror(errno));
3022         if (!errstr) {
3023                 errstr = "";
3024         }
3025         exit_server_cleanly(errstr);
3026 }
3027
3028 /****************************************************************************
3029  Fake (read/write) sendfile. Returns -1 on read or write fail.
3030 ****************************************************************************/
3031
3032 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
3033 {
3034         size_t bufsize;
3035         size_t tosend = nread;
3036         char *buf;
3037
3038         if (nread == 0) {
3039                 return 0;
3040         }
3041
3042         bufsize = MIN(nread, 65536);
3043
3044         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3045                 return -1;
3046         }
3047
3048         while (tosend > 0) {
3049                 ssize_t ret;
3050                 size_t cur_read;
3051
3052                 if (tosend > bufsize) {
3053                         cur_read = bufsize;
3054                 } else {
3055                         cur_read = tosend;
3056                 }
3057                 ret = read_file(fsp,buf,startpos,cur_read);
3058                 if (ret == -1) {
3059                         SAFE_FREE(buf);
3060                         return -1;
3061                 }
3062
3063                 /* If we had a short read, fill with zeros. */
3064                 if (ret < cur_read) {
3065                         memset(buf + ret, '\0', cur_read - ret);
3066                 }
3067
3068                 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
3069                     != cur_read) {
3070                         char addr[INET6_ADDRSTRLEN];
3071                         /*
3072                          * Try and give an error message saying what
3073                          * client failed.
3074                          */
3075                         DEBUG(0, ("write_data failed for client %s. "
3076                                   "Error %s\n",
3077                                   get_peer_addr(fsp->conn->sconn->sock, addr,
3078                                                 sizeof(addr)),
3079                                   strerror(errno)));
3080                         SAFE_FREE(buf);
3081                         return -1;
3082                 }
3083                 tosend -= cur_read;
3084                 startpos += cur_read;
3085         }
3086
3087         SAFE_FREE(buf);
3088         return (ssize_t)nread;
3089 }
3090
3091 /****************************************************************************
3092  Deal with the case of sendfile reading less bytes from the file than
3093  requested. Fill with zeros (all we can do).
3094 ****************************************************************************/
3095
3096 void sendfile_short_send(files_struct *fsp,
3097                                 ssize_t nread,
3098                                 size_t headersize,
3099                                 size_t smb_maxcnt)
3100 {
3101 #define SHORT_SEND_BUFSIZE 1024
3102         if (nread < headersize) {
3103                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3104                         "header for file %s (%s). Terminating\n",
3105                         fsp_str_dbg(fsp), strerror(errno)));
3106                 exit_server_cleanly("sendfile_short_send failed");
3107         }
3108
3109         nread -= headersize;
3110
3111         if (nread < smb_maxcnt) {
3112                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3113                 if (!buf) {
3114                         exit_server_cleanly("sendfile_short_send: "
3115                                 "malloc failed");
3116                 }
3117
3118                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3119                         "with zeros !\n", fsp_str_dbg(fsp)));
3120
3121                 while (nread < smb_maxcnt) {
3122                         /*
3123                          * We asked for the real file size and told sendfile
3124                          * to not go beyond the end of the file. But it can
3125                          * happen that in between our fstat call and the
3126                          * sendfile call the file was truncated. This is very
3127                          * bad because we have already announced the larger
3128                          * number of bytes to the client.
3129                          *
3130                          * The best we can do now is to send 0-bytes, just as
3131                          * a read from a hole in a sparse file would do.
3132                          *
3133                          * This should happen rarely enough that I don't care
3134                          * about efficiency here :-)
3135                          */
3136                         size_t to_write;
3137
3138                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3139                         if (write_data(fsp->conn->sconn->sock, buf, to_write)
3140                             != to_write) {
3141                                 char addr[INET6_ADDRSTRLEN];
3142                                 /*
3143                                  * Try and give an error message saying what
3144                                  * client failed.
3145                                  */
3146                                 DEBUG(0, ("write_data failed for client %s. "
3147                                           "Error %s\n",
3148                                           get_peer_addr(
3149                                                   fsp->conn->sconn->sock, addr,
3150                                                   sizeof(addr)),
3151                                           strerror(errno)));
3152                                 exit_server_cleanly("sendfile_short_send: "
3153                                                     "write_data failed");
3154                         }
3155                         nread += to_write;
3156                 }
3157                 SAFE_FREE(buf);
3158         }
3159 }
3160
3161 /****************************************************************************
3162  Return a readbraw error (4 bytes of zero).
3163 ****************************************************************************/
3164
3165 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3166 {
3167         char header[4];
3168
3169         SIVAL(header,0,0);
3170
3171         smbd_lock_socket(sconn);
3172         if (write_data(sconn->sock,header,4) != 4) {
3173                 char addr[INET6_ADDRSTRLEN];
3174                 /*
3175                  * Try and give an error message saying what
3176                  * client failed.
3177                  */
3178                 DEBUG(0, ("write_data failed for client %s. "
3179                           "Error %s\n",
3180                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
3181                           strerror(errno)));
3182
3183                 fail_readraw();
3184         }
3185         smbd_unlock_socket(sconn);
3186 }
3187
3188 /****************************************************************************
3189  Use sendfile in readbraw.
3190 ****************************************************************************/
3191
3192 static void send_file_readbraw(connection_struct *conn,
3193                                struct smb_request *req,
3194                                files_struct *fsp,
3195                                off_t startpos,
3196                                size_t nread,
3197                                ssize_t mincount)
3198 {
3199         struct smbd_server_connection *sconn = req->sconn;
3200         char *outbuf = NULL;
3201         ssize_t ret=0;
3202
3203         /*
3204          * We can only use sendfile on a non-chained packet
3205          * but we can use on a non-oplocked file. tridge proved this
3206          * on a train in Germany :-). JRA.
3207          * reply_readbraw has already checked the length.
3208          */
3209
3210         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3211             (fsp->wcp == NULL) &&
3212             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3213                 ssize_t sendfile_read = -1;
3214                 char header[4];
3215                 DATA_BLOB header_blob;
3216
3217                 _smb_setlen(header,nread);
3218                 header_blob = data_blob_const(header, 4);
3219
3220                 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3221                                                  &header_blob, startpos,
3222                                                  nread);
3223                 if (sendfile_read == -1) {
3224                         /* Returning ENOSYS means no data at all was sent.
3225                          * Do this as a normal read. */
3226                         if (errno == ENOSYS) {
3227                                 goto normal_readbraw;
3228                         }
3229
3230                         /*
3231                          * Special hack for broken Linux with no working sendfile. If we
3232                          * return EINTR we sent the header but not the rest of the data.
3233                          * Fake this up by doing read/write calls.
3234                          */
3235                         if (errno == EINTR) {
3236                                 /* Ensure we don't do this again. */
3237                                 set_use_sendfile(SNUM(conn), False);
3238                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3239
3240                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
3241                                         DEBUG(0,("send_file_readbraw: "
3242                                                  "fake_sendfile failed for "
3243                                                  "file %s (%s).\n",
3244                                                  fsp_str_dbg(fsp),
3245                                                  strerror(errno)));
3246                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3247                                 }
3248                                 return;
3249                         }
3250
3251                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3252                                  "file %s (%s). Terminating\n",
3253                                  fsp_str_dbg(fsp), strerror(errno)));
3254                         exit_server_cleanly("send_file_readbraw sendfile failed");
3255                 } else if (sendfile_read == 0) {
3256                         /*
3257                          * Some sendfile implementations return 0 to indicate
3258                          * that there was a short read, but nothing was
3259                          * actually written to the socket.  In this case,
3260                          * fallback to the normal read path so the header gets
3261                          * the correct byte count.
3262                          */
3263                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3264                                   "bytes falling back to the normal read: "
3265                                   "%s\n", fsp_str_dbg(fsp)));
3266                         goto normal_readbraw;
3267                 }
3268
3269                 /* Deal with possible short send. */
3270                 if (sendfile_read != 4+nread) {
3271                         sendfile_short_send(fsp, sendfile_read, 4, nread);
3272                 }
3273                 return;
3274         }
3275
3276 normal_readbraw:
3277
3278         outbuf = talloc_array(NULL, char, nread+4);
3279         if (!outbuf) {
3280                 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3281                         (unsigned)(nread+4)));
3282                 reply_readbraw_error(sconn);
3283                 return;
3284         }
3285
3286         if (nread > 0) {
3287                 ret = read_file(fsp,outbuf+4,startpos,nread);
3288 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3289                 if (ret < mincount)
3290                         ret = 0;
3291 #else
3292                 if (ret < nread)
3293                         ret = 0;
3294 #endif
3295         }
3296
3297         _smb_setlen(outbuf,ret);
3298         if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3299                 char addr[INET6_ADDRSTRLEN];
3300                 /*
3301                  * Try and give an error message saying what
3302                  * client failed.
3303                  */
3304                 DEBUG(0, ("write_data failed for client %s. "
3305                           "Error %s\n",
3306                           get_peer_addr(fsp->conn->sconn->sock, addr,
3307                                         sizeof(addr)),
3308                           strerror(errno)));
3309
3310                 fail_readraw();
3311         }
3312
3313         TALLOC_FREE(outbuf);
3314 }
3315
3316 /****************************************************************************
3317  Reply to a readbraw (core+ protocol).
3318 ****************************************************************************/
3319
3320 void reply_readbraw(struct smb_request *req)
3321 {
3322         connection_struct *conn = req->conn;
3323         struct smbd_server_connection *sconn = req->sconn;
3324         ssize_t maxcount,mincount;
3325         size_t nread = 0;
3326         off_t startpos;
3327         files_struct *fsp;
3328         struct lock_struct lock;
3329         off_t size = 0;
3330
3331         START_PROFILE(SMBreadbraw);
3332
3333         if (srv_is_signing_active(sconn) || req->encrypted) {
3334                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3335                         "raw reads/writes are disallowed.");
3336         }
3337
3338         if (req->wct < 8) {
3339                 reply_readbraw_error(sconn);
3340                 END_PROFILE(SMBreadbraw);
3341                 return;
3342         }
3343
3344         if (sconn->smb1.echo_handler.trusted_fde) {
3345                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3346                          "'async smb echo handler = yes'\n"));
3347                 reply_readbraw_error(sconn);
3348                 END_PROFILE(SMBreadbraw);
3349                 return;
3350         }
3351
3352         /*
3353          * Special check if an oplock break has been issued
3354          * and the readraw request croses on the wire, we must
3355          * return a zero length response here.
3356          */
3357
3358         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3359
3360         /*
3361          * We have to do a check_fsp by hand here, as
3362          * we must always return 4 zero bytes on error,
3363          * not a NTSTATUS.
3364          */
3365
3366         if (!fsp || !conn || conn != fsp->conn ||
3367                         req->vuid != fsp->vuid ||
3368                         fsp->is_directory || fsp->fh->fd == -1) {
3369                 /*
3370                  * fsp could be NULL here so use the value from the packet. JRA.
3371                  */
3372                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3373                         "- cache prime?\n",
3374                         (int)SVAL(req->vwv+0, 0)));
3375                 reply_readbraw_error(sconn);
3376                 END_PROFILE(SMBreadbraw);
3377                 return;
3378         }
3379
3380         /* Do a "by hand" version of CHECK_READ. */
3381         if (!(fsp->can_read ||
3382                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3383                                 (fsp->access_mask & FILE_EXECUTE)))) {
3384                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3385                                 (int)SVAL(req->vwv+0, 0)));
3386                 reply_readbraw_error(sconn);
3387                 END_PROFILE(SMBreadbraw);
3388                 return;
3389         }
3390
3391         flush_write_cache(fsp, READRAW_FLUSH);
3392
3393         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3394         if(req->wct == 10) {
3395                 /*
3396                  * This is a large offset (64 bit) read.
3397                  */
3398
3399                 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3400
3401                 if(startpos < 0) {
3402                         DEBUG(0,("reply_readbraw: negative 64 bit "
3403                                 "readraw offset (%.0f) !\n",
3404                                 (double)startpos ));
3405                         reply_readbraw_error(sconn);
3406                         END_PROFILE(SMBreadbraw);
3407                         return;
3408                 }
3409         }
3410
3411         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3412         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3413
3414         /* ensure we don't overrun the packet size */
3415         maxcount = MIN(65535,maxcount);
3416
3417         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3418             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3419             &lock);
3420
3421         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3422                 reply_readbraw_error(sconn);
3423                 END_PROFILE(SMBreadbraw);
3424                 return;
3425         }
3426
3427         if (fsp_stat(fsp) == 0) {
3428                 size = fsp->fsp_name->st.st_ex_size;
3429         }
3430
3431         if (startpos >= size) {
3432                 nread = 0;
3433         } else {
3434                 nread = MIN(maxcount,(size - startpos));
3435         }
3436
3437 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3438         if (nread < mincount)
3439                 nread = 0;
3440 #endif
3441
3442         DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3443                 "min=%lu nread=%lu\n",
3444                 fsp_fnum_dbg(fsp), (double)startpos,
3445                 (unsigned long)maxcount,
3446                 (unsigned long)mincount,
3447                 (unsigned long)nread ) );
3448
3449         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3450
3451         DEBUG(5,("reply_readbraw finished\n"));
3452
3453         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3454
3455         END_PROFILE(SMBreadbraw);
3456         return;
3457 }
3458
3459 #undef DBGC_CLASS
3460 #define DBGC_CLASS DBGC_LOCKING
3461
3462 /****************************************************************************
3463  Reply to a lockread (core+ protocol).
3464 ****************************************************************************/
3465
3466 void reply_lockread(struct smb_request *req)
3467 {
3468         connection_struct *conn = req->conn;
3469         ssize_t nread = -1;
3470         char *data;
3471         off_t startpos;
3472         size_t numtoread;
3473         size_t maxtoread;
3474         NTSTATUS status;
3475         files_struct *fsp;
3476         struct byte_range_lock *br_lck = NULL;
3477         char *p = NULL;
3478         struct smbd_server_connection *sconn = req->sconn;
3479
3480         START_PROFILE(SMBlockread);
3481
3482         if (req->wct < 5) {
3483                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3484                 END_PROFILE(SMBlockread);
3485                 return;
3486         }
3487
3488         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3489
3490         if (!check_fsp(conn, req, fsp)) {
3491                 END_PROFILE(SMBlockread);
3492                 return;
3493         }
3494
3495         if (!CHECK_READ(fsp,req)) {
3496                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3497                 END_PROFILE(SMBlockread);
3498                 return;
3499         }
3500
3501         numtoread = SVAL(req->vwv+1, 0);
3502         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3503
3504         /*
3505          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3506          * protocol request that predates the read/write lock concept.
3507          * Thus instead of asking for a read lock here we need to ask
3508          * for a write lock. JRA.
3509          * Note that the requested lock size is unaffected by max_send.
3510          */
3511
3512         br_lck = do_lock(req->sconn->msg_ctx,
3513                         fsp,
3514                         (uint64_t)req->smbpid,
3515                         (uint64_t)numtoread,
3516                         (uint64_t)startpos,
3517                         WRITE_LOCK,
3518                         WINDOWS_LOCK,
3519                         False, /* Non-blocking lock. */
3520                         &status,
3521                         NULL,
3522                         NULL);
3523         TALLOC_FREE(br_lck);
3524
3525         if (NT_STATUS_V(status)) {
3526                 reply_nterror(req, status);
3527                 END_PROFILE(SMBlockread);
3528                 return;
3529         }
3530
3531         /*
3532          * However the requested READ size IS affected by max_send. Insanity.... JRA.
3533          */
3534         maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3535
3536         if (numtoread > maxtoread) {
3537                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3538 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3539                         (unsigned int)numtoread, (unsigned int)maxtoread,
3540                         (unsigned int)sconn->smb1.sessions.max_send));
3541                 numtoread = maxtoread;
3542         }
3543
3544         reply_outbuf(req, 5, numtoread + 3);
3545
3546         data = smb_buf(req->outbuf) + 3;
3547
3548         nread = read_file(fsp,data,startpos,numtoread);
3549
3550         if (nread < 0) {
3551                 reply_nterror(req, map_nt_error_from_unix(errno));
3552                 END_PROFILE(SMBlockread);
3553                 return;
3554         }
3555
3556         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3557
3558         SSVAL(req->outbuf,smb_vwv0,nread);
3559         SSVAL(req->outbuf,smb_vwv5,nread+3);
3560         p = smb_buf(req->outbuf);
3561         SCVAL(p,0,0); /* pad byte. */
3562         SSVAL(p,1,nread);
3563
3564         DEBUG(3,("lockread %s num=%d nread=%d\n",
3565                  fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3566
3567         END_PROFILE(SMBlockread);
3568         return;
3569 }
3570
3571 #undef DBGC_CLASS
3572 #define DBGC_CLASS DBGC_ALL
3573
3574 /****************************************************************************
3575  Reply to a read.
3576 ****************************************************************************/
3577
3578 void reply_read(struct smb_request *req)
3579 {
3580         connection_struct *conn = req->conn;
3581         size_t numtoread;
3582         size_t maxtoread;
3583         ssize_t nread = 0;
3584         char *data;
3585         off_t startpos;
3586         files_struct *fsp;
3587         struct lock_struct lock;
3588         struct smbd_server_connection *sconn = req->sconn;
3589
3590         START_PROFILE(SMBread);
3591
3592         if (req->wct < 3) {
3593                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3594                 END_PROFILE(SMBread);
3595                 return;
3596         }
3597
3598         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3599
3600         if (!check_fsp(conn, req, fsp)) {
3601                 END_PROFILE(SMBread);
3602                 return;
3603         }
3604
3605         if (!CHECK_READ(fsp,req)) {
3606                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3607                 END_PROFILE(SMBread);
3608                 return;
3609         }
3610
3611         numtoread = SVAL(req->vwv+1, 0);
3612         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3613
3614         /*
3615          * The requested read size cannot be greater than max_send. JRA.
3616          */
3617         maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3618
3619         if (numtoread > maxtoread) {
3620                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3621 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3622                         (unsigned int)numtoread, (unsigned int)maxtoread,
3623                         (unsigned int)sconn->smb1.sessions.max_send));
3624                 numtoread = maxtoread;
3625         }
3626
3627         reply_outbuf(req, 5, numtoread+3);
3628
3629         data = smb_buf(req->outbuf) + 3;
3630
3631         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3632             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3633             &lock);
3634
3635         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3636                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3637                 END_PROFILE(SMBread);
3638                 return;
3639         }
3640
3641         if (numtoread > 0)
3642                 nread = read_file(fsp,data,startpos,numtoread);
3643
3644         if (nread < 0) {
3645                 reply_nterror(req, map_nt_error_from_unix(errno));
3646                 goto strict_unlock;
3647         }
3648
3649         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3650
3651         SSVAL(req->outbuf,smb_vwv0,nread);
3652         SSVAL(req->outbuf,smb_vwv5,nread+3);
3653         SCVAL(smb_buf(req->outbuf),0,1);
3654         SSVAL(smb_buf(req->outbuf),1,nread);
3655
3656         DEBUG(3, ("read %s num=%d nread=%d\n",
3657                   fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3658
3659 strict_unlock:
3660         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3661
3662         END_PROFILE(SMBread);
3663         return;
3664 }
3665
3666 /****************************************************************************
3667  Setup readX header.
3668 ****************************************************************************/
3669
3670 static int setup_readX_header(struct smb_request *req, char *outbuf,
3671                               size_t smb_maxcnt)
3672 {
3673         int outsize;
3674
3675         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3676
3677         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3678
3679         SCVAL(outbuf,smb_vwv0,0xFF);
3680         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3681         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3682         SSVAL(outbuf,smb_vwv6,
3683               (smb_wct - 4)     /* offset from smb header to wct */
3684               + 1               /* the wct field */
3685               + 12 * sizeof(uint16_t) /* vwv */
3686               + 2);             /* the buflen field */
3687         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3688         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3689         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3690         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3691         return outsize;
3692 }
3693
3694 /****************************************************************************
3695  Reply to a read and X - possibly using sendfile.
3696 ****************************************************************************/
3697
3698 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3699                             files_struct *fsp, off_t startpos,
3700                             size_t smb_maxcnt)
3701 {
3702         ssize_t nread = -1;
3703         struct lock_struct lock;
3704         int saved_errno = 0;
3705
3706         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3707             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3708             &lock);
3709
3710         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3711                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3712                 return;
3713         }
3714
3715         /*
3716          * We can only use sendfile on a non-chained packet
3717          * but we can use on a non-oplocked file. tridge proved this
3718          * on a train in Germany :-). JRA.
