source/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28
  29 /* look in server.c for some explanation of these variables */
  30 extern enum protocol_types Protocol;
  31 extern int max_recv;
  32 extern uint32 global_client_caps;
  33
  34 extern bool global_encrypted_passwords_negotiated;
  35
  36 /****************************************************************************
  37  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  38  path or anything including wildcards.
  39  We're assuming here that '/' is not the second byte in any multibyte char
  40  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  41  set.
  42 ****************************************************************************/
  43
  44 /* Custom version for processing POSIX paths. */
  45 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  46
  47 static NTSTATUS check_path_syntax_internal(char *path,
  48                                            bool posix_path,
  49                                            bool *p_last_component_contains_wcard)
  50 {
  51         char *d = path;
  52         const char *s = path;
  53         NTSTATUS ret = NT_STATUS_OK;
  54         bool start_of_name_component = True;
  55         bool stream_started = false;
  56
  57         *p_last_component_contains_wcard = False;
  58
  59         while (*s) {
  60                 if (stream_started) {
  61                         switch (*s) {
  62                         case '/':
  63                         case '\\':
  64                                 return NT_STATUS_OBJECT_NAME_INVALID;
  65                         case ':':
  66                                 if (s[1] == '\0') {
  67                                         return NT_STATUS_OBJECT_NAME_INVALID;
  68                                 }
  69                                 if (strchr_m(&s[1], ':')) {
  70                                         return NT_STATUS_OBJECT_NAME_INVALID;
  71                                 }
  72                                 if (StrCaseCmp(s, ":$DATA") != 0) {
  73                                         return NT_STATUS_INVALID_PARAMETER;
  74                                 }
  75                                 break;
  76                         }
  77                 }
  78
  79                 if (!stream_started && *s == ':') {
  80                         if (*p_last_component_contains_wcard) {
  81                                 return NT_STATUS_OBJECT_NAME_INVALID;
  82                         }
  83                         /* stream names allow more characters than file names */
  84                         stream_started = true;
  85                         start_of_name_component = false;
  86                         posix_path = true;
  87
  88                         if (s[1] == '\0') {
  89                                 return NT_STATUS_OBJECT_NAME_INVALID;
  90                         }
  91                 }
  92
  93                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
  94                         /*
  95                          * Safe to assume is not the second part of a mb char
  96                          * as this is handled below.
  97                          */
  98                         /* Eat multiple '/' or '\\' */
  99                         while (IS_PATH_SEP(*s,posix_path)) {
 100                                 s++;
 101                         }
 102                         if ((d != path) && (*s != '\0')) {
 103                                 /* We only care about non-leading or trailing '/' or '\\' */
 104                                 *d++ = '/';
 105                         }
 106
 107                         start_of_name_component = True;
 108                         /* New component. */
 109                         *p_last_component_contains_wcard = False;
 110                         continue;
 111                 }
 112
 113                 if (start_of_name_component) {
 114                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 115                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 116
 117                                 /*
 118                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 119                                  */
 120
 121                                 /* If  we just added a '/' - delete it */
 122                                 if ((d > path) && (*(d-1) == '/')) {
 123                                         *(d-1) = '\0';
 124                                         d--;
 125                                 }
 126
 127                                 /* Are we at the start ? Can't go back further if so. */
 128                                 if (d <= path) {
 129                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 130                                         break;
 131                                 }
 132                                 /* Go back one level... */
 133                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 134                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 135                                 /* Decrement d first as d points to the *next* char to write into. */
 136                                 for (d--; d > path; d--) {
 137                                         if (*d == '/')
 138                                                 break;
 139                                 }
 140                                 s += 2; /* Else go past the .. */
 141                                 /* We're still at the start of a name component, just the previous one. */
 142                                 continue;
 143
 144                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 145                                 if (posix_path) {
 146                                         /* Eat the '.' */
 147                                         s++;
 148                                         continue;
 149                                 }
 150                         }
 151
 152                 }
 153
 154                 if (!(*s & 0x80)) {
 155                         if (!posix_path) {
 156                                 if (*s <= 0x1f || *s == '|') {
 157                                         return NT_STATUS_OBJECT_NAME_INVALID;
 158                                 }
 159                                 switch (*s) {
 160                                         case '*':
 161                                         case '?':
 162                                         case '<':
 163                                         case '>':
 164                                         case '"':
 165                                                 *p_last_component_contains_wcard = True;
 166                                                 break;
 167                                         default:
 168                                                 break;
 169                                 }
 170                         }
 171                         *d++ = *s++;
 172                 } else {
 173                         size_t siz;
 174                         /* Get the size of the next MB character. */
 175                         next_codepoint(s,&siz);
 176                         switch(siz) {
 177                                 case 5:
 178                                         *d++ = *s++;
 179                                         /*fall through*/
 180                                 case 4:
 181                                         *d++ = *s++;
 182                                         /*fall through*/
 183                                 case 3:
 184                                         *d++ = *s++;
 185                                         /*fall through*/
 186                                 case 2:
 187                                         *d++ = *s++;
 188                                         /*fall through*/
 189                                 case 1:
 190                                         *d++ = *s++;
 191                                         break;
 192                                 default:
 193                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 194                                         *d = '\0';
 195                                         return NT_STATUS_INVALID_PARAMETER;
 196                         }
 197                 }
 198                 start_of_name_component = False;
 199         }
 200
 201         *d = '\0';
 202
 203         return ret;
 204 }
 205
 206 /****************************************************************************
 207  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 208  No wildcards allowed.
 209 ****************************************************************************/
 210
 211 NTSTATUS check_path_syntax(char *path)
 212 {
 213         bool ignore;
 214         return check_path_syntax_internal(path, False, &ignore);
 215 }
 216
 217 /****************************************************************************
 218  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 219  Wildcards allowed - p_contains_wcard returns true if the last component contained
 220  a wildcard.
 221 ****************************************************************************/
 222
 223 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 224 {
 225         return check_path_syntax_internal(path, False, p_contains_wcard);
 226 }
 227
 228 /****************************************************************************
 229  Check the path for a POSIX client.
 230  We're assuming here that '/' is not the second byte in any multibyte char
 231  set (a safe assumption).
 232 ****************************************************************************/
 233
 234 NTSTATUS check_path_syntax_posix(char *path)
 235 {
 236         bool ignore;
 237         return check_path_syntax_internal(path, True, &ignore);
 238 }
 239
 240 /****************************************************************************
 241  Pull a string and check the path allowing a wilcard - provide for error return.
 242 ****************************************************************************/
 243
 244 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 245                         const char *inbuf,
 246                         uint16 smb_flags2,
 247                         char **pp_dest,
 248                         const char *src,
 249                         size_t src_len,
 250                         int flags,
 251                         NTSTATUS *err,
 252                         bool *contains_wcard)
 253 {
 254         size_t ret;
 255
 256         *pp_dest = NULL;
 257
 258         if (src_len == 0) {
 259                 ret = srvstr_pull_buf_talloc(ctx,
 260                                 inbuf,
 261                                 smb_flags2,
 262                                 pp_dest,
 263                                 src,
 264                                 flags);
 265         } else {
 266                 ret = srvstr_pull_talloc(ctx,
 267                                 inbuf,
 268                                 smb_flags2,
 269                                 pp_dest,
 270                                 src,
 271                                 src_len,
 272                                 flags);
 273         }
 274
 275         if (!*pp_dest) {
 276                 *err = NT_STATUS_INVALID_PARAMETER;
 277                 return ret;
 278         }
 279
 280         *contains_wcard = False;
 281
 282         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 283                 /*
 284                  * For a DFS path the function parse_dfs_path()
 285                  * will do the path processing, just make a copy.
 286                  */
 287                 *err = NT_STATUS_OK;
 288                 return ret;
 289         }
 290
 291         if (lp_posix_pathnames()) {
 292                 *err = check_path_syntax_posix(*pp_dest);
 293         } else {
 294                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 295         }
 296
 297         return ret;
 298 }
 299
 300 /****************************************************************************
 301  Pull a string and check the path - provide for error return.
 302 ****************************************************************************/
 303
 304 size_t srvstr_get_path(TALLOC_CTX *ctx,
 305                         const char *inbuf,
 306                         uint16 smb_flags2,
 307                         char **pp_dest,
 308                         const char *src,
 309                         size_t src_len,
 310                         int flags,
 311                         NTSTATUS *err)
 312 {
 313         size_t ret;
 314
 315         *pp_dest = NULL;
 316
 317         if (src_len == 0) {
 318                 ret = srvstr_pull_buf_talloc(ctx,
 319                                         inbuf,
 320                                         smb_flags2,
 321                                         pp_dest,
 322                                         src,
 323                                         flags);
 324         } else {
 325                 ret = srvstr_pull_talloc(ctx,
 326                                 inbuf,
 327                                 smb_flags2,
 328                                 pp_dest,
 329                                 src,
 330                                 src_len,
 331                                 flags);
 332         }
 333
 334         if (!*pp_dest) {
 335                 *err = NT_STATUS_INVALID_PARAMETER;
 336                 return ret;
 337         }
 338
 339         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 340                 /*
 341                  * For a DFS path the function parse_dfs_path()
 342                  * will do the path processing, just make a copy.
 343                  */
 344                 *err = NT_STATUS_OK;
 345                 return ret;
 346         }
 347
 348         if (lp_posix_pathnames()) {
 349                 *err = check_path_syntax_posix(*pp_dest);
 350         } else {
 351                 *err = check_path_syntax(*pp_dest);
 352         }
 353
 354         return ret;
 355 }
 356
 357 /****************************************************************************
 358  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 359 ****************************************************************************/
 360
 361 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 362                     files_struct *fsp)
 363 {
 364         if (!(fsp) || !(conn)) {
 365                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 366                 return False;
 367         }
 368         if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
 369                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 370                 return False;
 371         }
 372         return True;
 373 }
 374
 375 /****************************************************************************
 376  Check if we have a correct fsp pointing to a file.
 377 ****************************************************************************/
 378
 379 bool check_fsp(connection_struct *conn, struct smb_request *req,
 380                files_struct *fsp)
 381 {
 382         if (!check_fsp_open(conn, req, fsp)) {
 383                 return False;
 384         }
 385         if ((fsp)->is_directory) {
 386                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 387                 return False;
 388         }
 389         if ((fsp)->fh->fd == -1) {
 390                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 391                 return False;
 392         }
 393         (fsp)->num_smb_operations++;
 394         return True;
 395 }
 396
 397 /****************************************************************************
 398  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 399  the CHECK_NTQUOTA_HANDLE_OK macro.
 400 ****************************************************************************/
 401
 402 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 403                               files_struct *fsp)
 404 {
 405         if (!check_fsp_open(conn, req, fsp)) {
 406                 return false;
 407         }
 408
 409         if (fsp->is_directory) {
 410                 return false;
 411         }
 412
 413         if (fsp->fake_file_handle == NULL) {
 414                 return false;
 415         }
 416
 417         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 418                 return false;
 419         }
 420
 421         if (fsp->fake_file_handle->private_data == NULL) {
 422                 return false;
 423         }
 424
 425         return true;
 426 }
 427
 428 /****************************************************************************
 429  Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
 430 ****************************************************************************/
 431
 432 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
 433                       files_struct *fsp)
 434 {
 435         if ((fsp) && (conn) && ((conn)==(fsp)->conn)
 436             && (req->vuid == (fsp)->vuid)) {
 437                 return True;
 438         }
 439
 440         reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 441         return False;
 442 }
 443
 444 /****************************************************************************
 445  Reply to a (netbios-level) special message.
 446 ****************************************************************************/
 447
 448 void reply_special(char *inbuf)
 449 {
 450         int msg_type = CVAL(inbuf,0);
 451         int msg_flags = CVAL(inbuf,1);
 452         fstring name1,name2;
 453         char name_type = 0;
 454
 455         /*
 456          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 457          * calculation & friends (srv_send_smb uses that) we need the full smb
 458          * header.
 459          */
 460         char outbuf[smb_size];
 461
 462         static bool already_got_session = False;
 463
 464         *name1 = *name2 = 0;
 465
 466         memset(outbuf, '\0', sizeof(outbuf));
 467
 468         smb_setlen(outbuf,0);
 469
 470         switch (msg_type) {
 471         case 0x81: /* session request */
 472
 473                 if (already_got_session) {
 474                         exit_server_cleanly("multiple session request not permitted");
 475                 }
 476
 477                 SCVAL(outbuf,0,0x82);
 478                 SCVAL(outbuf,3,0);
 479                 if (name_len(inbuf+4) > 50 ||
 480                     name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
 481                         DEBUG(0,("Invalid name length in session request\n"));
 482                         return;
 483                 }
 484                 name_extract(inbuf,4,name1);
 485                 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
 486                 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
 487                          name1,name2));
 488
 489                 set_local_machine_name(name1, True);
 490                 set_remote_machine_name(name2, True);
 491
 492                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 493                          get_local_machine_name(), get_remote_machine_name(),
 494                          name_type));
 495
 496                 if (name_type == 'R') {
 497                         /* We are being asked for a pathworks session ---
 498                            no thanks! */
 499                         SCVAL(outbuf, 0,0x83);
 500                         break;
 501                 }
 502
 503                 /* only add the client's machine name to the list
 504                    of possibly valid usernames if we are operating
 505                    in share mode security */
 506                 if (lp_security() == SEC_SHARE) {
 507                         add_session_user(get_remote_machine_name());
 508                 }
 509
 510                 reload_services(True);
 511                 reopen_logs();
 512
 513                 already_got_session = True;
 514                 break;
 515
 516         case 0x89: /* session keepalive request
 517                       (some old clients produce this?) */
 518                 SCVAL(outbuf,0,SMBkeepalive);
 519                 SCVAL(outbuf,3,0);
 520                 break;
 521
 522         case 0x82: /* positive session response */
 523         case 0x83: /* negative session response */
 524         case 0x84: /* retarget session response */
 525                 DEBUG(0,("Unexpected session response\n"));
 526                 break;
 527
 528         case SMBkeepalive: /* session keepalive */
 529         default:
 530                 return;
 531         }
 532
 533         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 534                     msg_type, msg_flags));
 535
 536         srv_send_smb(smbd_server_fd(), outbuf, false);
 537         return;
 538 }
 539
 540 /****************************************************************************
 541  Reply to a tcon.
 542  conn POINTER CAN BE NULL HERE !
 543 ****************************************************************************/
 544
 545 void reply_tcon(struct smb_request *req)
 546 {
 547         connection_struct *conn = req->conn;
 548         const char *service;
 549         char *service_buf = NULL;
 550         char *password = NULL;
 551         char *dev = NULL;
 552         int pwlen=0;
 553         NTSTATUS nt_status;
 554         char *p;
 555         DATA_BLOB password_blob;
 556         TALLOC_CTX *ctx = talloc_tos();
 557
 558         START_PROFILE(SMBtcon);
 559
 560         if (smb_buflen(req->inbuf) < 4) {
 561                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 562                 END_PROFILE(SMBtcon);
 563                 return;
 564         }
 565
 566         p = smb_buf(req->inbuf)+1;
 567         p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
 568                                     &service_buf, p, STR_TERMINATE) + 1;
 569         pwlen = srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
 570                                        &password, p, STR_TERMINATE) + 1;
 571         p += pwlen;
 572         p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
 573                                     &dev, p, STR_TERMINATE) + 1;
 574
 575         if (service_buf == NULL || password == NULL || dev == NULL) {
 576                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 577                 END_PROFILE(SMBtcon);
 578                 return;
 579         }
 580         p = strrchr_m(service_buf,'\\');
 581         if (p) {
 582                 service = p+1;
 583         } else {
 584                 service = service_buf;
 585         }
 586
 587         password_blob = data_blob(password, pwlen+1);
 588
 589         conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
 590         req->conn = conn;
 591
 592         data_blob_clear_free(&password_blob);
 593
 594         if (!conn) {
 595                 reply_nterror(req, nt_status);
 596                 END_PROFILE(SMBtcon);
 597                 return;
 598         }
 599
 600         reply_outbuf(req, 2, 0);
 601         SSVAL(req->outbuf,smb_vwv0,max_recv);
 602         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 603         SSVAL(req->outbuf,smb_tid,conn->cnum);
 604
 605         DEBUG(3,("tcon service=%s cnum=%d\n",
 606                  service, conn->cnum));
 607
 608         END_PROFILE(SMBtcon);
 609         return;
 610 }
 611
 612 /****************************************************************************
 613  Reply to a tcon and X.
 614  conn POINTER CAN BE NULL HERE !
 615 ****************************************************************************/
 616
 617 void reply_tcon_and_X(struct smb_request *req)
 618 {
 619         connection_struct *conn = req->conn;
 620         char *service = NULL;
 621         DATA_BLOB password;
 622         TALLOC_CTX *ctx = talloc_tos();
 623         /* what the cleint thinks the device is */
 624         char *client_devicetype = NULL;
 625         /* what the server tells the client the share represents */
 626         const char *server_devicetype;
 627         NTSTATUS nt_status;
 628         int passlen;
 629         char *path = NULL;
 630         char *p, *q;
 631         uint16 tcon_flags;
 632
 633         START_PROFILE(SMBtconX);
 634
 635         if (req->wct < 4) {
 636                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 637                 END_PROFILE(SMBtconX);
 638                 return;
 639         }
 640
 641         passlen = SVAL(req->inbuf,smb_vwv3);
 642         tcon_flags = SVAL(req->inbuf,smb_vwv2);
 643
 644         /* we might have to close an old one */
 645         if ((tcon_flags & 0x1) && conn) {
 646                 close_cnum(conn,req->vuid);
 647                 req->conn = NULL;
 648                 conn = NULL;
 649         }
 650
 651         if ((passlen > MAX_PASS_LEN) || (passlen >= smb_buflen(req->inbuf))) {
 652                 reply_doserror(req, ERRDOS, ERRbuftoosmall);
 653                 END_PROFILE(SMBtconX);
 654                 return;
 655         }
 656
 657         if (global_encrypted_passwords_negotiated) {
 658                 password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
 659                                             passlen);
 660                 if (lp_security() == SEC_SHARE) {
 661                         /*
 662                          * Security = share always has a pad byte
 663                          * after the password.
 664                          */
 665                         p = smb_buf(req->inbuf) + passlen + 1;
 666                 } else {
 667                         p = smb_buf(req->inbuf) + passlen;
 668                 }
 669         } else {
 670                 password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
 671                                             passlen+1);
 672                 /* Ensure correct termination */
 673                 password.data[passlen]=0;
 674                 p = smb_buf(req->inbuf) + passlen + 1;
 675         }
 676
 677         p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &path, p,
 678                              STR_TERMINATE);
 679
 680         if (path == NULL) {
 681                 data_blob_clear_free(&password);
 682                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 683                 END_PROFILE(SMBtconX);
 684                 return;
 685         }
 686
 687         /*
 688          * the service name can be either: \\server\share
 689          * or share directly like on the DELL PowerVault 705
 690          */
 691         if (*path=='\\') {
 692                 q = strchr_m(path+2,'\\');
 693                 if (!q) {
 694                         data_blob_clear_free(&password);
 695                         reply_doserror(req, ERRDOS, ERRnosuchshare);
 696                         END_PROFILE(SMBtconX);
 697                         return;
 698                 }
 699                 service = q+1;
 700         } else {
 701                 service = path;
 702         }
 703
 704         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 705                                 &client_devicetype, p,
 706                                 MIN(6,smb_bufrem(req->inbuf, p)), STR_ASCII);
 707
 708         if (client_devicetype == NULL) {
 709                 data_blob_clear_free(&password);
 710                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 711                 END_PROFILE(SMBtconX);
 712                 return;
 713         }
 714
 715         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 716
 717         conn = make_connection(service, password, client_devicetype,
 718                                req->vuid, &nt_status);
 719         req->conn =conn;
 720
 721         data_blob_clear_free(&password);
 722
 723         if (!conn) {
 724                 reply_nterror(req, nt_status);
 725                 END_PROFILE(SMBtconX);
 726                 return;
 727         }
 728
 729         if ( IS_IPC(conn) )
 730                 server_devicetype = "IPC";
 731         else if ( IS_PRINT(conn) )
 732                 server_devicetype = "LPT1:";
 733         else
 734                 server_devicetype = "A:";
 735
 736         if (Protocol < PROTOCOL_NT1) {
 737                 reply_outbuf(req, 2, 0);
 738                 if (message_push_string(&req->outbuf, server_devicetype,
 739                                         STR_TERMINATE|STR_ASCII) == -1) {
 740                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 741                         END_PROFILE(SMBtconX);
 742                         return;
 743                 }
 744         } else {
 745                 /* NT sets the fstype of IPC$ to the null string */
 746                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 747
 748                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 749                         /* Return permissions. */
 750                         uint32 perm1 = 0;
 751                         uint32 perm2 = 0;
 752
 753                         reply_outbuf(req, 7, 0);
 754
 755                         if (IS_IPC(conn)) {
 756                                 perm1 = FILE_ALL_ACCESS;
 757                                 perm2 = FILE_ALL_ACCESS;
 758                         } else {
 759                                 perm1 = CAN_WRITE(conn) ?
 760                                                 SHARE_ALL_ACCESS :
 761                                                 SHARE_READ_ONLY;
 762                         }
 763
 764                         SIVAL(req->outbuf, smb_vwv3, perm1);
 765                         SIVAL(req->outbuf, smb_vwv5, perm2);
 766                 } else {
 767                         reply_outbuf(req, 3, 0);
 768                 }
 769
 770                 if ((message_push_string(&req->outbuf, server_devicetype,
 771                                          STR_TERMINATE|STR_ASCII) == -1)
 772                     || (message_push_string(&req->outbuf, fstype,
 773                                             STR_TERMINATE) == -1)) {
 774                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 775                         END_PROFILE(SMBtconX);
 776                         return;
 777                 }
 778
 779                 /* what does setting this bit do? It is set by NT4 and
 780                    may affect the ability to autorun mounted cdroms */
 781                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 782                       (lp_csc_policy(SNUM(conn)) << 2));
 783
 784                 init_dfsroot(conn, req->inbuf, req->outbuf);
 785         }
 786
 787
 788         DEBUG(3,("tconX service=%s \n",
 789                  service));
 790
 791         /* set the incoming and outgoing tid to the just created one */
 792         SSVAL(req->inbuf,smb_tid,conn->cnum);
 793         SSVAL(req->outbuf,smb_tid,conn->cnum);
 794
 795         END_PROFILE(SMBtconX);
 796
 797         chain_reply(req);
 798         return;
 799 }
 800
 801 /****************************************************************************
 802  Reply to an unknown type.
 803 ****************************************************************************/
 804
 805 void reply_unknown_new(struct smb_request *req, uint8 type)
 806 {
 807         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 808                   smb_fn_name(type), type, type));
 809         reply_doserror(req, ERRSRV, ERRunknownsmb);
 810         return;
 811 }
 812
 813 /****************************************************************************
 814  Reply to an ioctl.
 815  conn POINTER CAN BE NULL HERE !
 816 ****************************************************************************/
 817
 818 void reply_ioctl(struct smb_request *req)
 819 {
 820         connection_struct *conn = req->conn;
 821         uint16 device;
 822         uint16 function;
 823         uint32 ioctl_code;
 824         int replysize;
 825         char *p;
 826
 827         START_PROFILE(SMBioctl);
 828
 829         if (req->wct < 3) {
 830                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 831                 END_PROFILE(SMBioctl);
 832                 return;
 833         }
 834
 835         device     = SVAL(req->inbuf,smb_vwv1);
 836         function   = SVAL(req->inbuf,smb_vwv2);
 837         ioctl_code = (device << 16) + function;
 838
 839         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 840
 841         switch (ioctl_code) {
 842             case IOCTL_QUERY_JOB_INFO:
 843                     replysize = 32;
 844                     break;
 845             default:
 846                     reply_doserror(req, ERRSRV, ERRnosupport);
 847                     END_PROFILE(SMBioctl);
 848                     return;
 849         }
 850
 851         reply_outbuf(req, 8, replysize+1);
 852         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 853         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 854         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 855         p = smb_buf(req->outbuf);
 856         memset(p, '\0', replysize+1); /* valgrind-safe. */
 857         p += 1;          /* Allow for alignment */
 858
 859         switch (ioctl_code) {
 860                 case IOCTL_QUERY_JOB_INFO:
 861                 {
 862                         files_struct *fsp = file_fsp(SVAL(req->inbuf,
 863                                                           smb_vwv0));
 864                         if (!fsp) {
 865                                 reply_doserror(req, ERRDOS, ERRbadfid);
 866                                 END_PROFILE(SMBioctl);
 867                                 return;
 868                         }
 869                         SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
 870                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 871                                     global_myname(), 15,
 872                                     STR_TERMINATE|STR_ASCII);
 873                         if (conn) {
 874                                 srvstr_push((char *)req->outbuf, req->flags2,
 875                                             p+18, lp_servicename(SNUM(conn)),
 876                                             13, STR_TERMINATE|STR_ASCII);
 877                         } else {
 878                                 memset(p+18, 0, 13);
 879                         }
 880                         break;
 881                 }
 882         }
 883
 884         END_PROFILE(SMBioctl);
 885         return;
 886 }
 887
 888 /****************************************************************************
 889  Strange checkpath NTSTATUS mapping.
 890 ****************************************************************************/
 891
 892 static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
 893 {
 894         /* Strange DOS error code semantics only for checkpath... */
 895         if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
 896                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 897                         /* We need to map to ERRbadpath */
 898                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 899                 }
 900         }
 901         return status;
 902 }
 903
 904 /****************************************************************************
 905  Reply to a checkpath.
 906 ****************************************************************************/
 907
 908 void reply_checkpath(struct smb_request *req)
 909 {
 910         connection_struct *conn = req->conn;
 911         char *name = NULL;
 912         SMB_STRUCT_STAT sbuf;
 913         NTSTATUS status;
 914         TALLOC_CTX *ctx = talloc_tos();
 915
 916         START_PROFILE(SMBcheckpath);
 917
 918         srvstr_get_path(ctx,(char *)req->inbuf, req->flags2, &name,
 919                         smb_buf(req->inbuf) + 1, 0,
 920                         STR_TERMINATE, &status);
 921         if (!NT_STATUS_IS_OK(status)) {
 922                 status = map_checkpath_error((char *)req->inbuf, status);
 923                 reply_nterror(req, status);
 924                 END_PROFILE(SMBcheckpath);
 925                 return;
 926         }
 927
 928         status = resolve_dfspath(ctx, conn,
 929                         req->flags2 & FLAGS2_DFS_PATHNAMES,
 930                         name,
 931                         &name);
 932         if (!NT_STATUS_IS_OK(status)) {
 933                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
 934                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
 935                                         ERRSRV, ERRbadpath);
 936                         END_PROFILE(SMBcheckpath);
 937                         return;
 938                 }
 939                 goto path_err;
 940         }
 941
 942         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->inbuf,smb_vwv0)));
 943
 944         status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
 945         if (!NT_STATUS_IS_OK(status)) {
 946                 goto path_err;
 947         }
 948
 949         status = check_name(conn, name);
 950         if (!NT_STATUS_IS_OK(status)) {
 951                 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
 952                 goto path_err;
 953         }
 954
 955         if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
 956                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
 957                 status = map_nt_error_from_unix(errno);
 958                 goto path_err;
 959         }
 960
 961         if (!S_ISDIR(sbuf.st_mode)) {
 962                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
 963                                 ERRDOS, ERRbadpath);
 964                 END_PROFILE(SMBcheckpath);
 965                 return;
 966         }
 967
 968         reply_outbuf(req, 0, 0);
 969
 970         END_PROFILE(SMBcheckpath);
 971         return;
 972
 973   path_err:
 974
 975         END_PROFILE(SMBcheckpath);
 976
 977         /* We special case this - as when a Windows machine
 978                 is parsing a path is steps through the components
 979                 one at a time - if a component fails it expects
 980                 ERRbadpath, not ERRbadfile.
 981         */
 982         status = map_checkpath_error((char *)req->inbuf, status);
 983         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 984                 /*
 985                  * Windows returns different error codes if
 986                  * the parent directory is valid but not the
 987                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
 988                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
 989                  * if the path is invalid.