3719          */
3720
3721         if (!req_is_in_chain(req) &&
3722             !req->encrypted &&
3723             (fsp->base_fsp == NULL) &&
3724             (fsp->wcp == NULL) &&
3725             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3726                 uint8 headerbuf[smb_size + 12 * 2];
3727                 DATA_BLOB header;
3728
3729                 if(fsp_stat(fsp) == -1) {
3730                         reply_nterror(req, map_nt_error_from_unix(errno));
3731                         goto strict_unlock;
3732                 }
3733
3734                 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3735                     (startpos > fsp->fsp_name->st.st_ex_size) ||
3736                     (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3737                         /*
3738                          * We already know that we would do a short read, so don't
3739                          * try the sendfile() path.
3740                          */
3741                         goto nosendfile_read;
3742                 }
3743
3744                 /*
3745                  * Set up the packet header before send. We
3746                  * assume here the sendfile will work (get the
3747                  * correct amount of data).
3748                  */
3749
3750                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3751
3752                 construct_reply_common_req(req, (char *)headerbuf);
3753                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3754
3755                 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3756                                          startpos, smb_maxcnt);
3757                 if (nread == -1) {
3758                         /* Returning ENOSYS means no data at all was sent.
3759                            Do this as a normal read. */
3760                         if (errno == ENOSYS) {
3761                                 goto normal_read;
3762                         }
3763
3764                         /*
3765                          * Special hack for broken Linux with no working sendfile. If we
3766                          * return EINTR we sent the header but not the rest of the data.
3767                          * Fake this up by doing read/write calls.
3768                          */
3769
3770                         if (errno == EINTR) {
3771                                 /* Ensure we don't do this again. */
3772                                 set_use_sendfile(SNUM(conn), False);
3773                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3774                                 nread = fake_sendfile(fsp, startpos,
3775                                                       smb_maxcnt);
3776                                 if (nread == -1) {
3777                                         DEBUG(0,("send_file_readX: "
3778                                                  "fake_sendfile failed for "
3779                                                  "file %s (%s).\n",
3780                                                  fsp_str_dbg(fsp),
3781                                                  strerror(errno)));
3782                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3783                                 }
3784                                 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3785                                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3786                                 /* No outbuf here means successful sendfile. */
3787                                 goto strict_unlock;
3788                         }
3789
3790                         DEBUG(0,("send_file_readX: sendfile failed for file "
3791                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3792                                  strerror(errno)));
3793                         exit_server_cleanly("send_file_readX sendfile failed");
3794                 } else if (nread == 0) {
3795                         /*
3796                          * Some sendfile implementations return 0 to indicate
3797                          * that there was a short read, but nothing was
3798                          * actually written to the socket.  In this case,
3799                          * fallback to the normal read path so the header gets
3800                          * the correct byte count.
3801                          */
3802                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3803                                   "falling back to the normal read: %s\n",
3804                                   fsp_str_dbg(fsp)));
3805                         goto normal_read;
3806                 }
3807
3808                 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3809                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3810
3811                 /* Deal with possible short send. */
3812                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3813                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3814                 }
3815                 /* No outbuf here means successful sendfile. */
3816                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3817                 SMB_PERFCOUNT_END(&req->pcd);
3818                 goto strict_unlock;
3819         }
3820
3821 normal_read:
3822
3823         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3824                 uint8 headerbuf[smb_size + 2*12];
3825
3826                 construct_reply_common_req(req, (char *)headerbuf);
3827                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3828
3829                 /* Send out the header. */
3830                 if (write_data(req->sconn->sock, (char *)headerbuf,
3831                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3832
3833                         char addr[INET6_ADDRSTRLEN];
3834                         /*
3835                          * Try and give an error message saying what
3836                          * client failed.
3837                          */
3838                         DEBUG(0, ("write_data failed for client %s. "
3839                                   "Error %s\n",
3840                                   get_peer_addr(req->sconn->sock, addr,
3841                                                 sizeof(addr)),
3842                                   strerror(errno)));
3843
3844                         DEBUG(0,("send_file_readX: write_data failed for file "
3845                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3846                                  strerror(errno)));
3847                         exit_server_cleanly("send_file_readX sendfile failed");
3848                 }
3849                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3850                 if (nread == -1) {
3851                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3852                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3853                                  strerror(errno)));
3854                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3855                 }
3856                 goto strict_unlock;
3857         }
3858
3859 nosendfile_read:
3860
3861         reply_outbuf(req, 12, smb_maxcnt);
3862         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3863         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
3864
3865         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3866         saved_errno = errno;
3867
3868         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3869
3870         if (nread < 0) {
3871                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3872                 return;
3873         }
3874
3875         setup_readX_header(req, (char *)req->outbuf, nread);
3876
3877         DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3878                   fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3879         return;
3880
3881  strict_unlock:
3882         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3883         TALLOC_FREE(req->outbuf);
3884         return;
3885 }
3886
3887 /****************************************************************************
3888  Work out how much space we have for a read return.
3889 ****************************************************************************/
3890
3891 static size_t calc_max_read_pdu(const struct smb_request *req)
3892 {
3893         if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3894                 return req->sconn->smb1.sessions.max_send;
3895         }
3896
3897         if (!lp_large_readwrite()) {
3898                 return req->sconn->smb1.sessions.max_send;
3899         }
3900
3901         if (req_is_in_chain(req)) {
3902                 return req->sconn->smb1.sessions.max_send;
3903         }
3904
3905         if (req->encrypted) {
3906                 /*
3907                  * Don't take encrypted traffic up to the
3908                  * limit. There are padding considerations
3909                  * that make that tricky.
3910                  */
3911                 return req->sconn->smb1.sessions.max_send;
3912         }
3913
3914         if (srv_is_signing_active(req->sconn)) {
3915                 return 0x1FFFF;
3916         }
3917
3918         if (!lp_unix_extensions()) {
3919                 return 0x1FFFF;
3920         }
3921
3922         /*
3923          * We can do ultra-large POSIX reads.
3924          */
3925         return 0xFFFFFF;
3926 }
3927
3928 /****************************************************************************
3929  Calculate how big a read can be. Copes with all clients. It's always
3930  safe to return a short read - Windows does this.
3931 ****************************************************************************/
3932
3933 static size_t calc_read_size(const struct smb_request *req,
3934                              size_t upper_size,
3935                              size_t lower_size)
3936 {
3937         size_t max_pdu = calc_max_read_pdu(req);
3938         size_t total_size = 0;
3939         size_t hdr_len = MIN_SMB_SIZE + VWV(12);
3940         size_t max_len = max_pdu - hdr_len;
3941
3942         /*
3943          * Windows explicitly ignores upper size of 0xFFFF.
3944          * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3945          * We must do the same as these will never fit even in
3946          * an extended size NetBIOS packet.
3947          */
3948         if (upper_size == 0xFFFF) {
3949                 upper_size = 0;
3950         }
3951
3952         if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3953                 upper_size = 0;
3954         }
3955
3956         total_size = ((upper_size<<16) | lower_size);
3957
3958         /*
3959          * LARGE_READX test shows it's always safe to return
3960          * a short read. Windows does so.
3961          */
3962         return MIN(total_size, max_len);
3963 }
3964
3965 /****************************************************************************
3966  Reply to a read and X.
3967 ****************************************************************************/
3968
3969 void reply_read_and_X(struct smb_request *req)
3970 {
3971         connection_struct *conn = req->conn;
3972         files_struct *fsp;
3973         off_t startpos;
3974         size_t smb_maxcnt;
3975         size_t upper_size;
3976         bool big_readX = False;
3977 #if 0
3978         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3979 #endif
3980
3981         START_PROFILE(SMBreadX);
3982
3983         if ((req->wct != 10) && (req->wct != 12)) {
3984                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3985                 return;
3986         }
3987
3988         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3989         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3990         smb_maxcnt = SVAL(req->vwv+5, 0);
3991
3992         /* If it's an IPC, pass off the pipe handler. */
3993         if (IS_IPC(conn)) {
3994                 reply_pipe_read_and_X(req);
3995                 END_PROFILE(SMBreadX);
3996                 return;
3997         }
3998
3999         if (!check_fsp(conn, req, fsp)) {
4000                 END_PROFILE(SMBreadX);
4001                 return;
4002         }
4003
4004         if (!CHECK_READ(fsp,req)) {
4005                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4006                 END_PROFILE(SMBreadX);
4007                 return;
4008         }
4009
4010         upper_size = SVAL(req->vwv+7, 0);
4011         smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4012         if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4013                 /*
4014                  * This is a heuristic to avoid keeping large
4015                  * outgoing buffers around over long-lived aio
4016                  * requests.
4017                  */
4018                 big_readX = True;
4019         }
4020
4021         if (req->wct == 12) {
4022                 /*
4023                  * This is a large offset (64 bit) read.
4024                  */
4025                 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4026
4027         }
4028
4029         if (!big_readX) {
4030                 NTSTATUS status = schedule_aio_read_and_X(conn,
4031                                         req,
4032                                         fsp,
4033                                         startpos,
4034                                         smb_maxcnt);
4035                 if (NT_STATUS_IS_OK(status)) {
4036                         /* Read scheduled - we're done. */
4037                         goto out;
4038                 }
4039                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4040                         /* Real error - report to client. */
4041                         END_PROFILE(SMBreadX);
4042                         reply_nterror(req, status);
4043                         return;
4044                 }
4045                 /* NT_STATUS_RETRY - fall back to sync read. */
4046         }
4047
4048         smbd_lock_socket(req->sconn);
4049         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4050         smbd_unlock_socket(req->sconn);
4051
4052  out:
4053         END_PROFILE(SMBreadX);
4054         return;
4055 }
4056
4057 /****************************************************************************
4058  Error replies to writebraw must have smb_wct == 1. Fix this up.
4059 ****************************************************************************/
4060
4061 void error_to_writebrawerr(struct smb_request *req)
4062 {
4063         uint8 *old_outbuf = req->outbuf;
4064
4065         reply_outbuf(req, 1, 0);
4066
4067         memcpy(req->outbuf, old_outbuf, smb_size);
4068         TALLOC_FREE(old_outbuf);
4069 }
4070
4071 /****************************************************************************
4072  Read 4 bytes of a smb packet and return the smb length of the packet.
4073  Store the result in the buffer. This version of the function will
4074  never return a session keepalive (length of zero).
4075  Timeout is in milliseconds.
4076 ****************************************************************************/
4077
4078 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4079                                 size_t *len)
4080 {
4081         uint8_t msgtype = NBSSkeepalive;
4082
4083         while (msgtype == NBSSkeepalive) {
4084                 NTSTATUS status;
4085
4086                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4087                                                           len);
4088                 if (!NT_STATUS_IS_OK(status)) {
4089                         char addr[INET6_ADDRSTRLEN];
4090                         /* Try and give an error message
4091                          * saying what client failed. */
4092                         DEBUG(0, ("read_fd_with_timeout failed for "
4093                                   "client %s read error = %s.\n",
4094                                   get_peer_addr(fd,addr,sizeof(addr)),
4095                                   nt_errstr(status)));
4096                         return status;
4097                 }
4098
4099                 msgtype = CVAL(inbuf, 0);
4100         }
4101
4102         DEBUG(10,("read_smb_length: got smb length of %lu\n",
4103                   (unsigned long)len));
4104
4105         return NT_STATUS_OK;
4106 }
4107
4108 /****************************************************************************
4109  Reply to a writebraw (core+ or LANMAN1.0 protocol).
4110 ****************************************************************************/
4111
4112 void reply_writebraw(struct smb_request *req)
4113 {
4114         connection_struct *conn = req->conn;
4115         char *buf = NULL;
4116         ssize_t nwritten=0;
4117         ssize_t total_written=0;
4118         size_t numtowrite=0;
4119         size_t tcount;
4120         off_t startpos;
4121         const char *data=NULL;
4122         bool write_through;
4123         files_struct *fsp;
4124         struct lock_struct lock;
4125         NTSTATUS status;
4126
4127         START_PROFILE(SMBwritebraw);
4128
4129         /*
4130          * If we ever reply with an error, it must have the SMB command
4131          * type of SMBwritec, not SMBwriteBraw, as this tells the client
4132          * we're finished.
4133          */
4134         SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4135
4136         if (srv_is_signing_active(req->sconn)) {
4137                 END_PROFILE(SMBwritebraw);
4138                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4139                                 "raw reads/writes are disallowed.");
4140         }
4141
4142         if (req->wct < 12) {
4143                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4144                 error_to_writebrawerr(req);
4145                 END_PROFILE(SMBwritebraw);
4146                 return;
4147         }
4148
4149         if (req->sconn->smb1.echo_handler.trusted_fde) {
4150                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4151                          "'async smb echo handler = yes'\n"));
4152                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4153                 error_to_writebrawerr(req);
4154                 END_PROFILE(SMBwritebraw);
4155                 return;
4156         }
4157
4158         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4159         if (!check_fsp(conn, req, fsp)) {
4160                 error_to_writebrawerr(req);
4161                 END_PROFILE(SMBwritebraw);
4162                 return;
4163         }
4164
4165         if (!CHECK_WRITE(fsp)) {
4166                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4167                 error_to_writebrawerr(req);
4168                 END_PROFILE(SMBwritebraw);
4169                 return;
4170         }
4171
4172         tcount = IVAL(req->vwv+1, 0);
4173         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4174         write_through = BITSETW(req->vwv+7,0);
4175
4176         /* We have to deal with slightly different formats depending
4177                 on whether we are using the core+ or lanman1.0 protocol */
4178
4179         if(get_Protocol() <= PROTOCOL_COREPLUS) {
4180                 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4181                 data = smb_buf_const(req->inbuf);
4182         } else {
4183                 numtowrite = SVAL(req->vwv+10, 0);
4184                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4185         }
4186
4187         /* Ensure we don't write bytes past the end of this packet. */
4188         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4189                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4190                 error_to_writebrawerr(req);
4191                 END_PROFILE(SMBwritebraw);
4192                 return;
4193         }
4194
4195         if (!fsp->print_file) {
4196                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4197                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4198                     &lock);
4199
4200                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4201                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4202                         error_to_writebrawerr(req);
4203                         END_PROFILE(SMBwritebraw);
4204                         return;
4205                 }
4206         }
4207
4208         if (numtowrite>0) {
4209                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4210         }
4211
4212         DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4213                         "wrote=%d sync=%d\n",
4214                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4215                 (int)nwritten, (int)write_through));
4216
4217         if (nwritten < (ssize_t)numtowrite)  {
4218                 reply_nterror(req, NT_STATUS_DISK_FULL);
4219                 error_to_writebrawerr(req);
4220                 goto strict_unlock;
4221         }
4222
4223         total_written = nwritten;
4224
4225         /* Allocate a buffer of 64k + length. */
4226         buf = talloc_array(NULL, char, 65540);
4227         if (!buf) {
4228                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4229                 error_to_writebrawerr(req);
4230                 goto strict_unlock;
4231         }
4232
4233         /* Return a SMBwritebraw message to the redirector to tell
4234          * it to send more bytes */
4235
4236         memcpy(buf, req->inbuf, smb_size);
4237         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4238         SCVAL(buf,smb_com,SMBwritebraw);
4239         SSVALS(buf,smb_vwv0,0xFFFF);
4240         show_msg(buf);
4241         if (!srv_send_smb(req->sconn,
4242                           buf,
4243                           false, 0, /* no signing */
4244                           IS_CONN_ENCRYPTED(conn),
4245                           &req->pcd)) {
4246                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4247                         "failed.");
4248         }
4249
4250         /* Now read the raw data into the buffer and write it */
4251         status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4252                                  &numtowrite);
4253         if (!NT_STATUS_IS_OK(status)) {
4254                 exit_server_cleanly("secondary writebraw failed");
4255         }
4256
4257         /* Set up outbuf to return the correct size */
4258         reply_outbuf(req, 1, 0);
4259
4260         if (numtowrite != 0) {
4261
4262                 if (numtowrite > 0xFFFF) {
4263                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4264                                 "raw requested (%u). Terminating\n",
4265                                 (unsigned int)numtowrite ));
4266                         exit_server_cleanly("secondary writebraw failed");
4267                 }
4268
4269                 if (tcount > nwritten+numtowrite) {
4270                         DEBUG(3,("reply_writebraw: Client overestimated the "
4271                                 "write %d %d %d\n",
4272                                 (int)tcount,(int)nwritten,(int)numtowrite));
4273                 }
4274
4275                 status = read_data(req->sconn->sock, buf+4, numtowrite);
4276
4277                 if (!NT_STATUS_IS_OK(status)) {
4278                         char addr[INET6_ADDRSTRLEN];
4279                         /* Try and give an error message
4280                          * saying what client failed. */
4281                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4282                                   "raw read failed (%s) for client %s. "
4283                                   "Terminating\n", nt_errstr(status),
4284                                   get_peer_addr(req->sconn->sock, addr,
4285                                                 sizeof(addr))));
4286                         exit_server_cleanly("secondary writebraw failed");
4287                 }
4288
4289                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4290                 if (nwritten == -1) {
4291                         TALLOC_FREE(buf);
4292                         reply_nterror(req, map_nt_error_from_unix(errno));
4293                         error_to_writebrawerr(req);
4294                         goto strict_unlock;
4295                 }
4296
4297                 if (nwritten < (ssize_t)numtowrite) {
4298                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4299                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4300                 }
4301
4302                 if (nwritten > 0) {
4303                         total_written += nwritten;
4304                 }
4305         }
4306
4307         TALLOC_FREE(buf);
4308         SSVAL(req->outbuf,smb_vwv0,total_written);
4309
4310         status = sync_file(conn, fsp, write_through);
4311         if (!NT_STATUS_IS_OK(status)) {
4312                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4313                          fsp_str_dbg(fsp), nt_errstr(status)));
4314                 reply_nterror(req, status);
4315                 error_to_writebrawerr(req);
4316                 goto strict_unlock;
4317         }
4318
4319         DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4320                 "wrote=%d\n",
4321                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4322                 (int)total_written));
4323
4324         if (!fsp->print_file) {
4325                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4326         }
4327
4328         /* We won't return a status if write through is not selected - this
4329          * follows what WfWg does */
4330         END_PROFILE(SMBwritebraw);
4331
4332         if (!write_through && total_written==tcount) {
4333
4334 #if RABBIT_PELLET_FIX
4335                 /*
4336                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4337                  * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4338                  * JRA.