 990                  */
 991                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
 992                                 ERRDOS, ERRbadpath);
 993                 return;
 994         }
 995
 996         reply_nterror(req, status);
 997 }
 998
 999 /****************************************************************************
1000  Reply to a getatr.
1001 ****************************************************************************/
1002
1003 void reply_getatr(struct smb_request *req)
1004 {
1005         connection_struct *conn = req->conn;
1006         char *fname = NULL;
1007         SMB_STRUCT_STAT sbuf;
1008         int mode=0;
1009         SMB_OFF_T size=0;
1010         time_t mtime=0;
1011         char *p;
1012         NTSTATUS status;
1013         TALLOC_CTX *ctx = talloc_tos();
1014
1015         START_PROFILE(SMBgetatr);
1016
1017         p = smb_buf(req->inbuf) + 1;
1018         p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
1019                              0, STR_TERMINATE, &status);
1020         if (!NT_STATUS_IS_OK(status)) {
1021                 reply_nterror(req, status);
1022                 END_PROFILE(SMBgetatr);
1023                 return;
1024         }
1025
1026         status = resolve_dfspath(ctx, conn,
1027                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1028                                 fname,
1029                                 &fname);
1030         if (!NT_STATUS_IS_OK(status)) {
1031                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1032                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1033                                         ERRSRV, ERRbadpath);
1034                         END_PROFILE(SMBgetatr);
1035                         return;
1036                 }
1037                 reply_nterror(req, status);
1038                 END_PROFILE(SMBgetatr);
1039                 return;
1040         }
1041
1042         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1043                 under WfWg - weird! */
1044         if (*fname == '\0') {
1045                 mode = aHIDDEN | aDIR;
1046                 if (!CAN_WRITE(conn)) {
1047                         mode |= aRONLY;
1048                 }
1049                 size = 0;
1050                 mtime = 0;
1051         } else {
1052                 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
1053                 if (!NT_STATUS_IS_OK(status)) {
1054                         reply_nterror(req, status);
1055                         END_PROFILE(SMBgetatr);
1056                         return;
1057                 }
1058                 status = check_name(conn, fname);
1059                 if (!NT_STATUS_IS_OK(status)) {
1060                         DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
1061                         reply_nterror(req, status);
1062                         END_PROFILE(SMBgetatr);
1063                         return;
1064                 }
1065                 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
1066                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1067                         reply_unixerror(req, ERRDOS,ERRbadfile);
1068                         END_PROFILE(SMBgetatr);
1069                         return;
1070                 }
1071
1072                 mode = dos_mode(conn,fname,&sbuf);
1073                 size = sbuf.st_size;
1074                 mtime = sbuf.st_mtime;
1075                 if (mode & aDIR) {
1076                         size = 0;
1077                 }
1078         }
1079
1080         reply_outbuf(req, 10, 0);
1081
1082         SSVAL(req->outbuf,smb_vwv0,mode);
1083         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1084                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1085         } else {
1086                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1087         }
1088         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1089
1090         if (Protocol >= PROTOCOL_NT1) {
1091                 SSVAL(req->outbuf, smb_flg2,
1092                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1093         }
1094
1095         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1096
1097         END_PROFILE(SMBgetatr);
1098         return;
1099 }
1100
1101 /****************************************************************************
1102  Reply to a setatr.
1103 ****************************************************************************/
1104
1105 void reply_setatr(struct smb_request *req)
1106 {
1107         struct timespec ts[2];
1108         connection_struct *conn = req->conn;
1109         char *fname = NULL;
1110         int mode;
1111         time_t mtime;
1112         SMB_STRUCT_STAT sbuf;
1113         char *p;
1114         NTSTATUS status;
1115         TALLOC_CTX *ctx = talloc_tos();
1116
1117         START_PROFILE(SMBsetatr);
1118
1119         ZERO_STRUCT(ts);
1120
1121         if (req->wct < 2) {
1122                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1123                 return;
1124         }
1125
1126         p = smb_buf(req->inbuf) + 1;
1127         p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
1128                                 0, STR_TERMINATE, &status);
1129         if (!NT_STATUS_IS_OK(status)) {
1130                 reply_nterror(req, status);
1131                 END_PROFILE(SMBsetatr);
1132                 return;
1133         }
1134
1135         status = resolve_dfspath(ctx, conn,
1136                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1137                                 fname,
1138                                 &fname);
1139         if (!NT_STATUS_IS_OK(status)) {
1140                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1141                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1142                                         ERRSRV, ERRbadpath);
1143                         END_PROFILE(SMBsetatr);
1144                         return;
1145                 }
1146                 reply_nterror(req, status);
1147                 END_PROFILE(SMBsetatr);
1148                 return;
1149         }
1150
1151         status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1152         if (!NT_STATUS_IS_OK(status)) {
1153                 reply_nterror(req, status);
1154                 END_PROFILE(SMBsetatr);
1155                 return;
1156         }
1157
1158         status = check_name(conn, fname);
1159         if (!NT_STATUS_IS_OK(status)) {
1160                 reply_nterror(req, status);
1161                 END_PROFILE(SMBsetatr);
1162                 return;
1163         }
1164
1165         if (fname[0] == '.' && fname[1] == '\0') {
1166                 /*
1167                  * Not sure here is the right place to catch this
1168                  * condition. Might be moved to somewhere else later -- vl
1169                  */
1170                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1171                 END_PROFILE(SMBsetatr);
1172                 return;
1173         }
1174
1175         mode = SVAL(req->inbuf,smb_vwv0);
1176         mtime = srv_make_unix_date3(req->inbuf+smb_vwv1);
1177
1178         ts[1] = convert_time_t_to_timespec(mtime);
1179         status = smb_set_file_time(conn, NULL, fname,
1180                                    &sbuf, ts, true);
1181         if (!NT_STATUS_IS_OK(status)) {
1182                 reply_unixerror(req, ERRDOS, ERRnoaccess);
1183                 END_PROFILE(SMBsetatr);
1184                 return;
1185         }
1186
1187         if (mode != FILE_ATTRIBUTE_NORMAL) {
1188                 if (VALID_STAT_OF_DIR(sbuf))
1189                         mode |= aDIR;
1190                 else
1191                         mode &= ~aDIR;
1192
1193                 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1194                         reply_unixerror(req, ERRDOS, ERRnoaccess);
1195                         END_PROFILE(SMBsetatr);
1196                         return;
1197                 }
1198         }
1199
1200         reply_outbuf(req, 0, 0);
1201
1202         DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1203
1204         END_PROFILE(SMBsetatr);
1205         return;
1206 }
1207
1208 /****************************************************************************
1209  Reply to a dskattr.
1210 ****************************************************************************/
1211
1212 void reply_dskattr(struct smb_request *req)
1213 {
1214         connection_struct *conn = req->conn;
1215         SMB_BIG_UINT dfree,dsize,bsize;
1216         START_PROFILE(SMBdskattr);
1217
1218         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
1219                 reply_unixerror(req, ERRHRD, ERRgeneral);
1220                 END_PROFILE(SMBdskattr);
1221                 return;
1222         }
1223
1224         reply_outbuf(req, 5, 0);
1225
1226         if (Protocol <= PROTOCOL_LANMAN2) {
1227                 double total_space, free_space;
1228                 /* we need to scale this to a number that DOS6 can handle. We
1229                    use floating point so we can handle large drives on systems
1230                    that don't have 64 bit integers
1231
1232                    we end up displaying a maximum of 2G to DOS systems
1233                 */
1234                 total_space = dsize * (double)bsize;
1235                 free_space = dfree * (double)bsize;
1236
1237                 dsize = (SMB_BIG_UINT)((total_space+63*512) / (64*512));
1238                 dfree = (SMB_BIG_UINT)((free_space+63*512) / (64*512));
1239
1240                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1241                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1242
1243                 SSVAL(req->outbuf,smb_vwv0,dsize);
1244                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1245                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1246                 SSVAL(req->outbuf,smb_vwv3,dfree);
1247         } else {
1248                 SSVAL(req->outbuf,smb_vwv0,dsize);
1249                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1250                 SSVAL(req->outbuf,smb_vwv2,512);
1251                 SSVAL(req->outbuf,smb_vwv3,dfree);
1252         }
1253
1254         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1255
1256         END_PROFILE(SMBdskattr);
1257         return;
1258 }
1259
1260 /****************************************************************************
1261  Reply to a search.
1262  Can be called from SMBsearch, SMBffirst or SMBfunique.
1263 ****************************************************************************/
1264
1265 void reply_search(struct smb_request *req)
1266 {
1267         connection_struct *conn = req->conn;
1268         char *mask = NULL;
1269         char *directory = NULL;
1270         char *fname = NULL;
1271         SMB_OFF_T size;
1272         uint32 mode;
1273         time_t date;
1274         uint32 dirtype;
1275         unsigned int numentries = 0;
1276         unsigned int maxentries = 0;
1277         bool finished = False;
1278         char *p;
1279         int status_len;
1280         char *path = NULL;
1281         char status[21];
1282         int dptr_num= -1;
1283         bool check_descend = False;
1284         bool expect_close = False;
1285         NTSTATUS nt_status;
1286         bool mask_contains_wcard = False;
1287         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1288         TALLOC_CTX *ctx = talloc_tos();
1289         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1290
1291         START_PROFILE(SMBsearch);
1292
1293         if (req->wct < 2) {
1294                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1295                 END_PROFILE(SMBsearch);
1296                 return;
1297         }
1298
1299         if (lp_posix_pathnames()) {
1300                 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1301                 END_PROFILE(SMBsearch);
1302                 return;
1303         }
1304
1305         /* If we were called as SMBffirst then we must expect close. */
1306         if(CVAL(req->inbuf,smb_com) == SMBffirst) {
1307                 expect_close = True;
1308         }
1309
1310         reply_outbuf(req, 1, 3);
1311         maxentries = SVAL(req->inbuf,smb_vwv0);
1312         dirtype = SVAL(req->inbuf,smb_vwv1);
1313         p = smb_buf(req->inbuf) + 1;
1314         p += srvstr_get_path_wcard(ctx,
1315                                 (char *)req->inbuf,
1316                                 req->flags2,
1317                                 &path,
1318                                 p,
1319                                 0,
1320                                 STR_TERMINATE,
1321                                 &nt_status,
1322                                 &mask_contains_wcard);
1323         if (!NT_STATUS_IS_OK(nt_status)) {
1324                 reply_nterror(req, nt_status);
1325                 END_PROFILE(SMBsearch);
1326                 return;
1327         }
1328
1329         nt_status = resolve_dfspath_wcard(ctx, conn,
1330                                           req->flags2 & FLAGS2_DFS_PATHNAMES,
1331                                           path,
1332                                           &path,
1333                                           &mask_contains_wcard);
1334         if (!NT_STATUS_IS_OK(nt_status)) {
1335                 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1336                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1337                                         ERRSRV, ERRbadpath);
1338                         END_PROFILE(SMBsearch);
1339                         return;
1340                 }
1341                 reply_nterror(req, nt_status);
1342                 END_PROFILE(SMBsearch);
1343                 return;
1344         }
1345
1346         p++;
1347         status_len = SVAL(p, 0);
1348         p += 2;
1349
1350         /* dirtype &= ~aDIR; */
1351
1352         if (status_len == 0) {
1353                 SMB_STRUCT_STAT sbuf;
1354
1355                 nt_status = unix_convert(ctx, conn, path, True,
1356                                 &directory, NULL, &sbuf);
1357                 if (!NT_STATUS_IS_OK(nt_status)) {
1358                         reply_nterror(req, nt_status);
1359                         END_PROFILE(SMBsearch);
1360                         return;
1361                 }
1362
1363                 nt_status = check_name(conn, directory);
1364                 if (!NT_STATUS_IS_OK(nt_status)) {
1365                         reply_nterror(req, nt_status);
1366                         END_PROFILE(SMBsearch);
1367                         return;
1368                 }
1369
1370                 p = strrchr_m(directory,'/');
1371                 if (!p) {
1372                         mask = directory;
1373                         directory = talloc_strdup(ctx,".");
1374                         if (!directory) {
1375                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1376                                 END_PROFILE(SMBsearch);
1377                                 return;
1378                         }
1379                 } else {
1380                         *p = 0;
1381                         mask = p+1;
1382                 }
1383
1384                 if (*directory == '\0') {
1385                         directory = talloc_strdup(ctx,".");
1386                         if (!directory) {
1387                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1388                                 END_PROFILE(SMBsearch);
1389                                 return;
1390                         }
1391                 }
1392                 memset((char *)status,'\0',21);
1393                 SCVAL(status,0,(dirtype & 0x1F));
1394
1395                 nt_status = dptr_create(conn,
1396                                         directory,
1397                                         True,
1398                                         expect_close,
1399                                         req->smbpid,
1400                                         mask,
1401                                         mask_contains_wcard,
1402                                         dirtype,
1403                                         &conn->dirptr);
1404                 if (!NT_STATUS_IS_OK(nt_status)) {
1405                         reply_nterror(req, nt_status);
1406                         END_PROFILE(SMBsearch);
1407                         return;
1408                 }
1409                 dptr_num = dptr_dnum(conn->dirptr);
1410         } else {
1411                 int status_dirtype;
1412
1413                 memcpy(status,p,21);
1414                 status_dirtype = CVAL(status,0) & 0x1F;
1415                 if (status_dirtype != (dirtype & 0x1F)) {
1416                         dirtype = status_dirtype;
1417                 }
1418
1419                 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1420                 if (!conn->dirptr) {
1421                         goto SearchEmpty;
1422                 }
1423                 string_set(&conn->dirpath,dptr_path(dptr_num));
1424                 mask = dptr_wcard(dptr_num);
1425                 if (!mask) {
1426                         goto SearchEmpty;
1427                 }
1428                 /*
1429                  * For a 'continue' search we have no string. So
1430                  * check from the initial saved string.
1431                  */
1432                 mask_contains_wcard = ms_has_wild(mask);
1433                 dirtype = dptr_attr(dptr_num);
1434         }
1435
1436         DEBUG(4,("dptr_num is %d\n",dptr_num));
1437
1438         if ((dirtype&0x1F) == aVOLID) {
1439                 char buf[DIR_STRUCT_SIZE];
1440                 memcpy(buf,status,21);
1441                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1442                                 0,aVOLID,0,!allow_long_path_components)) {
1443                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1444                         END_PROFILE(SMBsearch);
1445                         return;
1446                 }
1447                 dptr_fill(buf+12,dptr_num);
1448                 if (dptr_zero(buf+12) && (status_len==0)) {
1449                         numentries = 1;
1450                 } else {
1451                         numentries = 0;
1452                 }
1453                 if (message_push_blob(&req->outbuf,
1454                                       data_blob_const(buf, sizeof(buf)))
1455                     == -1) {
1456                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1457                         END_PROFILE(SMBsearch);
1458                         return;
1459                 }
1460         } else {
1461                 unsigned int i;
1462                 maxentries = MIN(
1463                         maxentries,
1464                         ((BUFFER_SIZE -
1465                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1466                          /DIR_STRUCT_SIZE));
1467
1468                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1469                         conn->dirpath,lp_dontdescend(SNUM(conn))));
1470                 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1471                         check_descend = True;
1472                 }
1473
1474                 for (i=numentries;(i<maxentries) && !finished;i++) {
1475                         finished = !get_dir_entry(ctx,
1476                                                   conn,
1477                                                   mask,
1478                                                   dirtype,
1479                                                   &fname,
1480                                                   &size,
1481                                                   &mode,
1482                                                   &date,
1483                                                   check_descend,
1484                                                   ask_sharemode);
1485                         if (!finished) {
1486                                 char buf[DIR_STRUCT_SIZE];
1487                                 memcpy(buf,status,21);
1488                                 if (!make_dir_struct(ctx,
1489                                                 buf,
1490                                                 mask,
1491                                                 fname,
1492                                                 size,
1493                                                 mode,
1494                                                 date,
1495                                                 !allow_long_path_components)) {
1496                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1497                                         END_PROFILE(SMBsearch);
1498                                         return;
1499                                 }
1500                                 if (!dptr_fill(buf+12,dptr_num)) {
1501                                         break;
1502                                 }
1503                                 if (message_push_blob(&req->outbuf,
1504                                                       data_blob_const(buf, sizeof(buf)))
1505                                     == -1) {
1506                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1507                                         END_PROFILE(SMBsearch);
1508                                         return;
1509                                 }
1510                                 numentries++;
1511                         }
1512                 }
1513         }
1514
1515   SearchEmpty:
1516
1517         /* If we were called as SMBffirst with smb_search_id == NULL
1518                 and no entries were found then return error and close dirptr
1519                 (X/Open spec) */
1520
1521         if (numentries == 0) {
1522                 dptr_close(&dptr_num);
1523         } else if(expect_close && status_len == 0) {
1524                 /* Close the dptr - we know it's gone */
1525                 dptr_close(&dptr_num);
1526         }
1527
1528         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1529         if(dptr_num >= 0 && CVAL(req->inbuf,smb_com) == SMBfunique) {
1530                 dptr_close(&dptr_num);
1531         }
1532
1533         if ((numentries == 0) && !mask_contains_wcard) {
1534                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1535                 END_PROFILE(SMBsearch);
1536                 return;
1537         }
1538
1539         SSVAL(req->outbuf,smb_vwv0,numentries);
1540         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1541         SCVAL(smb_buf(req->outbuf),0,5);
1542         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1543
1544         /* The replies here are never long name. */
1545         SSVAL(req->outbuf, smb_flg2,
1546               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1547         if (!allow_long_path_components) {
1548                 SSVAL(req->outbuf, smb_flg2,
1549                       SVAL(req->outbuf, smb_flg2)
1550                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1551         }
1552
1553         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1554         SSVAL(req->outbuf, smb_flg2,
1555               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1556
1557         if (!directory) {
1558                 directory = dptr_path(dptr_num);
1559         }
1560
1561         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1562                 smb_fn_name(CVAL(req->inbuf,smb_com)),
1563                 mask,
1564                 directory ? directory : "./",
1565                 dirtype,
1566                 numentries,
1567                 maxentries ));
1568
1569         END_PROFILE(SMBsearch);
1570         return;
1571 }
1572
1573 /****************************************************************************
1574  Reply to a fclose (stop directory search).
1575 ****************************************************************************/
1576
1577 void reply_fclose(struct smb_request *req)
1578 {
1579         int status_len;
1580         char status[21];
1581         int dptr_num= -2;
1582         char *p;
1583         char *path = NULL;
1584         NTSTATUS err;
1585         bool path_contains_wcard = False;
1586         TALLOC_CTX *ctx = talloc_tos();
1587
1588         START_PROFILE(SMBfclose);
1589
1590         if (lp_posix_pathnames()) {
1591                 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1592                 END_PROFILE(SMBfclose);
1593                 return;
1594         }
1595
1596         p = smb_buf(req->inbuf) + 1;
1597         p += srvstr_get_path_wcard(ctx,
1598                                 (char *)req->inbuf,
1599                                 req->flags2,
1600                                 &path,
1601                                 p,
1602                                 0,
1603                                 STR_TERMINATE,
1604                                 &err,
1605                                 &path_contains_wcard);
1606         if (!NT_STATUS_IS_OK(err)) {
1607                 reply_nterror(req, err);
1608                 END_PROFILE(SMBfclose);
1609                 return;
1610         }
1611         p++;
1612         status_len = SVAL(p,0);
1613         p += 2;
1614
1615         if (status_len == 0) {
1616                 reply_doserror(req, ERRSRV, ERRsrverror);
1617                 END_PROFILE(SMBfclose);
1618                 return;
1619         }
1620
1621         memcpy(status,p,21);
1622
1623         if(dptr_fetch(status+12,&dptr_num)) {
1624                 /*  Close the dptr - we know it's gone */
1625                 dptr_close(&dptr_num);
1626         }
1627
1628         reply_outbuf(req, 1, 0);
1629         SSVAL(req->outbuf,smb_vwv0,0);
1630
1631         DEBUG(3,("search close\n"));
1632
1633         END_PROFILE(SMBfclose);
1634         return;
1635 }
1636
1637 /****************************************************************************
1638  Reply to an open.
1639 ****************************************************************************/
1640
1641 void reply_open(struct smb_request *req)
1642 {
1643         connection_struct *conn = req->conn;
1644         char *fname = NULL;
1645         uint32 fattr=0;
1646         SMB_OFF_T size = 0;
1647         time_t mtime=0;
1648         int info;
1649         SMB_STRUCT_STAT sbuf;
1650         files_struct *fsp;
1651         int oplock_request;
1652         int deny_mode;
1653         uint32 dos_attr;
1654         uint32 access_mask;
1655         uint32 share_mode;
1656         uint32 create_disposition;
1657         uint32 create_options = 0;
1658         NTSTATUS status;
1659         TALLOC_CTX *ctx = talloc_tos();
1660
1661         START_PROFILE(SMBopen);
1662
1663         if (req->wct < 2) {
1664                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1665                 END_PROFILE(SMBopen);
1666                 return;
1667         }
1668
1669         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1670         deny_mode = SVAL(req->inbuf,smb_vwv0);
1671         dos_attr = SVAL(req->inbuf,smb_vwv1);
1672
1673         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1674                         smb_buf(req->inbuf)+1, 0,
1675                         STR_TERMINATE, &status);
1676         if (!NT_STATUS_IS_OK(status)) {
1677                 reply_nterror(req, status);
1678                 END_PROFILE(SMBopen);
1679                 return;
1680         }
1681
1682         if (!map_open_params_to_ntcreate(
1683                     fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1684                     &share_mode, &create_disposition, &create_options)) {
1685                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1686                 END_PROFILE(SMBopen);
1687                 return;
1688         }
1689
1690         status = create_file(conn,                      /* conn */
1691                              req,                       /* req */
1692                              0,                         /* root_dir_fid */
1693                              fname,                     /* fname */
1694                              access_mask,               /* access_mask */
1695                              share_mode,                /* share_access */
1696                              create_disposition,        /* create_disposition*/
1697                              create_options,            /* create_options */
1698                              dos_attr,                  /* file_attributes */
1699                              oplock_request,            /* oplock_request */
1700                              0,                         /* allocation_size */
1701                              NULL,                      /* sd */
1702                              NULL,                      /* ea_list */
1703                              &fsp,                      /* result */
1704                              &info,                     /* pinfo */
1705                              &sbuf);                    /* psbuf */
1706
1707         if (!NT_STATUS_IS_OK(status)) {
1708                 if (open_was_deferred(req->mid)) {
1709                         /* We have re-scheduled this call. */
1710                         END_PROFILE(SMBopen);
1711                         return;
1712                 }
1713                 reply_openerror(req, status);
1714                 END_PROFILE(SMBopen);
1715                 return;
1716         }
1717
1718         size = sbuf.st_size;
1719         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1720         mtime = sbuf.st_mtime;
1721
1722         if (fattr & aDIR) {
1723                 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1724                 close_file(fsp,ERROR_CLOSE);
1725                 reply_doserror(req, ERRDOS,ERRnoaccess);
1726                 END_PROFILE(SMBopen);
1727                 return;
1728         }
1729
1730         reply_outbuf(req, 7, 0);
1731         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1732         SSVAL(req->outbuf,smb_vwv1,fattr);
1733         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1734                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1735         } else {
1736                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1737         }
1738         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1739         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1740
1741         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1742                 SCVAL(req->outbuf,smb_flg,
1743                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1744         }
1745
1746         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1747                 SCVAL(req->outbuf,smb_flg,
1748                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1749         }
1750         END_PROFILE(SMBopen);
1751         return;
1752 }
1753
1754 /****************************************************************************
1755  Reply to an open and X.
1756 ****************************************************************************/
1757
1758 void reply_open_and_X(struct smb_request *req)
1759 {
1760         connection_struct *conn = req->conn;
1761         char *fname = NULL;
1762         uint16 open_flags;
1763         int deny_mode;
1764         uint32 smb_attr;
1765         /* Breakout the oplock request bits so we can set the
1766                 reply bits separately. */
1767         int ex_oplock_request;
1768         int core_oplock_request;
1769         int oplock_request;
1770 #if 0
1771         int smb_sattr = SVAL(req->inbuf,smb_vwv4);
1772         uint32 smb_time = make_unix_date3(req->inbuf+smb_vwv6);
1773 #endif
1774         int smb_ofun;
1775         uint32 fattr=0;
1776         int mtime=0;
1777         SMB_STRUCT_STAT sbuf;
1778         int smb_action = 0;
1779         files_struct *fsp;
1780         NTSTATUS status;
1781         SMB_BIG_UINT allocation_size;
1782         ssize_t retval = -1;
1783         uint32 access_mask;
1784         uint32 share_mode;
1785         uint32 create_disposition;
1786         uint32 create_options = 0;
1787         TALLOC_CTX *ctx = talloc_tos();
1788
1789         START_PROFILE(SMBopenX);
1790
1791         if (req->wct < 15) {
1792                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1793                 END_PROFILE(SMBopenX);
1794                 return;
1795         }
1796
1797         open_flags = SVAL(req->inbuf,smb_vwv2);
1798         deny_mode = SVAL(req->inbuf,smb_vwv3);
1799         smb_attr = SVAL(req->inbuf,smb_vwv5);
1800         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1801         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1802         oplock_request = ex_oplock_request | core_oplock_request;
1803         smb_ofun = SVAL(req->inbuf,smb_vwv8);
1804         allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv9);
1805
1806         /* If it's an IPC, pass off the pipe handler. */
1807         if (IS_IPC(conn)) {
1808                 if (lp_nt_pipe_support()) {
1809                         reply_open_pipe_and_X(conn, req);
1810                 } else {
1811                         reply_doserror(req, ERRSRV, ERRaccess);
1812                 }
1813                 END_PROFILE(SMBopenX);
1814                 return;
1815         }
1816
1817         /* XXXX we need to handle passed times, sattr and flags */
1818         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1819                         smb_buf(req->inbuf), 0, STR_TERMINATE,
1820                         &status);
1821         if (!NT_STATUS_IS_OK(status)) {
1822                 reply_nterror(req, status);
1823                 END_PROFILE(SMBopenX);
1824                 return;
1825         }
1826
1827         if (!map_open_params_to_ntcreate(
1828                     fname, deny_mode, smb_ofun, &access_mask,
1829                     &share_mode, &create_disposition, &create_options)) {
1830                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1831                 END_PROFILE(SMBopenX);
1832                 return;
1833         }
1834
1835         status = create_file(conn,                      /* conn */
1836                              req,                       /* req */
1837                              0,                         /* root_dir_fid */
1838                              fname,                     /* fname */
1839                              access_mask,               /* access_mask */
1840                              share_mode,                /* share_access */
1841                              create_disposition,        /* create_disposition*/
1842                              create_options,            /* create_options */
1843                              smb_attr,                  /* file_attributes */
1844                              oplock_request,            /* oplock_request */
1845                              0,                         /* allocation_size */
1846                              NULL,                      /* sd */
1847                              NULL,                      /* ea_list */
1848                              &fsp,                      /* result */
1849                              &smb_action,               /* pinfo */
1850                              &sbuf);                    /* psbuf */
1851
1852         if (!NT_STATUS_IS_OK(status)) {
1853                 END_PROFILE(SMBopenX);
1854                 if (open_was_deferred(req->mid)) {
1855                         /* We have re-scheduled this call. */
1856                         return;
1857                 }
1858                 reply_openerror(req, status);
1859                 return;
1860         }
1861
1862         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1863            if the file is truncated or created. */
1864         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1865                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1866                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1867                         close_file(fsp,ERROR_CLOSE);
1868                         reply_nterror(req, NT_STATUS_DISK_FULL);
1869                         END_PROFILE(SMBopenX);
1870                         return;
1871                 }
1872                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1873                 if (retval < 0) {
1874                         close_file(fsp,ERROR_CLOSE);
1875                         reply_nterror(req, NT_STATUS_DISK_FULL);
1876                         END_PROFILE(SMBopenX);
1877                         return;
1878                 }
1879                 sbuf.st_size = get_allocation_size(conn,fsp,&sbuf);
1880         }
1881
1882         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1883         mtime = sbuf.st_mtime;
1884         if (fattr & aDIR) {
1885                 close_file(fsp,ERROR_CLOSE);
1886                 reply_doserror(req, ERRDOS, ERRnoaccess);
1887                 END_PROFILE(SMBopenX);
1888                 return;
1889         }
1890
1891         /* If the caller set the extended oplock request bit
1892                 and we granted one (by whatever means) - set the
1893                 correct bit for extended oplock reply.