4339                  */
4340                 if (!send_keepalive(req->sconn->sock)) {
4341                         exit_server_cleanly("reply_writebraw: send of "
4342                                 "keepalive failed");
4343                 }
4344 #endif
4345                 TALLOC_FREE(req->outbuf);
4346         }
4347         return;
4348
4349 strict_unlock:
4350         if (!fsp->print_file) {
4351                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4352         }
4353
4354         END_PROFILE(SMBwritebraw);
4355         return;
4356 }
4357
4358 #undef DBGC_CLASS
4359 #define DBGC_CLASS DBGC_LOCKING
4360
4361 /****************************************************************************
4362  Reply to a writeunlock (core+).
4363 ****************************************************************************/
4364
4365 void reply_writeunlock(struct smb_request *req)
4366 {
4367         connection_struct *conn = req->conn;
4368         ssize_t nwritten = -1;
4369         size_t numtowrite;
4370         off_t startpos;
4371         const char *data;
4372         NTSTATUS status = NT_STATUS_OK;
4373         files_struct *fsp;
4374         struct lock_struct lock;
4375         int saved_errno = 0;
4376
4377         START_PROFILE(SMBwriteunlock);
4378
4379         if (req->wct < 5) {
4380                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4381                 END_PROFILE(SMBwriteunlock);
4382                 return;
4383         }
4384
4385         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4386
4387         if (!check_fsp(conn, req, fsp)) {
4388                 END_PROFILE(SMBwriteunlock);
4389                 return;
4390         }
4391
4392         if (!CHECK_WRITE(fsp)) {
4393                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4394                 END_PROFILE(SMBwriteunlock);
4395                 return;
4396         }
4397
4398         numtowrite = SVAL(req->vwv+1, 0);
4399         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4400         data = (const char *)req->buf + 3;
4401
4402         if (!fsp->print_file && numtowrite > 0) {
4403                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4404                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4405                     &lock);
4406
4407                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4408                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4409                         END_PROFILE(SMBwriteunlock);
4410                         return;
4411                 }
4412         }
4413
4414         /* The special X/Open SMB protocol handling of
4415            zero length writes is *NOT* done for
4416            this call */
4417         if(numtowrite == 0) {
4418                 nwritten = 0;
4419         } else {
4420                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4421                 saved_errno = errno;
4422         }
4423
4424         status = sync_file(conn, fsp, False /* write through */);
4425         if (!NT_STATUS_IS_OK(status)) {
4426                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4427                          fsp_str_dbg(fsp), nt_errstr(status)));
4428                 reply_nterror(req, status);
4429                 goto strict_unlock;
4430         }
4431
4432         if(nwritten < 0) {
4433                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4434                 goto strict_unlock;
4435         }
4436
4437         if((nwritten < numtowrite) && (numtowrite != 0)) {
4438                 reply_nterror(req, NT_STATUS_DISK_FULL);
4439                 goto strict_unlock;
4440         }
4441
4442         if (numtowrite && !fsp->print_file) {
4443                 status = do_unlock(req->sconn->msg_ctx,
4444                                 fsp,
4445                                 (uint64_t)req->smbpid,
4446                                 (uint64_t)numtowrite,
4447                                 (uint64_t)startpos,
4448                                 WINDOWS_LOCK);
4449
4450                 if (NT_STATUS_V(status)) {
4451                         reply_nterror(req, status);
4452                         goto strict_unlock;
4453                 }
4454         }
4455
4456         reply_outbuf(req, 1, 0);
4457
4458         SSVAL(req->outbuf,smb_vwv0,nwritten);
4459
4460         DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4461                   fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4462
4463 strict_unlock:
4464         if (numtowrite && !fsp->print_file) {
4465                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4466         }
4467
4468         END_PROFILE(SMBwriteunlock);
4469         return;
4470 }
4471
4472 #undef DBGC_CLASS
4473 #define DBGC_CLASS DBGC_ALL
4474
4475 /****************************************************************************
4476  Reply to a write.
4477 ****************************************************************************/
4478
4479 void reply_write(struct smb_request *req)
4480 {
4481         connection_struct *conn = req->conn;
4482         size_t numtowrite;
4483         ssize_t nwritten = -1;
4484         off_t startpos;
4485         const char *data;
4486         files_struct *fsp;
4487         struct lock_struct lock;
4488         NTSTATUS status;
4489         int saved_errno = 0;
4490
4491         START_PROFILE(SMBwrite);
4492
4493         if (req->wct < 5) {
4494                 END_PROFILE(SMBwrite);
4495                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4496                 return;
4497         }
4498
4499         /* If it's an IPC, pass off the pipe handler. */
4500         if (IS_IPC(conn)) {
4501                 reply_pipe_write(req);
4502                 END_PROFILE(SMBwrite);
4503                 return;
4504         }
4505
4506         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4507
4508         if (!check_fsp(conn, req, fsp)) {
4509                 END_PROFILE(SMBwrite);
4510                 return;
4511         }
4512
4513         if (!CHECK_WRITE(fsp)) {
4514                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4515                 END_PROFILE(SMBwrite);
4516                 return;
4517         }
4518
4519         numtowrite = SVAL(req->vwv+1, 0);
4520         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4521         data = (const char *)req->buf + 3;
4522
4523         if (!fsp->print_file) {
4524                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4525                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4526                         &lock);
4527
4528                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4529                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4530                         END_PROFILE(SMBwrite);
4531                         return;
4532                 }
4533         }
4534
4535         /*
4536          * X/Open SMB protocol says that if smb_vwv1 is
4537          * zero then the file size should be extended or
4538          * truncated to the size given in smb_vwv[2-3].
4539          */
4540
4541         if(numtowrite == 0) {
4542                 /*
4543                  * This is actually an allocate call, and set EOF. JRA.
4544                  */
4545                 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4546                 if (nwritten < 0) {
4547                         reply_nterror(req, NT_STATUS_DISK_FULL);
4548                         goto strict_unlock;
4549                 }
4550                 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4551                 if (nwritten < 0) {
4552                         reply_nterror(req, NT_STATUS_DISK_FULL);
4553                         goto strict_unlock;
4554                 }
4555                 trigger_write_time_update_immediate(fsp);
4556         } else {
4557                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4558         }
4559
4560         status = sync_file(conn, fsp, False);
4561         if (!NT_STATUS_IS_OK(status)) {
4562                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4563                          fsp_str_dbg(fsp), nt_errstr(status)));
4564                 reply_nterror(req, status);
4565                 goto strict_unlock;
4566         }
4567
4568         if(nwritten < 0) {
4569                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4570                 goto strict_unlock;
4571         }
4572
4573         if((nwritten == 0) && (numtowrite != 0)) {
4574                 reply_nterror(req, NT_STATUS_DISK_FULL);
4575                 goto strict_unlock;
4576         }
4577
4578         reply_outbuf(req, 1, 0);
4579
4580         SSVAL(req->outbuf,smb_vwv0,nwritten);
4581
4582         if (nwritten < (ssize_t)numtowrite) {
4583                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4584                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4585         }
4586
4587         DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4588
4589 strict_unlock:
4590         if (!fsp->print_file) {
4591                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4592         }
4593
4594         END_PROFILE(SMBwrite);
4595         return;
4596 }
4597
4598 /****************************************************************************
4599  Ensure a buffer is a valid writeX for recvfile purposes.
4600 ****************************************************************************/
4601
4602 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4603                                                 (2*14) + /* word count (including bcc) */ \
4604                                                 1 /* pad byte */)
4605
4606 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4607                             const uint8_t *inbuf)
4608 {
4609         size_t numtowrite;
4610         connection_struct *conn = NULL;
4611         unsigned int doff = 0;
4612         size_t len = smb_len_large(inbuf);
4613         struct smbXsrv_tcon *tcon;
4614         NTSTATUS status;
4615         NTTIME now = 0;
4616
4617         if (is_encrypted_packet(sconn, inbuf)) {
4618                 /* Can't do this on encrypted
4619                  * connections. */
4620                 return false;
4621         }
4622
4623         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4624                 return false;
4625         }
4626
4627         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4628                         CVAL(inbuf,smb_wct) != 14) {
4629                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4630                         "invalid word length.\n"));
4631                 return false;
4632         }
4633
4634         status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
4635                                      now, &tcon);
4636         if (!NT_STATUS_IS_OK(status)) {
4637                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4638                 return false;
4639         }
4640         conn = tcon->compat;
4641
4642         if (IS_IPC(conn)) {
4643                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4644                 return false;
4645         }
4646         if (IS_PRINT(conn)) {
4647                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4648                 return false;
4649         }
4650         doff = SVAL(inbuf,smb_vwv11);
4651
4652         numtowrite = SVAL(inbuf,smb_vwv10);
4653
4654         if (len > doff && len - doff > 0xFFFF) {
4655                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4656         }
4657
4658         if (numtowrite == 0) {
4659                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4660                 return false;
4661         }
4662
4663         /* Ensure the sizes match up. */
4664         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4665                 /* no pad byte...old smbclient :-( */
4666                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4667                         (unsigned int)doff,
4668                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4669                 return false;
4670         }
4671
4672         if (len - doff != numtowrite) {
4673                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4674                         "len = %u, doff = %u, numtowrite = %u\n",
4675                         (unsigned int)len,
4676                         (unsigned int)doff,
4677                         (unsigned int)numtowrite ));
4678                 return false;
4679         }
4680
4681         DEBUG(10,("is_valid_writeX_buffer: true "
4682                 "len = %u, doff = %u, numtowrite = %u\n",
4683                 (unsigned int)len,
4684                 (unsigned int)doff,
4685                 (unsigned int)numtowrite ));
4686
4687         return true;
4688 }
4689
4690 /****************************************************************************
4691  Reply to a write and X.
4692 ****************************************************************************/
4693
4694 void reply_write_and_X(struct smb_request *req)
4695 {
4696         connection_struct *conn = req->conn;
4697         files_struct *fsp;
4698         struct lock_struct lock;
4699         off_t startpos;
4700         size_t numtowrite;
4701         bool write_through;
4702         ssize_t nwritten;
4703         unsigned int smb_doff;
4704         unsigned int smblen;
4705         const char *data;
4706         NTSTATUS status;
4707         int saved_errno = 0;
4708
4709         START_PROFILE(SMBwriteX);
4710
4711         if ((req->wct != 12) && (req->wct != 14)) {
4712                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4713                 goto out;
4714         }
4715
4716         numtowrite = SVAL(req->vwv+10, 0);
4717         smb_doff = SVAL(req->vwv+11, 0);
4718         smblen = smb_len(req->inbuf);
4719
4720         if (req->unread_bytes > 0xFFFF ||
4721                         (smblen > smb_doff &&
4722                                 smblen - smb_doff > 0xFFFF)) {
4723                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4724         }
4725
4726         if (req->unread_bytes) {
4727                 /* Can't do a recvfile write on IPC$ */
4728                 if (IS_IPC(conn)) {
4729                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4730                         goto out;
4731                 }
4732                 if (numtowrite != req->unread_bytes) {
4733                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4734                         goto out;
4735                 }
4736         } else {
4737                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4738                                 smb_doff + numtowrite > smblen) {
4739                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4740                         goto out;
4741                 }
4742         }
4743
4744         /* If it's an IPC, pass off the pipe handler. */
4745         if (IS_IPC(conn)) {
4746                 if (req->unread_bytes) {
4747                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4748                         goto out;
4749                 }
4750                 reply_pipe_write_and_X(req);
4751                 goto out;
4752         }
4753
4754         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4755         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4756         write_through = BITSETW(req->vwv+7,0);
4757
4758         if (!check_fsp(conn, req, fsp)) {
4759                 goto out;
4760         }
4761
4762         if (!CHECK_WRITE(fsp)) {
4763                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4764                 goto out;
4765         }
4766
4767         data = smb_base(req->inbuf) + smb_doff;
4768
4769         if(req->wct == 14) {
4770                 /*
4771                  * This is a large offset (64 bit) write.
4772                  */
4773                 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4774
4775         }
4776
4777         /* X/Open SMB protocol says that, unlike SMBwrite
4778         if the length is zero then NO truncation is
4779         done, just a write of zero. To truncate a file,
4780         use SMBwrite. */
4781
4782         if(numtowrite == 0) {
4783                 nwritten = 0;
4784         } else {
4785                 if (req->unread_bytes == 0) {
4786                         status = schedule_aio_write_and_X(conn,
4787                                                 req,
4788                                                 fsp,
4789                                                 data,
4790                                                 startpos,
4791                                                 numtowrite);
4792
4793                         if (NT_STATUS_IS_OK(status)) {
4794                                 /* write scheduled - we're done. */
4795                                 goto out;
4796                         }
4797                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4798                                 /* Real error - report to client. */
4799                                 reply_nterror(req, status);
4800                                 goto out;
4801                         }
4802                         /* NT_STATUS_RETRY - fall through to sync write. */
4803                 }
4804
4805                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4806                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4807                     &lock);
4808
4809                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4810                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4811                         goto out;
4812                 }
4813
4814                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4815                 saved_errno = errno;
4816
4817                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4818         }
4819
4820         if(nwritten < 0) {
4821                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4822                 goto out;
4823         }
4824
4825         if((nwritten == 0) && (numtowrite != 0)) {
4826                 reply_nterror(req, NT_STATUS_DISK_FULL);
4827                 goto out;
4828         }
4829
4830         reply_outbuf(req, 6, 0);
4831         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4832         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
4833         SSVAL(req->outbuf,smb_vwv2,nwritten);
4834         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4835
4836         DEBUG(3,("writeX %s num=%d wrote=%d\n",
4837                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4838
4839         status = sync_file(conn, fsp, write_through);
4840         if (!NT_STATUS_IS_OK(status)) {
4841                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4842                          fsp_str_dbg(fsp), nt_errstr(status)));
4843                 reply_nterror(req, status);
4844                 goto out;
4845         }
4846
4847         END_PROFILE(SMBwriteX);
4848         return;
4849
4850 out:
4851         if (req->unread_bytes) {
4852                 /* writeX failed. drain socket. */
4853                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4854                                 req->unread_bytes) {
4855                         smb_panic("failed to drain pending bytes");
4856                 }
4857                 req->unread_bytes = 0;
4858         }
4859
4860         END_PROFILE(SMBwriteX);
4861         return;
4862 }
4863
4864 /****************************************************************************
4865  Reply to a lseek.
4866 ****************************************************************************/
4867
4868 void reply_lseek(struct smb_request *req)
4869 {
4870         connection_struct *conn = req->conn;
4871         off_t startpos;
4872         off_t res= -1;
4873         int mode,umode;
4874         files_struct *fsp;
4875
4876         START_PROFILE(SMBlseek);
4877
4878         if (req->wct < 4) {
4879                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4880                 END_PROFILE(SMBlseek);
4881                 return;
4882         }
4883
4884         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4885
4886         if (!check_fsp(conn, req, fsp)) {
4887                 return;
4888         }
4889
4890         flush_write_cache(fsp, SEEK_FLUSH);
4891
4892         mode = SVAL(req->vwv+1, 0) & 3;
4893         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4894         startpos = (off_t)IVALS(req->vwv+2, 0);
4895
4896         switch (mode) {
4897                 case 0:
4898                         umode = SEEK_SET;
4899                         res = startpos;
4900                         break;
4901                 case 1:
4902                         umode = SEEK_CUR;
4903                         res = fsp->fh->pos + startpos;
4904                         break;
4905                 case 2:
4906                         umode = SEEK_END;
4907                         break;
4908                 default:
4909                         umode = SEEK_SET;
4910                         res = startpos;
4911                         break;
4912         }
4913
4914         if (umode == SEEK_END) {
4915                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4916                         if(errno == EINVAL) {
4917                                 off_t current_pos = startpos;
4918
4919                                 if(fsp_stat(fsp) == -1) {
4920                                         reply_nterror(req,
4921                                                 map_nt_error_from_unix(errno));
4922                                         END_PROFILE(SMBlseek);
4923                                         return;
4924                                 }
4925
4926                                 current_pos += fsp->fsp_name->st.st_ex_size;
4927                                 if(current_pos < 0)
4928                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4929                         }
4930                 }
4931
4932                 if(res == -1) {
4933                         reply_nterror(req, map_nt_error_from_unix(errno));
4934                         END_PROFILE(SMBlseek);
4935                         return;
4936                 }
4937         }
4938
4939         fsp->fh->pos = res;
4940
4941         reply_outbuf(req, 2, 0);
4942         SIVAL(req->outbuf,smb_vwv0,res);
4943
4944         DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4945                 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4946
4947         END_PROFILE(SMBlseek);
4948         return;
4949 }
4950
4951 /****************************************************************************
4952  Reply to a flush.
4953 ****************************************************************************/
4954
4955 void reply_flush(struct smb_request *req)
4956 {
4957         connection_struct *conn = req->conn;
4958         uint16 fnum;
4959         files_struct *fsp;
4960
4961         START_PROFILE(SMBflush);
4962
4963         if (req->wct < 1) {
4964                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4965                 return;
4966         }
4967
4968         fnum = SVAL(req->vwv+0, 0);
4969         fsp = file_fsp(req, fnum);
4970
4971         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4972                 return;
4973         }
4974
4975         if (!fsp) {
4976                 file_sync_all(conn);
4977         } else {
4978                 NTSTATUS status = sync_file(conn, fsp, True);
4979                 if (!NT_STATUS_IS_OK(status)) {
4980                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4981                                 fsp_str_dbg(fsp), nt_errstr(status)));
4982                         reply_nterror(req, status);
4983                         END_PROFILE(SMBflush);
4984                         return;
4985                 }
4986         }
4987
4988         reply_outbuf(req, 0, 0);
4989
4990         DEBUG(3,("flush\n"));
4991         END_PROFILE(SMBflush);
4992         return;
4993 }
4994
4995 /****************************************************************************
4996  Reply to a exit.
4997  conn POINTER CAN BE NULL HERE !
4998 ****************************************************************************/
4999
5000 void reply_exit(struct smb_request *req)
5001 {
5002         START_PROFILE(SMBexit);
5003
5004         file_close_pid(req->sconn, req->smbpid, req->vuid);
5005
5006         reply_outbuf(req, 0, 0);
5007
5008         DEBUG(3,("exit\n"));
5009
5010         END_PROFILE(SMBexit);
5011         return;
5012 }
5013
5014 struct reply_close_state {
5015         files_struct *fsp;
5016         struct smb_request *smbreq;
5017 };
5018
5019 static void do_smb1_close(struct tevent_req *req);
5020
5021 void reply_close(struct smb_request *req)
5022 {
5023         connection_struct *conn = req->conn;
5024         NTSTATUS status = NT_STATUS_OK;
5025         files_struct *fsp = NULL;
5026         START_PROFILE(SMBclose);
5027
5028         if (req->wct < 3) {
5029                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5030                 END_PROFILE(SMBclose);
5031                 return;
5032         }
5033
5034         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5035
5036         /*
5037          * We can only use check_fsp if we know it's not a directory.
5038          */
5039
5040         if (!check_fsp_open(conn, req, fsp)) {
5041                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5042                 END_PROFILE(SMBclose);
5043                 return;
5044         }
5045
5046         DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5047                   fsp->is_directory ? "directory" : "file",
5048                   fsp->fh->fd, fsp_fnum_dbg(fsp),
5049                   conn->num_files_open));
5050
5051         if (!fsp->is_directory) {
5052                 time_t t;
5053
5054                 /*
5055                  * Take care of any time sent in the close.
5056                  */
5057
5058                 t = srv_make_unix_date3(req->vwv+1);
5059                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5060         }
5061
5062         if (fsp->num_aio_requests != 0) {
5063
5064                 struct reply_close_state *state;
5065
5066                 DEBUG(10, ("closing with aio %u requests pending\n",
5067                            fsp->num_aio_requests));
5068
5069                 /*
5070                  * We depend on the aio_extra destructor to take care of this
5071                  * close request once fsp->num_aio_request drops to 0.
5072                  */
5073
5074                 fsp->deferred_close = tevent_wait_send(
5075                         fsp, fsp->conn->sconn->ev_ctx);
5076                 if (fsp->deferred_close == NULL) {
5077                         status = NT_STATUS_NO_MEMORY;
5078                         goto done;
5079                 }
5080
5081                 state = talloc(fsp, struct reply_close_state);
5082                 if (state == NULL) {
5083                         TALLOC_FREE(fsp->deferred_close);
5084                         status = NT_STATUS_NO_MEMORY;
5085                         goto done;
5086                 }
5087                 state->fsp = fsp;
5088                 state->smbreq = talloc_move(fsp, &req);
5089                 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5090                                         state);
5091                 END_PROFILE(SMBclose);
5092                 return;
5093         }
5094
5095         /*
5096          * close_file() returns the unix errno if an error was detected on
5097          * close - normally this is due to a disk full error. If not then it
5098          * was probably an I/O error.
5099          */
5100
5101         status = close_file(req, fsp, NORMAL_CLOSE);
5102 done:
5103         if (!NT_STATUS_IS_OK(status)) {
5104                 reply_nterror(req, status);
5105                 END_PROFILE(SMBclose);
5106                 return;
5107         }
5108
5109         reply_outbuf(req, 0, 0);
5110         END_PROFILE(SMBclose);
5111         return;
5112 }
5113
5114 static void do_smb1_close(struct tevent_req *req)
5115 {
5116         struct reply_close_state *state = tevent_req_callback_data(
5117                 req, struct reply_close_state);
5118         struct smb_request *smbreq;
5119         NTSTATUS status;
5120         int ret;
5121
5122         ret = tevent_wait_recv(req);
5123         TALLOC_FREE(req);
5124         if (ret != 0) {
5125                 DEBUG(10, ("tevent_wait_recv returned %s\n",
5126                            strerror(ret)));
5127                 /*
5128                  * Continue anyway, this should never happen
5129                  */
5130         }
5131
5132         /*
5133          * fsp->smb2_close_request right now is a talloc grandchild of
5134          * fsp. When we close_file(fsp), it would go with it. No chance to
5135          * reply...
5136          */
5137         smbreq = talloc_move(talloc_tos(), &state->smbreq);
5138
5139         status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5140         if (NT_STATUS_IS_OK(status)) {
5141                 reply_outbuf(smbreq, 0, 0);
5142         } else {
5143                 reply_nterror(smbreq, status);
5144         }
5145         if (!srv_send_smb(smbreq->sconn,
5146                         (char *)smbreq->outbuf,
5147                         true,
5148                         smbreq->seqnum+1,
5149                         IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5150                         NULL)) {
5151                 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5152                                     "failed.");
5153         }
5154         TALLOC_FREE(smbreq);
5155 }
5156
5157 /****************************************************************************
5158  Reply to a writeclose (Core+ protocol).
5159 ****************************************************************************/
5160
5161 void reply_writeclose(struct smb_request *req)
5162 {
5163         connection_struct *conn = req->conn;
5164         size_t numtowrite;
5165         ssize_t nwritten = -1;
5166         NTSTATUS close_status = NT_STATUS_OK;
5167         off_t startpos;
5168         const char *data;
5169         struct timespec mtime;
5170         files_struct *fsp;
5171         struct lock_struct lock;
5172
5173         START_PROFILE(SMBwriteclose);
5174
5175         if (req->wct < 6) {
5176                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5177                 END_PROFILE(SMBwriteclose);
5178                 return;
5179         }
5180
5181         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5182
5183         if (!check_fsp(conn, req, fsp)) {
5184                 END_PROFILE(SMBwriteclose);
5185                 return;
5186         }
5187         if (!CHECK_WRITE(fsp)) {
5188                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5189                 END_PROFILE(SMBwriteclose);
5190                 return;
5191         }
5192
5193         numtowrite = SVAL(req->vwv+1, 0);
5194         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5195         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5196         data = (const char *)req->buf + 1;
5197
5198         if (!fsp->print_file) {
5199                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5200                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5201                     &lock);
5202
5203                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5204                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5205                         END_PROFILE(SMBwriteclose);
5206                         return;
5207                 }
5208         }
5209
5210         nwritten = write_file(req,fsp,data,startpos,numtowrite);
5211
5212         set_close_write_time(fsp, mtime);
5213
5214         /*
5215          * More insanity. W2K only closes the file if writelen > 0.
5216          * JRA.
5217          */
5218
5219         if (numtowrite) {
5220                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5221                          "file %s\n", fsp_str_dbg(fsp)));
5222                 close_status = close_file(req, fsp, NORMAL_CLOSE);
5223         }
5224
5225         DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5226                  fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5227                  conn->num_files_open));
5228
5229         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5230                 reply_nterror(req, NT_STATUS_DISK_FULL);
5231                 goto strict_unlock;
5232         }
5233
5234         if(!NT_STATUS_IS_OK(close_status)) {
5235                 reply_nterror(req, close_status);
5236                 goto strict_unlock;
5237         }
5238
5239         reply_outbuf(req, 1, 0);
5240
5241         SSVAL(req->outbuf,smb_vwv0,nwritten);
5242
5243 strict_unlock:
5244         if (numtowrite && !fsp->print_file) {
5245                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5246         }
5247
5248         END_PROFILE(SMBwriteclose);
5249         return;
5250 }
5251
5252 #undef DBGC_CLASS
5253 #define DBGC_CLASS DBGC_LOCKING
5254
5255 /****************************************************************************
5256  Reply to a lock.
5257 ****************************************************************************/
5258
5259 void reply_lock(struct smb_request *req)
5260 {
5261         connection_struct *conn = req->conn;
5262         uint64_t count,offset;
5263         NTSTATUS status;
5264         files_struct *fsp;
5265         struct byte_range_lock *br_lck = NULL;
5266
5267         START_PROFILE(SMBlock);
5268
5269         if (req->wct < 5) {
5270                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5271                 END_PROFILE(SMBlock);
5272                 return;
5273         }
5274
5275         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5276
5277         if (!check_fsp(conn, req, fsp)) {
5278                 END_PROFILE(SMBlock);
5279                 return;
5280         }
5281
5282         count = (uint64_t)IVAL(req->vwv+1, 0);
5283         offset = (uint64_t)IVAL(req->vwv+3, 0);
5284
5285         DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5286                  fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5287
5288         br_lck = do_lock(req->sconn->msg_ctx,
5289                         fsp,
5290                         (uint64_t)req->smbpid,
5291                         count,
5292                         offset,
5293                         WRITE_LOCK,
5294                         WINDOWS_LOCK,
5295                         False, /* Non-blocking lock. */
5296                         &status,
5297                         NULL,
5298                         NULL);
5299
5300         TALLOC_FREE(br_lck);
5301
5302         if (NT_STATUS_V(status)) {
5303                 reply_nterror(req, status);
5304                 END_PROFILE(SMBlock);
5305                 return;
5306         }
5307
5308         reply_outbuf(req, 0, 0);
5309
5310         END_PROFILE(SMBlock);
5311         return;
5312 }
5313
5314 /****************************************************************************
5315  Reply to a unlock.
5316 ****************************************************************************/
5317
5318 void reply_unlock(struct smb_request *req)
5319 {
5320         connection_struct *conn = req->conn;
5321         uint64_t count,offset;
5322         NTSTATUS status;
5323         files_struct *fsp;
5324
5325         START_PROFILE(SMBunlock);
5326
5327         if (req->wct < 5) {
5328                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5329                 END_PROFILE(SMBunlock);
5330                 return;
5331         }
5332
5333         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5334
5335         if (!check_fsp(conn, req, fsp)) {
5336                 END_PROFILE(SMBunlock);
5337                 return;
5338         }
5339
5340         count = (uint64_t)IVAL(req->vwv+1, 0);
5341         offset = (uint64_t)IVAL(req->vwv+3, 0);
5342
5343         status = do_unlock(req->sconn->msg_ctx,
5344                         fsp,
5345                         (uint64_t)req->smbpid,
5346                         count,
5347                         offset,
5348                         WINDOWS_LOCK);
5349
5350         if (NT_STATUS_V(status)) {
5351                 reply_nterror(req, status);
5352                 END_PROFILE(SMBunlock);
5353                 return;
5354         }
5355
5356         DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5357                     fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5358
5359         reply_outbuf(req, 0, 0);
5360
5361         END_PROFILE(SMBunlock);
5362         return;
5363 }
5364
5365 #undef DBGC_CLASS
5366 #define DBGC_CLASS DBGC_ALL
5367
5368 /****************************************************************************
5369  Reply to a tdis.
5370  conn POINTER CAN BE NULL HERE !
5371 ****************************************************************************/
5372
5373 void reply_tdis(struct smb_request *req)
5374 {
5375         NTSTATUS status;
5376         connection_struct *conn = req->conn;
5377         struct smbXsrv_tcon *tcon;
5378
5379         START_PROFILE(SMBtdis);
5380
5381         if (!conn) {
5382                 DEBUG(4,("Invalid connection in tdis\n"));
5383                 reply_force_doserror(req, ERRSRV, ERRinvnid);
5384                 END_PROFILE(SMBtdis);
5385                 return;
5386         }
5387
5388         tcon = conn->tcon;
5389         req->conn = NULL;
5390
5391         /*
5392          * TODO: cancel all outstanding requests on the tcon
5393          */
5394         status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5395         if (!NT_STATUS_IS_OK(status)) {
5396                 DEBUG(0, ("reply_tdis: "
5397                           "smbXsrv_tcon_disconnect() failed: %s\n",
5398                           nt_errstr(status)));
5399                 /*
5400                  * If we hit this case, there is something completely
5401                  * wrong, so we better disconnect the transport connection.
5402                  */
5403                 END_PROFILE(SMBtdis);
5404                 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5405                 return;
5406         }
5407
5408         TALLOC_FREE(tcon);
5409
5410         reply_outbuf(req, 0, 0);
5411         END_PROFILE(SMBtdis);
5412         return;
5413 }
5414
5415 /****************************************************************************
5416  Reply to a echo.
5417  conn POINTER CAN BE NULL HERE !
5418 ****************************************************************************/
5419
5420 void reply_echo(struct smb_request *req)
5421 {
5422         connection_struct *conn = req->conn;
5423         struct smb_perfcount_data local_pcd;
5424         struct smb_perfcount_data *cur_pcd;
5425         int smb_reverb;
5426         int seq_num;
5427
5428         START_PROFILE(SMBecho);
5429
5430         smb_init_perfcount_data(&local_pcd);
5431
5432         if (req->wct < 1) {
5433                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5434                 END_PROFILE(SMBecho);
5435                 return;
5436         }
5437
5438         smb_reverb = SVAL(req->vwv+0, 0);
5439
5440         reply_outbuf(req, 1, req->buflen);
5441
5442         /* copy any incoming data back out */
5443         if (req->buflen > 0) {
5444                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5445         }
5446
5447         if (smb_reverb > 100) {
5448                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5449                 smb_reverb = 100;
5450         }
5451
5452         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5453
5454                 /* this makes sure we catch the request pcd */
5455                 if (seq_num == smb_reverb) {
5456                         cur_pcd = &req->pcd;
5457                 } else {
5458                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5459                         cur_pcd = &local_pcd;
5460                 }
5461
5462                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5463
5464                 show_msg((char *)req->outbuf);
5465                 if (!srv_send_smb(req->sconn,
5466                                 (char *)req->outbuf,
5467                                 true, req->seqnum+1,
5468                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5469                                 cur_pcd))
5470                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5471         }
5472
5473         DEBUG(3,("echo %d times\n", smb_reverb));
5474
5475         TALLOC_FREE(req->outbuf);
5476
5477         END_PROFILE(SMBecho);
5478         return;
5479 }
5480
5481 /****************************************************************************
5482  Reply to a printopen.
5483 ****************************************************************************/
5484
5485 void reply_printopen(struct smb_request *req)
5486 {
5487         connection_struct *conn = req->conn;
5488         files_struct *fsp;
5489         NTSTATUS status;
5490
5491         START_PROFILE(SMBsplopen);
5492
5493         if (req->wct < 2) {
5494                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5495                 END_PROFILE(SMBsplopen);
5496                 return;
5497         }
5498
5499         if (!CAN_PRINT(conn)) {
5500                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5501                 END_PROFILE(SMBsplopen);
5502                 return;
5503         }
5504
5505         status = file_new(req, conn, &fsp);
5506         if(!NT_STATUS_IS_OK(status)) {
5507                 reply_nterror(req, status);
5508                 END_PROFILE(SMBsplopen);
5509                 return;
5510         }
5511
5512         /* Open for exclusive use, write only. */
5513         status = print_spool_open(fsp, NULL, req->vuid);
5514
5515         if (!NT_STATUS_IS_OK(status)) {
5516                 file_free(req, fsp);
5517                 reply_nterror(req, status);
5518                 END_PROFILE(SMBsplopen);
5519                 return;
5520         }
5521
5522         reply_outbuf(req, 1, 0);
5523         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5524
5525         DEBUG(3,("openprint fd=%d %s\n",
5526                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5527
5528         END_PROFILE(SMBsplopen);
5529         return;
5530 }
5531
5532 /****************************************************************************
5533  Reply to a printclose.
5534 ****************************************************************************/
5535
5536 void reply_printclose(struct smb_request *req)
5537 {
5538         connection_struct *conn = req->conn;
5539         files_struct *fsp;
5540         NTSTATUS status;
5541
5542         START_PROFILE(SMBsplclose);
5543
5544         if (req->wct < 1) {
5545                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5546                 END_PROFILE(SMBsplclose);
5547                 return;
5548         }
5549
5550         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5551
5552         if (!check_fsp(conn, req, fsp)) {
5553                 END_PROFILE(SMBsplclose);
5554                 return;
5555         }
5556
5557         if (!CAN_PRINT(conn)) {
5558                 reply_force_doserror(req, ERRSRV, ERRerror);
5559                 END_PROFILE(SMBsplclose);
5560                 return;
5561         }
5562
5563         DEBUG(3,("printclose fd=%d %s\n",
5564                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5565
5566         status = close_file(req, fsp, NORMAL_CLOSE);
5567
5568         if(!NT_STATUS_IS_OK(status)) {
5569                 reply_nterror(req, status);
5570                 END_PROFILE(SMBsplclose);
5571                 return;
5572         }
5573
5574         reply_outbuf(req, 0, 0);
5575
5576         END_PROFILE(SMBsplclose);
5577         return;
5578 }
5579
5580 /****************************************************************************
5581  Reply to a printqueue.
5582 ****************************************************************************/
5583
5584 void reply_printqueue(struct smb_request *req)
5585 {
5586         connection_struct *conn = req->conn;
5587         int max_count;
5588         int start_index;
5589
5590         START_PROFILE(SMBsplretq);
5591
5592         if (req->wct < 2) {
5593                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5594                 END_PROFILE(SMBsplretq);
5595                 return;
5596         }
5597
5598         max_count = SVAL(req->vwv+0, 0);
5599         start_index = SVAL(req->vwv+1, 0);
5600
5601         /* we used to allow the client to get the cnum wrong, but that
5602            is really quite gross and only worked when there was only
5603            one printer - I think we should now only accept it if they
5604            get it right (tridge) */
5605         if (!CAN_PRINT(conn)) {
5606                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5607                 END_PROFILE(SMBsplretq);
5608                 return;
5609         }
5610
5611         reply_outbuf(req, 2, 3);
5612         SSVAL(req->outbuf,smb_vwv0,0);
5613         SSVAL(req->outbuf,smb_vwv1,0);
5614         SCVAL(smb_buf(req->outbuf),0,1);
5615         SSVAL(smb_buf(req->outbuf),1,0);
5616
5617         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5618                  start_index, max_count));
5619
5620         {
5621                 TALLOC_CTX *mem_ctx = talloc_tos();
5622                 NTSTATUS status;
5623                 WERROR werr;
5624                 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5625                 struct rpc_pipe_client *cli = NULL;
5626                 struct dcerpc_binding_handle *b = NULL;
5627                 struct policy_handle handle;
5628                 struct spoolss_DevmodeContainer devmode_ctr;
5629                 union spoolss_JobInfo *info;
5630                 uint32_t count;
5631                 uint32_t num_to_get;
5632                 uint32_t first;
5633                 uint32_t i;
5634
5635                 ZERO_STRUCT(handle);
5636
5637                 status = rpc_pipe_open_interface(conn,
5638                                                  &ndr_table_spoolss.syntax_id,
5639                                                  conn->session_info,
5640                                                  conn->sconn->remote_address,
5641                                                  conn->sconn->msg_ctx,
5642                                                  &cli);
5643                 if (!NT_STATUS_IS_OK(status)) {
5644                         DEBUG(0, ("reply_printqueue: "
5645                                   "could not connect to spoolss: %s\n",
5646                                   nt_errstr(status)));
5647                         reply_nterror(req, status);
5648                         goto out;
5649                 }
5650                 b = cli->binding_handle;
5651
5652                 ZERO_STRUCT(devmode_ctr);
5653
5654                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5655                                                 sharename,
5656                                                 NULL, devmode_ctr,
5657                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5658                                                 &handle,
5659                                                 &werr);
5660                 if (!NT_STATUS_IS_OK(status)) {
5661                         reply_nterror(req, status);
5662                         goto out;
5663                 }
5664                 if (!W_ERROR_IS_OK(werr)) {
5665                         reply_nterror(req, werror_to_ntstatus(werr));
5666                         goto out;
5667                 }
5668
5669                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5670                                                &handle,
5671                                                0, /* firstjob */
5672                                                0xff, /* numjobs */
5673                                                2, /* level */
5674                                                0, /* offered */
5675                                                &count,
5676                                                &info);
5677                 if (!W_ERROR_IS_OK(werr)) {
5678                         reply_nterror(req, werror_to_ntstatus(werr));
5679                         goto out;
5680                 }
5681
5682                 if (max_count > 0) {
5683                         first = start_index;
5684                 } else {
5685                         first = start_index + max_count + 1;
5686                 }
5687
5688                 if (first >= count) {
5689                         num_to_get = first;
5690                 } else {
5691                         num_to_get = first + MIN(ABS(max_count), count - first);
5692                 }
5693
5694                 for (i = first; i < num_to_get; i++) {
5695                         char blob[28];
5696                         char *p = blob;
5697                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5698                         int qstatus;
5699                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5700                                                         info[i].info2.job_id);
5701
5702                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5703                                 qstatus = 2;
5704                         } else {
5705                                 qstatus = 3;
5706                         }
5707
5708                         srv_put_dos_date2(p, 0, qtime);
5709                         SCVAL(p, 4, qstatus);
5710                         SSVAL(p, 5, qrapjobid);
5711                         SIVAL(p, 7, info[i].info2.size);
5712                         SCVAL(p, 11, 0);
5713                         srvstr_push(blob, req->flags2, p+12,
5714                                     info[i].info2.notify_name, 16, STR_ASCII);
5715
5716                         if (message_push_blob(
5717                                     &req->outbuf,
5718                                     data_blob_const(
5719                                             blob, sizeof(blob))) == -1) {
5720                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5721                                 goto out;
5722                         }
5723                 }
5724
5725                 if (count > 0) {
5726                         SSVAL(req->outbuf,smb_vwv0,count);
5727                         SSVAL(req->outbuf,smb_vwv1,
5728                               (max_count>0?first+count:first-1));
5729                         SCVAL(smb_buf(req->outbuf),0,1);
5730                         SSVAL(smb_buf(req->outbuf),1,28*count);
5731                 }
5732
5733
5734                 DEBUG(3, ("%u entries returned in queue\n",
5735                           (unsigned)count));
5736
5737 out:
5738                 if (b && is_valid_policy_hnd(&handle)) {
5739                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5740                 }
5741
5742         }
5743
5744         END_PROFILE(SMBsplretq);
5745         return;
5746 }
5747
5748 /****************************************************************************
5749  Reply to a printwrite.
5750 ****************************************************************************/
5751
5752 void reply_printwrite(struct smb_request *req)
5753 {
5754         connection_struct *conn = req->conn;
5755         int numtowrite;
5756         const char *data;
5757         files_struct *fsp;
5758
5759         START_PROFILE(SMBsplwr);
5760
5761         if (req->wct < 1) {
5762                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5763                 END_PROFILE(SMBsplwr);
5764                 return;
5765         }
5766
5767         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5768
5769         if (!check_fsp(conn, req, fsp)) {
5770                 END_PROFILE(SMBsplwr);
5771                 return;
5772         }
5773
5774         if (!fsp->print_file) {
5775                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5776                 END_PROFILE(SMBsplwr);
5777                 return;
5778         }
5779
5780         if (!CHECK_WRITE(fsp)) {
5781                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5782                 END_PROFILE(SMBsplwr);
5783                 return;
5784         }
5785
5786         numtowrite = SVAL(req->buf, 1);
5787
5788         if (req->buflen < numtowrite + 3) {
5789                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5790                 END_PROFILE(SMBsplwr);
5791                 return;
5792         }
5793
5794         data = (const char *)req->buf + 3;
5795
5796         if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5797                 reply_nterror(req, map_nt_error_from_unix(errno));
5798                 END_PROFILE(SMBsplwr);
5799                 return;
5800         }
5801
5802         DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5803
5804         END_PROFILE(SMBsplwr);
5805         return;
5806 }
5807
5808 /****************************************************************************
5809  Reply to a mkdir.
5810 ****************************************************************************/
5811
5812 void reply_mkdir(struct smb_request *req)
5813 {
5814         connection_struct *conn = req->conn;
5815         struct smb_filename *smb_dname = NULL;
5816         char *directory = NULL;
5817         NTSTATUS status;
5818         TALLOC_CTX *ctx = talloc_tos();
5819
5820         START_PROFILE(SMBmkdir);
5821
5822         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5823                             STR_TERMINATE, &status);
5824         if (!NT_STATUS_IS_OK(status)) {
5825                 reply_nterror(req, status);
5826                 goto out;
5827         }
5828
5829         status = filename_convert(ctx, conn,
5830                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5831                                  directory,
5832                                  UCF_PREP_CREATEFILE,
5833                                  NULL,
5834                                  &smb_dname);
5835         if (!NT_STATUS_IS_OK(status)) {
5836                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5837                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5838                                         ERRSRV, ERRbadpath);
5839                         goto out;
5840                 }
5841                 reply_nterror(req, status);
5842                 goto out;
5843         }
5844
5845         status = create_directory(conn, req, smb_dname);
5846
5847         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5848
5849         if (!NT_STATUS_IS_OK(status)) {
5850
5851                 if (!use_nt_status()
5852                     && NT_STATUS_EQUAL(status,
5853                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5854                         /*
5855                          * Yes, in the DOS error code case we get a
5856                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5857                          * samba4 torture test.