1894         */
1895
1896         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1897                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1898         }
1899
1900         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1901                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1902         }
1903
1904         /* If the caller set the core oplock request bit
1905                 and we granted one (by whatever means) - set the
1906                 correct bit for core oplock reply.
1907         */
1908
1909         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1910                 reply_outbuf(req, 19, 0);
1911         } else {
1912                 reply_outbuf(req, 15, 0);
1913         }
1914
1915         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1916                 SCVAL(req->outbuf, smb_flg,
1917                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1918         }
1919
1920         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1921                 SCVAL(req->outbuf, smb_flg,
1922                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1923         }
1924
1925         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1926         SSVAL(req->outbuf,smb_vwv3,fattr);
1927         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1928                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1929         } else {
1930                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1931         }
1932         SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1933         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1934         SSVAL(req->outbuf,smb_vwv11,smb_action);
1935
1936         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1937                 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1938         }
1939
1940         END_PROFILE(SMBopenX);
1941         chain_reply(req);
1942         return;
1943 }
1944
1945 /****************************************************************************
1946  Reply to a SMBulogoffX.
1947 ****************************************************************************/
1948
1949 void reply_ulogoffX(struct smb_request *req)
1950 {
1951         user_struct *vuser;
1952
1953         START_PROFILE(SMBulogoffX);
1954
1955         vuser = get_valid_user_struct(req->vuid);
1956
1957         if(vuser == NULL) {
1958                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1959                          req->vuid));
1960         }
1961
1962         /* in user level security we are supposed to close any files
1963                 open by this user */
1964         if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1965                 file_close_user(req->vuid);
1966         }
1967
1968         invalidate_vuid(req->vuid);
1969
1970         reply_outbuf(req, 2, 0);
1971
1972         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1973
1974         END_PROFILE(SMBulogoffX);
1975         chain_reply(req);
1976 }
1977
1978 /****************************************************************************
1979  Reply to a mknew or a create.
1980 ****************************************************************************/
1981
1982 void reply_mknew(struct smb_request *req)
1983 {
1984         connection_struct *conn = req->conn;
1985         char *fname = NULL;
1986         int com;
1987         uint32 fattr = 0;
1988         struct timespec ts[2];
1989         files_struct *fsp;
1990         int oplock_request = 0;
1991         SMB_STRUCT_STAT sbuf;
1992         NTSTATUS status;
1993         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1994         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1995         uint32 create_disposition;
1996         uint32 create_options = 0;
1997         TALLOC_CTX *ctx = talloc_tos();
1998
1999         START_PROFILE(SMBcreate);
2000
2001         if (req->wct < 3) {
2002                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2003                 END_PROFILE(SMBcreate);
2004                 return;
2005         }
2006
2007         fattr = SVAL(req->inbuf,smb_vwv0);
2008         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2009         com = SVAL(req->inbuf,smb_com);
2010
2011         ts[1] =convert_time_t_to_timespec(
2012                         srv_make_unix_date3(req->inbuf + smb_vwv1));
2013                         /* mtime. */
2014
2015         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
2016                         smb_buf(req->inbuf) + 1, 0,
2017                         STR_TERMINATE, &status);
2018         if (!NT_STATUS_IS_OK(status)) {
2019                 reply_nterror(req, status);
2020                 END_PROFILE(SMBcreate);
2021                 return;
2022         }
2023
2024         if (fattr & aVOLID) {
2025                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2026                         "please report this\n", fname));
2027         }
2028
2029         if(com == SMBmknew) {
2030                 /* We should fail if file exists. */
2031                 create_disposition = FILE_CREATE;
2032         } else {
2033                 /* Create if file doesn't exist, truncate if it does. */
2034                 create_disposition = FILE_OVERWRITE_IF;
2035         }
2036
2037         status = create_file(conn,                      /* conn */
2038                              req,                       /* req */
2039                              0,                         /* root_dir_fid */
2040                              fname,                     /* fname */
2041                              access_mask,               /* access_mask */
2042                              share_mode,                /* share_access */
2043                              create_disposition,        /* create_disposition*/
2044                              create_options,            /* create_options */
2045                              fattr,                     /* file_attributes */
2046                              oplock_request,            /* oplock_request */
2047                              0,                         /* allocation_size */
2048                              NULL,                      /* sd */
2049                              NULL,                      /* ea_list */
2050                              &fsp,                      /* result */
2051                              NULL,                      /* pinfo */
2052                              &sbuf);                    /* psbuf */
2053
2054         if (!NT_STATUS_IS_OK(status)) {
2055                 END_PROFILE(SMBcreate);
2056                 if (open_was_deferred(req->mid)) {
2057                         /* We have re-scheduled this call. */
2058                         return;
2059                 }
2060                 reply_openerror(req, status);
2061                 return;
2062         }
2063
2064         ts[0] = get_atimespec(&sbuf); /* atime. */
2065         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, ts, true);
2066         if (!NT_STATUS_IS_OK(status)) {
2067                 END_PROFILE(SMBcreate);
2068                 reply_openerror(req, status);
2069                 return;
2070         }
2071
2072         reply_outbuf(req, 1, 0);
2073         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2074
2075         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2076                 SCVAL(req->outbuf,smb_flg,
2077                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2078         }
2079
2080         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2081                 SCVAL(req->outbuf,smb_flg,
2082                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2083         }
2084
2085         DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2086         DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2087                     fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2088
2089         END_PROFILE(SMBcreate);
2090         return;
2091 }
2092
2093 /****************************************************************************
2094  Reply to a create temporary file.
2095 ****************************************************************************/
2096
2097 void reply_ctemp(struct smb_request *req)
2098 {
2099         connection_struct *conn = req->conn;
2100         char *fname = NULL;
2101         uint32 fattr;
2102         files_struct *fsp;
2103         int oplock_request;
2104         int tmpfd;
2105         SMB_STRUCT_STAT sbuf;
2106         char *s;
2107         NTSTATUS status;
2108         TALLOC_CTX *ctx = talloc_tos();
2109
2110         START_PROFILE(SMBctemp);
2111
2112         if (req->wct < 3) {
2113                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2114                 END_PROFILE(SMBctemp);
2115                 return;
2116         }
2117
2118         fattr = SVAL(req->inbuf,smb_vwv0);
2119         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2120
2121         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
2122                         smb_buf(req->inbuf)+1, 0, STR_TERMINATE,
2123                         &status);
2124         if (!NT_STATUS_IS_OK(status)) {
2125                 reply_nterror(req, status);
2126                 END_PROFILE(SMBctemp);
2127                 return;
2128         }
2129         if (*fname) {
2130                 fname = talloc_asprintf(ctx,
2131                                 "%s/TMXXXXXX",
2132                                 fname);
2133         } else {
2134                 fname = talloc_strdup(ctx, "TMXXXXXX");
2135         }
2136
2137         if (!fname) {
2138                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2139                 END_PROFILE(SMBctemp);
2140                 return;
2141         }
2142
2143         status = resolve_dfspath(ctx, conn,
2144                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2145                                 fname,
2146                                 &fname);
2147         if (!NT_STATUS_IS_OK(status)) {
2148                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2149                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2150                                         ERRSRV, ERRbadpath);
2151                         END_PROFILE(SMBctemp);
2152                         return;
2153                 }
2154                 reply_nterror(req, status);
2155                 END_PROFILE(SMBctemp);
2156                 return;
2157         }
2158
2159         status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2160         if (!NT_STATUS_IS_OK(status)) {
2161                 reply_nterror(req, status);
2162                 END_PROFILE(SMBctemp);
2163                 return;
2164         }
2165
2166         status = check_name(conn, fname);
2167         if (!NT_STATUS_IS_OK(status)) {
2168                 reply_nterror(req, status);
2169                 END_PROFILE(SMBctemp);
2170                 return;
2171         }
2172
2173         tmpfd = smb_mkstemp(fname);
2174         if (tmpfd == -1) {
2175                 reply_unixerror(req, ERRDOS, ERRnoaccess);
2176                 END_PROFILE(SMBctemp);
2177                 return;
2178         }
2179
2180         SMB_VFS_STAT(conn,fname,&sbuf);
2181
2182         /* We should fail if file does not exist. */
2183         status = open_file_ntcreate(conn, req, fname, &sbuf,
2184                                 FILE_GENERIC_READ | FILE_GENERIC_WRITE,
2185                                 FILE_SHARE_READ|FILE_SHARE_WRITE,
2186                                 FILE_OPEN,
2187                                 0,
2188                                 fattr,
2189                                 oplock_request,
2190                                 NULL, &fsp);
2191
2192         /* close fd from smb_mkstemp() */
2193         close(tmpfd);
2194
2195         if (!NT_STATUS_IS_OK(status)) {
2196                 if (open_was_deferred(req->mid)) {
2197                         /* We have re-scheduled this call. */
2198                         END_PROFILE(SMBctemp);
2199                         return;
2200                 }
2201                 reply_openerror(req, status);
2202                 END_PROFILE(SMBctemp);
2203                 return;
2204         }
2205
2206         reply_outbuf(req, 1, 0);
2207         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2208
2209         /* the returned filename is relative to the directory */
2210         s = strrchr_m(fsp->fsp_name, '/');
2211         if (!s) {
2212                 s = fsp->fsp_name;
2213         } else {
2214                 s++;
2215         }
2216
2217 #if 0
2218         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2219            thing in the byte section. JRA */
2220         SSVALS(p, 0, -1); /* what is this? not in spec */
2221 #endif
2222         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2223             == -1) {
2224                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2225                 END_PROFILE(SMBctemp);
2226                 return;
2227         }
2228
2229         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2230                 SCVAL(req->outbuf, smb_flg,
2231                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2232         }
2233
2234         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2235                 SCVAL(req->outbuf, smb_flg,
2236                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2237         }
2238
2239         DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2240         DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2241                     fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2242
2243         END_PROFILE(SMBctemp);
2244         return;
2245 }
2246
2247 /*******************************************************************
2248  Check if a user is allowed to rename a file.
2249 ********************************************************************/
2250
2251 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2252                            uint16 dirtype, SMB_STRUCT_STAT *pst)
2253 {
2254         uint32 fmode;
2255
2256         if (!CAN_WRITE(conn)) {
2257                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2258         }
2259
2260         fmode = dos_mode(conn, fsp->fsp_name, pst);
2261         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2262                 return NT_STATUS_NO_SUCH_FILE;
2263         }
2264
2265         if (S_ISDIR(pst->st_mode)) {
2266                 if (fsp->posix_open) {
2267                         return NT_STATUS_OK;
2268                 }
2269
2270                 /* If no pathnames are open below this
2271                    directory, allow the rename. */
2272
2273                 if (file_find_subpath(fsp)) {
2274                         return NT_STATUS_ACCESS_DENIED;
2275                 }
2276                 return NT_STATUS_OK;
2277         }
2278
2279         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2280                 return NT_STATUS_OK;
2281         }
2282
2283         return NT_STATUS_ACCESS_DENIED;
2284 }
2285
2286 /*******************************************************************
2287  * unlink a file with all relevant access checks
2288  *******************************************************************/
2289
2290 static NTSTATUS do_unlink(connection_struct *conn,
2291                         struct smb_request *req,
2292                         const char *fname,
2293                         uint32 dirtype)
2294 {
2295         SMB_STRUCT_STAT sbuf;
2296         uint32 fattr;
2297         files_struct *fsp;
2298         uint32 dirtype_orig = dirtype;
2299         NTSTATUS status;
2300
2301         DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2302
2303         if (!CAN_WRITE(conn)) {
2304                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2305         }
2306
2307         if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2308                 return map_nt_error_from_unix(errno);
2309         }
2310
2311         fattr = dos_mode(conn,fname,&sbuf);
2312
2313         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2314                 dirtype = aDIR|aARCH|aRONLY;
2315         }
2316
2317         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2318         if (!dirtype) {
2319                 return NT_STATUS_NO_SUCH_FILE;
2320         }
2321
2322         if (!dir_check_ftype(conn, fattr, dirtype)) {
2323                 if (fattr & aDIR) {
2324                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2325                 }
2326                 return NT_STATUS_NO_SUCH_FILE;
2327         }
2328
2329         if (dirtype_orig & 0x8000) {
2330                 /* These will never be set for POSIX. */
2331                 return NT_STATUS_NO_SUCH_FILE;
2332         }
2333
2334 #if 0
2335         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2336                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2337         }
2338
2339         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2340                 return NT_STATUS_NO_SUCH_FILE;
2341         }
2342
2343         if (dirtype & 0xFF00) {
2344                 /* These will never be set for POSIX. */
2345                 return NT_STATUS_NO_SUCH_FILE;
2346         }
2347
2348         dirtype &= 0xFF;
2349         if (!dirtype) {
2350                 return NT_STATUS_NO_SUCH_FILE;
2351         }
2352
2353         /* Can't delete a directory. */
2354         if (fattr & aDIR) {
2355                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2356         }
2357 #endif
2358
2359 #if 0 /* JRATEST */
2360         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2361                 return NT_STATUS_OBJECT_NAME_INVALID;
2362 #endif /* JRATEST */
2363
2364         /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2365
2366           On a Windows share, a file with read-only dosmode can be opened with
2367           DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2368           fails with NT_STATUS_CANNOT_DELETE error.
2369
2370           This semantic causes a problem that a user can not
2371           rename a file with read-only dosmode on a Samba share
2372           from a Windows command prompt (i.e. cmd.exe, but can rename
2373           from Windows Explorer).
2374         */
2375
2376         if (!lp_delete_readonly(SNUM(conn))) {
2377                 if (fattr & aRONLY) {
2378                         return NT_STATUS_CANNOT_DELETE;
2379                 }
2380         }
2381
2382         /* On open checks the open itself will check the share mode, so
2383            don't do it here as we'll get it wrong. */
2384
2385         status = create_file_unixpath
2386                 (conn,                  /* conn */
2387                  req,                   /* req */
2388                  fname,                 /* fname */
2389                  DELETE_ACCESS,         /* access_mask */
2390                  FILE_SHARE_NONE,       /* share_access */
2391                  FILE_OPEN,             /* create_disposition*/
2392                  FILE_NON_DIRECTORY_FILE, /* create_options */
2393                  FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2394                  0,                     /* oplock_request */
2395                  0,                     /* allocation_size */
2396                  NULL,                  /* sd */
2397                  NULL,                  /* ea_list */
2398                  &fsp,                  /* result */
2399                  NULL,                  /* pinfo */
2400                  &sbuf);                /* psbuf */
2401
2402         if (!NT_STATUS_IS_OK(status)) {
2403                 DEBUG(10, ("create_file_unixpath failed: %s\n",
2404                            nt_errstr(status)));
2405                 return status;
2406         }
2407
2408         /* The set is across all open files on this dev/inode pair. */
2409         if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2410                 close_file(fsp, NORMAL_CLOSE);
2411                 return NT_STATUS_ACCESS_DENIED;
2412         }
2413
2414         return close_file(fsp,NORMAL_CLOSE);
2415 }
2416
2417 /****************************************************************************
2418  The guts of the unlink command, split out so it may be called by the NT SMB
2419  code.
2420 ****************************************************************************/
2421
2422 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2423                           uint32 dirtype, const char *name_in, bool has_wild)
2424 {
2425         const char *directory = NULL;
2426         char *mask = NULL;
2427         char *name = NULL;
2428         char *p = NULL;
2429         int count=0;
2430         NTSTATUS status = NT_STATUS_OK;
2431         SMB_STRUCT_STAT sbuf;
2432         TALLOC_CTX *ctx = talloc_tos();
2433
2434         status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2435         if (!NT_STATUS_IS_OK(status)) {
2436                 return status;
2437         }
2438
2439         p = strrchr_m(name,'/');
2440         if (!p) {
2441                 directory = talloc_strdup(ctx, ".");
2442                 if (!directory) {
2443                         return NT_STATUS_NO_MEMORY;
2444                 }
2445                 mask = name;
2446         } else {
2447                 *p = 0;
2448                 directory = name;
2449                 mask = p+1;
2450         }
2451
2452         /*
2453          * We should only check the mangled cache
2454          * here if unix_convert failed. This means
2455          * that the path in 'mask' doesn't exist
2456          * on the file system and so we need to look
2457          * for a possible mangle. This patch from
2458          * Tine Smukavec <valentin.smukavec@hermes.si>.
2459          */
2460
2461         if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2462                 char *new_mask = NULL;
2463                 mangle_lookup_name_from_8_3(ctx,
2464                                 mask,
2465                                 &new_mask,
2466                                 conn->params );
2467                 if (new_mask) {
2468                         mask = new_mask;
2469                 }
2470         }
2471
2472         if (!has_wild) {
2473                 directory = talloc_asprintf(ctx,
2474                                 "%s/%s",
2475                                 directory,
2476                                 mask);
2477                 if (!directory) {
2478                         return NT_STATUS_NO_MEMORY;
2479                 }
2480                 if (dirtype == 0) {
2481                         dirtype = FILE_ATTRIBUTE_NORMAL;
2482                 }
2483
2484                 status = check_name(conn, directory);
2485                 if (!NT_STATUS_IS_OK(status)) {
2486                         return status;
2487                 }
2488
2489                 status = do_unlink(conn, req, directory, dirtype);
2490                 if (!NT_STATUS_IS_OK(status)) {
2491                         return status;
2492                 }
2493
2494                 count++;
2495         } else {
2496                 struct smb_Dir *dir_hnd = NULL;
2497                 long offset = 0;
2498                 const char *dname;
2499
2500                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2501                         return NT_STATUS_OBJECT_NAME_INVALID;
2502                 }
2503
2504                 if (strequal(mask,"????????.???")) {
2505                         mask[0] = '*';
2506                         mask[1] = '\0';
2507                 }
2508
2509                 status = check_name(conn, directory);
2510                 if (!NT_STATUS_IS_OK(status)) {
2511                         return status;
2512                 }
2513
2514                 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2515                                   dirtype);
2516                 if (dir_hnd == NULL) {
2517                         return map_nt_error_from_unix(errno);
2518                 }
2519
2520                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2521                    the pattern matches against the long name, otherwise the short name
2522                    We don't implement this yet XXXX
2523                 */
2524
2525                 status = NT_STATUS_NO_SUCH_FILE;
2526
2527                 while ((dname = ReadDirName(dir_hnd, &offset))) {
2528                         SMB_STRUCT_STAT st;
2529                         char *fname = NULL;
2530
2531                         if (!is_visible_file(conn, directory, dname, &st, True)) {
2532                                 continue;
2533                         }
2534
2535                         /* Quick check for "." and ".." */
2536                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2537                                 continue;
2538                         }
2539
2540                         if(!mask_match(dname, mask, conn->case_sensitive)) {
2541                                 continue;
2542                         }
2543
2544                         fname = talloc_asprintf(ctx, "%s/%s",
2545                                         directory,
2546                                         dname);
2547                         if (!fname) {
2548                                 return NT_STATUS_NO_MEMORY;
2549                         }
2550
2551                         status = check_name(conn, fname);
2552                         if (!NT_STATUS_IS_OK(status)) {
2553                                 TALLOC_FREE(dir_hnd);
2554                                 return status;
2555                         }
2556
2557                         status = do_unlink(conn, req, fname, dirtype);
2558                         if (!NT_STATUS_IS_OK(status)) {
2559                                 TALLOC_FREE(fname);
2560                                 continue;
2561                         }
2562
2563                         count++;
2564                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2565                                  fname));
2566
2567                         TALLOC_FREE(fname);
2568                 }
2569                 TALLOC_FREE(dir_hnd);
2570         }
2571
2572         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2573                 status = map_nt_error_from_unix(errno);
2574         }
2575
2576         return status;
2577 }
2578
2579 /****************************************************************************
2580  Reply to a unlink
2581 ****************************************************************************/
2582
2583 void reply_unlink(struct smb_request *req)
2584 {
2585         connection_struct *conn = req->conn;
2586         char *name = NULL;
2587         uint32 dirtype;
2588         NTSTATUS status;
2589         bool path_contains_wcard = False;
2590         TALLOC_CTX *ctx = talloc_tos();
2591
2592         START_PROFILE(SMBunlink);
2593
2594         if (req->wct < 1) {
2595                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2596                 END_PROFILE(SMBunlink);
2597                 return;
2598         }
2599
2600         dirtype = SVAL(req->inbuf,smb_vwv0);
2601
2602         srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name,
2603                               smb_buf(req->inbuf) + 1, 0,
2604                               STR_TERMINATE, &status, &path_contains_wcard);
2605         if (!NT_STATUS_IS_OK(status)) {
2606                 reply_nterror(req, status);
2607                 END_PROFILE(SMBunlink);
2608                 return;
2609         }
2610
2611         status = resolve_dfspath_wcard(ctx, conn,
2612                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
2613                                        name,
2614                                        &name,
2615                                        &path_contains_wcard);
2616         if (!NT_STATUS_IS_OK(status)) {
2617                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2618                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2619                                         ERRSRV, ERRbadpath);
2620                         END_PROFILE(SMBunlink);
2621                         return;
2622                 }
2623                 reply_nterror(req, status);
2624                 END_PROFILE(SMBunlink);
2625                 return;
2626         }
2627
2628         DEBUG(3,("reply_unlink : %s\n",name));
2629
2630         status = unlink_internals(conn, req, dirtype, name,
2631                                   path_contains_wcard);
2632         if (!NT_STATUS_IS_OK(status)) {
2633                 if (open_was_deferred(req->mid)) {
2634                         /* We have re-scheduled this call. */
2635                         END_PROFILE(SMBunlink);
2636                         return;
2637                 }
2638                 reply_nterror(req, status);
2639                 END_PROFILE(SMBunlink);
2640                 return;
2641         }
2642
2643         reply_outbuf(req, 0, 0);
2644         END_PROFILE(SMBunlink);
2645
2646         return;
2647 }
2648
2649 /****************************************************************************
2650  Fail for readbraw.
2651 ****************************************************************************/
2652
2653 static void fail_readraw(void)
2654 {
2655         const char *errstr = talloc_asprintf(talloc_tos(),
2656                         "FAIL ! reply_readbraw: socket write fail (%s)",
2657                         strerror(errno));
2658         if (!errstr) {
2659                 errstr = "";
2660         }
2661         exit_server_cleanly(errstr);
2662 }
2663
2664 /****************************************************************************
2665  Fake (read/write) sendfile. Returns -1 on read or write fail.
2666 ****************************************************************************/
2667
2668 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2669                              size_t nread)
2670 {
2671         size_t bufsize;
2672         size_t tosend = nread;
2673         char *buf;
2674
2675         if (nread == 0) {
2676                 return 0;
2677         }
2678
2679         bufsize = MIN(nread, 65536);
2680
2681         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2682                 return -1;
2683         }
2684
2685         while (tosend > 0) {
2686                 ssize_t ret;
2687                 size_t cur_read;
2688
2689                 if (tosend > bufsize) {
2690                         cur_read = bufsize;
2691                 } else {
2692                         cur_read = tosend;
2693                 }
2694                 ret = read_file(fsp,buf,startpos,cur_read);
2695                 if (ret == -1) {
2696                         SAFE_FREE(buf);
2697                         return -1;
2698                 }
2699
2700                 /* If we had a short read, fill with zeros. */
2701                 if (ret < cur_read) {
2702                         memset(buf, '\0', cur_read - ret);
2703                 }
2704
2705                 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2706                         SAFE_FREE(buf);
2707                         return -1;
2708                 }
2709                 tosend -= cur_read;
2710                 startpos += cur_read;
2711         }
2712
2713         SAFE_FREE(buf);
2714         return (ssize_t)nread;
2715 }
2716
2717 /****************************************************************************
2718  Return a readbraw error (4 bytes of zero).
2719 ****************************************************************************/
2720
2721 static void reply_readbraw_error(void)
2722 {
2723         char header[4];
2724         SIVAL(header,0,0);
2725         if (write_data(smbd_server_fd(),header,4) != 4) {
2726                 fail_readraw();
2727         }
2728 }
2729
2730 /****************************************************************************
2731  Use sendfile in readbraw.
2732 ****************************************************************************/
2733
2734 void send_file_readbraw(connection_struct *conn,
2735                         files_struct *fsp,
2736                         SMB_OFF_T startpos,
2737                         size_t nread,
2738                         ssize_t mincount)
2739 {
2740         char *outbuf = NULL;
2741         ssize_t ret=0;
2742
2743 #if defined(WITH_SENDFILE)
2744         /*
2745          * We can only use sendfile on a non-chained packet
2746          * but we can use on a non-oplocked file. tridge proved this
2747          * on a train in Germany :-). JRA.
2748          * reply_readbraw has already checked the length.
2749          */
2750
2751         if ( (chain_size == 0) && (nread > 0) && (fsp->base_fsp == NULL) &&
2752             (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2753                 char header[4];
2754                 DATA_BLOB header_blob;
2755
2756                 _smb_setlen(header,nread);
2757                 header_blob = data_blob_const(header, 4);
2758
2759                 if (SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2760                                 &header_blob, startpos, nread) == -1) {
2761                         /* Returning ENOSYS means no data at all was sent.
2762                          * Do this as a normal read. */
2763                         if (errno == ENOSYS) {
2764                                 goto normal_readbraw;
2765                         }
2766
2767                         /*
2768                          * Special hack for broken Linux with no working sendfile. If we
2769                          * return EINTR we sent the header but not the rest of the data.
2770                          * Fake this up by doing read/write calls.
2771                          */
2772                         if (errno == EINTR) {
2773                                 /* Ensure we don't do this again. */
2774                                 set_use_sendfile(SNUM(conn), False);
2775                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2776
2777                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
2778                                         DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2779                                                 fsp->fsp_name, strerror(errno) ));
2780                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2781                                 }
2782                                 return;
2783                         }
2784
2785                         DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2786                                 fsp->fsp_name, strerror(errno) ));
2787                         exit_server_cleanly("send_file_readbraw sendfile failed");
2788                 }
2789
2790                 return;
2791         }
2792
2793 normal_readbraw:
2794 #endif
2795
2796         outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2797         if (!outbuf) {
2798                 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2799                         (unsigned)(nread+4)));
2800                 reply_readbraw_error();
2801                 return;
2802         }
2803
2804         if (nread > 0) {
2805                 ret = read_file(fsp,outbuf+4,startpos,nread);
2806 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2807                 if (ret < mincount)
2808                         ret = 0;
2809 #else
2810                 if (ret < nread)
2811                         ret = 0;
2812 #endif
2813         }
2814
2815         _smb_setlen(outbuf,ret);
2816         if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2817                 fail_readraw();
2818
2819         TALLOC_FREE(outbuf);
2820 }
2821
2822 /****************************************************************************
2823  Reply to a readbraw (core+ protocol).
2824 ****************************************************************************/
2825
2826 void reply_readbraw(struct smb_request *req)
2827 {
2828         connection_struct *conn = req->conn;
2829         ssize_t maxcount,mincount;
2830         size_t nread = 0;
2831         SMB_OFF_T startpos;
2832         files_struct *fsp;
2833         SMB_STRUCT_STAT st;
2834         SMB_OFF_T size = 0;
2835
2836         START_PROFILE(SMBreadbraw);
2837
2838         if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
2839                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2840                         "raw reads/writes are disallowed.");
2841         }
2842
2843         if (req->wct < 8) {
2844                 reply_readbraw_error();
2845                 END_PROFILE(SMBreadbraw);
2846                 return;
2847         }
2848
2849         /*
2850          * Special check if an oplock break has been issued
2851          * and the readraw request croses on the wire, we must
2852          * return a zero length response here.
2853          */
2854
2855         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
2856
2857         /*
2858          * We have to do a check_fsp by hand here, as
2859          * we must always return 4 zero bytes on error,
2860          * not a NTSTATUS.
2861          */
2862
2863         if (!fsp || !conn || conn != fsp->conn ||
2864                         req->vuid != fsp->vuid ||
2865                         fsp->is_directory || fsp->fh->fd == -1) {
2866                 /*
2867                  * fsp could be NULL here so use the value from the packet. JRA.
2868                  */
2869                 DEBUG(3,("reply_readbraw: fnum %d not valid "
2870                         "- cache prime?\n",
2871                         (int)SVAL(req->inbuf,smb_vwv0)));
2872                 reply_readbraw_error();
2873                 END_PROFILE(SMBreadbraw);
2874                 return;
2875         }
2876
2877         /* Do a "by hand" version of CHECK_READ. */
2878         if (!(fsp->can_read ||
2879                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2880                                 (fsp->access_mask & FILE_EXECUTE)))) {
2881                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2882                                 (int)SVAL(req->inbuf,smb_vwv0)));
2883                 reply_readbraw_error();
2884                 END_PROFILE(SMBreadbraw);
2885                 return;
2886         }
2887
2888         flush_write_cache(fsp, READRAW_FLUSH);
2889
2890         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv1);
2891         if(req->wct == 10) {
2892                 /*
2893                  * This is a large offset (64 bit) read.
2894                  */
2895 #ifdef LARGE_SMB_OFF_T
2896
2897                 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv8)) << 32);
2898
2899 #else /* !LARGE_SMB_OFF_T */
2900
2901                 /*
2902                  * Ensure we haven't been sent a >32 bit offset.
2903                  */
2904
2905                 if(IVAL(req->inbuf,smb_vwv8) != 0) {
2906                         DEBUG(0,("reply_readbraw: large offset "
2907                                 "(%x << 32) used and we don't support "
2908                                 "64 bit offsets.\n",
2909                         (unsigned int)IVAL(req->inbuf,smb_vwv8) ));
2910                         reply_readbraw_error();
2911                         END_PROFILE(SMBreadbraw);
2912                         return;
2913                 }
2914
2915 #endif /* LARGE_SMB_OFF_T */
2916
2917                 if(startpos < 0) {
2918                         DEBUG(0,("reply_readbraw: negative 64 bit "
2919                                 "readraw offset (%.0f) !\n",
2920                                 (double)startpos ));
2921                         reply_readbraw_error();
2922                         END_PROFILE(SMBreadbraw);
2923                         return;
2924                 }
2925         }
2926
2927         maxcount = (SVAL(req->inbuf,smb_vwv3) & 0xFFFF);
2928         mincount = (SVAL(req->inbuf,smb_vwv4) & 0xFFFF);
2929
2930         /* ensure we don't overrun the packet size */
2931         maxcount = MIN(65535,maxcount);
2932
2933         if (is_locked(fsp,(uint32)req->smbpid,
2934                         (SMB_BIG_UINT)maxcount,
2935                         (SMB_BIG_UINT)startpos,
2936                         READ_LOCK)) {
2937                 reply_readbraw_error();
2938                 END_PROFILE(SMBreadbraw);
2939                 return;
2940         }
2941
2942         if (SMB_VFS_FSTAT(fsp, &st) == 0) {
2943                 size = st.st_size;
2944         }
2945
2946         if (startpos >= size) {
2947                 nread = 0;
2948         } else {
2949                 nread = MIN(maxcount,(size - startpos));
2950         }
2951
2952 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2953         if (nread < mincount)
2954                 nread = 0;
2955 #endif
2956
2957         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
2958                 "min=%lu nread=%lu\n",
2959                 fsp->fnum, (double)startpos,
2960                 (unsigned long)maxcount,
2961                 (unsigned long)mincount,
2962                 (unsigned long)nread ) );
2963
2964         send_file_readbraw(conn, fsp, startpos, nread, mincount);
2965
2966         DEBUG(5,("reply_readbraw finished\n"));
2967         END_PROFILE(SMBreadbraw);
2968 }
2969
2970 #undef DBGC_CLASS
2971 #define DBGC_CLASS DBGC_LOCKING
2972
2973 /****************************************************************************
2974  Reply to a lockread (core+ protocol).
2975 ****************************************************************************/
2976
2977 void reply_lockread(struct smb_request *req)
2978 {
2979         connection_struct *conn = req->conn;
2980         ssize_t nread = -1;
2981         char *data;
2982         SMB_OFF_T startpos;
2983         size_t numtoread;
2984         NTSTATUS status;
2985         files_struct *fsp;
2986         struct byte_range_lock *br_lck = NULL;
2987         char *p = NULL;
2988
2989         START_PROFILE(SMBlockread);
2990
2991         if (req->wct < 5) {
2992                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2993                 END_PROFILE(SMBlockread);
2994                 return;
2995         }
2996
2997         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
2998
2999         if (!check_fsp(conn, req, fsp)) {
3000                 END_PROFILE(SMBlockread);
3001                 return;
3002         }
3003
3004         if (!CHECK_READ(fsp,req->inbuf)) {
3005                 reply_doserror(req, ERRDOS, ERRbadaccess);
3006                 END_PROFILE(SMBlockread);
3007                 return;
3008         }
3009
3010         release_level_2_oplocks_on_change(fsp);
3011
3012         numtoread = SVAL(req->inbuf,smb_vwv1);
3013         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3014
3015         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3016
3017         reply_outbuf(req, 5, numtoread + 3);
3018
3019         data = smb_buf(req->outbuf) + 3;
3020
3021         /*
3022          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3023          * protocol request that predates the read/write lock concept.
3024          * Thus instead of asking for a read lock here we need to ask
3025          * for a write lock. JRA.
3026          * Note that the requested lock size is unaffected by max_recv.
3027          */
3028
3029         br_lck = do_lock(smbd_messaging_context(),
3030                         fsp,
3031                         req->smbpid,
3032                         (SMB_BIG_UINT)numtoread,
3033                         (SMB_BIG_UINT)startpos,
3034                         WRITE_LOCK,
3035                         WINDOWS_LOCK,
3036                         False, /* Non-blocking lock. */
3037                         &status,
3038                         NULL);
3039         TALLOC_FREE(br_lck);
3040
3041         if (NT_STATUS_V(status)) {
3042                 reply_nterror(req, status);
3043                 END_PROFILE(SMBlockread);
3044                 return;
3045         }
3046
3047         /*
3048          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3049          */
3050
3051         if (numtoread > max_recv) {
3052                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3053 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3054                         (unsigned int)numtoread, (unsigned int)max_recv ));
3055                 numtoread = MIN(numtoread,max_recv);
3056         }
3057         nread = read_file(fsp,data,startpos,numtoread);
3058
3059         if (nread < 0) {
3060                 reply_unixerror(req, ERRDOS, ERRnoaccess);
3061                 END_PROFILE(SMBlockread);
3062                 return;
3063         }
3064
3065         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3066
3067         SSVAL(req->outbuf,smb_vwv0,nread);
3068         SSVAL(req->outbuf,smb_vwv5,nread+3);
3069         p = smb_buf(req->outbuf);
3070         SCVAL(p,0,0); /* pad byte. */
3071         SSVAL(p,1,nread);
3072
3073         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3074                  fsp->fnum, (int)numtoread, (int)nread));
3075
3076         END_PROFILE(SMBlockread);
3077         return;
3078 }
3079
3080 #undef DBGC_CLASS
3081 #define DBGC_CLASS DBGC_ALL
3082
3083 /****************************************************************************
3084  Reply to a read.
3085 ****************************************************************************/
3086
3087 void reply_read(struct smb_request *req)
3088 {
3089         connection_struct *conn = req->conn;
3090         size_t numtoread;
3091         ssize_t nread = 0;
3092         char *data;
3093         SMB_OFF_T startpos;
3094         int outsize = 0;
3095         files_struct *fsp;
3096
3097         START_PROFILE(SMBread);
3098
3099         if (req->wct < 3) {
3100                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3101                 END_PROFILE(SMBread);
3102                 return;
3103         }
3104
3105         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3106
3107         if (!check_fsp(conn, req, fsp)) {
3108                 END_PROFILE(SMBread);
3109                 return;
3110         }
3111
3112         if (!CHECK_READ(fsp,req->inbuf)) {
3113                 reply_doserror(req, ERRDOS, ERRbadaccess);
3114                 END_PROFILE(SMBread);
3115                 return;
3116         }
3117
3118         numtoread = SVAL(req->inbuf,smb_vwv1);
3119         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3120
3121         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3122
3123         /*
3124          * The requested read size cannot be greater than max_recv. JRA.
3125          */
3126         if (numtoread > max_recv) {
3127                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3128 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3129                         (unsigned int)numtoread, (unsigned int)max_recv ));
3130                 numtoread = MIN(numtoread,max_recv);
3131         }
3132
3133         reply_outbuf(req, 5, numtoread+3);
3134
3135         data = smb_buf(req->outbuf) + 3;
3136
3137         if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtoread,
3138                       (SMB_BIG_UINT)startpos, READ_LOCK)) {
3139                 reply_doserror(req, ERRDOS,ERRlock);
3140                 END_PROFILE(SMBread);
3141                 return;
3142         }
3143
3144         if (numtoread > 0)
3145                 nread = read_file(fsp,data,startpos,numtoread);
3146
3147         if (nread < 0) {
3148                 reply_unixerror(req, ERRDOS,ERRnoaccess);
3149                 END_PROFILE(SMBread);
3150                 return;
3151         }
3152
3153         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3154
3155         SSVAL(req->outbuf,smb_vwv0,nread);
3156         SSVAL(req->outbuf,smb_vwv5,nread+3);
3157         SCVAL(smb_buf(req->outbuf),0,1);
3158         SSVAL(smb_buf(req->outbuf),1,nread);
3159
3160         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3161                 fsp->fnum, (int)numtoread, (int)nread ) );
3162
3163         END_PROFILE(SMBread);
3164         return;
3165 }
3166
3167 /****************************************************************************
3168  Setup readX header.
3169 ****************************************************************************/
3170
3171 static int setup_readX_header(char *outbuf, size_t smb_maxcnt)
3172 {
3173         int outsize;
3174         char *data;
3175
3176         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3177         data = smb_buf(outbuf);
3178
3179         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3180
3181         SCVAL(outbuf,smb_vwv0,0xFF);
3182         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3183         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3184         SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
3185         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3186         SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
3187         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3188         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3189         return outsize;
3190 }
3191
3192 /****************************************************************************
3193  Reply to a read and X - possibly using sendfile.
3194 ****************************************************************************/
3195
3196 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3197                             files_struct *fsp, SMB_OFF_T startpos,
3198                             size_t smb_maxcnt)
3199 {
3200         SMB_STRUCT_STAT sbuf;
3201         ssize_t nread = -1;
3202
3203         if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3204                 reply_unixerror(req, ERRDOS, ERRnoaccess);
3205                 return;
3206         }
3207
3208         if (startpos > sbuf.st_size) {
3209                 smb_maxcnt = 0;
3210         } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
3211                 smb_maxcnt = (sbuf.st_size - startpos);
3212         }
3213
3214         if (smb_maxcnt == 0) {
3215                 goto normal_read;
3216         }
3217
3218 #if defined(WITH_SENDFILE)
3219         /*
3220          * We can only use sendfile on a non-chained packet
3221          * but we can use on a non-oplocked file. tridge proved this
3222          * on a train in Germany :-). JRA.
3223          */
3224
3225         if ((chain_size == 0) && (CVAL(req->inbuf,smb_vwv0) == 0xFF) &&
3226             !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3227             lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
3228                 uint8 headerbuf[smb_size + 12 * 2];
3229                 DATA_BLOB header;
3230
3231                 /*
3232                  * Set up the packet header before send. We
3233                  * assume here the sendfile will work (get the
3234                  * correct amount of data).
3235                  */
3236
3237                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3238
3239                 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3240                 setup_readX_header((char *)headerbuf, smb_maxcnt);
3241
3242                 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3243                         /* Returning ENOSYS means no data at all was sent.
3244                            Do this as a normal read. */
3245                         if (errno == ENOSYS) {
3246                                 goto normal_read;
3247                         }
3248
3249                         /*
3250                          * Special hack for broken Linux with no working sendfile. If we
3251                          * return EINTR we sent the header but not the rest of the data.
3252                          * Fake this up by doing read/write calls.
3253                          */
3254
3255                         if (errno == EINTR) {
3256                                 /* Ensure we don't do this again. */
3257                                 set_use_sendfile(SNUM(conn), False);
3258                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3259                                 nread = fake_sendfile(fsp, startpos,
3260                                                       smb_maxcnt);
3261                                 if (nread == -1) {
3262                                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3263                                                 fsp->fsp_name, strerror(errno) ));
3264                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3265                                 }
3266                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3267                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3268                                 /* No outbuf here means successful sendfile. */
3269                                 TALLOC_FREE(req->outbuf);
3270                                 return;
3271                         }
3272
3273                         DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3274                                 fsp->fsp_name, strerror(errno) ));
3275                         exit_server_cleanly("send_file_readX sendfile failed");
3276                 }
3277
3278                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3279                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3280                 /* No outbuf here means successful sendfile. */
3281                 TALLOC_FREE(req->outbuf);
3282                 return;
3283         }
3284 #endif
3285
3286 normal_read:
3287
3288         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3289                 uint8 headerbuf[smb_size + 2*12];
3290
3291                 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3292                 setup_readX_header((char *)headerbuf, smb_maxcnt);
3293
3294                 /* Send out the header. */
3295                 if (write_data(smbd_server_fd(), (char *)headerbuf,
3296                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3297                         DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3298                                 fsp->fsp_name, strerror(errno) ));
3299                         exit_server_cleanly("send_file_readX sendfile failed");
3300                 }
3301                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3302                 if (nread == -1) {
3303                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3304                                 fsp->fsp_name, strerror(errno) ));
3305                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3306                 }
3307                 TALLOC_FREE(req->outbuf);
3308                 return;
3309         } else {
3310                 reply_outbuf(req, 12, smb_maxcnt);
3311
3312                 nread = read_file(fsp, smb_buf(req->outbuf), startpos,
3313                                   smb_maxcnt);
3314                 if (nread < 0) {
3315                         reply_unixerror(req, ERRDOS, ERRnoaccess);
3316                         return;
3317                 }
3318
3319                 setup_readX_header((char *)req->outbuf, nread);
3320
3321                 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3322                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3323
3324                 chain_reply(req);
3325
3326                 return;
3327         }
3328 }
3329
3330 /****************************************************************************
3331  Reply to a read and X.
3332 ****************************************************************************/
3333
3334 void reply_read_and_X(struct smb_request *req)
3335 {
3336         connection_struct *conn = req->conn;
3337         files_struct *fsp;
3338         SMB_OFF_T startpos;
3339         size_t smb_maxcnt;
3340         bool big_readX = False;
3341 #if 0
3342         size_t smb_mincnt = SVAL(req->inbuf,smb_vwv6);
3343 #endif
3344
3345         START_PROFILE(SMBreadX);
3346
3347         if ((req->wct != 10) && (req->wct != 12)) {
3348                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3349                 return;
3350         }
3351
3352         fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
3353         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3354         smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
3355
3356         /* If it's an IPC, pass off the pipe handler. */
3357         if (IS_IPC(conn)) {
3358                 reply_pipe_read_and_X(req);
3359                 END_PROFILE(SMBreadX);
3360                 return;
3361         }
3362
3363         if (!check_fsp(conn, req, fsp)) {
3364                 END_PROFILE(SMBreadX);
3365                 return;
3366         }
3367
3368         if (!CHECK_READ(fsp,req->inbuf)) {
3369                 reply_doserror(req, ERRDOS,ERRbadaccess);
3370                 END_PROFILE(SMBreadX);
3371                 return;
3372         }
3373
3374         if (global_client_caps & CAP_LARGE_READX) {
3375                 size_t upper_size = SVAL(req->inbuf,smb_vwv7);
3376                 smb_maxcnt |= (upper_size<<16);
3377                 if (upper_size > 1) {
3378                         /* Can't do this on a chained packet. */
3379                         if ((CVAL(req->inbuf,smb_vwv0) != 0xFF)) {
3380                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3381                                 END_PROFILE(SMBreadX);
3382                                 return;
3383                         }
3384                         /* We currently don't do this on signed or sealed data. */
3385                         if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
3386                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3387                                 END_PROFILE(SMBreadX);
3388                                 return;
3389                         }
3390                         /* Is there room in the reply for this data ? */
3391                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3392                                 reply_nterror(req,
3393                                               NT_STATUS_INVALID_PARAMETER);
3394                                 END_PROFILE(SMBreadX);
3395                                 return;
3396                         }
3397                         big_readX = True;
3398                 }
3399         }
3400
3401         if (req->wct == 12) {
3402 #ifdef LARGE_SMB_OFF_T
3403                 /*
3404                  * This is a large offset (64 bit) read.
3405                  */
3406                 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv10)) << 32);
3407
3408 #else /* !LARGE_SMB_OFF_T */
3409
3410                 /*
3411                  * Ensure we haven't been sent a >32 bit offset.
3412                  */
3413
3414                 if(IVAL(req->inbuf,smb_vwv10) != 0) {
3415                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3416                                  "used and we don't support 64 bit offsets.\n",
3417                                  (unsigned int)IVAL(req->inbuf,smb_vwv10) ));
3418                         END_PROFILE(SMBreadX);
3419                         reply_doserror(req, ERRDOS, ERRbadaccess);
3420                         return;
3421                 }
3422
3423 #endif /* LARGE_SMB_OFF_T */
3424
3425         }
3426
3427         if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)smb_maxcnt,
3428                       (SMB_BIG_UINT)startpos, READ_LOCK)) {
3429                 END_PROFILE(SMBreadX);
3430                 reply_doserror(req, ERRDOS, ERRlock);
3431                 return;
3432         }
3433
3434         if (!big_readX &&
3435             schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3436                 END_PROFILE(SMBreadX);
3437                 return;
3438         }
3439
3440         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3441
3442         END_PROFILE(SMBreadX);
3443         return;
3444 }
3445
3446 /****************************************************************************
3447  Error replies to writebraw must have smb_wct == 1. Fix this up.
3448 ****************************************************************************/
3449
3450 void error_to_writebrawerr(struct smb_request *req)
3451 {
3452         uint8 *old_outbuf = req->outbuf;
3453
3454         reply_outbuf(req, 1, 0);
3455
3456         memcpy(req->outbuf, old_outbuf, smb_size);
3457         TALLOC_FREE(old_outbuf);
3458 }
3459
3460 /****************************************************************************
3461  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3462 ****************************************************************************/
3463
3464 void reply_writebraw(struct smb_request *req)
3465 {
3466         connection_struct *conn = req->conn;
3467         char *buf = NULL;
3468         ssize_t nwritten=0;
3469         ssize_t total_written=0;
3470         size_t numtowrite=0;
3471         size_t tcount;
3472         SMB_OFF_T startpos;
3473         char *data=NULL;
3474         bool write_through;
3475         files_struct *fsp;
3476         NTSTATUS status;
3477
3478         START_PROFILE(SMBwritebraw);
3479
3480         /*
3481          * If we ever reply with an error, it must have the SMB command
3482          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3483          * we're finished.
3484          */
3485         SCVAL(req->inbuf,smb_com,SMBwritec);
3486
3487         if (srv_is_signing_active()) {
3488                 END_PROFILE(SMBwritebraw);
3489                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3490                                 "raw reads/writes are disallowed.");
3491         }
3492
3493         if (req->wct < 12) {
3494                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3495                 error_to_writebrawerr(req);
3496                 END_PROFILE(SMBwritebraw);
3497                 return;
3498         }
3499
3500         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3501         if (!check_fsp(conn, req, fsp)) {
3502                 error_to_writebrawerr(req);
3503                 END_PROFILE(SMBwritebraw);
3504                 return;
3505         }
3506
3507         if (!CHECK_WRITE(fsp)) {
3508                 reply_doserror(req, ERRDOS, ERRbadaccess);
3509                 error_to_writebrawerr(req);
3510                 END_PROFILE(SMBwritebraw);
3511                 return;
3512         }
3513
3514         tcount = IVAL(req->inbuf,smb_vwv1);
3515         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3516         write_through = BITSETW(req->inbuf+smb_vwv7,0);
3517
3518         /* We have to deal with slightly different formats depending
3519                 on whether we are using the core+ or lanman1.0 protocol */
3520
3521         if(Protocol <= PROTOCOL_COREPLUS) {
3522                 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3523                 data = smb_buf(req->inbuf);
3524         } else {
3525                 numtowrite = SVAL(req->inbuf,smb_vwv10);
3526                 data = smb_base(req->inbuf) + SVAL(req->inbuf, smb_vwv11);
3527         }
3528
3529         /* Ensure we don't write bytes past the end of this packet. */
3530         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3531                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3532                 error_to_writebrawerr(req);
3533                 END_PROFILE(SMBwritebraw);
3534                 return;
3535         }
3536
3537         if (is_locked(fsp,(uint32)req->smbpid,(SMB_BIG_UINT)tcount,
3538                                 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3539                 reply_doserror(req, ERRDOS, ERRlock);
3540                 error_to_writebrawerr(req);
3541                 END_PROFILE(SMBwritebraw);
3542                 return;
3543         }
3544
3545         if (numtowrite>0) {
3546                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3547         }
3548
3549         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3550                         "wrote=%d sync=%d\n",
3551                 fsp->fnum, (double)startpos, (int)numtowrite,
3552                 (int)nwritten, (int)write_through));
3553
3554         if (nwritten < (ssize_t)numtowrite)  {
3555                 reply_unixerror(req, ERRHRD, ERRdiskfull);
3556                 error_to_writebrawerr(req);
3557                 END_PROFILE(SMBwritebraw);
3558                 return;
3559         }
3560
3561         total_written = nwritten;
3562
3563         /* Allocate a buffer of 64k + length. */
3564         buf = TALLOC_ARRAY(NULL, char, 65540);
3565         if (!buf) {
3566                 reply_doserror(req, ERRDOS, ERRnomem);
3567                 error_to_writebrawerr(req);
3568                 END_PROFILE(SMBwritebraw);
3569                 return;
3570         }
3571
3572         /* Return a SMBwritebraw message to the redirector to tell
3573          * it to send more bytes */
3574
3575         memcpy(buf, req->inbuf, smb_size);
3576         srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3577         SCVAL(buf,smb_com,SMBwritebraw);
3578         SSVALS(buf,smb_vwv0,0xFFFF);
3579         show_msg(buf);
3580         if (!srv_send_smb(smbd_server_fd(),
3581                         buf,
3582                         IS_CONN_ENCRYPTED(conn))) {
3583                 exit_server_cleanly("reply_writebraw: srv_send_smb "
3584                         "failed.");
3585         }
3586
3587         /* Now read the raw data into the buffer and write it */
3588         status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3589                                  &numtowrite);
3590         if (!NT_STATUS_IS_OK(status)) {
3591                 exit_server_cleanly("secondary writebraw failed");
3592         }
3593
3594         /* Set up outbuf to return the correct size */
3595         reply_outbuf(req, 1, 0);
3596
3597         if (numtowrite != 0) {
3598
3599                 if (numtowrite > 0xFFFF) {
3600                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3601                                 "raw requested (%u). Terminating\n",
3602                                 (unsigned int)numtowrite ));
3603                         exit_server_cleanly("secondary writebraw failed");
3604                 }
3605
3606                 if (tcount > nwritten+numtowrite) {
3607                         DEBUG(3,("reply_writebraw: Client overestimated the "
3608                                 "write %d %d %d\n",
3609                                 (int)tcount,(int)nwritten,(int)numtowrite));
3610                 }
3611
3612                 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3613
3614                 if (!NT_STATUS_IS_OK(status)) {
3615                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3616                                  "raw read failed (%s). Terminating\n",
3617                                  nt_errstr(status)));
3618                         exit_server_cleanly("secondary writebraw failed");
3619                 }
3620
3621                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3622                 if (nwritten == -1) {
3623                         TALLOC_FREE(buf);
3624                         reply_unixerror(req, ERRHRD, ERRdiskfull);
3625                         error_to_writebrawerr(req);
3626                         END_PROFILE(SMBwritebraw);
3627                         return;
3628                 }
3629
3630                 if (nwritten < (ssize_t)numtowrite) {
3631                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
3632                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
3633                 }
3634
3635                 if (nwritten > 0) {
3636                         total_written += nwritten;
3637                 }
3638         }
3639
3640         TALLOC_FREE(buf);
3641         SSVAL(req->outbuf,smb_vwv0,total_written);
3642
3643         status = sync_file(conn, fsp, write_through);
3644         if (!NT_STATUS_IS_OK(status)) {
3645                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3646                         fsp->fsp_name, nt_errstr(status) ));
3647                 reply_nterror(req, status);
3648                 error_to_writebrawerr(req);
3649                 END_PROFILE(SMBwritebraw);
3650                 return;
3651         }
3652
3653         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3654                 "wrote=%d\n",
3655                 fsp->fnum, (double)startpos, (int)numtowrite,
3656                 (int)total_written));
3657
3658         /* We won't return a status if write through is not selected - this
3659          * follows what WfWg does */
3660         END_PROFILE(SMBwritebraw);
3661
3662         if (!write_through && total_written==tcount) {
3663
3664 #if RABBIT_PELLET_FIX
3665                 /*
3666                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3667                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3668                  * JRA.