5858                          */
5859                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5860                 }
5861
5862                 reply_nterror(req, status);
5863                 goto out;
5864         }
5865
5866         reply_outbuf(req, 0, 0);
5867
5868         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5869  out:
5870         TALLOC_FREE(smb_dname);
5871         END_PROFILE(SMBmkdir);
5872         return;
5873 }
5874
5875 /****************************************************************************
5876  Reply to a rmdir.
5877 ****************************************************************************/
5878
5879 void reply_rmdir(struct smb_request *req)
5880 {
5881         connection_struct *conn = req->conn;
5882         struct smb_filename *smb_dname = NULL;
5883         char *directory = NULL;
5884         NTSTATUS status;
5885         TALLOC_CTX *ctx = talloc_tos();
5886         files_struct *fsp = NULL;
5887         int info = 0;
5888         struct smbd_server_connection *sconn = req->sconn;
5889
5890         START_PROFILE(SMBrmdir);
5891
5892         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5893                             STR_TERMINATE, &status);
5894         if (!NT_STATUS_IS_OK(status)) {
5895                 reply_nterror(req, status);
5896                 goto out;
5897         }
5898
5899         status = filename_convert(ctx, conn,
5900                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5901                                  directory,
5902                                  0,
5903                                  NULL,
5904                                  &smb_dname);
5905         if (!NT_STATUS_IS_OK(status)) {
5906                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5907                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5908                                         ERRSRV, ERRbadpath);
5909                         goto out;
5910                 }
5911                 reply_nterror(req, status);
5912                 goto out;
5913         }
5914
5915         if (is_ntfs_stream_smb_fname(smb_dname)) {
5916                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5917                 goto out;
5918         }
5919
5920         status = SMB_VFS_CREATE_FILE(
5921                 conn,                                   /* conn */
5922                 req,                                    /* req */
5923                 0,                                      /* root_dir_fid */
5924                 smb_dname,                              /* fname */
5925                 DELETE_ACCESS,                          /* access_mask */
5926                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5927                         FILE_SHARE_DELETE),
5928                 FILE_OPEN,                              /* create_disposition*/
5929                 FILE_DIRECTORY_FILE,                    /* create_options */
5930                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5931                 0,                                      /* oplock_request */
5932                 0,                                      /* allocation_size */
5933                 0,                                      /* private_flags */
5934                 NULL,                                   /* sd */
5935                 NULL,                                   /* ea_list */
5936                 &fsp,                                   /* result */
5937                 &info);                                 /* pinfo */
5938
5939         if (!NT_STATUS_IS_OK(status)) {
5940                 if (open_was_deferred(req->sconn, req->mid)) {
5941                         /* We have re-scheduled this call. */
5942                         goto out;
5943                 }
5944                 reply_nterror(req, status);
5945                 goto out;
5946         }
5947
5948         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5949         if (!NT_STATUS_IS_OK(status)) {
5950                 close_file(req, fsp, ERROR_CLOSE);
5951                 reply_nterror(req, status);
5952                 goto out;
5953         }
5954
5955         if (!set_delete_on_close(fsp, true,
5956                         conn->session_info->security_token,
5957                         conn->session_info->unix_token)) {
5958                 close_file(req, fsp, ERROR_CLOSE);
5959                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5960                 goto out;
5961         }
5962
5963         status = close_file(req, fsp, NORMAL_CLOSE);
5964         if (!NT_STATUS_IS_OK(status)) {
5965                 reply_nterror(req, status);
5966         } else {
5967                 reply_outbuf(req, 0, 0);
5968         }
5969
5970         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5971
5972         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5973  out:
5974         TALLOC_FREE(smb_dname);
5975         END_PROFILE(SMBrmdir);
5976         return;
5977 }
5978
5979 /*******************************************************************
5980  Resolve wildcards in a filename rename.
5981 ********************************************************************/
5982
5983 static bool resolve_wildcards(TALLOC_CTX *ctx,
5984                                 const char *name1,
5985                                 const char *name2,
5986                                 char **pp_newname)
5987 {
5988         char *name2_copy = NULL;
5989         char *root1 = NULL;
5990         char *root2 = NULL;
5991         char *ext1 = NULL;
5992         char *ext2 = NULL;
5993         char *p,*p2, *pname1, *pname2;
5994
5995         name2_copy = talloc_strdup(ctx, name2);
5996         if (!name2_copy) {
5997                 return False;
5998         }
5999
6000         pname1 = strrchr_m(name1,'/');
6001         pname2 = strrchr_m(name2_copy,'/');
6002
6003         if (!pname1 || !pname2) {
6004                 return False;
6005         }
6006
6007         /* Truncate the copy of name2 at the last '/' */
6008         *pname2 = '\0';
6009
6010         /* Now go past the '/' */
6011         pname1++;
6012         pname2++;
6013
6014         root1 = talloc_strdup(ctx, pname1);
6015         root2 = talloc_strdup(ctx, pname2);
6016
6017         if (!root1 || !root2) {
6018                 return False;
6019         }
6020
6021         p = strrchr_m(root1,'.');
6022         if (p) {
6023                 *p = 0;
6024                 ext1 = talloc_strdup(ctx, p+1);
6025         } else {
6026                 ext1 = talloc_strdup(ctx, "");
6027         }
6028         p = strrchr_m(root2,'.');
6029         if (p) {
6030                 *p = 0;
6031                 ext2 = talloc_strdup(ctx, p+1);
6032         } else {
6033                 ext2 = talloc_strdup(ctx, "");
6034         }
6035
6036         if (!ext1 || !ext2) {
6037                 return False;
6038         }
6039
6040         p = root1;
6041         p2 = root2;
6042         while (*p2) {
6043                 if (*p2 == '?') {
6044                         /* Hmmm. Should this be mb-aware ? */
6045                         *p2 = *p;
6046                         p2++;
6047                 } else if (*p2 == '*') {
6048                         *p2 = '\0';
6049                         root2 = talloc_asprintf(ctx, "%s%s",
6050                                                 root2,
6051                                                 p);
6052                         if (!root2) {
6053                                 return False;
6054                         }
6055                         break;
6056                 } else {
6057                         p2++;
6058                 }
6059                 if (*p) {
6060                         p++;
6061                 }
6062         }
6063
6064         p = ext1;
6065         p2 = ext2;
6066         while (*p2) {
6067                 if (*p2 == '?') {
6068                         /* Hmmm. Should this be mb-aware ? */
6069                         *p2 = *p;
6070                         p2++;
6071                 } else if (*p2 == '*') {
6072                         *p2 = '\0';
6073                         ext2 = talloc_asprintf(ctx, "%s%s",
6074                                                 ext2,
6075                                                 p);
6076                         if (!ext2) {
6077                                 return False;
6078                         }
6079                         break;
6080                 } else {
6081                         p2++;
6082                 }
6083                 if (*p) {
6084                         p++;
6085                 }
6086         }
6087
6088         if (*ext2) {
6089                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6090                                 name2_copy,
6091                                 root2,
6092                                 ext2);
6093         } else {
6094                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6095                                 name2_copy,
6096                                 root2);
6097         }
6098
6099         if (!*pp_newname) {
6100                 return False;
6101         }
6102
6103         return True;
6104 }
6105
6106 /****************************************************************************
6107  Ensure open files have their names updated. Updated to notify other smbd's
6108  asynchronously.
6109 ****************************************************************************/
6110
6111 static void rename_open_files(connection_struct *conn,
6112                               struct share_mode_lock *lck,
6113                               uint32_t orig_name_hash,
6114                               const struct smb_filename *smb_fname_dst)
6115 {
6116         files_struct *fsp;
6117         bool did_rename = False;
6118         NTSTATUS status;
6119         uint32_t new_name_hash = 0;
6120
6121         for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
6122             fsp = file_find_di_next(fsp)) {
6123                 /* fsp_name is a relative path under the fsp. To change this for other
6124                    sharepaths we need to manipulate relative paths. */
6125                 /* TODO - create the absolute path and manipulate the newname
6126                    relative to the sharepath. */
6127                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6128                         continue;
6129                 }
6130                 if (fsp->name_hash != orig_name_hash) {
6131                         continue;
6132                 }
6133                 DEBUG(10, ("rename_open_files: renaming file %s "
6134                            "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6135                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6136                            smb_fname_str_dbg(smb_fname_dst)));
6137
6138                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6139                 if (NT_STATUS_IS_OK(status)) {
6140                         did_rename = True;
6141                         new_name_hash = fsp->name_hash;
6142                 }
6143         }
6144
6145         if (!did_rename) {
6146                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6147                            "for %s\n", file_id_string_tos(&lck->data->id),
6148                            smb_fname_str_dbg(smb_fname_dst)));
6149         }
6150
6151         /* Send messages to all smbd's (not ourself) that the name has changed. */
6152         rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
6153                               orig_name_hash, new_name_hash,
6154                               smb_fname_dst);
6155
6156 }
6157
6158 /****************************************************************************
6159  We need to check if the source path is a parent directory of the destination
6160  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6161  refuse the rename with a sharing violation. Under UNIX the above call can
6162  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6163  probably need to check that the client is a Windows one before disallowing
6164  this as a UNIX client (one with UNIX extensions) can know the source is a
6165  symlink and make this decision intelligently. Found by an excellent bug
6166  report from <AndyLiebman@aol.com>.
6167 ****************************************************************************/
6168
6169 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6170                                      const struct smb_filename *smb_fname_dst)
6171 {
6172         const char *psrc = smb_fname_src->base_name;
6173         const char *pdst = smb_fname_dst->base_name;
6174         size_t slen;
6175
6176         if (psrc[0] == '.' && psrc[1] == '/') {
6177                 psrc += 2;
6178         }
6179         if (pdst[0] == '.' && pdst[1] == '/') {
6180                 pdst += 2;
6181         }
6182         if ((slen = strlen(psrc)) > strlen(pdst)) {
6183                 return False;
6184         }
6185         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6186 }
6187
6188 /*
6189  * Do the notify calls from a rename
6190  */
6191
6192 static void notify_rename(connection_struct *conn, bool is_dir,
6193                           const struct smb_filename *smb_fname_src,
6194                           const struct smb_filename *smb_fname_dst)
6195 {
6196         char *parent_dir_src = NULL;
6197         char *parent_dir_dst = NULL;
6198         uint32 mask;
6199
6200         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6201                 : FILE_NOTIFY_CHANGE_FILE_NAME;
6202
6203         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6204                             &parent_dir_src, NULL) ||
6205             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6206                             &parent_dir_dst, NULL)) {
6207                 goto out;
6208         }
6209
6210         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6211                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6212                              smb_fname_src->base_name);
6213                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6214                              smb_fname_dst->base_name);
6215         }
6216         else {
6217                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6218                              smb_fname_src->base_name);
6219                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6220                              smb_fname_dst->base_name);
6221         }
6222
6223         /* this is a strange one. w2k3 gives an additional event for
6224            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6225            files, but not directories */
6226         if (!is_dir) {
6227                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6228                              FILE_NOTIFY_CHANGE_ATTRIBUTES
6229                              |FILE_NOTIFY_CHANGE_CREATION,
6230                              smb_fname_dst->base_name);
6231         }
6232  out:
6233         TALLOC_FREE(parent_dir_src);
6234         TALLOC_FREE(parent_dir_dst);
6235 }
6236
6237 /****************************************************************************
6238  Returns an error if the parent directory for a filename is open in an
6239  incompatible way.
6240 ****************************************************************************/
6241
6242 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6243                                         const struct smb_filename *smb_fname_dst_in)
6244 {
6245         char *parent_dir = NULL;
6246         struct smb_filename smb_fname_parent;
6247         struct file_id id;
6248         files_struct *fsp = NULL;
6249         int ret;
6250
6251         if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6252                         &parent_dir, NULL)) {
6253                 return NT_STATUS_NO_MEMORY;
6254         }
6255         ZERO_STRUCT(smb_fname_parent);
6256         smb_fname_parent.base_name = parent_dir;
6257
6258         ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6259         if (ret == -1) {
6260                 return map_nt_error_from_unix(errno);
6261         }
6262
6263         /*
6264          * We're only checking on this smbd here, mostly good
6265          * enough.. and will pass tests.
6266          */
6267
6268         id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6269         for (fsp = file_find_di_first(conn->sconn, id); fsp;
6270                         fsp = file_find_di_next(fsp)) {
6271                 if (fsp->access_mask & DELETE_ACCESS) {
6272                         return NT_STATUS_SHARING_VIOLATION;
6273                 }
6274         }
6275         return NT_STATUS_OK;
6276 }
6277
6278 /****************************************************************************
6279  Rename an open file - given an fsp.
6280 ****************************************************************************/
6281
6282 NTSTATUS rename_internals_fsp(connection_struct *conn,
6283                         files_struct *fsp,
6284                         const struct smb_filename *smb_fname_dst_in,
6285                         uint32 attrs,
6286                         bool replace_if_exists)
6287 {
6288         TALLOC_CTX *ctx = talloc_tos();
6289         struct smb_filename *smb_fname_dst = NULL;
6290         NTSTATUS status = NT_STATUS_OK;
6291         struct share_mode_lock *lck = NULL;
6292         bool dst_exists, old_is_stream, new_is_stream;
6293
6294         status = check_name(conn, smb_fname_dst_in->base_name);
6295         if (!NT_STATUS_IS_OK(status)) {
6296                 return status;
6297         }
6298
6299         status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6300         if (!NT_STATUS_IS_OK(status)) {
6301                 return status;
6302         }
6303
6304         /* Make a copy of the dst smb_fname structs */
6305
6306         smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6307         if (smb_fname_dst == NULL) {
6308                 status = NT_STATUS_NO_MEMORY;
6309                 goto out;
6310         }
6311
6312         /*
6313          * Check for special case with case preserving and not
6314          * case sensitive. If the old last component differs from the original
6315          * last component only by case, then we should allow
6316          * the rename (user is trying to change the case of the
6317          * filename).
6318          */
6319         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6320             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6321             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6322                 char *last_slash;
6323                 char *fname_dst_lcomp_base_mod = NULL;
6324                 struct smb_filename *smb_fname_orig_lcomp = NULL;
6325
6326                 /*
6327                  * Get the last component of the destination name.
6328                  */
6329                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6330                 if (last_slash) {
6331                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6332                 } else {
6333                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6334                 }
6335                 if (!fname_dst_lcomp_base_mod) {
6336                         status = NT_STATUS_NO_MEMORY;
6337                         goto out;
6338                 }
6339
6340                 /*
6341                  * Create an smb_filename struct using the original last
6342                  * component of the destination.
6343                  */
6344                 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6345                         ctx, smb_fname_dst->original_lcomp, NULL);
6346                 if (smb_fname_orig_lcomp == NULL) {
6347                         status = NT_STATUS_NO_MEMORY;
6348                         TALLOC_FREE(fname_dst_lcomp_base_mod);
6349                         goto out;
6350                 }
6351
6352                 /* If the base names only differ by case, use original. */
6353                 if(!strcsequal(fname_dst_lcomp_base_mod,
6354                                smb_fname_orig_lcomp->base_name)) {
6355                         char *tmp;
6356                         /*
6357                          * Replace the modified last component with the
6358                          * original.
6359                          */
6360                         if (last_slash) {
6361                                 *last_slash = '\0'; /* Truncate at the '/' */
6362                                 tmp = talloc_asprintf(smb_fname_dst,
6363                                         "%s/%s",
6364                                         smb_fname_dst->base_name,
6365                                         smb_fname_orig_lcomp->base_name);
6366                         } else {
6367                                 tmp = talloc_asprintf(smb_fname_dst,
6368                                         "%s",
6369                                         smb_fname_orig_lcomp->base_name);
6370                         }
6371                         if (tmp == NULL) {
6372                                 status = NT_STATUS_NO_MEMORY;
6373                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6374                                 TALLOC_FREE(smb_fname_orig_lcomp);
6375                                 goto out;
6376                         }
6377                         TALLOC_FREE(smb_fname_dst->base_name);
6378                         smb_fname_dst->base_name = tmp;
6379                 }
6380
6381                 /* If the stream_names only differ by case, use original. */
6382                 if(!strcsequal(smb_fname_dst->stream_name,
6383                                smb_fname_orig_lcomp->stream_name)) {
6384                         char *tmp = NULL;
6385                         /* Use the original stream. */
6386                         tmp = talloc_strdup(smb_fname_dst,
6387                                             smb_fname_orig_lcomp->stream_name);
6388                         if (tmp == NULL) {
6389                                 status = NT_STATUS_NO_MEMORY;
6390                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6391                                 TALLOC_FREE(smb_fname_orig_lcomp);
6392                                 goto out;
6393                         }
6394                         TALLOC_FREE(smb_fname_dst->stream_name);
6395                         smb_fname_dst->stream_name = tmp;
6396                 }
6397                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6398                 TALLOC_FREE(smb_fname_orig_lcomp);
6399         }
6400
6401         /*
6402          * If the src and dest names are identical - including case,
6403          * don't do the rename, just return success.