3669                  */
3670                 if (!send_keepalive(smbd_server_fd())) {
3671                         exit_server_cleanly("reply_writebraw: send of "
3672                                 "keepalive failed");
3673                 }
3674 #endif
3675                 TALLOC_FREE(req->outbuf);
3676         }
3677         return;
3678 }
3679
3680 #undef DBGC_CLASS
3681 #define DBGC_CLASS DBGC_LOCKING
3682
3683 /****************************************************************************
3684  Reply to a writeunlock (core+).
3685 ****************************************************************************/
3686
3687 void reply_writeunlock(struct smb_request *req)
3688 {
3689         connection_struct *conn = req->conn;
3690         ssize_t nwritten = -1;
3691         size_t numtowrite;
3692         SMB_OFF_T startpos;
3693         char *data;
3694         NTSTATUS status = NT_STATUS_OK;
3695         files_struct *fsp;
3696
3697         START_PROFILE(SMBwriteunlock);
3698
3699         if (req->wct < 5) {
3700                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3701                 END_PROFILE(SMBwriteunlock);
3702                 return;
3703         }
3704
3705         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3706
3707         if (!check_fsp(conn, req, fsp)) {
3708                 END_PROFILE(SMBwriteunlock);
3709                 return;
3710         }
3711
3712         if (!CHECK_WRITE(fsp)) {
3713                 reply_doserror(req, ERRDOS,ERRbadaccess);
3714                 END_PROFILE(SMBwriteunlock);
3715                 return;
3716         }
3717
3718         numtowrite = SVAL(req->inbuf,smb_vwv1);
3719         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3720         data = smb_buf(req->inbuf) + 3;
3721
3722         if (numtowrite
3723             && is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
3724                          (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3725                 reply_doserror(req, ERRDOS, ERRlock);
3726                 END_PROFILE(SMBwriteunlock);
3727                 return;
3728         }
3729
3730         /* The special X/Open SMB protocol handling of
3731            zero length writes is *NOT* done for
3732            this call */
3733         if(numtowrite == 0) {
3734                 nwritten = 0;
3735         } else {
3736                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3737         }
3738
3739         status = sync_file(conn, fsp, False /* write through */);
3740         if (!NT_STATUS_IS_OK(status)) {
3741                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3742                         fsp->fsp_name, nt_errstr(status) ));
3743                 reply_nterror(req, status);
3744                 END_PROFILE(SMBwriteunlock);
3745                 return;
3746         }
3747
3748         if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3749                 reply_unixerror(req, ERRHRD, ERRdiskfull);
3750                 END_PROFILE(SMBwriteunlock);
3751                 return;
3752         }
3753
3754         if (numtowrite) {
3755                 status = do_unlock(smbd_messaging_context(),
3756                                 fsp,
3757                                 req->smbpid,
3758                                 (SMB_BIG_UINT)numtowrite,
3759                                 (SMB_BIG_UINT)startpos,
3760                                 WINDOWS_LOCK);
3761
3762                 if (NT_STATUS_V(status)) {
3763                         reply_nterror(req, status);
3764                         END_PROFILE(SMBwriteunlock);
3765                         return;
3766                 }
3767         }
3768
3769         reply_outbuf(req, 1, 0);
3770
3771         SSVAL(req->outbuf,smb_vwv0,nwritten);
3772
3773         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3774                  fsp->fnum, (int)numtowrite, (int)nwritten));
3775
3776         END_PROFILE(SMBwriteunlock);
3777         return;
3778 }
3779
3780 #undef DBGC_CLASS
3781 #define DBGC_CLASS DBGC_ALL
3782
3783 /****************************************************************************
3784  Reply to a write.
3785 ****************************************************************************/
3786
3787 void reply_write(struct smb_request *req)
3788 {
3789         connection_struct *conn = req->conn;
3790         size_t numtowrite;
3791         ssize_t nwritten = -1;
3792         SMB_OFF_T startpos;
3793         char *data;
3794         files_struct *fsp;
3795         NTSTATUS status;
3796
3797         START_PROFILE(SMBwrite);
3798
3799         if (req->wct < 5) {
3800                 END_PROFILE(SMBwrite);
3801                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3802                 return;
3803         }
3804
3805         /* If it's an IPC, pass off the pipe handler. */
3806         if (IS_IPC(conn)) {
3807                 reply_pipe_write(req);
3808                 END_PROFILE(SMBwrite);
3809                 return;
3810         }
3811
3812         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3813
3814         if (!check_fsp(conn, req, fsp)) {
3815                 END_PROFILE(SMBwrite);
3816                 return;
3817         }
3818
3819         if (!CHECK_WRITE(fsp)) {
3820                 reply_doserror(req, ERRDOS, ERRbadaccess);
3821                 END_PROFILE(SMBwrite);
3822                 return;
3823         }
3824
3825         numtowrite = SVAL(req->inbuf,smb_vwv1);
3826         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3827         data = smb_buf(req->inbuf) + 3;
3828
3829         if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
3830                       (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3831                 reply_doserror(req, ERRDOS, ERRlock);
3832                 END_PROFILE(SMBwrite);
3833                 return;
3834         }
3835
3836         /*
3837          * X/Open SMB protocol says that if smb_vwv1 is
3838          * zero then the file size should be extended or
3839          * truncated to the size given in smb_vwv[2-3].
3840          */
3841
3842         if(numtowrite == 0) {
3843                 /*
3844                  * This is actually an allocate call, and set EOF. JRA.
3845                  */
3846                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3847                 if (nwritten < 0) {
3848                         reply_nterror(req, NT_STATUS_DISK_FULL);
3849                         END_PROFILE(SMBwrite);
3850                         return;
3851                 }
3852                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3853                 if (nwritten < 0) {
3854                         reply_nterror(req, NT_STATUS_DISK_FULL);
3855                         END_PROFILE(SMBwrite);
3856                         return;
3857                 }
3858                 trigger_write_time_update_immediate(fsp);
3859         } else {
3860                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3861         }
3862
3863         status = sync_file(conn, fsp, False);
3864         if (!NT_STATUS_IS_OK(status)) {
3865                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
3866                         fsp->fsp_name, nt_errstr(status) ));
3867                 reply_nterror(req, status);
3868                 END_PROFILE(SMBwrite);
3869                 return;
3870         }
3871
3872         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3873                 reply_unixerror(req, ERRHRD, ERRdiskfull);
3874                 END_PROFILE(SMBwrite);
3875                 return;
3876         }
3877
3878         reply_outbuf(req, 1, 0);
3879
3880         SSVAL(req->outbuf,smb_vwv0,nwritten);
3881
3882         if (nwritten < (ssize_t)numtowrite) {
3883                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3884                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3885         }
3886
3887         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3888
3889         END_PROFILE(SMBwrite);
3890         return;
3891 }
3892
3893 /****************************************************************************
3894  Ensure a buffer is a valid writeX for recvfile purposes.
3895 ****************************************************************************/
3896
3897 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
3898                                                 (2*14) + /* word count (including bcc) */ \
3899                                                 1 /* pad byte */)
3900
3901 bool is_valid_writeX_buffer(const uint8_t *inbuf)
3902 {
3903         size_t numtowrite;
3904         connection_struct *conn = NULL;
3905         unsigned int doff = 0;
3906         size_t len = smb_len_large(inbuf);
3907
3908         if (is_encrypted_packet(inbuf)) {
3909                 /* Can't do this on encrypted
3910                  * connections. */
3911                 return false;
3912         }
3913
3914         if (CVAL(inbuf,smb_com) != SMBwriteX) {
3915                 return false;
3916         }
3917
3918         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
3919                         CVAL(inbuf,smb_wct) != 14) {
3920                 DEBUG(10,("is_valid_writeX_buffer: chained or "
3921                         "invalid word length.\n"));
3922                 return false;
3923         }
3924
3925         conn = conn_find(SVAL(inbuf, smb_tid));
3926         if (conn == NULL) {
3927                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
3928                 return false;
3929         }
3930         if (IS_IPC(conn)) {
3931                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
3932                 return false;
3933         }
3934         if (IS_PRINT(conn)) {
3935                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
3936                 return false;
3937         }
3938         doff = SVAL(inbuf,smb_vwv11);
3939
3940         numtowrite = SVAL(inbuf,smb_vwv10);
3941
3942         if (len > doff && len - doff > 0xFFFF) {
3943                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
3944         }
3945
3946         if (numtowrite == 0) {
3947                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
3948                 return false;
3949         }
3950
3951         /* Ensure the sizes match up. */
3952         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
3953                 /* no pad byte...old smbclient :-( */
3954                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
3955                         (unsigned int)doff,
3956                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
3957                 return false;
3958         }
3959
3960         if (len - doff != numtowrite) {
3961                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
3962                         "len = %u, doff = %u, numtowrite = %u\n",
3963                         (unsigned int)len,
3964                         (unsigned int)doff,
3965                         (unsigned int)numtowrite ));
3966                 return false;
3967         }
3968
3969         DEBUG(10,("is_valid_writeX_buffer: true "
3970                 "len = %u, doff = %u, numtowrite = %u\n",
3971                 (unsigned int)len,
3972                 (unsigned int)doff,
3973                 (unsigned int)numtowrite ));
3974
3975         return true;
3976 }
3977
3978 /****************************************************************************
3979  Reply to a write and X.
3980 ****************************************************************************/
3981
3982 void reply_write_and_X(struct smb_request *req)
3983 {
3984         connection_struct *conn = req->conn;
3985         files_struct *fsp;
3986         SMB_OFF_T startpos;
3987         size_t numtowrite;
3988         bool write_through;
3989         ssize_t nwritten;
3990         unsigned int smb_doff;
3991         unsigned int smblen;
3992         char *data;
3993         NTSTATUS status;
3994
3995         START_PROFILE(SMBwriteX);
3996
3997         if ((req->wct != 12) && (req->wct != 14)) {
3998                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3999                 END_PROFILE(SMBwriteX);
4000                 return;
4001         }
4002
4003         numtowrite = SVAL(req->inbuf,smb_vwv10);
4004         smb_doff = SVAL(req->inbuf,smb_vwv11);
4005         smblen = smb_len(req->inbuf);
4006
4007         if (req->unread_bytes > 0xFFFF ||
4008                         (smblen > smb_doff &&
4009                                 smblen - smb_doff > 0xFFFF)) {
4010                 numtowrite |= (((size_t)SVAL(req->inbuf,smb_vwv9))<<16);
4011         }
4012
4013         if (req->unread_bytes) {
4014                 /* Can't do a recvfile write on IPC$ */
4015                 if (IS_IPC(conn)) {
4016                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4017                         END_PROFILE(SMBwriteX);
4018                         return;
4019                 }
4020                 if (numtowrite != req->unread_bytes) {
4021                         reply_doserror(req, ERRDOS, ERRbadmem);
4022                         END_PROFILE(SMBwriteX);
4023                         return;
4024                 }
4025         } else {
4026                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4027                                 smb_doff + numtowrite > smblen) {
4028                         reply_doserror(req, ERRDOS, ERRbadmem);
4029                         END_PROFILE(SMBwriteX);
4030                         return;
4031                 }
4032         }
4033
4034         /* If it's an IPC, pass off the pipe handler. */
4035         if (IS_IPC(conn)) {
4036                 if (req->unread_bytes) {
4037                         reply_doserror(req, ERRDOS, ERRbadmem);
4038                         END_PROFILE(SMBwriteX);
4039                         return;
4040                 }
4041                 reply_pipe_write_and_X(req);
4042                 END_PROFILE(SMBwriteX);
4043                 return;
4044         }
4045
4046         fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
4047         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
4048         write_through = BITSETW(req->inbuf+smb_vwv7,0);
4049
4050         if (!check_fsp(conn, req, fsp)) {
4051                 END_PROFILE(SMBwriteX);
4052                 return;
4053         }
4054
4055         if (!CHECK_WRITE(fsp)) {
4056                 reply_doserror(req, ERRDOS, ERRbadaccess);
4057                 END_PROFILE(SMBwriteX);
4058                 return;
4059         }
4060
4061         data = smb_base(req->inbuf) + smb_doff;
4062
4063         if(req->wct == 14) {
4064 #ifdef LARGE_SMB_OFF_T
4065                 /*
4066                  * This is a large offset (64 bit) write.
4067                  */
4068                 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv12)) << 32);
4069
4070 #else /* !LARGE_SMB_OFF_T */
4071
4072                 /*
4073                  * Ensure we haven't been sent a >32 bit offset.
4074                  */
4075
4076                 if(IVAL(req->inbuf,smb_vwv12) != 0) {
4077                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4078                                  "used and we don't support 64 bit offsets.\n",
4079                                  (unsigned int)IVAL(req->inbuf,smb_vwv12) ));
4080                         reply_doserror(req, ERRDOS, ERRbadaccess);
4081                         END_PROFILE(SMBwriteX);
4082                         return;
4083                 }
4084
4085 #endif /* LARGE_SMB_OFF_T */
4086         }
4087
4088         if (is_locked(fsp,(uint32)req->smbpid,
4089                       (SMB_BIG_UINT)numtowrite,
4090                       (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
4091                 reply_doserror(req, ERRDOS, ERRlock);
4092                 END_PROFILE(SMBwriteX);
4093                 return;
4094         }
4095
4096         /* X/Open SMB protocol says that, unlike SMBwrite
4097         if the length is zero then NO truncation is
4098         done, just a write of zero. To truncate a file,
4099         use SMBwrite. */
4100
4101         if(numtowrite == 0) {
4102                 nwritten = 0;
4103         } else {
4104
4105                 if ((req->unread_bytes == 0) &&
4106                     schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4107                                              numtowrite)) {
4108                         END_PROFILE(SMBwriteX);
4109                         return;
4110                 }
4111
4112                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4113         }
4114
4115         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4116                 reply_unixerror(req, ERRHRD, ERRdiskfull);
4117                 END_PROFILE(SMBwriteX);
4118                 return;
4119         }
4120
4121         reply_outbuf(req, 6, 0);
4122         SSVAL(req->outbuf,smb_vwv2,nwritten);
4123         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4124
4125         if (nwritten < (ssize_t)numtowrite) {
4126                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4127                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4128         }
4129
4130         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4131                 fsp->fnum, (int)numtowrite, (int)nwritten));
4132
4133         status = sync_file(conn, fsp, write_through);
4134         if (!NT_STATUS_IS_OK(status)) {
4135                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4136                         fsp->fsp_name, nt_errstr(status) ));
4137                 reply_nterror(req, status);
4138                 END_PROFILE(SMBwriteX);
4139                 return;
4140         }
4141
4142         END_PROFILE(SMBwriteX);
4143         chain_reply(req);
4144         return;
4145 }
4146
4147 /****************************************************************************
4148  Reply to a lseek.
4149 ****************************************************************************/
4150
4151 void reply_lseek(struct smb_request *req)
4152 {
4153         connection_struct *conn = req->conn;
4154         SMB_OFF_T startpos;
4155         SMB_OFF_T res= -1;
4156         int mode,umode;
4157         files_struct *fsp;
4158
4159         START_PROFILE(SMBlseek);
4160
4161         if (req->wct < 4) {
4162                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4163                 END_PROFILE(SMBlseek);
4164                 return;
4165         }
4166
4167         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4168
4169         if (!check_fsp(conn, req, fsp)) {
4170                 return;
4171         }
4172
4173         flush_write_cache(fsp, SEEK_FLUSH);
4174
4175         mode = SVAL(req->inbuf,smb_vwv1) & 3;
4176         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4177         startpos = (SMB_OFF_T)IVALS(req->inbuf,smb_vwv2);
4178
4179         switch (mode) {
4180                 case 0:
4181                         umode = SEEK_SET;
4182                         res = startpos;
4183                         break;
4184                 case 1:
4185                         umode = SEEK_CUR;
4186                         res = fsp->fh->pos + startpos;
4187                         break;
4188                 case 2:
4189                         umode = SEEK_END;
4190                         break;
4191                 default:
4192                         umode = SEEK_SET;
4193                         res = startpos;
4194                         break;
4195         }
4196
4197         if (umode == SEEK_END) {
4198                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4199                         if(errno == EINVAL) {
4200                                 SMB_OFF_T current_pos = startpos;
4201                                 SMB_STRUCT_STAT sbuf;
4202
4203                                 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4204                                         reply_unixerror(req, ERRDOS,
4205                                                         ERRnoaccess);
4206                                         END_PROFILE(SMBlseek);
4207                                         return;
4208                                 }
4209
4210                                 current_pos += sbuf.st_size;
4211                                 if(current_pos < 0)
4212                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4213                         }
4214                 }
4215
4216                 if(res == -1) {
4217                         reply_unixerror(req, ERRDOS, ERRnoaccess);
4218                         END_PROFILE(SMBlseek);
4219                         return;
4220                 }
4221         }
4222
4223         fsp->fh->pos = res;
4224
4225         reply_outbuf(req, 2, 0);
4226         SIVAL(req->outbuf,smb_vwv0,res);
4227
4228         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4229                 fsp->fnum, (double)startpos, (double)res, mode));
4230
4231         END_PROFILE(SMBlseek);
4232         return;
4233 }
4234
4235 /****************************************************************************
4236  Reply to a flush.
4237 ****************************************************************************/
4238
4239 void reply_flush(struct smb_request *req)
4240 {
4241         connection_struct *conn = req->conn;
4242         uint16 fnum;
4243         files_struct *fsp;
4244
4245         START_PROFILE(SMBflush);
4246
4247         if (req->wct < 1) {
4248                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4249                 return;
4250         }
4251
4252         fnum = SVAL(req->inbuf,smb_vwv0);
4253         fsp = file_fsp(fnum);
4254
4255         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4256                 return;
4257         }
4258
4259         if (!fsp) {
4260                 file_sync_all(conn);
4261         } else {
4262                 NTSTATUS status = sync_file(conn, fsp, True);
4263                 if (!NT_STATUS_IS_OK(status)) {
4264                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4265                                 fsp->fsp_name, nt_errstr(status) ));
4266                         reply_nterror(req, status);
4267                         END_PROFILE(SMBflush);
4268                         return;
4269                 }
4270         }
4271
4272         reply_outbuf(req, 0, 0);
4273
4274         DEBUG(3,("flush\n"));
4275         END_PROFILE(SMBflush);
4276         return;
4277 }
4278
4279 /****************************************************************************
4280  Reply to a exit.
4281  conn POINTER CAN BE NULL HERE !
4282 ****************************************************************************/
4283
4284 void reply_exit(struct smb_request *req)
4285 {
4286         START_PROFILE(SMBexit);
4287
4288         file_close_pid(req->smbpid, req->vuid);
4289
4290         reply_outbuf(req, 0, 0);
4291
4292         DEBUG(3,("exit\n"));
4293
4294         END_PROFILE(SMBexit);
4295         return;
4296 }
4297
4298 /****************************************************************************
4299  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4300 ****************************************************************************/
4301
4302 void reply_close(struct smb_request *req)
4303 {
4304         connection_struct *conn = req->conn;
4305         NTSTATUS status = NT_STATUS_OK;
4306         files_struct *fsp = NULL;
4307         START_PROFILE(SMBclose);
4308
4309         if (req->wct < 3) {
4310                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4311                 END_PROFILE(SMBclose);
4312                 return;
4313         }
4314
4315         /* If it's an IPC, pass off to the pipe handler. */
4316         if (IS_IPC(conn)) {
4317                 reply_pipe_close(conn, req);
4318                 END_PROFILE(SMBclose);
4319                 return;
4320         }
4321
4322         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4323
4324         /*
4325          * We can only use check_fsp if we know it's not a directory.
4326          */
4327
4328         if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4329                 reply_doserror(req, ERRDOS, ERRbadfid);
4330                 END_PROFILE(SMBclose);
4331                 return;
4332         }
4333
4334         if(fsp->is_directory) {
4335                 /*
4336                  * Special case - close NT SMB directory handle.
4337                  */
4338                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4339                 status = close_file(fsp,NORMAL_CLOSE);
4340         } else {
4341                 time_t t;
4342                 /*
4343                  * Close ordinary file.
4344                  */
4345
4346                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4347                          fsp->fh->fd, fsp->fnum,
4348                          conn->num_files_open));
4349
4350                 /*
4351                  * Take care of any time sent in the close.
4352                  */
4353
4354                 t = srv_make_unix_date3(req->inbuf+smb_vwv1);
4355                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4356
4357                 /*
4358                  * close_file() returns the unix errno if an error
4359                  * was detected on close - normally this is due to
4360                  * a disk full error. If not then it was probably an I/O error.
4361                  */
4362
4363                 status = close_file(fsp,NORMAL_CLOSE);
4364         }
4365
4366         if (!NT_STATUS_IS_OK(status)) {
4367                 reply_nterror(req, status);
4368                 END_PROFILE(SMBclose);
4369                 return;
4370         }
4371
4372         reply_outbuf(req, 0, 0);
4373         END_PROFILE(SMBclose);
4374         return;
4375 }
4376
4377 /****************************************************************************
4378  Reply to a writeclose (Core+ protocol).
4379 ****************************************************************************/
4380
4381 void reply_writeclose(struct smb_request *req)
4382 {
4383         connection_struct *conn = req->conn;
4384         size_t numtowrite;
4385         ssize_t nwritten = -1;
4386         NTSTATUS close_status = NT_STATUS_OK;
4387         SMB_OFF_T startpos;
4388         char *data;
4389         struct timespec mtime;
4390         files_struct *fsp;
4391
4392         START_PROFILE(SMBwriteclose);
4393
4394         if (req->wct < 6) {
4395                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4396                 END_PROFILE(SMBwriteclose);
4397                 return;
4398         }
4399
4400         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4401
4402         if (!check_fsp(conn, req, fsp)) {
4403                 END_PROFILE(SMBwriteclose);
4404                 return;
4405         }
4406         if (!CHECK_WRITE(fsp)) {
4407                 reply_doserror(req, ERRDOS,ERRbadaccess);
4408                 END_PROFILE(SMBwriteclose);
4409                 return;
4410         }
4411
4412         numtowrite = SVAL(req->inbuf,smb_vwv1);
4413         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
4414         mtime = convert_time_t_to_timespec(srv_make_unix_date3(
4415                                                    req->inbuf+smb_vwv4));
4416         data = smb_buf(req->inbuf) + 1;
4417
4418         if (numtowrite
4419             && is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
4420                          (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
4421                 reply_doserror(req, ERRDOS,ERRlock);
4422                 END_PROFILE(SMBwriteclose);
4423                 return;
4424         }
4425
4426         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4427
4428         set_close_write_time(fsp, mtime);
4429
4430         /*
4431          * More insanity. W2K only closes the file if writelen > 0.
4432          * JRA.
4433          */
4434
4435         if (numtowrite) {
4436                 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4437                         fsp->fsp_name ));
4438                 close_status = close_file(fsp,NORMAL_CLOSE);
4439         }
4440
4441         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4442                  fsp->fnum, (int)numtowrite, (int)nwritten,
4443                  conn->num_files_open));
4444
4445         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4446                 reply_doserror(req, ERRHRD, ERRdiskfull);
4447                 END_PROFILE(SMBwriteclose);
4448                 return;
4449         }
4450
4451         if(!NT_STATUS_IS_OK(close_status)) {
4452                 reply_nterror(req, close_status);
4453                 END_PROFILE(SMBwriteclose);
4454                 return;
4455         }
4456
4457         reply_outbuf(req, 1, 0);
4458
4459         SSVAL(req->outbuf,smb_vwv0,nwritten);
4460         END_PROFILE(SMBwriteclose);
4461         return;
4462 }
4463
4464 #undef DBGC_CLASS
4465 #define DBGC_CLASS DBGC_LOCKING
4466
4467 /****************************************************************************
4468  Reply to a lock.
4469 ****************************************************************************/
4470
4471 void reply_lock(struct smb_request *req)
4472 {
4473         connection_struct *conn = req->conn;
4474         SMB_BIG_UINT count,offset;
4475         NTSTATUS status;
4476         files_struct *fsp;
4477         struct byte_range_lock *br_lck = NULL;
4478
4479         START_PROFILE(SMBlock);
4480
4481         if (req->wct < 5) {
4482                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4483                 END_PROFILE(SMBlock);
4484                 return;
4485         }
4486
4487         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4488
4489         if (!check_fsp(conn, req, fsp)) {
4490                 END_PROFILE(SMBlock);
4491                 return;
4492         }
4493
4494         release_level_2_oplocks_on_change(fsp);
4495
4496         count = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv1);
4497         offset = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv3);
4498
4499         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4500                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4501
4502         br_lck = do_lock(smbd_messaging_context(),
4503                         fsp,
4504                         req->smbpid,
4505                         count,
4506                         offset,
4507                         WRITE_LOCK,
4508                         WINDOWS_LOCK,
4509                         False, /* Non-blocking lock. */
4510                         &status,
4511                         NULL);
4512
4513         TALLOC_FREE(br_lck);
4514
4515         if (NT_STATUS_V(status)) {
4516                 reply_nterror(req, status);
4517                 END_PROFILE(SMBlock);
4518                 return;
4519         }
4520
4521         reply_outbuf(req, 0, 0);
4522
4523         END_PROFILE(SMBlock);
4524         return;
4525 }
4526
4527 /****************************************************************************
4528  Reply to a unlock.
4529 ****************************************************************************/
4530
4531 void reply_unlock(struct smb_request *req)
4532 {
4533         connection_struct *conn = req->conn;
4534         SMB_BIG_UINT count,offset;
4535         NTSTATUS status;
4536         files_struct *fsp;
4537
4538         START_PROFILE(SMBunlock);
4539
4540         if (req->wct < 5) {
4541                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4542                 END_PROFILE(SMBunlock);
4543                 return;
4544         }
4545
4546         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4547
4548         if (!check_fsp(conn, req, fsp)) {
4549                 END_PROFILE(SMBunlock);
4550                 return;
4551         }
4552
4553         count = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv1);
4554         offset = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv3);
4555
4556         status = do_unlock(smbd_messaging_context(),
4557                         fsp,
4558                         req->smbpid,
4559                         count,
4560                         offset,
4561                         WINDOWS_LOCK);
4562
4563         if (NT_STATUS_V(status)) {
4564                 reply_nterror(req, status);
4565                 END_PROFILE(SMBunlock);
4566                 return;
4567         }
4568
4569         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4570                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4571
4572         reply_outbuf(req, 0, 0);
4573
4574         END_PROFILE(SMBunlock);
4575         return;
4576 }
4577
4578 #undef DBGC_CLASS
4579 #define DBGC_CLASS DBGC_ALL
4580
4581 /****************************************************************************
4582  Reply to a tdis.
4583  conn POINTER CAN BE NULL HERE !
4584 ****************************************************************************/
4585
4586 void reply_tdis(struct smb_request *req)
4587 {
4588         connection_struct *conn = req->conn;
4589         START_PROFILE(SMBtdis);
4590
4591         if (!conn) {
4592                 DEBUG(4,("Invalid connection in tdis\n"));
4593                 reply_doserror(req, ERRSRV, ERRinvnid);
4594                 END_PROFILE(SMBtdis);
4595                 return;
4596         }
4597
4598         conn->used = False;
4599
4600         close_cnum(conn,req->vuid);
4601         req->conn = NULL;
4602
4603         reply_outbuf(req, 0, 0);
4604         END_PROFILE(SMBtdis);
4605         return;
4606 }
4607
4608 /****************************************************************************
4609  Reply to a echo.
4610  conn POINTER CAN BE NULL HERE !