6404          */
6405
6406         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6407             strcsequal(fsp->fsp_name->stream_name,
6408                        smb_fname_dst->stream_name)) {
6409                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6410                           "- returning success\n",
6411                           smb_fname_str_dbg(smb_fname_dst)));
6412                 status = NT_STATUS_OK;
6413                 goto out;
6414         }
6415
6416         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6417         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6418
6419         /* Return the correct error code if both names aren't streams. */
6420         if (!old_is_stream && new_is_stream) {
6421                 status = NT_STATUS_OBJECT_NAME_INVALID;
6422                 goto out;
6423         }
6424
6425         if (old_is_stream && !new_is_stream) {
6426                 status = NT_STATUS_INVALID_PARAMETER;
6427                 goto out;
6428         }
6429
6430         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6431
6432         if(!replace_if_exists && dst_exists) {
6433                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6434                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6435                           smb_fname_str_dbg(smb_fname_dst)));
6436                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6437                 goto out;
6438         }
6439
6440         if (dst_exists) {
6441                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6442                     &smb_fname_dst->st);
6443                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6444                                                            fileid);
6445                 /* The file can be open when renaming a stream */
6446                 if (dst_fsp && !new_is_stream) {
6447                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6448                         status = NT_STATUS_ACCESS_DENIED;
6449                         goto out;
6450                 }
6451         }
6452
6453         /* Ensure we have a valid stat struct for the source. */
6454         status = vfs_stat_fsp(fsp);
6455         if (!NT_STATUS_IS_OK(status)) {
6456                 goto out;
6457         }
6458
6459         status = can_rename(conn, fsp, attrs);
6460
6461         if (!NT_STATUS_IS_OK(status)) {
6462                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6463                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6464                           smb_fname_str_dbg(smb_fname_dst)));
6465                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6466                         status = NT_STATUS_ACCESS_DENIED;
6467                 goto out;
6468         }
6469
6470         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6471                 status = NT_STATUS_ACCESS_DENIED;
6472         }
6473
6474         lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6475
6476         /*
6477          * We have the file open ourselves, so not being able to get the
6478          * corresponding share mode lock is a fatal error.
6479          */
6480
6481         SMB_ASSERT(lck != NULL);
6482
6483         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6484                 uint32 create_options = fsp->fh->private_options;
6485
6486                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6487                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6488                           smb_fname_str_dbg(smb_fname_dst)));
6489
6490                 if (!fsp->is_directory &&
6491                     !lp_posix_pathnames() &&
6492                     (lp_map_archive(SNUM(conn)) ||
6493                     lp_store_dos_attributes(SNUM(conn)))) {
6494                         /* We must set the archive bit on the newly
6495                            renamed file. */
6496                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6497                                 uint32_t old_dosmode = dos_mode(conn,
6498                                                         smb_fname_dst);
6499                                 file_set_dosmode(conn,
6500                                         smb_fname_dst,
6501                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6502                                         NULL,
6503                                         true);
6504                         }
6505                 }
6506
6507                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6508                               smb_fname_dst);
6509
6510                 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6511
6512                 /*
6513                  * A rename acts as a new file create w.r.t. allowing an initial delete
6514                  * on close, probably because in Windows there is a new handle to the
6515                  * new file. If initial delete on close was requested but not
6516                  * originally set, we need to set it here. This is probably not 100% correct,
6517                  * but will work for the CIFSFS client which in non-posix mode
6518                  * depends on these semantics. JRA.
6519                  */
6520
6521                 if (create_options & FILE_DELETE_ON_CLOSE) {
6522                         status = can_set_delete_on_close(fsp, 0);
6523
6524                         if (NT_STATUS_IS_OK(status)) {
6525                                 /* Note that here we set the *inital* delete on close flag,
6526                                  * not the regular one. The magic gets handled in close. */
6527                                 fsp->initial_delete_on_close = True;
6528                         }
6529                 }
6530                 TALLOC_FREE(lck);
6531                 status = NT_STATUS_OK;
6532                 goto out;
6533         }
6534
6535         TALLOC_FREE(lck);
6536
6537         if (errno == ENOTDIR || errno == EISDIR) {
6538                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6539         } else {
6540                 status = map_nt_error_from_unix(errno);
6541         }
6542
6543         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6544                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6545                   smb_fname_str_dbg(smb_fname_dst)));
6546
6547  out:
6548         TALLOC_FREE(smb_fname_dst);
6549
6550         return status;
6551 }
6552
6553 /****************************************************************************
6554  The guts of the rename command, split out so it may be called by the NT SMB
6555  code.
6556 ****************************************************************************/
6557
6558 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6559                         connection_struct *conn,
6560                         struct smb_request *req,
6561                         struct smb_filename *smb_fname_src,
6562                         struct smb_filename *smb_fname_dst,
6563                         uint32 attrs,
6564                         bool replace_if_exists,
6565                         bool src_has_wild,
6566                         bool dest_has_wild,
6567                         uint32_t access_mask)
6568 {
6569         char *fname_src_dir = NULL;
6570         char *fname_src_mask = NULL;
6571         int count=0;
6572         NTSTATUS status = NT_STATUS_OK;
6573         struct smb_Dir *dir_hnd = NULL;
6574         const char *dname = NULL;
6575         char *talloced = NULL;
6576         long offset = 0;
6577         int create_options = 0;
6578         bool posix_pathnames = lp_posix_pathnames();
6579         int rc;
6580
6581         /*
6582          * Split the old name into directory and last component
6583          * strings. Note that unix_convert may have stripped off a
6584          * leading ./ from both name and newname if the rename is
6585          * at the root of the share. We need to make sure either both
6586          * name and newname contain a / character or neither of them do
6587          * as this is checked in resolve_wildcards().
6588          */
6589
6590         /* Split up the directory from the filename/mask. */
6591         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6592                                       &fname_src_dir, &fname_src_mask);
6593         if (!NT_STATUS_IS_OK(status)) {
6594                 status = NT_STATUS_NO_MEMORY;
6595                 goto out;
6596         }
6597
6598         /*
6599          * We should only check the mangled cache
6600          * here if unix_convert failed. This means
6601          * that the path in 'mask' doesn't exist
6602          * on the file system and so we need to look
6603          * for a possible mangle. This patch from
6604          * Tine Smukavec <valentin.smukavec@hermes.si>.
6605          */
6606
6607         if (!VALID_STAT(smb_fname_src->st) &&
6608             mangle_is_mangled(fname_src_mask, conn->params)) {
6609                 char *new_mask = NULL;
6610                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6611                                             conn->params);
6612                 if (new_mask) {
6613                         TALLOC_FREE(fname_src_mask);
6614                         fname_src_mask = new_mask;
6615                 }
6616         }
6617
6618         if (!src_has_wild) {
6619                 files_struct *fsp;
6620
6621                 /*
6622                  * Only one file needs to be renamed. Append the mask back
6623                  * onto the directory.
6624                  */
6625                 TALLOC_FREE(smb_fname_src->base_name);
6626                 if (ISDOT(fname_src_dir)) {
6627                         /* Ensure we use canonical names on open. */
6628                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6629                                                         "%s",
6630                                                         fname_src_mask);
6631                 } else {
6632                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6633                                                         "%s/%s",
6634                                                         fname_src_dir,
6635                                                         fname_src_mask);
6636                 }
6637                 if (!smb_fname_src->base_name) {
6638                         status = NT_STATUS_NO_MEMORY;
6639                         goto out;
6640                 }
6641
6642                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6643                           "case_preserve = %d, short case preserve = %d, "
6644                           "directory = %s, newname = %s, "
6645                           "last_component_dest = %s\n",
6646                           conn->case_sensitive, conn->case_preserve,
6647                           conn->short_case_preserve,
6648                           smb_fname_str_dbg(smb_fname_src),
6649                           smb_fname_str_dbg(smb_fname_dst),
6650                           smb_fname_dst->original_lcomp));
6651
6652                 /* The dest name still may have wildcards. */
6653                 if (dest_has_wild) {
6654                         char *fname_dst_mod = NULL;
6655                         if (!resolve_wildcards(smb_fname_dst,
6656                                                smb_fname_src->base_name,
6657                                                smb_fname_dst->base_name,
6658                                                &fname_dst_mod)) {
6659                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6660                                           "%s %s failed\n",
6661                                           smb_fname_src->base_name,
6662                                           smb_fname_dst->base_name));
6663                                 status = NT_STATUS_NO_MEMORY;
6664                                 goto out;
6665                         }
6666                         TALLOC_FREE(smb_fname_dst->base_name);
6667                         smb_fname_dst->base_name = fname_dst_mod;
6668                 }
6669
6670                 ZERO_STRUCT(smb_fname_src->st);
6671                 if (posix_pathnames) {
6672                         rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6673                 } else {
6674                         rc = SMB_VFS_STAT(conn, smb_fname_src);
6675                 }
6676                 if (rc == -1) {
6677                         status = map_nt_error_from_unix_common(errno);
6678                         goto out;
6679                 }
6680
6681                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6682                         create_options |= FILE_DIRECTORY_FILE;
6683                 }
6684
6685                 status = SMB_VFS_CREATE_FILE(
6686                         conn,                           /* conn */
6687                         req,                            /* req */
6688                         0,                              /* root_dir_fid */
6689                         smb_fname_src,                  /* fname */
6690                         access_mask,                    /* access_mask */
6691                         (FILE_SHARE_READ |              /* share_access */
6692                             FILE_SHARE_WRITE),
6693                         FILE_OPEN,                      /* create_disposition*/
6694                         create_options,                 /* create_options */
6695                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6696                         0,                              /* oplock_request */
6697                         0,                              /* allocation_size */
6698                         0,                              /* private_flags */
6699                         NULL,                           /* sd */
6700                         NULL,                           /* ea_list */
6701                         &fsp,                           /* result */
6702                         NULL);                          /* pinfo */
6703
6704                 if (!NT_STATUS_IS_OK(status)) {
6705                         DEBUG(3, ("Could not open rename source %s: %s\n",
6706                                   smb_fname_str_dbg(smb_fname_src),
6707                                   nt_errstr(status)));
6708                         goto out;
6709                 }
6710
6711                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6712                                               attrs, replace_if_exists);
6713
6714                 close_file(req, fsp, NORMAL_CLOSE);
6715
6716                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6717                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6718                           smb_fname_str_dbg(smb_fname_dst)));
6719
6720                 goto out;
6721         }
6722
6723         /*
6724          * Wildcards - process each file that matches.
6725          */
6726         if (strequal(fname_src_mask, "????????.???")) {
6727                 TALLOC_FREE(fname_src_mask);
6728                 fname_src_mask = talloc_strdup(ctx, "*");
6729                 if (!fname_src_mask) {
6730                         status = NT_STATUS_NO_MEMORY;
6731                         goto out;
6732                 }
6733         }
6734
6735         status = check_name(conn, fname_src_dir);
6736         if (!NT_STATUS_IS_OK(status)) {
6737                 goto out;
6738         }
6739
6740         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6741                           attrs);
6742         if (dir_hnd == NULL) {
6743                 status = map_nt_error_from_unix(errno);
6744                 goto out;
6745         }
6746
6747         status = NT_STATUS_NO_SUCH_FILE;
6748         /*
6749          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6750          * - gentest fix. JRA
6751          */
6752
6753         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6754                                     &talloced))) {
6755                 files_struct *fsp = NULL;
6756                 char *destname = NULL;
6757                 bool sysdir_entry = False;
6758
6759                 /* Quick check for "." and ".." */
6760                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6761                         if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6762                                 sysdir_entry = True;
6763                         } else {
6764                                 TALLOC_FREE(talloced);
6765                                 continue;
6766                         }
6767                 }
6768
6769                 if (!is_visible_file(conn, fname_src_dir, dname,
6770                                      &smb_fname_src->st, false)) {
6771                         TALLOC_FREE(talloced);
6772                         continue;
6773                 }
6774
6775                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6776                         TALLOC_FREE(talloced);
6777                         continue;
6778                 }
6779
6780                 if (sysdir_entry) {
6781                         status = NT_STATUS_OBJECT_NAME_INVALID;
6782                         break;
6783                 }
6784
6785                 TALLOC_FREE(smb_fname_src->base_name);
6786                 if (ISDOT(fname_src_dir)) {
6787                         /* Ensure we use canonical names on open. */
6788                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6789                                                         "%s",
6790                                                         dname);
6791                 } else {
6792                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6793                                                         "%s/%s",
6794                                                         fname_src_dir,
6795                                                         dname);
6796                 }
6797                 if (!smb_fname_src->base_name) {
6798                         status = NT_STATUS_NO_MEMORY;
6799                         goto out;
6800                 }
6801
6802                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6803                                        smb_fname_dst->base_name,
6804                                        &destname)) {
6805                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6806                                   smb_fname_src->base_name, destname));
6807                         TALLOC_FREE(talloced);
6808                         continue;
6809                 }
6810                 if (!destname) {
6811                         status = NT_STATUS_NO_MEMORY;
6812                         goto out;
6813                 }
6814
6815                 TALLOC_FREE(smb_fname_dst->base_name);
6816                 smb_fname_dst->base_name = destname;
6817
6818                 ZERO_STRUCT(smb_fname_src->st);
6819                 if (posix_pathnames) {
6820                         SMB_VFS_LSTAT(conn, smb_fname_src);
6821                 } else {
6822                         SMB_VFS_STAT(conn, smb_fname_src);
6823                 }
6824
6825                 create_options = 0;
6826
6827                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6828                         create_options |= FILE_DIRECTORY_FILE;
6829                 }
6830
6831                 status = SMB_VFS_CREATE_FILE(
6832                         conn,                           /* conn */
6833                         req,                            /* req */
6834                         0,                              /* root_dir_fid */
6835                         smb_fname_src,                  /* fname */
6836                         access_mask,                    /* access_mask */
6837                         (FILE_SHARE_READ |              /* share_access */
6838                             FILE_SHARE_WRITE),
6839                         FILE_OPEN,                      /* create_disposition*/
6840                         create_options,                 /* create_options */
6841                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6842                         0,                              /* oplock_request */
6843                         0,                              /* allocation_size */
6844                         0,                              /* private_flags */
6845                         NULL,                           /* sd */
6846                         NULL,                           /* ea_list */
6847                         &fsp,                           /* result */
6848                         NULL);                          /* pinfo */
6849
6850                 if (!NT_STATUS_IS_OK(status)) {
6851                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6852                                  "returned %s rename %s -> %s\n",
6853                                  nt_errstr(status),
6854                                  smb_fname_str_dbg(smb_fname_src),
6855                                  smb_fname_str_dbg(smb_fname_dst)));
6856                         break;
6857                 }
6858
6859                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6860                                                               dname);
6861                 if (!smb_fname_dst->original_lcomp) {
6862                         status = NT_STATUS_NO_MEMORY;
6863                         goto out;
6864                 }
6865
6866                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6867                                               attrs, replace_if_exists);
6868
6869                 close_file(req, fsp, NORMAL_CLOSE);
6870
6871                 if (!NT_STATUS_IS_OK(status)) {
6872                         DEBUG(3, ("rename_internals_fsp returned %s for "
6873                                   "rename %s -> %s\n", nt_errstr(status),
6874                                   smb_fname_str_dbg(smb_fname_src),
6875                                   smb_fname_str_dbg(smb_fname_dst)));
6876                         break;
6877                 }
6878
6879                 count++;
6880
6881                 DEBUG(3,("rename_internals: doing rename on %s -> "
6882                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6883                          smb_fname_str_dbg(smb_fname_src)));
6884                 TALLOC_FREE(talloced);
6885         }
6886         TALLOC_FREE(dir_hnd);
6887
6888         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6889                 status = map_nt_error_from_unix(errno);
6890         }
6891
6892  out:
6893         TALLOC_FREE(talloced);
6894         TALLOC_FREE(fname_src_dir);
6895         TALLOC_FREE(fname_src_mask);
6896         return status;
6897 }
6898
6899 /****************************************************************************
6900  Reply to a mv.
6901 ****************************************************************************/
6902
6903 void reply_mv(struct smb_request *req)
6904 {
6905         connection_struct *conn = req->conn;
6906         char *name = NULL;
6907         char *newname = NULL;
6908         const char *p;
6909         uint32 attrs;
6910         NTSTATUS status;
6911         bool src_has_wcard = False;
6912         bool dest_has_wcard = False;
6913         TALLOC_CTX *ctx = talloc_tos();
6914         struct smb_filename *smb_fname_src = NULL;
6915         struct smb_filename *smb_fname_dst = NULL;
6916         uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6917         uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6918         bool stream_rename = false;
6919
6920         START_PROFILE(SMBmv);
6921
6922         if (req->wct < 1) {
6923                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6924                 goto out;
6925         }
6926
6927         attrs = SVAL(req->vwv+0, 0);
6928
6929         p = (const char *)req->buf + 1;
6930         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6931                                        &status, &src_has_wcard);
6932         if (!NT_STATUS_IS_OK(status)) {
6933                 reply_nterror(req, status);
6934                 goto out;
6935         }
6936         p++;
6937         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6938                                        &status, &dest_has_wcard);
6939         if (!NT_STATUS_IS_OK(status)) {
6940                 reply_nterror(req, status);
6941                 goto out;
6942         }
6943
6944         if (!lp_posix_pathnames()) {
6945                 /* The newname must begin with a ':' if the
6946                    name contains a ':'. */
6947                 if (strchr_m(name, ':')) {
6948                         if (newname[0] != ':') {
6949                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6950                                 goto out;
6951                         }
6952                         stream_rename = true;
6953                 }
6954         }
6955
6956         status = filename_convert(ctx,
6957                                   conn,
6958                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6959                                   name,
6960                                   src_ucf_flags,
6961                                   &src_has_wcard,
6962                                   &smb_fname_src);
6963
6964         if (!NT_STATUS_IS_OK(status)) {
6965                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6966                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6967                                         ERRSRV, ERRbadpath);
6968                         goto out;
6969                 }
6970                 reply_nterror(req, status);
6971                 goto out;
6972         }
6973
6974         status = filename_convert(ctx,
6975                                   conn,
6976                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6977                                   newname,
6978                                   dst_ucf_flags,
6979                                   &dest_has_wcard,
6980                                   &smb_fname_dst);
6981
6982         if (!NT_STATUS_IS_OK(status)) {
6983                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6984                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6985                                         ERRSRV, ERRbadpath);
6986                         goto out;
6987                 }
6988                 reply_nterror(req, status);
6989                 goto out;
6990         }
6991
6992         if (stream_rename) {
6993                 /* smb_fname_dst->base_name must be the same as
6994                    smb_fname_src->base_name. */
6995                 TALLOC_FREE(smb_fname_dst->base_name);
6996                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6997                                                 smb_fname_src->base_name);
6998                 if (!smb_fname_dst->base_name) {
6999                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7000                         goto out;
7001                 }
7002         }
7003
7004         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7005                  smb_fname_str_dbg(smb_fname_dst)));
7006
7007         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7008                                   attrs, False, src_has_wcard, dest_has_wcard,
7009                                   DELETE_ACCESS);
7010         if (!NT_STATUS_IS_OK(status)) {
7011                 if (open_was_deferred(req->sconn, req->mid)) {
7012                         /* We have re-scheduled this call. */
7013                         goto out;
7014                 }
7015                 reply_nterror(req, status);
7016                 goto out;
7017         }
7018
7019         reply_outbuf(req, 0, 0);
7020  out:
7021         TALLOC_FREE(smb_fname_src);
7022         TALLOC_FREE(smb_fname_dst);
7023         END_PROFILE(SMBmv);
7024         return;