4611 ****************************************************************************/
4612
4613 void reply_echo(struct smb_request *req)
4614 {
4615         connection_struct *conn = req->conn;
4616         int smb_reverb;
4617         int seq_num;
4618         unsigned int data_len = smb_buflen(req->inbuf);
4619
4620         START_PROFILE(SMBecho);
4621
4622         if (req->wct < 1) {
4623                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4624                 END_PROFILE(SMBecho);
4625                 return;
4626         }
4627
4628         if (data_len > BUFFER_SIZE) {
4629                 DEBUG(0,("reply_echo: data_len too large.\n"));
4630                 reply_nterror(req, NT_STATUS_INSUFFICIENT_RESOURCES);
4631                 END_PROFILE(SMBecho);
4632                 return;
4633         }
4634
4635         smb_reverb = SVAL(req->inbuf,smb_vwv0);
4636
4637         reply_outbuf(req, 1, data_len);
4638
4639         /* copy any incoming data back out */
4640         if (data_len > 0) {
4641                 memcpy(smb_buf(req->outbuf),smb_buf(req->inbuf),data_len);
4642         }
4643
4644         if (smb_reverb > 100) {
4645                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4646                 smb_reverb = 100;
4647         }
4648
4649         for (seq_num =1 ; seq_num <= smb_reverb ; seq_num++) {
4650                 SSVAL(req->outbuf,smb_vwv0,seq_num);
4651
4652                 show_msg((char *)req->outbuf);
4653                 if (!srv_send_smb(smbd_server_fd(),
4654                                 (char *)req->outbuf,
4655                                 IS_CONN_ENCRYPTED(conn)||req->encrypted))
4656                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
4657         }
4658
4659         DEBUG(3,("echo %d times\n", smb_reverb));
4660
4661         TALLOC_FREE(req->outbuf);
4662
4663         END_PROFILE(SMBecho);
4664         return;
4665 }
4666
4667 /****************************************************************************
4668  Reply to a printopen.
4669 ****************************************************************************/
4670
4671 void reply_printopen(struct smb_request *req)
4672 {
4673         connection_struct *conn = req->conn;
4674         files_struct *fsp;
4675         SMB_STRUCT_STAT sbuf;
4676         NTSTATUS status;
4677
4678         START_PROFILE(SMBsplopen);
4679
4680         if (req->wct < 2) {
4681                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4682                 END_PROFILE(SMBsplopen);
4683                 return;
4684         }
4685
4686         if (!CAN_PRINT(conn)) {
4687                 reply_doserror(req, ERRDOS, ERRnoaccess);
4688                 END_PROFILE(SMBsplopen);
4689                 return;
4690         }
4691
4692         status = file_new(conn, &fsp);
4693         if(!NT_STATUS_IS_OK(status)) {
4694                 reply_nterror(req, status);
4695                 END_PROFILE(SMBsplopen);
4696                 return;
4697         }
4698
4699         /* Open for exclusive use, write only. */
4700         status = print_fsp_open(conn, NULL, req->vuid, fsp, &sbuf);
4701
4702         if (!NT_STATUS_IS_OK(status)) {
4703                 file_free(fsp);
4704                 reply_nterror(req, status);
4705                 END_PROFILE(SMBsplopen);
4706                 return;
4707         }
4708
4709         reply_outbuf(req, 1, 0);
4710         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4711
4712         DEBUG(3,("openprint fd=%d fnum=%d\n",
4713                  fsp->fh->fd, fsp->fnum));
4714
4715         END_PROFILE(SMBsplopen);
4716         return;
4717 }
4718
4719 /****************************************************************************
4720  Reply to a printclose.
4721 ****************************************************************************/
4722
4723 void reply_printclose(struct smb_request *req)
4724 {
4725         connection_struct *conn = req->conn;
4726         files_struct *fsp;
4727         NTSTATUS status;
4728
4729         START_PROFILE(SMBsplclose);
4730
4731         if (req->wct < 1) {
4732                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4733                 END_PROFILE(SMBsplclose);
4734                 return;
4735         }
4736
4737         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4738
4739         if (!check_fsp(conn, req, fsp)) {
4740                 END_PROFILE(SMBsplclose);
4741                 return;
4742         }
4743
4744         if (!CAN_PRINT(conn)) {
4745                 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4746                 END_PROFILE(SMBsplclose);
4747                 return;
4748         }
4749
4750         DEBUG(3,("printclose fd=%d fnum=%d\n",
4751                  fsp->fh->fd,fsp->fnum));
4752
4753         status = close_file(fsp,NORMAL_CLOSE);
4754
4755         if(!NT_STATUS_IS_OK(status)) {
4756                 reply_nterror(req, status);
4757                 END_PROFILE(SMBsplclose);
4758                 return;
4759         }
4760
4761         reply_outbuf(req, 0, 0);
4762
4763         END_PROFILE(SMBsplclose);
4764         return;
4765 }
4766
4767 /****************************************************************************
4768  Reply to a printqueue.
4769 ****************************************************************************/
4770
4771 void reply_printqueue(struct smb_request *req)
4772 {
4773         connection_struct *conn = req->conn;
4774         int max_count;
4775         int start_index;
4776
4777         START_PROFILE(SMBsplretq);
4778
4779         if (req->wct < 2) {
4780                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4781                 END_PROFILE(SMBsplretq);
4782                 return;
4783         }
4784
4785         max_count = SVAL(req->inbuf,smb_vwv0);
4786         start_index = SVAL(req->inbuf,smb_vwv1);
4787
4788         /* we used to allow the client to get the cnum wrong, but that
4789            is really quite gross and only worked when there was only
4790            one printer - I think we should now only accept it if they
4791            get it right (tridge) */
4792         if (!CAN_PRINT(conn)) {
4793                 reply_doserror(req, ERRDOS, ERRnoaccess);
4794                 END_PROFILE(SMBsplretq);
4795                 return;
4796         }
4797
4798         reply_outbuf(req, 2, 3);
4799         SSVAL(req->outbuf,smb_vwv0,0);
4800         SSVAL(req->outbuf,smb_vwv1,0);
4801         SCVAL(smb_buf(req->outbuf),0,1);
4802         SSVAL(smb_buf(req->outbuf),1,0);
4803
4804         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4805                  start_index, max_count));
4806
4807         {
4808                 print_queue_struct *queue = NULL;
4809                 print_status_struct status;
4810                 int count = print_queue_status(SNUM(conn), &queue, &status);
4811                 int num_to_get = ABS(max_count);
4812                 int first = (max_count>0?start_index:start_index+max_count+1);
4813                 int i;
4814
4815                 if (first >= count)
4816                         num_to_get = 0;
4817                 else
4818                         num_to_get = MIN(num_to_get,count-first);
4819
4820
4821                 for (i=first;i<first+num_to_get;i++) {
4822                         char blob[28];
4823                         char *p = blob;
4824
4825                         srv_put_dos_date2(p,0,queue[i].time);
4826                         SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4827                         SSVAL(p,5, queue[i].job);
4828                         SIVAL(p,7,queue[i].size);
4829                         SCVAL(p,11,0);
4830                         srvstr_push(blob, req->flags2, p+12,
4831                                     queue[i].fs_user, 16, STR_ASCII);
4832
4833                         if (message_push_blob(
4834                                     &req->outbuf,
4835                                     data_blob_const(
4836                                             blob, sizeof(blob))) == -1) {
4837                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4838                                 END_PROFILE(SMBsplretq);
4839                                 return;
4840                         }
4841                 }
4842
4843                 if (count > 0) {
4844                         SSVAL(req->outbuf,smb_vwv0,count);
4845                         SSVAL(req->outbuf,smb_vwv1,
4846                               (max_count>0?first+count:first-1));
4847                         SCVAL(smb_buf(req->outbuf),0,1);
4848                         SSVAL(smb_buf(req->outbuf),1,28*count);
4849                 }
4850
4851                 SAFE_FREE(queue);
4852
4853                 DEBUG(3,("%d entries returned in queue\n",count));
4854         }
4855
4856         END_PROFILE(SMBsplretq);
4857         return;
4858 }
4859
4860 /****************************************************************************
4861  Reply to a printwrite.
4862 ****************************************************************************/
4863
4864 void reply_printwrite(struct smb_request *req)
4865 {
4866         connection_struct *conn = req->conn;
4867         int numtowrite;
4868         char *data;
4869         files_struct *fsp;
4870
4871         START_PROFILE(SMBsplwr);
4872
4873         if (req->wct < 1) {
4874                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4875                 END_PROFILE(SMBsplwr);
4876                 return;
4877         }
4878
4879         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4880
4881         if (!check_fsp(conn, req, fsp)) {
4882                 END_PROFILE(SMBsplwr);
4883                 return;
4884         }
4885
4886         if (!CAN_PRINT(conn)) {
4887                 reply_doserror(req, ERRDOS, ERRnoaccess);
4888                 END_PROFILE(SMBsplwr);
4889                 return;
4890         }
4891
4892         if (!CHECK_WRITE(fsp)) {
4893                 reply_doserror(req, ERRDOS, ERRbadaccess);
4894                 END_PROFILE(SMBsplwr);
4895                 return;
4896         }
4897
4898         numtowrite = SVAL(smb_buf(req->inbuf),1);
4899
4900         if (smb_buflen(req->inbuf) < numtowrite + 3) {
4901                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4902                 END_PROFILE(SMBsplwr);
4903                 return;
4904         }
4905
4906         data = smb_buf(req->inbuf) + 3;
4907
4908         if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
4909                 reply_unixerror(req, ERRHRD, ERRdiskfull);
4910                 END_PROFILE(SMBsplwr);
4911                 return;
4912         }
4913
4914         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
4915
4916         END_PROFILE(SMBsplwr);
4917         return;
4918 }
4919
4920 /****************************************************************************
4921  Reply to a mkdir.
4922 ****************************************************************************/
4923
4924 void reply_mkdir(struct smb_request *req)
4925 {
4926         connection_struct *conn = req->conn;
4927         char *directory = NULL;
4928         NTSTATUS status;
4929         SMB_STRUCT_STAT sbuf;
4930         TALLOC_CTX *ctx = talloc_tos();
4931
4932         START_PROFILE(SMBmkdir);
4933
4934         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
4935                         smb_buf(req->inbuf) + 1, 0,
4936                         STR_TERMINATE, &status);
4937         if (!NT_STATUS_IS_OK(status)) {
4938                 reply_nterror(req, status);
4939                 END_PROFILE(SMBmkdir);
4940                 return;
4941         }
4942
4943         status = resolve_dfspath(ctx, conn,
4944                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
4945                                  directory,
4946                                  &directory);
4947         if (!NT_STATUS_IS_OK(status)) {
4948                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4949                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
4950                                         ERRSRV, ERRbadpath);
4951                         END_PROFILE(SMBmkdir);
4952                         return;
4953                 }
4954                 reply_nterror(req, status);
4955                 END_PROFILE(SMBmkdir);
4956                 return;
4957         }
4958
4959         status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
4960         if (!NT_STATUS_IS_OK(status)) {
4961                 reply_nterror(req, status);
4962                 END_PROFILE(SMBmkdir);
4963                 return;
4964         }
4965
4966         status = check_name(conn, directory);
4967         if (!NT_STATUS_IS_OK(status)) {
4968                 reply_nterror(req, status);
4969                 END_PROFILE(SMBmkdir);
4970                 return;
4971         }
4972
4973         status = create_directory(conn, req, directory);
4974
4975         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
4976
4977         if (!NT_STATUS_IS_OK(status)) {
4978
4979                 if (!use_nt_status()
4980                     && NT_STATUS_EQUAL(status,
4981                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
4982                         /*
4983                          * Yes, in the DOS error code case we get a
4984                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
4985                          * samba4 torture test.
4986                          */
4987                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
4988                 }
4989
4990                 reply_nterror(req, status);
4991                 END_PROFILE(SMBmkdir);
4992                 return;
4993         }
4994
4995         reply_outbuf(req, 0, 0);
4996
4997         DEBUG( 3, ( "mkdir %s\n", directory ) );
4998
4999         END_PROFILE(SMBmkdir);
5000         return;
5001 }
5002
5003 /****************************************************************************
5004  Static function used by reply_rmdir to delete an entire directory
5005  tree recursively. Return True on ok, False on fail.
5006 ****************************************************************************/
5007
5008 static bool recursive_rmdir(TALLOC_CTX *ctx,
5009                         connection_struct *conn,
5010                         char *directory)
5011 {
5012         const char *dname = NULL;
5013         bool ret = True;
5014         long offset = 0;
5015         struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
5016                                           NULL, 0);
5017
5018         if(dir_hnd == NULL)
5019                 return False;
5020
5021         while((dname = ReadDirName(dir_hnd, &offset))) {
5022                 char *fullname = NULL;
5023                 SMB_STRUCT_STAT st;
5024
5025                 if (ISDOT(dname) || ISDOTDOT(dname)) {
5026                         continue;
5027                 }
5028
5029                 if (!is_visible_file(conn, directory, dname, &st, False)) {
5030                         continue;
5031                 }
5032
5033                 /* Construct the full name. */
5034                 fullname = talloc_asprintf(ctx,
5035                                 "%s/%s",
5036                                 directory,
5037                                 dname);
5038                 if (!fullname) {
5039                         errno = ENOMEM;
5040                         ret = False;
5041                         break;
5042                 }
5043
5044                 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5045                         ret = False;
5046                         break;
5047                 }
5048
5049                 if(st.st_mode & S_IFDIR) {
5050                         if(!recursive_rmdir(ctx, conn, fullname)) {
5051                                 ret = False;
5052                                 break;
5053                         }
5054                         if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5055                                 ret = False;
5056                                 break;
5057                         }
5058                 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5059                         ret = False;
5060                         break;
5061                 }
5062                 TALLOC_FREE(fullname);
5063         }
5064         TALLOC_FREE(dir_hnd);
5065         return ret;
5066 }
5067
5068 /****************************************************************************
5069  The internals of the rmdir code - called elsewhere.
5070 ****************************************************************************/
5071
5072 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5073                         connection_struct *conn,
5074                         const char *directory)
5075 {
5076         int ret;
5077         SMB_STRUCT_STAT st;
5078
5079         /* Might be a symlink. */
5080         if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
5081                 return map_nt_error_from_unix(errno);
5082         }
5083
5084         if (S_ISLNK(st.st_mode)) {
5085                 /* Is what it points to a directory ? */
5086                 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
5087                         return map_nt_error_from_unix(errno);
5088                 }
5089                 if (!(S_ISDIR(st.st_mode))) {
5090                         return NT_STATUS_NOT_A_DIRECTORY;
5091                 }
5092                 ret = SMB_VFS_UNLINK(conn,directory);
5093         } else {
5094                 ret = SMB_VFS_RMDIR(conn,directory);
5095         }
5096         if (ret == 0) {
5097                 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5098                              FILE_NOTIFY_CHANGE_DIR_NAME,
5099                              directory);
5100                 return NT_STATUS_OK;
5101         }
5102
5103         if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5104                 /*
5105                  * Check to see if the only thing in this directory are
5106                  * vetoed files/directories. If so then delete them and
5107                  * retry. If we fail to delete any of them (and we *don't*
5108                  * do a recursive delete) then fail the rmdir.
5109                  */
5110                 const char *dname;
5111                 long dirpos = 0;
5112                 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5113                                                   directory, NULL, 0);
5114
5115                 if(dir_hnd == NULL) {
5116                         errno = ENOTEMPTY;
5117                         goto err;
5118                 }
5119
5120                 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5121                         if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5122                                 continue;
5123                         if (!is_visible_file(conn, directory, dname, &st, False))
5124                                 continue;
5125                         if(!IS_VETO_PATH(conn, dname)) {
5126                                 TALLOC_FREE(dir_hnd);
5127                                 errno = ENOTEMPTY;
5128                                 goto err;
5129                         }
5130                 }
5131
5132                 /* We only have veto files/directories.
5133                  * Are we allowed to delete them ? */
5134
5135                 if(!lp_recursive_veto_delete(SNUM(conn))) {
5136                         TALLOC_FREE(dir_hnd);
5137                         errno = ENOTEMPTY;
5138                         goto err;
5139                 }
5140
5141                 /* Do a recursive delete. */
5142                 RewindDir(dir_hnd,&dirpos);
5143                 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5144                         char *fullname = NULL;
5145
5146                         if (ISDOT(dname) || ISDOTDOT(dname)) {
5147                                 continue;
5148                         }
5149                         if (!is_visible_file(conn, directory, dname, &st, False)) {
5150                                 continue;
5151                         }
5152
5153                         fullname = talloc_asprintf(ctx,
5154                                         "%s/%s",
5155                                         directory,
5156                                         dname);
5157
5158                         if(!fullname) {
5159                                 errno = ENOMEM;
5160                                 break;
5161                         }
5162
5163                         if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5164                                 break;
5165                         }
5166                         if(st.st_mode & S_IFDIR) {
5167                                 if(!recursive_rmdir(ctx, conn, fullname)) {
5168                                         break;
5169                                 }
5170                                 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5171                                         break;
5172                                 }
5173                         } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5174                                 break;
5175                         }
5176                         TALLOC_FREE(fullname);
5177                 }
5178                 TALLOC_FREE(dir_hnd);
5179                 /* Retry the rmdir */
5180                 ret = SMB_VFS_RMDIR(conn,directory);
5181         }
5182
5183   err:
5184
5185         if (ret != 0) {
5186                 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5187                          "%s\n", directory,strerror(errno)));
5188                 return map_nt_error_from_unix(errno);
5189         }
5190
5191         notify_fname(conn, NOTIFY_ACTION_REMOVED,
5192                      FILE_NOTIFY_CHANGE_DIR_NAME,
5193                      directory);
5194
5195         return NT_STATUS_OK;
5196 }
5197
5198 /****************************************************************************
5199  Reply to a rmdir.
5200 ****************************************************************************/
5201
5202 void reply_rmdir(struct smb_request *req)
5203 {
5204         connection_struct *conn = req->conn;
5205         char *directory = NULL;
5206         SMB_STRUCT_STAT sbuf;
5207         NTSTATUS status;
5208         TALLOC_CTX *ctx = talloc_tos();
5209
5210         START_PROFILE(SMBrmdir);
5211
5212         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
5213                         smb_buf(req->inbuf) + 1, 0,
5214                         STR_TERMINATE, &status);
5215         if (!NT_STATUS_IS_OK(status)) {
5216                 reply_nterror(req, status);
5217                 END_PROFILE(SMBrmdir);
5218                 return;
5219         }
5220
5221         status = resolve_dfspath(ctx, conn,
5222                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5223                                  directory,
5224                                  &directory);
5225         if (!NT_STATUS_IS_OK(status)) {
5226                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5227                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5228                                         ERRSRV, ERRbadpath);
5229                         END_PROFILE(SMBrmdir);
5230                         return;
5231                 }
5232                 reply_nterror(req, status);
5233                 END_PROFILE(SMBrmdir);
5234                 return;
5235         }
5236
5237         status = unix_convert(ctx, conn, directory, False, &directory,
5238                         NULL, &sbuf);
5239         if (!NT_STATUS_IS_OK(status)) {
5240                 reply_nterror(req, status);
5241                 END_PROFILE(SMBrmdir);
5242                 return;
5243         }
5244
5245         status = check_name(conn, directory);
5246         if (!NT_STATUS_IS_OK(status)) {
5247                 reply_nterror(req, status);
5248                 END_PROFILE(SMBrmdir);
5249                 return;
5250         }
5251
5252         dptr_closepath(directory, req->smbpid);
5253         status = rmdir_internals(ctx, conn, directory);
5254         if (!NT_STATUS_IS_OK(status)) {
5255                 reply_nterror(req, status);
5256                 END_PROFILE(SMBrmdir);
5257                 return;
5258         }
5259
5260         reply_outbuf(req, 0, 0);
5261
5262         DEBUG( 3, ( "rmdir %s\n", directory ) );
5263
5264         END_PROFILE(SMBrmdir);
5265         return;
5266 }
5267
5268 /*******************************************************************
5269  Resolve wildcards in a filename rename.
5270 ********************************************************************/
5271
5272 static bool resolve_wildcards(TALLOC_CTX *ctx,
5273                                 const char *name1,
5274                                 const char *name2,
5275                                 char **pp_newname)
5276 {
5277         char *name2_copy = NULL;
5278         char *root1 = NULL;
5279         char *root2 = NULL;
5280         char *ext1 = NULL;
5281         char *ext2 = NULL;
5282         char *p,*p2, *pname1, *pname2;
5283
5284         name2_copy = talloc_strdup(ctx, name2);
5285         if (!name2_copy) {
5286                 return False;
5287         }
5288
5289         pname1 = strrchr_m(name1,'/');
5290         pname2 = strrchr_m(name2_copy,'/');
5291
5292         if (!pname1 || !pname2) {
5293                 return False;
5294         }
5295
5296         /* Truncate the copy of name2 at the last '/' */
5297         *pname2 = '\0';
5298
5299         /* Now go past the '/' */
5300         pname1++;
5301         pname2++;
5302
5303         root1 = talloc_strdup(ctx, pname1);
5304         root2 = talloc_strdup(ctx, pname2);
5305
5306         if (!root1 || !root2) {
5307                 return False;
5308         }
5309
5310         p = strrchr_m(root1,'.');
5311         if (p) {
5312                 *p = 0;
5313                 ext1 = talloc_strdup(ctx, p+1);
5314         } else {
5315                 ext1 = talloc_strdup(ctx, "");
5316         }
5317         p = strrchr_m(root2,'.');
5318         if (p) {
5319                 *p = 0;
5320                 ext2 = talloc_strdup(ctx, p+1);
5321         } else {
5322                 ext2 = talloc_strdup(ctx, "");
5323         }
5324
5325         if (!ext1 || !ext2) {
5326                 return False;
5327         }
5328
5329         p = root1;
5330         p2 = root2;
5331         while (*p2) {
5332                 if (*p2 == '?') {
5333                         /* Hmmm. Should this be mb-aware ? */
5334                         *p2 = *p;
5335                         p2++;
5336                 } else if (*p2 == '*') {
5337                         *p2 = '\0';
5338                         root2 = talloc_asprintf(ctx, "%s%s",
5339                                                 root2,
5340                                                 p);
5341                         if (!root2) {
5342                                 return False;
5343                         }
5344                         break;
5345                 } else {
5346                         p2++;
5347                 }
5348                 if (*p) {
5349                         p++;
5350                 }
5351         }
5352
5353         p = ext1;
5354         p2 = ext2;
5355         while (*p2) {
5356                 if (*p2 == '?') {
5357                         /* Hmmm. Should this be mb-aware ? */
5358                         *p2 = *p;
5359                         p2++;
5360                 } else if (*p2 == '*') {
5361                         *p2 = '\0';
5362                         ext2 = talloc_asprintf(ctx, "%s%s",
5363                                                 ext2,
5364                                                 p);
5365                         if (!ext2) {
5366                                 return False;
5367                         }
5368                         break;
5369                 } else {
5370                         p2++;
5371                 }
5372                 if (*p) {
5373                         p++;
5374                 }
5375         }
5376
5377         if (*ext2) {
5378                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5379                                 name2_copy,
5380                                 root2,
5381                                 ext2);
5382         } else {
5383                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5384                                 name2_copy,
5385                                 root2);
5386         }
5387
5388         if (!*pp_newname) {
5389                 return False;
5390         }
5391
5392         return True;
5393 }
5394
5395 /****************************************************************************
5396  Ensure open files have their names updated. Updated to notify other smbd's
5397  asynchronously.
5398 ****************************************************************************/
5399
5400 static void rename_open_files(connection_struct *conn,
5401                               struct share_mode_lock *lck,
5402                               const char *newname)
5403 {
5404         files_struct *fsp;
5405         bool did_rename = False;
5406
5407         for(fsp = file_find_di_first(lck->id); fsp;
5408             fsp = file_find_di_next(fsp)) {
5409                 /* fsp_name is a relative path under the fsp. To change this for other
5410                    sharepaths we need to manipulate relative paths. */
5411                 /* TODO - create the absolute path and manipulate the newname
5412                    relative to the sharepath. */
5413                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5414                         continue;
5415                 }
5416                 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5417                           fsp->fnum, file_id_string_tos(&fsp->file_id),
5418                         fsp->fsp_name, newname ));
5419                 string_set(&fsp->fsp_name, newname);
5420                 did_rename = True;
5421         }
5422
5423         if (!did_rename) {
5424                 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5425                           file_id_string_tos(&lck->id), newname ));
5426         }
5427
5428         /* Send messages to all smbd's (not ourself) that the name has changed. */
5429         rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5430                               newname);
5431 }
5432
5433 /****************************************************************************
5434  We need to check if the source path is a parent directory of the destination
5435  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5436  refuse the rename with a sharing violation. Under UNIX the above call can
5437  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5438  probably need to check that the client is a Windows one before disallowing
5439  this as a UNIX client (one with UNIX extensions) can know the source is a
5440  symlink and make this decision intelligently. Found by an excellent bug
5441  report from <AndyLiebman@aol.com>.
5442 ****************************************************************************/
5443
5444 static bool rename_path_prefix_equal(const char *src, const char *dest)
5445 {
5446         const char *psrc = src;
5447         const char *pdst = dest;
5448         size_t slen;
5449
5450         if (psrc[0] == '.' && psrc[1] == '/') {
5451                 psrc += 2;
5452         }
5453         if (pdst[0] == '.' && pdst[1] == '/') {
5454                 pdst += 2;
5455         }
5456         if ((slen = strlen(psrc)) > strlen(pdst)) {
5457                 return False;
5458         }
5459         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5460 }
5461
5462 /*
5463  * Do the notify calls from a rename
5464  */
5465
5466 static void notify_rename(connection_struct *conn, bool is_dir,
5467                           const char *oldpath, const char *newpath)
5468 {
5469         char *olddir, *newdir;
5470         const char *oldname, *newname;
5471         uint32 mask;
5472
5473         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5474                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5475
5476         if (!parent_dirname_talloc(NULL, oldpath, &olddir, &oldname)
5477             || !parent_dirname_talloc(NULL, newpath, &newdir, &newname)) {
5478                 TALLOC_FREE(olddir);
5479                 return;
5480         }
5481
5482         if (strcmp(olddir, newdir) == 0) {
5483                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5484                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5485         }
5486         else {
5487                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5488                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5489         }
5490         TALLOC_FREE(olddir);
5491         TALLOC_FREE(newdir);
5492
5493         /* this is a strange one. w2k3 gives an additional event for
5494            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5495            files, but not directories */
5496         if (!is_dir) {
5497                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5498                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5499                              |FILE_NOTIFY_CHANGE_CREATION,
5500                              newpath);
5501         }
5502 }
5503
5504 /****************************************************************************
5505  Rename an open file - given an fsp.
5506 ****************************************************************************/
5507
5508 NTSTATUS rename_internals_fsp(connection_struct *conn,
5509                         files_struct *fsp,
5510                         char *newname,
5511                         const char *newname_last_component,
5512                         uint32 attrs,
5513                         bool replace_if_exists)
5514 {
5515         TALLOC_CTX *ctx = talloc_tos();
5516         SMB_STRUCT_STAT sbuf, sbuf1;
5517         NTSTATUS status = NT_STATUS_OK;
5518         struct share_mode_lock *lck = NULL;
5519         bool dst_exists, old_is_stream, new_is_stream;
5520
5521         ZERO_STRUCT(sbuf);
5522
5523         status = check_name(conn, newname);
5524         if (!NT_STATUS_IS_OK(status)) {
5525                 return status;
5526         }
5527
5528         /* Ensure newname contains a '/' */
5529         if(strrchr_m(newname,'/') == 0) {
5530                 newname = talloc_asprintf(ctx,
5531                                         "./%s",
5532                                         newname);
5533                 if (!newname) {
5534                         return NT_STATUS_NO_MEMORY;
5535                 }
5536         }
5537
5538         /*
5539          * Check for special case with case preserving and not
5540          * case sensitive. If the old last component differs from the original
5541          * last component only by case, then we should allow
5542          * the rename (user is trying to change the case of the
5543          * filename).
5544          */
5545
5546         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5547                         strequal(newname, fsp->fsp_name)) {
5548                 char *p;
5549                 char *newname_modified_last_component = NULL;
5550
5551                 /*
5552                  * Get the last component of the modified name.
5553                  * Note that we guarantee that newname contains a '/'
5554                  * character above.
5555                  */
5556                 p = strrchr_m(newname,'/');
5557                 newname_modified_last_component = talloc_strdup(ctx,
5558                                                 p+1);
5559                 if (!newname_modified_last_component) {
5560                         return NT_STATUS_NO_MEMORY;
5561                 }
5562
5563                 if(strcsequal(newname_modified_last_component,
5564                               newname_last_component) == False) {
5565                         /*
5566                          * Replace the modified last component with
5567                          * the original.
5568                          */
5569                         *p = '\0'; /* Truncate at the '/' */
5570                         newname = talloc_asprintf(ctx,
5571                                         "%s/%s",
5572                                         newname,
5573                                         newname_last_component);
5574                 }
5575         }
5576
5577         /*
5578          * If the src and dest names are identical - including case,
5579          * don't do the rename, just return success.
5580          */
5581
5582         if (strcsequal(fsp->fsp_name, newname)) {
5583                 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5584                         newname));
5585                 return NT_STATUS_OK;
5586         }
5587
5588         old_is_stream = is_ntfs_stream_name(fsp->fsp_name);
5589         new_is_stream = is_ntfs_stream_name(newname);
5590
5591         /* Return the correct error code if both names aren't streams. */
5592         if (!old_is_stream && new_is_stream) {
5593                 return NT_STATUS_OBJECT_NAME_INVALID;
5594         }
5595
5596         if (old_is_stream && !new_is_stream) {
5597                 return NT_STATUS_INVALID_PARAMETER;
5598         }
5599
5600         /*
5601          * Have vfs_object_exist also fill sbuf1
5602          */
5603         dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5604
5605         if(!replace_if_exists && dst_exists) {
5606                 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5607                         fsp->fsp_name,newname));
5608                 return NT_STATUS_OBJECT_NAME_COLLISION;
5609         }
5610
5611         if (dst_exists) {
5612                 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5613                 files_struct *dst_fsp = file_find_di_first(fileid);
5614                 /* The file can be open when renaming a stream */
5615                 if (dst_fsp && !new_is_stream) {
5616                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5617                         return NT_STATUS_ACCESS_DENIED;
5618                 }
5619         }
5620
5621         /* Ensure we have a valid stat struct for the source. */
5622         if (fsp->fh->fd != -1) {
5623                 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5624                         return map_nt_error_from_unix(errno);
5625                 }
5626         } else {
5627                 int ret = -1;
5628                 if (fsp->posix_open) {
5629                         ret = SMB_VFS_LSTAT(conn,fsp->fsp_name,&sbuf);
5630                 } else {
5631                         ret = SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf);
5632                 }
5633                 if (ret == -1) {
5634                         return map_nt_error_from_unix(errno);
5635                 }
5636         }
5637
5638         status = can_rename(conn, fsp, attrs, &sbuf);
5639
5640         if (!NT_STATUS_IS_OK(status)) {
5641                 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5642                         nt_errstr(status), fsp->fsp_name,newname));
5643                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5644                         status = NT_STATUS_ACCESS_DENIED;
5645                 return status;
5646         }
5647
5648         if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5649                 return NT_STATUS_ACCESS_DENIED;
5650         }
5651
5652         lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5653                                   NULL);
5654
5655         /*
5656          * We have the file open ourselves, so not being able to get the
5657          * corresponding share mode lock is a fatal error.
5658          */
5659
5660         SMB_ASSERT(lck != NULL);
5661
5662         if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5663                 uint32 create_options = fsp->fh->private_options;
5664
5665                 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5666                         fsp->fsp_name,newname));
5667
5668                 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5669
5670                 rename_open_files(conn, lck, newname);
5671
5672                 /*
5673                  * A rename acts as a new file create w.r.t. allowing an initial delete
5674                  * on close, probably because in Windows there is a new handle to the
5675                  * new file. If initial delete on close was requested but not
5676                  * originally set, we need to set it here. This is probably not 100% correct,
5677                  * but will work for the CIFSFS client which in non-posix mode
5678                  * depends on these semantics. JRA.
5679                  */
5680
5681                 if (create_options & FILE_DELETE_ON_CLOSE) {
5682                         status = can_set_delete_on_close(fsp, True, 0);
5683
5684                         if (NT_STATUS_IS_OK(status)) {
5685                                 /* Note that here we set the *inital* delete on close flag,
5686                                  * not the regular one. The magic gets handled in close. */
5687                                 fsp->initial_delete_on_close = True;
5688                         }
5689                 }
5690                 TALLOC_FREE(lck);
5691                 return NT_STATUS_OK;
5692         }
5693
5694         TALLOC_FREE(lck);
5695
5696         if (errno == ENOTDIR || errno == EISDIR) {
5697                 status = NT_STATUS_OBJECT_NAME_COLLISION;
5698         } else {
5699                 status = map_nt_error_from_unix(errno);
5700         }
5701
5702         DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5703                 nt_errstr(status), fsp->fsp_name,newname));
5704
5705         return status;
5706 }
5707
5708 /****************************************************************************
5709  The guts of the rename command, split out so it may be called by the NT SMB
5710  code.
5711 ****************************************************************************/
5712
5713 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5714                         connection_struct *conn,
5715                         struct smb_request *req,
5716                         const char *name_in,
5717                         const char *newname_in,
5718                         uint32 attrs,
5719                         bool replace_if_exists,
5720                         bool src_has_wild,
5721                         bool dest_has_wild,
5722                         uint32_t access_mask)
5723 {
5724         char *directory = NULL;
5725         char *mask = NULL;
5726         char *last_component_src = NULL;
5727         char *last_component_dest = NULL;
5728         char *name = NULL;
5729         char *newname = NULL;
5730         char *p;
5731         int count=0;
5732         NTSTATUS status = NT_STATUS_OK;
5733         SMB_STRUCT_STAT sbuf1, sbuf2;
5734         struct smb_Dir *dir_hnd = NULL;
5735         const char *dname;
5736         long offset = 0;
5737         bool posix_pathnames = lp_posix_pathnames();
5738
5739         ZERO_STRUCT(sbuf1);
5740         ZERO_STRUCT(sbuf2);
5741
5742         status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5743                         &last_component_src, &sbuf1);
5744         if (!NT_STATUS_IS_OK(status)) {
5745                 return status;
5746         }
5747
5748         status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5749                         &last_component_dest, &sbuf2);
5750         if (!NT_STATUS_IS_OK(status)) {
5751                 return status;
5752         }
5753
5754         /*
5755          * Split the old name into directory and last component
5756          * strings. Note that unix_convert may have stripped off a
5757          * leading ./ from both name and newname if the rename is
5758          * at the root of the share. We need to make sure either both
5759          * name and newname contain a / character or neither of them do
5760          * as this is checked in resolve_wildcards().
5761          */
5762
5763         p = strrchr_m(name,'/');
5764         if (!p) {
5765                 directory = talloc_strdup(ctx, ".");
5766                 if (!directory) {
5767                         return NT_STATUS_NO_MEMORY;
5768                 }
5769                 mask = name;
5770         } else {
5771                 *p = 0;
5772                 directory = talloc_strdup(ctx, name);
5773                 if (!directory) {
5774                         return NT_STATUS_NO_MEMORY;
5775                 }
5776                 mask = p+1;
5777                 *p = '/'; /* Replace needed for exceptional test below. */
5778         }
5779
5780         /*
5781          * We should only check the mangled cache
5782          * here if unix_convert failed. This means
5783          * that the path in 'mask' doesn't exist
5784          * on the file system and so we need to look
5785          * for a possible mangle. This patch from
5786          * Tine Smukavec <valentin.smukavec@hermes.si>.
5787          */
5788
5789         if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5790                 char *new_mask = NULL;
5791                 mangle_lookup_name_from_8_3(ctx,
5792                                         mask,
5793                                         &new_mask,
5794                                         conn->params );
5795                 if (new_mask) {
5796                         mask = new_mask;
5797                 }
5798         }
5799
5800         if (!src_has_wild) {
5801                 files_struct *fsp;
5802
5803                 /*
5804                  * No wildcards - just process the one file.
5805                  */
5806                 bool is_short_name = mangle_is_8_3(name, True, conn->params);
5807
5808                 /* Add a terminating '/' to the directory name. */
5809                 directory = talloc_asprintf_append(directory,
5810                                 "/%s",
5811                                 mask);
5812                 if (!directory) {
5813                         return NT_STATUS_NO_MEMORY;
5814                 }
5815
5816                 /* Ensure newname contains a '/' also */
5817                 if(strrchr_m(newname,'/') == 0) {
5818                         newname = talloc_asprintf(ctx,
5819                                                 "./%s",
5820                                                 newname);
5821                         if (!newname) {
5822                                 return NT_STATUS_NO_MEMORY;
5823                         }
5824                 }
5825
5826                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5827                           "case_preserve = %d, short case preserve = %d, "
5828                           "directory = %s, newname = %s, "
5829                           "last_component_dest = %s, is_8_3 = %d\n",
5830                           conn->case_sensitive, conn->case_preserve,
5831                           conn->short_case_preserve, directory,
5832                           newname, last_component_dest, is_short_name));
5833
5834                 /* The dest name still may have wildcards. */
5835                 if (dest_has_wild) {
5836                         char *mod_newname = NULL;
5837                         if (!resolve_wildcards(ctx,
5838                                         directory,newname,&mod_newname)) {
5839                                 DEBUG(6, ("rename_internals: resolve_wildcards "
5840                                         "%s %s failed\n",
5841                                         directory,
5842                                         newname));
5843                                 return NT_STATUS_NO_MEMORY;
5844                         }
5845                         newname = mod_newname;
5846                 }
5847
5848                 ZERO_STRUCT(sbuf1);
5849                 if (posix_pathnames) {
5850                         SMB_VFS_LSTAT(conn, directory, &sbuf1);
5851                 } else {
5852                         SMB_VFS_STAT(conn, directory, &sbuf1);
5853                 }
5854
5855                 status = S_ISDIR(sbuf1.st_mode) ?
5856                         open_directory(conn, req, directory, &sbuf1,
5857                                         access_mask,
5858                                         FILE_SHARE_READ|FILE_SHARE_WRITE,
5859                                         FILE_OPEN,
5860                                         0,
5861                                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0,
5862                                         NULL,
5863                                         &fsp)
5864                         : open_file_ntcreate(conn, req, directory, &sbuf1,
5865                                         access_mask,
5866                                         FILE_SHARE_READ|FILE_SHARE_WRITE,
5867                                         FILE_OPEN,
5868                                         0,
5869                                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0,
5870                                         0,
5871                                         NULL,
5872                                         &fsp);
5873
5874                 if (!NT_STATUS_IS_OK(status)) {
5875                         DEBUG(3, ("Could not open rename source %s: %s\n",
5876                                   directory, nt_errstr(status)));
5877                         return status;
5878                 }
5879
5880                 status = rename_internals_fsp(conn, fsp, newname,
5881                                               last_component_dest,
5882                                               attrs, replace_if_exists);
5883
5884                 close_file(fsp, NORMAL_CLOSE);
5885
5886                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
5887                           nt_errstr(status), directory,newname));
5888
5889                 return status;
5890         }
5891
5892         /*
5893          * Wildcards - process each file that matches.
5894          */
5895         if (strequal(mask,"????????.???")) {
5896                 mask[0] = '*';
5897                 mask[1] = '\0';
5898         }
5899
5900         status = check_name(conn, directory);
5901         if (!NT_STATUS_IS_OK(status)) {
5902                 return status;
5903         }
5904
5905         dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
5906         if (dir_hnd == NULL) {
5907                 return map_nt_error_from_unix(errno);
5908         }
5909
5910         status = NT_STATUS_NO_SUCH_FILE;
5911         /*
5912          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
5913          * - gentest fix. JRA
5914          */
5915
5916         while ((dname = ReadDirName(dir_hnd, &offset))) {
5917                 files_struct *fsp = NULL;
5918                 char *fname = NULL;
5919                 char *destname = NULL;
5920                 bool sysdir_entry = False;
5921
5922                 /* Quick check for "." and ".." */
5923                 if (ISDOT(dname) || ISDOTDOT(dname)) {
5924                         if (attrs & aDIR) {
5925                                 sysdir_entry = True;
5926                         } else {
5927                                 continue;
5928                         }
5929                 }
5930
5931                 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
5932                         continue;
5933                 }
5934
5935                 if(!mask_match(dname, mask, conn->case_sensitive)) {
5936                         continue;
5937                 }
5938
5939                 if (sysdir_entry) {
5940                         status = NT_STATUS_OBJECT_NAME_INVALID;
5941                         break;
5942                 }
5943
5944                 fname = talloc_asprintf(ctx,
5945                                 "%s/%s",
5946                                 directory,
5947                                 dname);
5948                 if (!fname) {
5949                         return NT_STATUS_NO_MEMORY;
5950                 }
5951
5952                 if (!resolve_wildcards(ctx,
5953                                 fname,newname,&destname)) {
5954                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
5955                                   fname, destname));
5956                         TALLOC_FREE(fname);
5957                         continue;
5958                 }
5959                 if (!destname) {
5960                         return NT_STATUS_NO_MEMORY;
5961                 }
5962
5963                 ZERO_STRUCT(sbuf1);
5964                 if (posix_pathnames) {
5965                         SMB_VFS_LSTAT(conn, fname, &sbuf1);
5966                 } else {
5967                         SMB_VFS_STAT(conn, fname, &sbuf1);
5968                 }
5969
5970                 status = S_ISDIR(sbuf1.st_mode) ?
5971                         open_directory(conn, req, fname, &sbuf1,
5972                                         access_mask,
5973                                         FILE_SHARE_READ|FILE_SHARE_WRITE,
5974                                         FILE_OPEN,
5975                                         0,
5976                                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0,
5977                                         NULL,
5978                                         &fsp)
5979                         : open_file_ntcreate(conn, req, fname, &sbuf1,
5980                                         access_mask,
5981                                         FILE_SHARE_READ|FILE_SHARE_WRITE,
5982                                         FILE_OPEN,
5983                                         0,
5984                                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0,
5985                                         0,
5986                                         NULL,
5987                                         &fsp);
5988
5989                 if (!NT_STATUS_IS_OK(status)) {
5990                         DEBUG(3,("rename_internals: open_file_ntcreate "
5991                                  "returned %s rename %s -> %s\n",
5992                                  nt_errstr(status), directory, newname));
5993                         break;
5994                 }
5995
5996                 status = rename_internals_fsp(conn, fsp, destname, dname,
5997                                               attrs, replace_if_exists);
5998
5999                 close_file(fsp, NORMAL_CLOSE);
6000
6001                 if (!NT_STATUS_IS_OK(status)) {
6002                         DEBUG(3, ("rename_internals_fsp returned %s for "
6003                                   "rename %s -> %s\n", nt_errstr(status),
6004                                   directory, newname));
6005                         break;
6006                 }
6007
6008                 count++;
6009
6010                 DEBUG(3,("rename_internals: doing rename on %s -> "
6011                          "%s\n",fname,destname));
6012
6013                 TALLOC_FREE(fname);
6014                 TALLOC_FREE(destname);
6015         }
6016         TALLOC_FREE(dir_hnd);
6017
6018         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6019                 status = map_nt_error_from_unix(errno);
6020         }
6021
6022         return status;
6023 }
6024
6025 /****************************************************************************
6026  Reply to a mv.
6027 ****************************************************************************/
6028
6029 void reply_mv(struct smb_request *req)
6030 {
6031         connection_struct *conn = req->conn;
6032         char *name = NULL;
6033         char *newname = NULL;
6034         char *p;
6035         uint32 attrs;
6036         NTSTATUS status;
6037         bool src_has_wcard = False;
6038         bool dest_has_wcard = False;
6039         TALLOC_CTX *ctx = talloc_tos();
6040
6041         START_PROFILE(SMBmv);
6042
6043         if (req->wct < 1) {
6044                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6045                 END_PROFILE(SMBmv);
6046                 return;
6047         }
6048
6049         attrs = SVAL(req->inbuf,smb_vwv0);
6050
6051         p = smb_buf(req->inbuf) + 1;
6052         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
6053                                    0, STR_TERMINATE, &status,
6054                                    &src_has_wcard);
6055         if (!NT_STATUS_IS_OK(status)) {
6056                 reply_nterror(req, status);
6057                 END_PROFILE(SMBmv);
6058                 return;
6059         }
6060         p++;
6061         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
6062                                    0, STR_TERMINATE, &status,
6063                                    &dest_has_wcard);
6064         if (!NT_STATUS_IS_OK(status)) {
6065                 reply_nterror(req, status);
6066                 END_PROFILE(SMBmv);
6067                 return;
6068         }
6069
6070         status = resolve_dfspath_wcard(ctx, conn,
6071                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
6072                                        name,
6073                                        &name,
6074                                        &src_has_wcard);
6075         if (!NT_STATUS_IS_OK(status)) {
6076                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6077                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6078                                         ERRSRV, ERRbadpath);
6079                         END_PROFILE(SMBmv);
6080                         return;
6081                 }
6082                 reply_nterror(req, status);
6083                 END_PROFILE(SMBmv);
6084                 return;
6085         }
6086
6087         status = resolve_dfspath_wcard(ctx, conn,
6088                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
6089                                        newname,
6090                                        &newname,
6091                                        &dest_has_wcard);
6092         if (!NT_STATUS_IS_OK(status)) {
6093                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6094                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6095                                         ERRSRV, ERRbadpath);
6096                         END_PROFILE(SMBmv);
6097                         return;
6098                 }
6099                 reply_nterror(req, status);
6100                 END_PROFILE(SMBmv);
6101                 return;
6102         }
6103
6104         DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
6105
6106         status = rename_internals(ctx, conn, req, name, newname, attrs, False,
6107                                   src_has_wcard, dest_has_wcard, DELETE_ACCESS);
6108         if (!NT_STATUS_IS_OK(status)) {
6109                 if (open_was_deferred(req->mid)) {
6110                         /* We have re-scheduled this call. */
6111                         END_PROFILE(SMBmv);
6112                         return;
6113                 }
6114                 reply_nterror(req, status);
6115                 END_PROFILE(SMBmv);
6116                 return;
6117         }
6118
6119         reply_outbuf(req, 0, 0);
6120
6121         END_PROFILE(SMBmv);
6122         return;
6123 }
6124
6125 /*******************************************************************
6126  Copy a file as part of a reply_copy.
6127 ******************************************************************/
6128
6129 /*
6130  * TODO: check error codes on all callers
6131  */
6132
6133 NTSTATUS copy_file(TALLOC_CTX *ctx,
6134                         connection_struct *conn,
6135                         const char *src,
6136                         const char *dest1,
6137                         int ofun,
6138                         int count,
6139                         bool target_is_directory)
6140 {
6141         SMB_STRUCT_STAT src_sbuf, sbuf2;
6142         SMB_OFF_T ret=-1;
6143         files_struct *fsp1,*fsp2;
6144         char *dest = NULL;
6145         uint32 dosattrs;
6146         uint32 new_create_disposition;
6147         NTSTATUS status;
6148
6149         dest = talloc_strdup(ctx, dest1);
6150         if (!dest) {
6151                 return NT_STATUS_NO_MEMORY;
6152         }
6153         if (target_is_directory) {
6154                 const char *p = strrchr_m(src,'/');
6155                 if (p) {
6156                         p++;
6157                 } else {
6158                         p = src;
6159                 }
6160                 dest = talloc_asprintf_append(dest,
6161                                 "/%s",
6162                                 p);
6163                 if (!dest) {
6164                         return NT_STATUS_NO_MEMORY;
6165                 }
6166         }
6167
6168         if (!vfs_file_exist(conn,src,&src_sbuf)) {
6169                 TALLOC_FREE(dest);
6170                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6171         }
6172
6173         if (!target_is_directory && count) {
6174                 new_create_disposition = FILE_OPEN;
6175         } else {
6176                 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6177                                 NULL, NULL, &new_create_disposition, NULL)) {
6178                         TALLOC_FREE(dest);
6179                         return NT_STATUS_INVALID_PARAMETER;
6180                 }
6181         }
6182
6183         status = open_file_ntcreate(conn, NULL, src, &src_sbuf,
6184                         FILE_GENERIC_READ,
6185                         FILE_SHARE_READ|FILE_SHARE_WRITE,
6186                         FILE_OPEN,
6187                         0,
6188                         FILE_ATTRIBUTE_NORMAL,
6189                         INTERNAL_OPEN_ONLY,
6190                         NULL, &fsp1);
6191
6192         if (!NT_STATUS_IS_OK(status)) {
6193                 TALLOC_FREE(dest);
6194                 return status;
6195         }
6196
6197         dosattrs = dos_mode(conn, src, &src_sbuf);
6198         if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6199                 ZERO_STRUCTP(&sbuf2);
6200         }
6201
6202         status = open_file_ntcreate(conn, NULL, dest, &sbuf2,
6203                         FILE_GENERIC_WRITE,
6204                         FILE_SHARE_READ|FILE_SHARE_WRITE,
6205                         new_create_disposition,
6206                         0,
6207                         dosattrs,
6208                         INTERNAL_OPEN_ONLY,
6209                         NULL, &fsp2);
6210
6211         TALLOC_FREE(dest);
6212
6213         if (!NT_STATUS_IS_OK(status)) {
6214                 close_file(fsp1,ERROR_CLOSE);
6215                 return status;
6216         }
6217
6218         if ((ofun&3) == 1) {
6219                 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6220                         DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6221                         /*
6222                          * Stop the copy from occurring.
6223                          */
6224                         ret = -1;
6225                         src_sbuf.st_size = 0;
6226                 }
6227         }
6228
6229         if (src_sbuf.st_size) {
6230                 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6231         }
6232
6233         close_file(fsp1,NORMAL_CLOSE);
6234
6235         /* Ensure the modtime is set correctly on the destination file. */
6236         set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6237
6238         /*
6239          * As we are opening fsp1 read-only we only expect
6240          * an error on close on fsp2 if we are out of space.
6241          * Thus we don't look at the error return from the
6242          * close of fsp1.
6243          */
6244         status = close_file(fsp2,NORMAL_CLOSE);
6245
6246         if (!NT_STATUS_IS_OK(status)) {
6247                 return status;
6248         }
6249
6250         if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6251                 return NT_STATUS_DISK_FULL;
6252         }
6253
6254         return NT_STATUS_OK;
6255 }
6256
6257 /****************************************************************************
6258  Reply to a file copy.
6259 ****************************************************************************/
6260
6261 void reply_copy(struct smb_request *req)
6262 {
6263         connection_struct *conn = req->conn;
6264         char *name = NULL;
6265         char *newname = NULL;
6266         char *directory = NULL;
6267         char *mask = NULL;
6268         char *p;
6269         int count=0;
6270         int error = ERRnoaccess;
6271         int err = 0;
6272         int tid2;
6273         int ofun;
6274         int flags;
6275         bool target_is_directory=False;
6276         bool source_has_wild = False;
6277         bool dest_has_wild = False;
6278         SMB_STRUCT_STAT sbuf1, sbuf2;
6279         NTSTATUS status;
6280         TALLOC_CTX *ctx = talloc_tos();
6281
6282         START_PROFILE(SMBcopy);
6283
6284         if (req->wct < 3) {
6285                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6286                 END_PROFILE(SMBcopy);
6287                 return;
6288         }
6289
6290         tid2 = SVAL(req->inbuf,smb_vwv0);
6291         ofun = SVAL(req->inbuf,smb_vwv1);
6292         flags = SVAL(req->inbuf,smb_vwv2);
6293
6294         p = smb_buf(req->inbuf);
6295         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
6296                                    0, STR_TERMINATE, &status,
6297                                    &source_has_wild);
6298         if (!NT_STATUS_IS_OK(status)) {
6299                 reply_nterror(req, status);
6300                 END_PROFILE(SMBcopy);
6301                 return;
6302         }
6303         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
6304                                    0, STR_TERMINATE, &status,
6305                                    &dest_has_wild);
6306         if (!NT_STATUS_IS_OK(status)) {
6307                 reply_nterror(req, status);
6308                 END_PROFILE(SMBcopy);
6309                 return;
6310         }
6311
6312         DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6313
6314         if (tid2 != conn->cnum) {
6315                 /* can't currently handle inter share copies XXXX */
6316                 DEBUG(3,("Rejecting inter-share copy\n"));
6317                 reply_doserror(req, ERRSRV, ERRinvdevice);
6318                 END_PROFILE(SMBcopy);
6319                 return;
6320         }
6321
6322         status = resolve_dfspath_wcard(ctx, conn,
6323                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
6324                                        name,
6325                                        &name,
6326                                        &source_has_wild);
6327         if (!NT_STATUS_IS_OK(status)) {
6328                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6329                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6330                                         ERRSRV, ERRbadpath);
6331                         END_PROFILE(SMBcopy);
6332                         return;
6333                 }
6334                 reply_nterror(req, status);
6335                 END_PROFILE(SMBcopy);
6336                 return;
6337         }
6338
6339         status = resolve_dfspath_wcard(ctx, conn,
6340                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
6341                                        newname,
6342                                        &newname,
6343                                        &dest_has_wild);
6344         if (!NT_STATUS_IS_OK(status)) {
6345                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6346                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6347                                         ERRSRV, ERRbadpath);
6348                         END_PROFILE(SMBcopy);
6349                         return;
6350                 }
6351                 reply_nterror(req, status);
6352                 END_PROFILE(SMBcopy);
6353                 return;
6354         }
6355
6356         status = unix_convert(ctx, conn, name, source_has_wild,
6357                         &name, NULL, &sbuf1);
6358         if (!NT_STATUS_IS_OK(status)) {
6359                 reply_nterror(req, status);
6360                 END_PROFILE(SMBcopy);
6361                 return;
6362         }
6363
6364         status = unix_convert(ctx, conn, newname, dest_has_wild,
6365                         &newname, NULL, &sbuf2);
6366         if (!NT_STATUS_IS_OK(status)) {
6367                 reply_nterror(req, status);
6368                 END_PROFILE(SMBcopy);
6369                 return;
6370         }
6371
6372         target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6373
6374         if ((flags&1) && target_is_directory) {
6375                 reply_doserror(req, ERRDOS, ERRbadfile);
6376                 END_PROFILE(SMBcopy);
6377                 return;
6378         }
6379
6380         if ((flags&2) && !target_is_directory) {
6381                 reply_doserror(req, ERRDOS, ERRbadpath);
6382                 END_PROFILE(SMBcopy);
6383                 return;
6384         }
6385
6386         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6387                 /* wants a tree copy! XXXX */
6388                 DEBUG(3,("Rejecting tree copy\n"));
6389                 reply_doserror(req, ERRSRV, ERRerror);
6390                 END_PROFILE(SMBcopy);
6391                 return;
6392         }
6393
6394         p = strrchr_m(name,'/');
6395         if (!p) {
6396                 directory = talloc_strdup(ctx, "./");
6397                 if (!directory) {
6398                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6399                         END_PROFILE(SMBcopy);
6400                         return;
6401                 }
6402                 mask = name;
6403         } else {
6404                 *p = 0;
6405                 directory = talloc_strdup(ctx, name);
6406                 if (!directory) {
6407                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6408                         END_PROFILE(SMBcopy);
6409                         return;
6410                 }
6411                 mask = p+1;
6412         }
6413
6414         /*
6415          * We should only check the mangled cache
6416          * here if unix_convert failed. This means
6417          * that the path in 'mask' doesn't exist
6418          * on the file system and so we need to look
6419          * for a possible mangle. This patch from
6420          * Tine Smukavec <valentin.smukavec@hermes.si>.