7025 }
7026
7027 /*******************************************************************
7028  Copy a file as part of a reply_copy.
7029 ******************************************************************/
7030
7031 /*
7032  * TODO: check error codes on all callers
7033  */
7034
7035 NTSTATUS copy_file(TALLOC_CTX *ctx,
7036                         connection_struct *conn,
7037                         struct smb_filename *smb_fname_src,
7038                         struct smb_filename *smb_fname_dst,
7039                         int ofun,
7040                         int count,
7041                         bool target_is_directory)
7042 {
7043         struct smb_filename *smb_fname_dst_tmp = NULL;
7044         off_t ret=-1;
7045         files_struct *fsp1,*fsp2;
7046         uint32 dosattrs;
7047         uint32 new_create_disposition;
7048         NTSTATUS status;
7049
7050
7051         smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7052         if (smb_fname_dst_tmp == NULL) {
7053                 return NT_STATUS_NO_MEMORY;
7054         }
7055
7056         /*
7057          * If the target is a directory, extract the last component from the
7058          * src filename and append it to the dst filename
7059          */
7060         if (target_is_directory) {
7061                 const char *p;
7062
7063                 /* dest/target can't be a stream if it's a directory. */
7064                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7065
7066                 p = strrchr_m(smb_fname_src->base_name,'/');
7067                 if (p) {
7068                         p++;
7069                 } else {
7070                         p = smb_fname_src->base_name;
7071                 }
7072                 smb_fname_dst_tmp->base_name =
7073                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7074                                            p);
7075                 if (!smb_fname_dst_tmp->base_name) {
7076                         status = NT_STATUS_NO_MEMORY;
7077                         goto out;
7078                 }
7079         }
7080
7081         status = vfs_file_exist(conn, smb_fname_src);
7082         if (!NT_STATUS_IS_OK(status)) {
7083                 goto out;
7084         }
7085
7086         if (!target_is_directory && count) {
7087                 new_create_disposition = FILE_OPEN;
7088         } else {
7089                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7090                                                  0, ofun,
7091                                                  NULL, NULL,
7092                                                  &new_create_disposition,
7093                                                  NULL,
7094                                                  NULL)) {
7095                         status = NT_STATUS_INVALID_PARAMETER;
7096                         goto out;
7097                 }
7098         }
7099
7100         /* Open the src file for reading. */
7101         status = SMB_VFS_CREATE_FILE(
7102                 conn,                                   /* conn */
7103                 NULL,                                   /* req */
7104                 0,                                      /* root_dir_fid */
7105                 smb_fname_src,                          /* fname */
7106                 FILE_GENERIC_READ,                      /* access_mask */
7107                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7108                 FILE_OPEN,                              /* create_disposition*/
7109                 0,                                      /* create_options */
7110                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
7111                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7112                 0,                                      /* allocation_size */
7113                 0,                                      /* private_flags */
7114                 NULL,                                   /* sd */
7115                 NULL,                                   /* ea_list */
7116                 &fsp1,                                  /* result */
7117                 NULL);                                  /* psbuf */
7118
7119         if (!NT_STATUS_IS_OK(status)) {
7120                 goto out;
7121         }
7122
7123         dosattrs = dos_mode(conn, smb_fname_src);
7124
7125         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7126                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7127         }
7128
7129         /* Open the dst file for writing. */
7130         status = SMB_VFS_CREATE_FILE(
7131                 conn,                                   /* conn */
7132                 NULL,                                   /* req */
7133                 0,                                      /* root_dir_fid */
7134                 smb_fname_dst,                          /* fname */
7135                 FILE_GENERIC_WRITE,                     /* access_mask */
7136                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7137                 new_create_disposition,                 /* create_disposition*/
7138                 0,                                      /* create_options */
7139                 dosattrs,                               /* file_attributes */
7140                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7141                 0,                                      /* allocation_size */
7142                 0,                                      /* private_flags */
7143                 NULL,                                   /* sd */
7144                 NULL,                                   /* ea_list */
7145                 &fsp2,                                  /* result */
7146                 NULL);                                  /* psbuf */
7147
7148         if (!NT_STATUS_IS_OK(status)) {
7149                 close_file(NULL, fsp1, ERROR_CLOSE);
7150                 goto out;
7151         }
7152
7153         if (ofun & OPENX_FILE_EXISTS_OPEN) {
7154                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7155                 if (ret == -1) {
7156                         DEBUG(0, ("error - vfs lseek returned error %s\n",
7157                                 strerror(errno)));
7158                         status = map_nt_error_from_unix(errno);
7159                         close_file(NULL, fsp1, ERROR_CLOSE);
7160                         close_file(NULL, fsp2, ERROR_CLOSE);
7161                         goto out;
7162                 }
7163         }
7164
7165         /* Do the actual copy. */
7166         if (smb_fname_src->st.st_ex_size) {
7167                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7168         } else {
7169                 ret = 0;
7170         }
7171
7172         close_file(NULL, fsp1, NORMAL_CLOSE);
7173
7174         /* Ensure the modtime is set correctly on the destination file. */
7175         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7176
7177         /*
7178          * As we are opening fsp1 read-only we only expect
7179          * an error on close on fsp2 if we are out of space.
7180          * Thus we don't look at the error return from the
7181          * close of fsp1.
7182          */
7183         status = close_file(NULL, fsp2, NORMAL_CLOSE);
7184
7185         if (!NT_STATUS_IS_OK(status)) {
7186                 goto out;
7187         }
7188
7189         if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7190                 status = NT_STATUS_DISK_FULL;
7191                 goto out;
7192         }
7193
7194         status = NT_STATUS_OK;
7195
7196  out:
7197         TALLOC_FREE(smb_fname_dst_tmp);
7198         return status;
7199 }
7200
7201 /****************************************************************************
7202  Reply to a file copy.
7203 ****************************************************************************/
7204
7205 void reply_copy(struct smb_request *req)
7206 {
7207         connection_struct *conn = req->conn;
7208         struct smb_filename *smb_fname_src = NULL;
7209         struct smb_filename *smb_fname_dst = NULL;
7210         char *fname_src = NULL;
7211         char *fname_dst = NULL;
7212         char *fname_src_mask = NULL;
7213         char *fname_src_dir = NULL;
7214         const char *p;
7215         int count=0;
7216         int error = ERRnoaccess;
7217         int tid2;
7218         int ofun;
7219         int flags;
7220         bool target_is_directory=False;
7221         bool source_has_wild = False;
7222         bool dest_has_wild = False;
7223         NTSTATUS status;
7224         TALLOC_CTX *ctx = talloc_tos();
7225
7226         START_PROFILE(SMBcopy);
7227
7228         if (req->wct < 3) {
7229                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7230                 goto out;
7231         }
7232
7233         tid2 = SVAL(req->vwv+0, 0);
7234         ofun = SVAL(req->vwv+1, 0);
7235         flags = SVAL(req->vwv+2, 0);
7236
7237         p = (const char *)req->buf;
7238         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7239                                        &status, &source_has_wild);
7240         if (!NT_STATUS_IS_OK(status)) {
7241                 reply_nterror(req, status);
7242                 goto out;
7243         }
7244         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7245                                        &status, &dest_has_wild);
7246         if (!NT_STATUS_IS_OK(status)) {
7247                 reply_nterror(req, status);
7248                 goto out;
7249         }
7250
7251         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7252
7253         if (tid2 != conn->cnum) {
7254                 /* can't currently handle inter share copies XXXX */
7255                 DEBUG(3,("Rejecting inter-share copy\n"));
7256                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7257                 goto out;
7258         }
7259
7260         status = filename_convert(ctx, conn,
7261                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7262                                   fname_src,
7263                                   UCF_COND_ALLOW_WCARD_LCOMP,
7264                                   &source_has_wild,
7265                                   &smb_fname_src);
7266         if (!NT_STATUS_IS_OK(status)) {
7267                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7268                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7269                                         ERRSRV, ERRbadpath);
7270                         goto out;
7271                 }
7272                 reply_nterror(req, status);
7273                 goto out;
7274         }
7275
7276         status = filename_convert(ctx, conn,
7277                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7278                                   fname_dst,
7279                                   UCF_COND_ALLOW_WCARD_LCOMP,
7280                                   &dest_has_wild,
7281                                   &smb_fname_dst);
7282         if (!NT_STATUS_IS_OK(status)) {
7283                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7284                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7285                                         ERRSRV, ERRbadpath);
7286                         goto out;
7287                 }
7288                 reply_nterror(req, status);
7289                 goto out;
7290         }
7291
7292         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7293
7294         if ((flags&1) && target_is_directory) {
7295                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7296                 goto out;
7297         }
7298
7299         if ((flags&2) && !target_is_directory) {
7300                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7301                 goto out;
7302         }
7303
7304         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7305                 /* wants a tree copy! XXXX */
7306                 DEBUG(3,("Rejecting tree copy\n"));
7307                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7308                 goto out;
7309         }
7310
7311         /* Split up the directory from the filename/mask. */
7312         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7313                                       &fname_src_dir, &fname_src_mask);
7314         if (!NT_STATUS_IS_OK(status)) {
7315                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7316                 goto out;
7317         }
7318
7319         /*
7320          * We should only check the mangled cache
7321          * here if unix_convert failed. This means
7322          * that the path in 'mask' doesn't exist
7323          * on the file system and so we need to look
7324          * for a possible mangle. This patch from
7325          * Tine Smukavec <valentin.smukavec@hermes.si>.
7326          */
7327         if (!VALID_STAT(smb_fname_src->st) &&
7328             mangle_is_mangled(fname_src_mask, conn->params)) {
7329                 char *new_mask = NULL;
7330                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7331                                             &new_mask, conn->params);
7332
7333                 /* Use demangled name if one was successfully found. */
7334                 if (new_mask) {
7335                         TALLOC_FREE(fname_src_mask);
7336                         fname_src_mask = new_mask;
7337                 }
7338         }
7339
7340         if (!source_has_wild) {
7341
7342                 /*
7343                  * Only one file needs to be copied. Append the mask back onto
7344                  * the directory.
7345                  */
7346                 TALLOC_FREE(smb_fname_src->base_name);
7347                 if (ISDOT(fname_src_dir)) {
7348                         /* Ensure we use canonical names on open. */
7349                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7350                                                         "%s",
7351                                                         fname_src_mask);
7352                 } else {
7353                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7354                                                         "%s/%s",
7355                                                         fname_src_dir,
7356                                                         fname_src_mask);
7357                 }
7358                 if (!smb_fname_src->base_name) {
7359                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7360                         goto out;
7361                 }
7362
7363                 if (dest_has_wild) {
7364                         char *fname_dst_mod = NULL;
7365                         if (!resolve_wildcards(smb_fname_dst,
7366                                                smb_fname_src->base_name,
7367                                                smb_fname_dst->base_name,
7368                                                &fname_dst_mod)) {
7369                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7370                                 goto out;
7371                         }
7372                         TALLOC_FREE(smb_fname_dst->base_name);
7373                         smb_fname_dst->base_name = fname_dst_mod;
7374                 }
7375
7376                 status = check_name(conn, smb_fname_src->base_name);
7377                 if (!NT_STATUS_IS_OK(status)) {
7378                         reply_nterror(req, status);
7379                         goto out;
7380                 }
7381
7382                 status = check_name(conn, smb_fname_dst->base_name);
7383                 if (!NT_STATUS_IS_OK(status)) {
7384                         reply_nterror(req, status);
7385                         goto out;
7386                 }
7387
7388                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7389                                    ofun, count, target_is_directory);
7390
7391                 if(!NT_STATUS_IS_OK(status)) {
7392                         reply_nterror(req, status);
7393                         goto out;
7394                 } else {
7395                         count++;
7396                 }
7397         } else {
7398                 struct smb_Dir *dir_hnd = NULL;
7399                 const char *dname = NULL;
7400                 char *talloced = NULL;
7401                 long offset = 0;
7402
7403                 /*
7404                  * There is a wildcard that requires us to actually read the
7405                  * src dir and copy each file matching the mask to the dst.
7406                  * Right now streams won't be copied, but this could
7407                  * presumably be added with a nested loop for reach dir entry.
7408                  */
7409                 SMB_ASSERT(!smb_fname_src->stream_name);
7410                 SMB_ASSERT(!smb_fname_dst->stream_name);
7411
7412                 smb_fname_src->stream_name = NULL;
7413                 smb_fname_dst->stream_name = NULL;
7414
7415                 if (strequal(fname_src_mask,"????????.???")) {
7416                         TALLOC_FREE(fname_src_mask);
7417                         fname_src_mask = talloc_strdup(ctx, "*");
7418                         if (!fname_src_mask) {
7419                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7420                                 goto out;
7421                         }
7422                 }
7423
7424                 status = check_name(conn, fname_src_dir);
7425                 if (!NT_STATUS_IS_OK(status)) {
7426                         reply_nterror(req, status);
7427                         goto out;
7428                 }
7429
7430                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7431                 if (dir_hnd == NULL) {
7432                         status = map_nt_error_from_unix(errno);
7433                         reply_nterror(req, status);
7434                         goto out;
7435                 }
7436
7437                 error = ERRbadfile;
7438
7439                 /* Iterate over the src dir copying each entry to the dst. */
7440                 while ((dname = ReadDirName(dir_hnd, &offset,
7441                                             &smb_fname_src->st, &talloced))) {
7442                         char *destname = NULL;
7443
7444                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7445                                 TALLOC_FREE(talloced);
7446                                 continue;
7447                         }
7448
7449                         if (!is_visible_file(conn, fname_src_dir, dname,
7450                                              &smb_fname_src->st, false)) {
7451                                 TALLOC_FREE(talloced);
7452                                 continue;
7453                         }
7454
7455                         if(!mask_match(dname, fname_src_mask,
7456                                        conn->case_sensitive)) {
7457                                 TALLOC_FREE(talloced);
7458                                 continue;
7459                         }
7460
7461                         error = ERRnoaccess;
7462
7463                         /* Get the src smb_fname struct setup. */
7464                         TALLOC_FREE(smb_fname_src->base_name);
7465                         if (ISDOT(fname_src_dir)) {
7466                                 /* Ensure we use canonical names on open. */
7467                                 smb_fname_src->base_name =
7468                                         talloc_asprintf(smb_fname_src, "%s",
7469                                                 dname);
7470                         } else {
7471                                 smb_fname_src->base_name =
7472                                         talloc_asprintf(smb_fname_src, "%s/%s",
7473                                                 fname_src_dir, dname);
7474                         }
7475
7476                         if (!smb_fname_src->base_name) {
7477                                 TALLOC_FREE(dir_hnd);
7478                                 TALLOC_FREE(talloced);
7479                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7480                                 goto out;
7481                         }
7482
7483                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7484                                                smb_fname_dst->base_name,
7485                                                &destname)) {
7486                                 TALLOC_FREE(talloced);
7487                                 continue;
7488                         }
7489                         if (!destname) {
7490                                 TALLOC_FREE(dir_hnd);
7491                                 TALLOC_FREE(talloced);
7492                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7493                                 goto out;
7494                         }
7495
7496                         TALLOC_FREE(smb_fname_dst->base_name);
7497                         smb_fname_dst->base_name = destname;
7498
7499                         status = check_name(conn, smb_fname_src->base_name);
7500                         if (!NT_STATUS_IS_OK(status)) {
7501                                 TALLOC_FREE(dir_hnd);
7502                                 TALLOC_FREE(talloced);
7503                                 reply_nterror(req, status);
7504                                 goto out;
7505                         }
7506
7507                         status = check_name(conn, smb_fname_dst->base_name);
7508                         if (!NT_STATUS_IS_OK(status)) {
7509                                 TALLOC_FREE(dir_hnd);
7510                                 TALLOC_FREE(talloced);
7511                                 reply_nterror(req, status);
7512                                 goto out;
7513                         }
7514
7515                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7516                                 smb_fname_src->base_name,
7517                                 smb_fname_dst->base_name));
7518
7519                         status = copy_file(ctx, conn, smb_fname_src,
7520                                            smb_fname_dst, ofun, count,
7521                                            target_is_directory);
7522                         if (NT_STATUS_IS_OK(status)) {
7523                                 count++;
7524                         }
7525
7526                         TALLOC_FREE(talloced);
7527                 }
7528                 TALLOC_FREE(dir_hnd);
7529         }
7530
7531         if (count == 0) {
7532                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7533                 goto out;
7534         }
7535
7536         reply_outbuf(req, 1, 0);
7537         SSVAL(req->outbuf,smb_vwv0,count);
7538  out:
7539         TALLOC_FREE(smb_fname_src);
7540         TALLOC_FREE(smb_fname_dst);
7541         TALLOC_FREE(fname_src);
7542         TALLOC_FREE(fname_dst);
7543         TALLOC_FREE(fname_src_mask);
7544         TALLOC_FREE(fname_src_dir);
7545
7546         END_PROFILE(SMBcopy);
7547         return;
7548 }
7549
7550 #undef DBGC_CLASS
7551 #define DBGC_CLASS DBGC_LOCKING
7552
7553 /****************************************************************************
7554  Get a lock pid, dealing with large count requests.
7555 ****************************************************************************/
7556
7557 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7558                     bool large_file_format)
7559 {
7560         if(!large_file_format)
7561                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7562         else
7563                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7564 }
7565
7566 /****************************************************************************
7567  Get a lock count, dealing with large count requests.
7568 ****************************************************************************/
7569
7570 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7571                         bool large_file_format)
7572 {
7573         uint64_t count = 0;
7574
7575         if(!large_file_format) {
7576                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7577         } else {
7578
7579 #if defined(HAVE_LONGLONG)
7580                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7581                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7582 #else /* HAVE_LONGLONG */
7583
7584                 /*
7585                  * NT4.x seems to be broken in that it sends large file (64 bit)
7586                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7587                  * negotiated. For boxes without large unsigned ints truncate the
7588                  * lock count by dropping the top 32 bits.
7589                  */
7590
7591                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7592                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7593                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7594                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7595                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7596                 }
7597
7598                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7599 #endif /* HAVE_LONGLONG */
7600         }
7601
7602         return count;
7603 }
7604
7605 #if !defined(HAVE_LONGLONG)
7606 /****************************************************************************
7607  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7608 ****************************************************************************/
7609
7610 static uint32 map_lock_offset(uint32 high, uint32 low)
7611 {
7612         unsigned int i;
7613         uint32 mask = 0;
7614         uint32 highcopy = high;
7615
7616         /*
7617          * Try and find out how many significant bits there are in high.
7618          */
7619
7620         for(i = 0; highcopy; i++)
7621                 highcopy >>= 1;
7622
7623         /*
7624          * We use 31 bits not 32 here as POSIX
7625          * lock offsets may not be negative.
7626          */
7627
7628         mask = (~0) << (31 - i);
7629
7630         if(low & mask)
7631                 return 0; /* Fail. */
7632
7633         high <<= (31 - i);
7634
7635         return (high|low);
7636 }
7637 #endif /* !defined(HAVE_LONGLONG) */
7638
7639 /****************************************************************************
7640  Get a lock offset, dealing with large offset requests.
7641 ****************************************************************************/
7642
7643 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7644                          bool large_file_format, bool *err)
7645 {
7646         uint64_t offset = 0;
7647
7648         *err = False;
7649
7650         if(!large_file_format) {
7651                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7652         } else {
7653
7654 #if defined(HAVE_LONGLONG)
7655                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7656                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7657 #else /* HAVE_LONGLONG */
7658
7659                 /*
7660                  * NT4.x seems to be broken in that it sends large file (64 bit)
7661                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7662                  * negotiated. For boxes without large unsigned ints mangle the
7663                  * lock offset by mapping the top 32 bits onto the lower 32.