6421          */
6422
6423         if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6424                 char *new_mask = NULL;
6425                 mangle_lookup_name_from_8_3(ctx,
6426                                         mask,
6427                                         &new_mask,
6428                                         conn->params );
6429                 if (new_mask) {
6430                         mask = new_mask;
6431                 }
6432         }
6433
6434         if (!source_has_wild) {
6435                 directory = talloc_asprintf_append(directory,
6436                                 "/%s",
6437                                 mask);
6438                 if (dest_has_wild) {
6439                         char *mod_newname = NULL;
6440                         if (!resolve_wildcards(ctx,
6441                                         directory,newname,&mod_newname)) {
6442                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6443                                 END_PROFILE(SMBcopy);
6444                                 return;
6445                         }
6446                         newname = mod_newname;
6447                 }
6448
6449                 status = check_name(conn, directory);
6450                 if (!NT_STATUS_IS_OK(status)) {
6451                         reply_nterror(req, status);
6452                         END_PROFILE(SMBcopy);
6453                         return;
6454                 }
6455
6456                 status = check_name(conn, newname);
6457                 if (!NT_STATUS_IS_OK(status)) {
6458                         reply_nterror(req, status);
6459                         END_PROFILE(SMBcopy);
6460                         return;
6461                 }
6462
6463                 status = copy_file(ctx,conn,directory,newname,ofun,
6464                                 count,target_is_directory);
6465
6466                 if(!NT_STATUS_IS_OK(status)) {
6467                         reply_nterror(req, status);
6468                         END_PROFILE(SMBcopy);
6469                         return;
6470                 } else {
6471                         count++;
6472                 }
6473         } else {
6474                 struct smb_Dir *dir_hnd = NULL;
6475                 const char *dname = NULL;
6476                 long offset = 0;
6477
6478                 if (strequal(mask,"????????.???")) {
6479                         mask[0] = '*';
6480                         mask[1] = '\0';
6481                 }
6482
6483                 status = check_name(conn, directory);
6484                 if (!NT_STATUS_IS_OK(status)) {
6485                         reply_nterror(req, status);
6486                         END_PROFILE(SMBcopy);
6487                         return;
6488                 }
6489
6490                 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6491                 if (dir_hnd == NULL) {
6492                         status = map_nt_error_from_unix(errno);
6493                         reply_nterror(req, status);
6494                         END_PROFILE(SMBcopy);
6495                         return;
6496                 }
6497
6498                 error = ERRbadfile;
6499
6500                 while ((dname = ReadDirName(dir_hnd, &offset))) {
6501                         char *destname = NULL;
6502                         char *fname = NULL;
6503
6504                         if (ISDOT(dname) || ISDOTDOT(dname)) {
6505                                 continue;
6506                         }
6507
6508                         if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6509                                 continue;
6510                         }
6511
6512                         if(!mask_match(dname, mask, conn->case_sensitive)) {
6513                                 continue;
6514                         }
6515
6516                         error = ERRnoaccess;
6517                         fname = talloc_asprintf(ctx,
6518                                         "%s/%s",
6519                                         directory,
6520                                         dname);
6521                         if (!fname) {
6522                                 TALLOC_FREE(dir_hnd);
6523                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6524                                 END_PROFILE(SMBcopy);
6525                                 return;
6526                         }
6527
6528                         if (!resolve_wildcards(ctx,
6529                                         fname,newname,&destname)) {
6530                                 continue;
6531                         }
6532                         if (!destname) {
6533                                 TALLOC_FREE(dir_hnd);
6534                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6535                                 END_PROFILE(SMBcopy);
6536                                 return;
6537                         }
6538
6539                         status = check_name(conn, fname);
6540                         if (!NT_STATUS_IS_OK(status)) {
6541                                 TALLOC_FREE(dir_hnd);
6542                                 reply_nterror(req, status);
6543                                 END_PROFILE(SMBcopy);
6544                                 return;
6545                         }
6546
6547                         status = check_name(conn, destname);
6548                         if (!NT_STATUS_IS_OK(status)) {
6549                                 TALLOC_FREE(dir_hnd);
6550                                 reply_nterror(req, status);
6551                                 END_PROFILE(SMBcopy);
6552                                 return;
6553                         }
6554
6555                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6556
6557                         status = copy_file(ctx,conn,fname,destname,ofun,
6558                                         count,target_is_directory);
6559                         if (NT_STATUS_IS_OK(status)) {
6560                                 count++;
6561                         }
6562                         TALLOC_FREE(fname);
6563                         TALLOC_FREE(destname);
6564                 }
6565                 TALLOC_FREE(dir_hnd);
6566         }
6567
6568         if (count == 0) {
6569                 if(err) {
6570                         /* Error on close... */
6571                         errno = err;
6572                         reply_unixerror(req, ERRHRD, ERRgeneral);
6573                         END_PROFILE(SMBcopy);
6574                         return;
6575                 }
6576
6577                 reply_doserror(req, ERRDOS, error);
6578                 END_PROFILE(SMBcopy);
6579                 return;
6580         }
6581
6582         reply_outbuf(req, 1, 0);
6583         SSVAL(req->outbuf,smb_vwv0,count);
6584
6585         END_PROFILE(SMBcopy);
6586         return;
6587 }
6588
6589 #undef DBGC_CLASS
6590 #define DBGC_CLASS DBGC_LOCKING
6591
6592 /****************************************************************************
6593  Get a lock pid, dealing with large count requests.
6594 ****************************************************************************/
6595
6596 uint32 get_lock_pid( char *data, int data_offset, bool large_file_format)
6597 {
6598         if(!large_file_format)
6599                 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6600         else
6601                 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6602 }
6603
6604 /****************************************************************************
6605  Get a lock count, dealing with large count requests.
6606 ****************************************************************************/
6607
6608 SMB_BIG_UINT get_lock_count( char *data, int data_offset, bool large_file_format)
6609 {
6610         SMB_BIG_UINT count = 0;
6611
6612         if(!large_file_format) {
6613                 count = (SMB_BIG_UINT)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6614         } else {
6615
6616 #if defined(HAVE_LONGLONG)
6617                 count = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6618                         ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6619 #else /* HAVE_LONGLONG */
6620
6621                 /*
6622                  * NT4.x seems to be broken in that it sends large file (64 bit)
6623                  * lockingX calls even if the CAP_LARGE_FILES was *not*
6624                  * negotiated. For boxes without large unsigned ints truncate the
6625                  * lock count by dropping the top 32 bits.
6626                  */
6627
6628                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6629                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6630                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6631                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6632                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6633                 }
6634
6635                 count = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6636 #endif /* HAVE_LONGLONG */
6637         }
6638
6639         return count;
6640 }
6641
6642 #if !defined(HAVE_LONGLONG)
6643 /****************************************************************************
6644  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6645 ****************************************************************************/
6646
6647 static uint32 map_lock_offset(uint32 high, uint32 low)
6648 {
6649         unsigned int i;
6650         uint32 mask = 0;
6651         uint32 highcopy = high;
6652
6653         /*
6654          * Try and find out how many significant bits there are in high.
6655          */
6656
6657         for(i = 0; highcopy; i++)
6658                 highcopy >>= 1;
6659
6660         /*
6661          * We use 31 bits not 32 here as POSIX
6662          * lock offsets may not be negative.
6663          */
6664
6665         mask = (~0) << (31 - i);
6666
6667         if(low & mask)
6668                 return 0; /* Fail. */
6669
6670         high <<= (31 - i);
6671
6672         return (high|low);
6673 }
6674 #endif /* !defined(HAVE_LONGLONG) */
6675
6676 /****************************************************************************
6677  Get a lock offset, dealing with large offset requests.
6678 ****************************************************************************/
6679
6680 SMB_BIG_UINT get_lock_offset( char *data, int data_offset, bool large_file_format, bool *err)
6681 {
6682         SMB_BIG_UINT offset = 0;
6683
6684         *err = False;
6685
6686         if(!large_file_format) {
6687                 offset = (SMB_BIG_UINT)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6688         } else {
6689
6690 #if defined(HAVE_LONGLONG)
6691                 offset = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6692                                 ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6693 #else /* HAVE_LONGLONG */
6694
6695                 /*
6696                  * NT4.x seems to be broken in that it sends large file (64 bit)
6697                  * lockingX calls even if the CAP_LARGE_FILES was *not*
6698                  * negotiated. For boxes without large unsigned ints mangle the
6699                  * lock offset by mapping the top 32 bits onto the lower 32.
6700                  */
6701
6702                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6703                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6704                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6705                         uint32 new_low = 0;
6706
6707                         if((new_low = map_lock_offset(high, low)) == 0) {
6708                                 *err = True;
6709                                 return (SMB_BIG_UINT)-1;
6710                         }
6711
6712                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6713                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6714                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6715                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6716                 }
6717
6718                 offset = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6719 #endif /* HAVE_LONGLONG */
6720         }
6721
6722         return offset;
6723 }
6724
6725 /****************************************************************************
6726  Reply to a lockingX request.
6727 ****************************************************************************/
6728
6729 void reply_lockingX(struct smb_request *req)
6730 {
6731         connection_struct *conn = req->conn;
6732         files_struct *fsp;
6733         unsigned char locktype;
6734         unsigned char oplocklevel;
6735         uint16 num_ulocks;
6736         uint16 num_locks;
6737         SMB_BIG_UINT count = 0, offset = 0;
6738         uint32 lock_pid;
6739         int32 lock_timeout;
6740         int i;
6741         char *data;
6742         bool large_file_format;
6743         bool err;
6744         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6745
6746         START_PROFILE(SMBlockingX);
6747
6748         if (req->wct < 8) {
6749                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6750                 END_PROFILE(SMBlockingX);
6751                 return;
6752         }
6753
6754         fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
6755         locktype = CVAL(req->inbuf,smb_vwv3);
6756         oplocklevel = CVAL(req->inbuf,smb_vwv3+1);
6757         num_ulocks = SVAL(req->inbuf,smb_vwv6);
6758         num_locks = SVAL(req->inbuf,smb_vwv7);
6759         lock_timeout = IVAL(req->inbuf,smb_vwv4);
6760         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6761
6762         if (!check_fsp(conn, req, fsp)) {
6763                 END_PROFILE(SMBlockingX);
6764                 return;
6765         }
6766
6767         data = smb_buf(req->inbuf);
6768
6769         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6770                 /* we don't support these - and CANCEL_LOCK makes w2k
6771                    and XP reboot so I don't really want to be
6772                    compatible! (tridge) */
6773                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6774                 END_PROFILE(SMBlockingX);
6775                 return;
6776         }
6777
6778         /* Check if this is an oplock break on a file
6779            we have granted an oplock on.
6780         */
6781         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6782                 /* Client can insist on breaking to none. */
6783                 bool break_to_none = (oplocklevel == 0);
6784                 bool result;
6785
6786                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6787                          "for fnum = %d\n", (unsigned int)oplocklevel,
6788                          fsp->fnum ));
6789
6790                 /*
6791                  * Make sure we have granted an exclusive or batch oplock on
6792                  * this file.
6793                  */
6794
6795                 if (fsp->oplock_type == 0) {
6796
6797                         /* The Samba4 nbench simulator doesn't understand
6798                            the difference between break to level2 and break
6799                            to none from level2 - it sends oplock break
6800                            replies in both cases. Don't keep logging an error
6801                            message here - just ignore it. JRA. */
6802
6803                         DEBUG(5,("reply_lockingX: Error : oplock break from "
6804                                  "client for fnum = %d (oplock=%d) and no "
6805                                  "oplock granted on this file (%s).\n",
6806                                  fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6807
6808                         /* if this is a pure oplock break request then don't
6809                          * send a reply */
6810                         if (num_locks == 0 && num_ulocks == 0) {
6811                                 END_PROFILE(SMBlockingX);
6812                                 return;
6813                         } else {
6814                                 END_PROFILE(SMBlockingX);
6815                                 reply_doserror(req, ERRDOS, ERRlock);
6816                                 return;
6817                         }
6818                 }
6819
6820                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
6821                     (break_to_none)) {
6822                         result = remove_oplock(fsp);
6823                 } else {
6824                         result = downgrade_oplock(fsp);
6825                 }
6826
6827                 if (!result) {
6828                         DEBUG(0, ("reply_lockingX: error in removing "
6829                                   "oplock on file %s\n", fsp->fsp_name));
6830                         /* Hmmm. Is this panic justified? */
6831                         smb_panic("internal tdb error");
6832                 }
6833
6834                 reply_to_oplock_break_requests(fsp);
6835
6836                 /* if this is a pure oplock break request then don't send a
6837                  * reply */
6838                 if (num_locks == 0 && num_ulocks == 0) {
6839                         /* Sanity check - ensure a pure oplock break is not a
6840                            chained request. */
6841                         if(CVAL(req->inbuf,smb_vwv0) != 0xff)
6842                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
6843                                          "break is a chained %d request !\n",
6844                                          (unsigned int)CVAL(req->inbuf,
6845                                                             smb_vwv0) ));
6846                         END_PROFILE(SMBlockingX);
6847                         return;
6848                 }
6849         }
6850
6851         /*
6852          * We do this check *after* we have checked this is not a oplock break
6853          * response message. JRA.
6854          */
6855
6856         release_level_2_oplocks_on_change(fsp);
6857
6858         if (smb_buflen(req->inbuf) <
6859             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
6860                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6861                 END_PROFILE(SMBlockingX);
6862                 return;
6863         }
6864
6865         /* Data now points at the beginning of the list
6866            of smb_unlkrng structs */
6867         for(i = 0; i < (int)num_ulocks; i++) {
6868                 lock_pid = get_lock_pid( data, i, large_file_format);
6869                 count = get_lock_count( data, i, large_file_format);
6870                 offset = get_lock_offset( data, i, large_file_format, &err);
6871
6872                 /*
6873                  * There is no error code marked "stupid client bug".... :-).
6874                  */
6875                 if(err) {
6876                         END_PROFILE(SMBlockingX);
6877                         reply_doserror(req, ERRDOS, ERRnoaccess);
6878                         return;
6879                 }
6880
6881                 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
6882                           "pid %u, file %s\n", (double)offset, (double)count,
6883                           (unsigned int)lock_pid, fsp->fsp_name ));
6884
6885                 status = do_unlock(smbd_messaging_context(),
6886                                 fsp,
6887                                 lock_pid,
6888                                 count,
6889                                 offset,
6890                                 WINDOWS_LOCK);
6891
6892                 if (NT_STATUS_V(status)) {
6893                         END_PROFILE(SMBlockingX);
6894                         reply_nterror(req, status);
6895                         return;
6896                 }
6897         }
6898
6899         /* Setup the timeout in seconds. */
6900
6901         if (!lp_blocking_locks(SNUM(conn))) {
6902                 lock_timeout = 0;
6903         }
6904
6905         /* Now do any requested locks */
6906         data += ((large_file_format ? 20 : 10)*num_ulocks);
6907
6908         /* Data now points at the beginning of the list
6909            of smb_lkrng structs */
6910
6911         for(i = 0; i < (int)num_locks; i++) {
6912                 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
6913                                 READ_LOCK:WRITE_LOCK);
6914                 lock_pid = get_lock_pid( data, i, large_file_format);
6915                 count = get_lock_count( data, i, large_file_format);
6916                 offset = get_lock_offset( data, i, large_file_format, &err);
6917
6918                 /*
6919                  * There is no error code marked "stupid client bug".... :-).
6920                  */
6921                 if(err) {
6922                         END_PROFILE(SMBlockingX);
6923                         reply_doserror(req, ERRDOS, ERRnoaccess);
6924                         return;
6925                 }
6926
6927                 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
6928                           "%u, file %s timeout = %d\n", (double)offset,
6929                           (double)count, (unsigned int)lock_pid,
6930                           fsp->fsp_name, (int)lock_timeout ));
6931
6932                 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
6933                         if (lp_blocking_locks(SNUM(conn))) {
6934
6935                                 /* Schedule a message to ourselves to
6936                                    remove the blocking lock record and
6937                                    return the right error. */
6938
6939                                 if (!blocking_lock_cancel(fsp,
6940                                                 lock_pid,
6941                                                 offset,
6942                                                 count,
6943                                                 WINDOWS_LOCK,
6944                                                 locktype,
6945                                                 NT_STATUS_FILE_LOCK_CONFLICT)) {
6946                                         END_PROFILE(SMBlockingX);
6947                                         reply_nterror(
6948                                                 req,
6949                                                 NT_STATUS_DOS(
6950                                                         ERRDOS,
6951                                                         ERRcancelviolation));
6952                                         return;
6953                                 }
6954                         }
6955                         /* Remove a matching pending lock. */
6956                         status = do_lock_cancel(fsp,
6957                                                 lock_pid,
6958                                                 count,
6959                                                 offset,
6960                                                 WINDOWS_LOCK);
6961                 } else {
6962                         bool blocking_lock = lock_timeout ? True : False;
6963                         bool defer_lock = False;
6964                         struct byte_range_lock *br_lck;
6965                         uint32 block_smbpid;
6966
6967                         br_lck = do_lock(smbd_messaging_context(),
6968                                         fsp,
6969                                         lock_pid,
6970                                         count,
6971                                         offset,
6972                                         lock_type,
6973                                         WINDOWS_LOCK,
6974                                         blocking_lock,
6975                                         &status,
6976                                         &block_smbpid);
6977
6978                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
6979                                 /* Windows internal resolution for blocking locks seems
6980                                    to be about 200ms... Don't wait for less than that. JRA. */
6981                                 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
6982                                         lock_timeout = lp_lock_spin_time();
6983                                 }
6984                                 defer_lock = True;
6985                         }
6986
6987                         /* This heuristic seems to match W2K3 very well. If a
6988                            lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
6989                            it pretends we asked for a timeout of between 150 - 300 milliseconds as
6990                            far as I can tell. Replacement for do_lock_spin(). JRA. */
6991
6992                         if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
6993                                         NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
6994                                 defer_lock = True;
6995                                 lock_timeout = lp_lock_spin_time();
6996                         }
6997
6998                         if (br_lck && defer_lock) {
6999                                 /*
7000                                  * A blocking lock was requested. Package up
7001                                  * this smb into a queued request and push it
7002                                  * onto the blocking lock queue.
7003                                  */
7004                                 if(push_blocking_lock_request(br_lck,
7005                                                         req,
7006                                                         fsp,
7007                                                         lock_timeout,
7008                                                         i,
7009                                                         lock_pid,
7010                                                         lock_type,
7011                                                         WINDOWS_LOCK,
7012                                                         offset,
7013                                                         count,
7014                                                         block_smbpid)) {
7015                                         TALLOC_FREE(br_lck);
7016                                         END_PROFILE(SMBlockingX);
7017                                         return;
7018                                 }
7019                         }
7020
7021                         TALLOC_FREE(br_lck);
7022                 }
7023
7024                 if (NT_STATUS_V(status)) {
7025                         END_PROFILE(SMBlockingX);
7026                         reply_nterror(req, status);
7027                         return;
7028                 }
7029         }
7030
7031         /* If any of the above locks failed, then we must unlock
7032            all of the previous locks (X/Open spec). */
7033
7034         if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
7035                         (i != num_locks) &&
7036                         (num_locks != 0)) {
7037                 /*
7038                  * Ensure we don't do a remove on the lock that just failed,
7039                  * as under POSIX rules, if we have a lock already there, we
7040                  * will delete it (and we shouldn't) .....
7041                  */
7042                 for(i--; i >= 0; i--) {
7043                         lock_pid = get_lock_pid( data, i, large_file_format);
7044                         count = get_lock_count( data, i, large_file_format);
7045                         offset = get_lock_offset( data, i, large_file_format,
7046                                                   &err);
7047
7048                         /*
7049                          * There is no error code marked "stupid client
7050                          * bug".... :-).
7051                          */
7052                         if(err) {
7053                                 END_PROFILE(SMBlockingX);
7054                                 reply_doserror(req, ERRDOS, ERRnoaccess);
7055                                 return;
7056                         }
7057
7058                         do_unlock(smbd_messaging_context(),
7059                                 fsp,
7060                                 lock_pid,
7061                                 count,
7062                                 offset,
7063                                 WINDOWS_LOCK);
7064                 }
7065                 END_PROFILE(SMBlockingX);
7066                 reply_nterror(req, status);
7067                 return;
7068         }
7069
7070         reply_outbuf(req, 2, 0);
7071
7072         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7073                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7074
7075         END_PROFILE(SMBlockingX);
7076         chain_reply(req);
7077 }
7078
7079 #undef DBGC_CLASS
7080 #define DBGC_CLASS DBGC_ALL
7081
7082 /****************************************************************************
7083  Reply to a SMBreadbmpx (read block multiplex) request.
7084  Always reply with an error, if someone has a platform really needs this,
7085  please contact vl@samba.org
7086 ****************************************************************************/
7087
7088 void reply_readbmpx(struct smb_request *req)
7089 {
7090         START_PROFILE(SMBreadBmpx);
7091         reply_doserror(req, ERRSRV, ERRuseSTD);
7092         END_PROFILE(SMBreadBmpx);
7093         return;
7094 }
7095
7096 /****************************************************************************
7097  Reply to a SMBreadbs (read block multiplex secondary) request.
7098  Always reply with an error, if someone has a platform really needs this,
7099  please contact vl@samba.org
7100 ****************************************************************************/
7101
7102 void reply_readbs(struct smb_request *req)
7103 {
7104         START_PROFILE(SMBreadBs);
7105         reply_doserror(req, ERRSRV, ERRuseSTD);
7106         END_PROFILE(SMBreadBs);
7107         return;
7108 }
7109
7110 /****************************************************************************
7111  Reply to a SMBsetattrE.
7112 ****************************************************************************/
7113
7114 void reply_setattrE(struct smb_request *req)
7115 {
7116         connection_struct *conn = req->conn;
7117         struct timespec ts[2];
7118         files_struct *fsp;
7119         SMB_STRUCT_STAT sbuf;
7120         NTSTATUS status;
7121
7122         START_PROFILE(SMBsetattrE);
7123
7124         if (req->wct < 7) {
7125                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7126                 END_PROFILE(SMBsetattrE);
7127                 return;
7128         }
7129
7130         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
7131
7132         if(!fsp || (fsp->conn != conn)) {
7133                 reply_doserror(req, ERRDOS, ERRbadfid);
7134                 END_PROFILE(SMBsetattrE);
7135                 return;
7136         }
7137
7138
7139         /*
7140          * Convert the DOS times into unix times. Ignore create
7141          * time as UNIX can't set this.
7142          */
7143
7144         ts[0] = convert_time_t_to_timespec(
7145                 srv_make_unix_date2(req->inbuf+smb_vwv3)); /* atime. */
7146         ts[1] = convert_time_t_to_timespec(
7147                 srv_make_unix_date2(req->inbuf+smb_vwv5)); /* mtime. */
7148
7149         reply_outbuf(req, 0, 0);
7150
7151         /*
7152          * Patch from Ray Frush <frush@engr.colostate.edu>
7153          * Sometimes times are sent as zero - ignore them.
7154          */
7155
7156         /* Ensure we have a valid stat struct for the source. */
7157         if (fsp->fh->fd != -1) {
7158                 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7159                         status = map_nt_error_from_unix(errno);
7160                         reply_nterror(req, status);
7161                         END_PROFILE(SMBsetattrE);
7162                         return;
7163                 }
7164         } else {
7165                 int ret = -1;
7166
7167                 if (fsp->posix_open) {
7168                         ret = SMB_VFS_LSTAT(conn, fsp->fsp_name, &sbuf);
7169                 } else {
7170                         ret = SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf);
7171                 }
7172                 if (ret == -1) {
7173                         status = map_nt_error_from_unix(errno);
7174                         reply_nterror(req, status);
7175                         END_PROFILE(SMBsetattrE);
7176                         return;
7177                 }
7178         }
7179
7180         status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7181                                    &sbuf, ts, true);
7182         if (!NT_STATUS_IS_OK(status)) {
7183                 reply_doserror(req, ERRDOS, ERRnoaccess);
7184                 END_PROFILE(SMBsetattrE);
7185                 return;
7186         }
7187
7188         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u\n",
7189                 fsp->fnum,
7190                 (unsigned int)ts[0].tv_sec,
7191                 (unsigned int)ts[1].tv_sec));
7192
7193         END_PROFILE(SMBsetattrE);
7194         return;
7195 }
7196
7197
7198 /* Back from the dead for OS/2..... JRA. */
7199
7200 /****************************************************************************
7201  Reply to a SMBwritebmpx (write block multiplex primary) request.
7202  Always reply with an error, if someone has a platform really needs this,
7203  please contact vl@samba.org
7204 ****************************************************************************/
7205
7206 void reply_writebmpx(struct smb_request *req)
7207 {
7208         START_PROFILE(SMBwriteBmpx);
7209         reply_doserror(req, ERRSRV, ERRuseSTD);
7210         END_PROFILE(SMBwriteBmpx);
7211         return;
7212 }
7213
7214 /****************************************************************************
7215  Reply to a SMBwritebs (write block multiplex secondary) request.
7216  Always reply with an error, if someone has a platform really needs this,
7217  please contact vl@samba.org
7218 ****************************************************************************/
7219
7220 void reply_writebs(struct smb_request *req)
7221 {
7222         START_PROFILE(SMBwriteBs);
7223         reply_doserror(req, ERRSRV, ERRuseSTD);
7224         END_PROFILE(SMBwriteBs);
7225         return;
7226 }
7227
7228 /****************************************************************************
7229  Reply to a SMBgetattrE.
7230 ****************************************************************************/
7231
7232 void reply_getattrE(struct smb_request *req)
7233 {
7234         connection_struct *conn = req->conn;
7235         SMB_STRUCT_STAT sbuf;
7236         int mode;
7237         files_struct *fsp;
7238         struct timespec create_ts;
7239
7240         START_PROFILE(SMBgetattrE);
7241
7242         if (req->wct < 1) {
7243                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7244                 END_PROFILE(SMBgetattrE);
7245                 return;
7246         }
7247
7248         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
7249
7250         if(!fsp || (fsp->conn != conn)) {
7251                 reply_doserror(req, ERRDOS, ERRbadfid);
7252                 END_PROFILE(SMBgetattrE);
7253                 return;
7254         }
7255
7256         /* Do an fstat on this file */
7257         if(fsp_stat(fsp, &sbuf)) {
7258                 reply_unixerror(req, ERRDOS, ERRnoaccess);
7259                 END_PROFILE(SMBgetattrE);
7260                 return;
7261         }
7262
7263         mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7264
7265         /*
7266          * Convert the times into dos times. Set create
7267          * date to be last modify date as UNIX doesn't save
7268          * this.
7269          */
7270
7271         reply_outbuf(req, 11, 0);
7272
7273         create_ts = get_create_timespec(&sbuf,
7274                                   lp_fake_dir_create_times(SNUM(conn)));
7275         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7276         srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7277         /* Should we check pending modtime here ? JRA */
7278         srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7279
7280         if (mode & aDIR) {
7281                 SIVAL(req->outbuf, smb_vwv6, 0);
7282                 SIVAL(req->outbuf, smb_vwv8, 0);
7283         } else {
7284                 uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
7285                 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7286                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7287         }
7288         SSVAL(req->outbuf,smb_vwv10, mode);
7289
7290         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7291
7292         END_PROFILE(SMBgetattrE);
7293         return;
7294 }