7664                  */
7665
7666                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7667                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7668                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7669                         uint32 new_low = 0;
7670
7671                         if((new_low = map_lock_offset(high, low)) == 0) {
7672                                 *err = True;
7673                                 return (uint64_t)-1;
7674                         }
7675
7676                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7677                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7678                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7679                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7680                 }
7681
7682                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7683 #endif /* HAVE_LONGLONG */
7684         }
7685
7686         return offset;
7687 }
7688
7689 NTSTATUS smbd_do_locking(struct smb_request *req,
7690                          files_struct *fsp,
7691                          uint8_t type,
7692                          int32_t timeout,
7693                          uint16_t num_ulocks,
7694                          struct smbd_lock_element *ulocks,
7695                          uint16_t num_locks,
7696                          struct smbd_lock_element *locks,
7697                          bool *async)
7698 {
7699         connection_struct *conn = req->conn;
7700         int i;
7701         NTSTATUS status = NT_STATUS_OK;
7702
7703         *async = false;
7704
7705         /* Data now points at the beginning of the list
7706            of smb_unlkrng structs */
7707         for(i = 0; i < (int)num_ulocks; i++) {
7708                 struct smbd_lock_element *e = &ulocks[i];
7709
7710                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7711                           "pid %u, file %s\n",
7712                           (double)e->offset,
7713                           (double)e->count,
7714                           (unsigned int)e->smblctx,
7715                           fsp_str_dbg(fsp)));
7716
7717                 if (e->brltype != UNLOCK_LOCK) {
7718                         /* this can only happen with SMB2 */
7719                         return NT_STATUS_INVALID_PARAMETER;
7720                 }
7721
7722                 status = do_unlock(req->sconn->msg_ctx,
7723                                 fsp,
7724                                 e->smblctx,
7725                                 e->count,
7726                                 e->offset,
7727                                 WINDOWS_LOCK);
7728
7729                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7730                     nt_errstr(status)));
7731
7732                 if (!NT_STATUS_IS_OK(status)) {
7733                         return status;
7734                 }
7735         }
7736
7737         /* Setup the timeout in seconds. */
7738
7739         if (!lp_blocking_locks(SNUM(conn))) {
7740                 timeout = 0;
7741         }
7742
7743         /* Data now points at the beginning of the list
7744            of smb_lkrng structs */
7745
7746         for(i = 0; i < (int)num_locks; i++) {
7747                 struct smbd_lock_element *e = &locks[i];
7748
7749                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7750                           "%llu, file %s timeout = %d\n",
7751                           (double)e->offset,
7752                           (double)e->count,
7753                           (unsigned long long)e->smblctx,
7754                           fsp_str_dbg(fsp),
7755                           (int)timeout));
7756
7757                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7758                         struct blocking_lock_record *blr = NULL;
7759
7760                         if (num_locks > 1) {
7761                                 /*
7762                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7763                                  * if the lock vector contains one entry. When given mutliple cancel
7764                                  * requests in a single PDU we expect the server to return an
7765                                  * error. Windows servers seem to accept the request but only
7766                                  * cancel the first lock.
7767                                  * JRA - Do what Windows does (tm) :-).
7768                                  */
7769
7770 #if 0
7771                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7772                                 return NT_STATUS_DOS(ERRDOS,
7773                                                 ERRcancelviolation);
7774 #else
7775                                 /* Windows behavior. */
7776                                 if (i != 0) {
7777                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7778                                                 "cancel request\n"));
7779                                         continue;
7780                                 }
7781 #endif
7782                         }
7783
7784                         if (lp_blocking_locks(SNUM(conn))) {
7785
7786                                 /* Schedule a message to ourselves to
7787                                    remove the blocking lock record and
7788                                    return the right error. */
7789
7790                                 blr = blocking_lock_cancel_smb1(fsp,
7791                                                 e->smblctx,
7792                                                 e->offset,
7793                                                 e->count,
7794                                                 WINDOWS_LOCK,
7795                                                 type,
7796                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7797                                 if (blr == NULL) {
7798                                         return NT_STATUS_DOS(
7799                                                         ERRDOS,
7800                                                         ERRcancelviolation);
7801                                 }
7802                         }
7803                         /* Remove a matching pending lock. */
7804                         status = do_lock_cancel(fsp,
7805                                                 e->smblctx,
7806                                                 e->count,
7807                                                 e->offset,
7808                                                 WINDOWS_LOCK,
7809                                                 blr);
7810                 } else {
7811                         bool blocking_lock = timeout ? true : false;
7812                         bool defer_lock = false;
7813                         struct byte_range_lock *br_lck;
7814                         uint64_t block_smblctx;
7815
7816                         br_lck = do_lock(req->sconn->msg_ctx,
7817                                         fsp,
7818                                         e->smblctx,
7819                                         e->count,
7820                                         e->offset,
7821                                         e->brltype,
7822                                         WINDOWS_LOCK,
7823                                         blocking_lock,
7824                                         &status,
7825                                         &block_smblctx,
7826                                         NULL);
7827
7828                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7829                                 /* Windows internal resolution for blocking locks seems
7830                                    to be about 200ms... Don't wait for less than that. JRA. */
7831                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7832                                         timeout = lp_lock_spin_time();
7833                                 }
7834                                 defer_lock = true;
7835                         }
7836
7837                         /* If a lock sent with timeout of zero would fail, and
7838                          * this lock has been requested multiple times,
7839                          * according to brl_lock_failed() we convert this
7840                          * request to a blocking lock with a timeout of between
7841                          * 150 - 300 milliseconds.
7842                          *
7843                          * If lp_lock_spin_time() has been set to 0, we skip
7844                          * this blocking retry and fail immediately.
7845                          *
7846                          * Replacement for do_lock_spin(). JRA. */
7847
7848                         if (!req->sconn->using_smb2 &&
7849                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7850                             lp_lock_spin_time() && !blocking_lock &&
7851                             NT_STATUS_EQUAL((status),
7852                                 NT_STATUS_FILE_LOCK_CONFLICT))
7853                         {
7854                                 defer_lock = true;
7855                                 timeout = lp_lock_spin_time();
7856                         }
7857
7858                         if (br_lck && defer_lock) {
7859                                 /*
7860                                  * A blocking lock was requested. Package up
7861                                  * this smb into a queued request and push it
7862                                  * onto the blocking lock queue.
7863                                  */
7864                                 if(push_blocking_lock_request(br_lck,
7865                                                         req,
7866                                                         fsp,
7867                                                         timeout,
7868                                                         i,
7869                                                         e->smblctx,
7870                                                         e->brltype,
7871                                                         WINDOWS_LOCK,
7872                                                         e->offset,
7873                                                         e->count,
7874                                                         block_smblctx)) {
7875                                         TALLOC_FREE(br_lck);
7876                                         *async = true;
7877                                         return NT_STATUS_OK;
7878                                 }
7879                         }
7880
7881                         TALLOC_FREE(br_lck);
7882                 }
7883
7884                 if (!NT_STATUS_IS_OK(status)) {
7885                         break;
7886                 }
7887         }
7888
7889         /* If any of the above locks failed, then we must unlock
7890            all of the previous locks (X/Open spec). */
7891
7892         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7893
7894                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7895                         i = -1; /* we want to skip the for loop */
7896                 }
7897
7898                 /*
7899                  * Ensure we don't do a remove on the lock that just failed,
7900                  * as under POSIX rules, if we have a lock already there, we
7901                  * will delete it (and we shouldn't) .....
7902                  */
7903                 for(i--; i >= 0; i--) {
7904                         struct smbd_lock_element *e = &locks[i];
7905
7906                         do_unlock(req->sconn->msg_ctx,
7907                                 fsp,
7908                                 e->smblctx,
7909                                 e->count,
7910                                 e->offset,
7911                                 WINDOWS_LOCK);
7912                 }
7913                 return status;
7914         }
7915
7916         DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
7917                   fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
7918
7919         return NT_STATUS_OK;
7920 }
7921
7922 /****************************************************************************
7923  Reply to a lockingX request.
7924 ****************************************************************************/
7925
7926 void reply_lockingX(struct smb_request *req)
7927 {
7928         connection_struct *conn = req->conn;
7929         files_struct *fsp;
7930         unsigned char locktype;
7931         unsigned char oplocklevel;
7932         uint16 num_ulocks;
7933         uint16 num_locks;
7934         int32 lock_timeout;
7935         int i;
7936         const uint8_t *data;
7937         bool large_file_format;
7938         bool err;
7939         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7940         struct smbd_lock_element *ulocks;
7941         struct smbd_lock_element *locks;
7942         bool async = false;
7943
7944         START_PROFILE(SMBlockingX);
7945
7946         if (req->wct < 8) {
7947                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7948                 END_PROFILE(SMBlockingX);
7949                 return;
7950         }
7951
7952         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7953         locktype = CVAL(req->vwv+3, 0);
7954         oplocklevel = CVAL(req->vwv+3, 1);
7955         num_ulocks = SVAL(req->vwv+6, 0);
7956         num_locks = SVAL(req->vwv+7, 0);
7957         lock_timeout = IVAL(req->vwv+4, 0);
7958         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7959
7960         if (!check_fsp(conn, req, fsp)) {
7961                 END_PROFILE(SMBlockingX);
7962                 return;
7963         }
7964
7965         data = req->buf;
7966
7967         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7968                 /* we don't support these - and CANCEL_LOCK makes w2k
7969                    and XP reboot so I don't really want to be
7970                    compatible! (tridge) */
7971                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7972                 END_PROFILE(SMBlockingX);
7973                 return;
7974         }
7975
7976         /* Check if this is an oplock break on a file
7977            we have granted an oplock on.
7978         */
7979         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7980                 /* Client can insist on breaking to none. */
7981                 bool break_to_none = (oplocklevel == 0);
7982                 bool result;
7983
7984                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7985                          "for %s\n", (unsigned int)oplocklevel,
7986                          fsp_fnum_dbg(fsp)));
7987
7988                 /*
7989                  * Make sure we have granted an exclusive or batch oplock on
7990                  * this file.
7991                  */
7992
7993                 if (fsp->oplock_type == 0) {
7994
7995                         /* The Samba4 nbench simulator doesn't understand
7996                            the difference between break to level2 and break
7997                            to none from level2 - it sends oplock break
7998                            replies in both cases. Don't keep logging an error
7999                            message here - just ignore it. JRA. */
8000
8001                         DEBUG(5,("reply_lockingX: Error : oplock break from "
8002                                  "client for %s (oplock=%d) and no "
8003                                  "oplock granted on this file (%s).\n",
8004                                  fsp_fnum_dbg(fsp), fsp->oplock_type,
8005                                  fsp_str_dbg(fsp)));
8006
8007                         /* if this is a pure oplock break request then don't
8008                          * send a reply */
8009                         if (num_locks == 0 && num_ulocks == 0) {
8010                                 END_PROFILE(SMBlockingX);
8011                                 return;
8012                         } else {
8013                                 END_PROFILE(SMBlockingX);
8014                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8015                                 return;
8016                         }
8017                 }
8018
8019                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8020                     (break_to_none)) {
8021                         result = remove_oplock(fsp);
8022                 } else {
8023                         result = downgrade_oplock(fsp);
8024                 }
8025
8026                 if (!result) {
8027                         DEBUG(0, ("reply_lockingX: error in removing "
8028                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
8029                         /* Hmmm. Is this panic justified? */
8030                         smb_panic("internal tdb error");
8031                 }
8032
8033                 /* if this is a pure oplock break request then don't send a
8034                  * reply */
8035                 if (num_locks == 0 && num_ulocks == 0) {
8036                         /* Sanity check - ensure a pure oplock break is not a
8037                            chained request. */
8038                         if(CVAL(req->vwv+0, 0) != 0xff)
8039                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
8040                                          "break is a chained %d request !\n",
8041                                          (unsigned int)CVAL(req->vwv+0, 0)));
8042                         END_PROFILE(SMBlockingX);
8043                         return;
8044                 }
8045         }
8046
8047         if (req->buflen <
8048             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8049                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8050                 END_PROFILE(SMBlockingX);
8051                 return;
8052         }
8053
8054         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8055         if (ulocks == NULL) {
8056                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8057                 END_PROFILE(SMBlockingX);
8058                 return;
8059         }
8060
8061         locks = talloc_array(req, struct smbd_lock_element, num_locks);
8062         if (locks == NULL) {
8063                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8064                 END_PROFILE(SMBlockingX);
8065                 return;
8066         }
8067
8068         /* Data now points at the beginning of the list
8069            of smb_unlkrng structs */
8070         for(i = 0; i < (int)num_ulocks; i++) {
8071                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8072                 ulocks[i].count = get_lock_count(data, i, large_file_format);
8073                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8074                 ulocks[i].brltype = UNLOCK_LOCK;
8075
8076                 /*
8077                  * There is no error code marked "stupid client bug".... :-).
8078                  */
8079                 if(err) {
8080                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8081                         END_PROFILE(SMBlockingX);
8082                         return;
8083                 }
8084         }
8085
8086         /* Now do any requested locks */
8087         data += ((large_file_format ? 20 : 10)*num_ulocks);
8088
8089         /* Data now points at the beginning of the list
8090            of smb_lkrng structs */
8091
8092         for(i = 0; i < (int)num_locks; i++) {
8093                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8094                 locks[i].count = get_lock_count(data, i, large_file_format);
8095                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8096
8097                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8098                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8099                                 locks[i].brltype = PENDING_READ_LOCK;
8100                         } else {
8101                                 locks[i].brltype = READ_LOCK;
8102                         }
8103                 } else {
8104                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8105                                 locks[i].brltype = PENDING_WRITE_LOCK;
8106                         } else {
8107                                 locks[i].brltype = WRITE_LOCK;
8108                         }
8109                 }
8110
8111                 /*
8112                  * There is no error code marked "stupid client bug".... :-).
8113                  */
8114                 if(err) {
8115                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8116                         END_PROFILE(SMBlockingX);
8117                         return;
8118                 }
8119         }
8120
8121         status = smbd_do_locking(req, fsp,
8122                                  locktype, lock_timeout,
8123                                  num_ulocks, ulocks,
8124                                  num_locks, locks,
8125                                  &async);
8126         if (!NT_STATUS_IS_OK(status)) {
8127                 END_PROFILE(SMBlockingX);
8128                 reply_nterror(req, status);
8129                 return;
8130         }
8131         if (async) {
8132                 END_PROFILE(SMBlockingX);
8133                 return;
8134         }
8135
8136         reply_outbuf(req, 2, 0);
8137         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8138         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
8139
8140         DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8141                   fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8142
8143         END_PROFILE(SMBlockingX);
8144 }
8145
8146 #undef DBGC_CLASS
8147 #define DBGC_CLASS DBGC_ALL
8148
8149 /****************************************************************************
8150  Reply to a SMBreadbmpx (read block multiplex) request.
8151  Always reply with an error, if someone has a platform really needs this,
8152  please contact vl@samba.org
8153 ****************************************************************************/
8154
8155 void reply_readbmpx(struct smb_request *req)
8156 {
8157         START_PROFILE(SMBreadBmpx);
8158         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8159         END_PROFILE(SMBreadBmpx);
8160         return;
8161 }
8162
8163 /****************************************************************************
8164  Reply to a SMBreadbs (read block multiplex secondary) request.
8165  Always reply with an error, if someone has a platform really needs this,
8166  please contact vl@samba.org
8167 ****************************************************************************/
8168
8169 void reply_readbs(struct smb_request *req)
8170 {
8171         START_PROFILE(SMBreadBs);
8172         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8173         END_PROFILE(SMBreadBs);
8174         return;
8175 }
8176
8177 /****************************************************************************
8178  Reply to a SMBsetattrE.
8179 ****************************************************************************/
8180
8181 void reply_setattrE(struct smb_request *req)
8182 {
8183         connection_struct *conn = req->conn;
8184         struct smb_file_time ft;
8185         files_struct *fsp;
8186         NTSTATUS status;
8187
8188         START_PROFILE(SMBsetattrE);
8189         ZERO_STRUCT(ft);
8190
8191         if (req->wct < 7) {
8192                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8193                 goto out;
8194         }
8195
8196         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8197
8198         if(!fsp || (fsp->conn != conn)) {
8199                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8200                 goto out;
8201         }
8202
8203         /*
8204          * Convert the DOS times into unix times.
8205          */
8206
8207         ft.atime = convert_time_t_to_timespec(
8208             srv_make_unix_date2(req->vwv+3));
8209         ft.mtime = convert_time_t_to_timespec(
8210             srv_make_unix_date2(req->vwv+5));
8211         ft.create_time = convert_time_t_to_timespec(
8212             srv_make_unix_date2(req->vwv+1));
8213
8214         reply_outbuf(req, 0, 0);
8215
8216         /*
8217          * Patch from Ray Frush <frush@engr.colostate.edu>
8218          * Sometimes times are sent as zero - ignore them.
8219          */
8220
8221         /* Ensure we have a valid stat struct for the source. */
8222         status = vfs_stat_fsp(fsp);
8223         if (!NT_STATUS_IS_OK(status)) {
8224                 reply_nterror(req, status);
8225                 goto out;
8226         }
8227
8228         if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8229                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8230                 goto out;
8231         }
8232
8233         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8234         if (!NT_STATUS_IS_OK(status)) {
8235                 reply_nterror(req, status);
8236                 goto out;
8237         }
8238
8239         DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8240                " createtime=%u\n",
8241                 fsp_fnum_dbg(fsp),
8242                 (unsigned int)ft.atime.tv_sec,
8243                 (unsigned int)ft.mtime.tv_sec,
8244                 (unsigned int)ft.create_time.tv_sec
8245                 ));
8246  out:
8247         END_PROFILE(SMBsetattrE);
8248         return;
8249 }
8250
8251
8252 /* Back from the dead for OS/2..... JRA. */
8253
8254 /****************************************************************************
8255  Reply to a SMBwritebmpx (write block multiplex primary) request.
8256  Always reply with an error, if someone has a platform really needs this,
8257  please contact vl@samba.org
8258 ****************************************************************************/
8259
8260 void reply_writebmpx(struct smb_request *req)
8261 {
8262         START_PROFILE(SMBwriteBmpx);
8263         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8264         END_PROFILE(SMBwriteBmpx);
8265         return;
8266 }
8267
8268 /****************************************************************************
8269  Reply to a SMBwritebs (write block multiplex secondary) request.
8270  Always reply with an error, if someone has a platform really needs this,
8271  please contact vl@samba.org
8272 ****************************************************************************/
8273
8274 void reply_writebs(struct smb_request *req)
8275 {
8276         START_PROFILE(SMBwriteBs);
8277         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8278         END_PROFILE(SMBwriteBs);
8279         return;
8280 }
8281
8282 /****************************************************************************
8283  Reply to a SMBgetattrE.
8284 ****************************************************************************/
8285
8286 void reply_getattrE(struct smb_request *req)
8287 {
8288         connection_struct *conn = req->conn;
8289         int mode;
8290         files_struct *fsp;
8291         struct timespec create_ts;
8292
8293         START_PROFILE(SMBgetattrE);
8294
8295         if (req->wct < 1) {
8296                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8297                 END_PROFILE(SMBgetattrE);
8298                 return;
8299         }
8300
8301         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8302
8303         if(!fsp || (fsp->conn != conn)) {
8304                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8305                 END_PROFILE(SMBgetattrE);
8306                 return;
8307         }
8308
8309         /* Do an fstat on this file */
8310         if(fsp_stat(fsp)) {
8311                 reply_nterror(req, map_nt_error_from_unix(errno));
8312                 END_PROFILE(SMBgetattrE);
8313                 return;
8314         }
8315
8316         mode = dos_mode(conn, fsp->fsp_name);
8317
8318         /*
8319          * Convert the times into dos times. Set create
8320          * date to be last modify date as UNIX doesn't save
8321          * this.
8322          */
8323
8324         reply_outbuf(req, 11, 0);
8325
8326         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8327         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8328         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8329                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8330         /* Should we check pending modtime here ? JRA */
8331         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8332                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8333
8334         if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8335                 SIVAL(req->outbuf, smb_vwv6, 0);
8336                 SIVAL(req->outbuf, smb_vwv8, 0);
8337         } else {
8338                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8339                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8340                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8341         }
8342         SSVAL(req->outbuf,smb_vwv10, mode);
8343
8344         DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8345
8346         END_PROFILE(SMBgetattrE);
8347         return;
8348 }