source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  35 #include "../librpc/gen_ndr/open_files.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "rpc_server/rpc_ncacn_np.h"
  39 #include "libcli/security/security.h"
  40 #include "libsmb/nmblib.h"
  41 #include "auth.h"
  42 #include "smbprofile.h"
  43 #include "../lib/tsocket/tsocket.h"
  44 #include "lib/tevent_wait.h"
  45 #include "libcli/smb/smb_signing.h"
  46
  47 /****************************************************************************
  48  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  49  path or anything including wildcards.
  50  We're assuming here that '/' is not the second byte in any multibyte char
  51  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  52  set.
  53 ****************************************************************************/
  54
  55 /* Custom version for processing POSIX paths. */
  56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  57
  58 static NTSTATUS check_path_syntax_internal(char *path,
  59                                            bool posix_path,
  60                                            bool *p_last_component_contains_wcard)
  61 {
  62         char *d = path;
  63         const char *s = path;
  64         NTSTATUS ret = NT_STATUS_OK;
  65         bool start_of_name_component = True;
  66         bool stream_started = false;
  67
  68         *p_last_component_contains_wcard = False;
  69
  70         while (*s) {
  71                 if (stream_started) {
  72                         switch (*s) {
  73                         case '/':
  74                         case '\\':
  75                                 return NT_STATUS_OBJECT_NAME_INVALID;
  76                         case ':':
  77                                 if (s[1] == '\0') {
  78                                         return NT_STATUS_OBJECT_NAME_INVALID;
  79                                 }
  80                                 if (strchr_m(&s[1], ':')) {
  81                                         return NT_STATUS_OBJECT_NAME_INVALID;
  82                                 }
  83                                 break;
  84                         }
  85                 }
  86
  87                 if ((*s == ':') && !posix_path && !stream_started) {
  88                         if (*p_last_component_contains_wcard) {
  89                                 return NT_STATUS_OBJECT_NAME_INVALID;
  90                         }
  91                         /* Stream names allow more characters than file names.
  92                            We're overloading posix_path here to allow a wider
  93                            range of characters. If stream_started is true this
  94                            is still a Windows path even if posix_path is true.
  95                            JRA.
  96                         */
  97                         stream_started = true;
  98                         start_of_name_component = false;
  99                         posix_path = true;
 100
 101                         if (s[1] == '\0') {
 102                                 return NT_STATUS_OBJECT_NAME_INVALID;
 103                         }
 104                 }
 105
 106                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 107                         /*
 108                          * Safe to assume is not the second part of a mb char
 109                          * as this is handled below.
 110                          */
 111                         /* Eat multiple '/' or '\\' */
 112                         while (IS_PATH_SEP(*s,posix_path)) {
 113                                 s++;
 114                         }
 115                         if ((d != path) && (*s != '\0')) {
 116                                 /* We only care about non-leading or trailing '/' or '\\' */
 117                                 *d++ = '/';
 118                         }
 119
 120                         start_of_name_component = True;
 121                         /* New component. */
 122                         *p_last_component_contains_wcard = False;
 123                         continue;
 124                 }
 125
 126                 if (start_of_name_component) {
 127                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 128                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 129
 130                                 /*
 131                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 132                                  */
 133
 134                                 /* If  we just added a '/' - delete it */
 135                                 if ((d > path) && (*(d-1) == '/')) {
 136                                         *(d-1) = '\0';
 137                                         d--;
 138                                 }
 139
 140                                 /* Are we at the start ? Can't go back further if so. */
 141                                 if (d <= path) {
 142                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 143                                         break;
 144                                 }
 145                                 /* Go back one level... */
 146                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 147                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 148                                 /* Decrement d first as d points to the *next* char to write into. */
 149                                 for (d--; d > path; d--) {
 150                                         if (*d == '/')
 151                                                 break;
 152                                 }
 153                                 s += 2; /* Else go past the .. */
 154                                 /* We're still at the start of a name component, just the previous one. */
 155                                 continue;
 156
 157                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 158                                 if (posix_path) {
 159                                         /* Eat the '.' */
 160                                         s++;
 161                                         continue;
 162                                 }
 163                         }
 164
 165                 }
 166
 167                 if (!(*s & 0x80)) {
 168                         if (!posix_path) {
 169                                 if (*s <= 0x1f || *s == '|') {
 170                                         return NT_STATUS_OBJECT_NAME_INVALID;
 171                                 }
 172                                 switch (*s) {
 173                                         case '*':
 174                                         case '?':
 175                                         case '<':
 176                                         case '>':
 177                                         case '"':
 178                                                 *p_last_component_contains_wcard = True;
 179                                                 break;
 180                                         default:
 181                                                 break;
 182                                 }
 183                         }
 184                         *d++ = *s++;
 185                 } else {
 186                         size_t siz;
 187                         /* Get the size of the next MB character. */
 188                         next_codepoint(s,&siz);
 189                         switch(siz) {
 190                                 case 5:
 191                                         *d++ = *s++;
 192                                         /*fall through*/
 193                                 case 4:
 194                                         *d++ = *s++;
 195                                         /*fall through*/
 196                                 case 3:
 197                                         *d++ = *s++;
 198                                         /*fall through*/
 199                                 case 2:
 200                                         *d++ = *s++;
 201                                         /*fall through*/
 202                                 case 1:
 203                                         *d++ = *s++;
 204                                         break;
 205                                 default:
 206                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 207                                         *d = '\0';
 208                                         return NT_STATUS_INVALID_PARAMETER;
 209                         }
 210                 }
 211                 start_of_name_component = False;
 212         }
 213
 214         *d = '\0';
 215
 216         return ret;
 217 }
 218
 219 /****************************************************************************
 220  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 221  No wildcards allowed.
 222 ****************************************************************************/
 223
 224 NTSTATUS check_path_syntax(char *path)
 225 {
 226         bool ignore;
 227         return check_path_syntax_internal(path, False, &ignore);
 228 }
 229
 230 /****************************************************************************
 231  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 232  Wildcards allowed - p_contains_wcard returns true if the last component contained
 233  a wildcard.
 234 ****************************************************************************/
 235
 236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 237 {
 238         return check_path_syntax_internal(path, False, p_contains_wcard);
 239 }
 240
 241 /****************************************************************************
 242  Check the path for a POSIX client.
 243  We're assuming here that '/' is not the second byte in any multibyte char
 244  set (a safe assumption).
 245 ****************************************************************************/
 246
 247 NTSTATUS check_path_syntax_posix(char *path)
 248 {
 249         bool ignore;
 250         return check_path_syntax_internal(path, True, &ignore);
 251 }
 252
 253 /****************************************************************************
 254  Pull a string and check the path allowing a wilcard - provide for error return.
 255 ****************************************************************************/
 256
 257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 258                         const char *base_ptr,
 259                         uint16 smb_flags2,
 260                         char **pp_dest,
 261                         const char *src,
 262                         size_t src_len,
 263                         int flags,
 264                         NTSTATUS *err,
 265                         bool *contains_wcard)
 266 {
 267         size_t ret;
 268
 269         *pp_dest = NULL;
 270
 271         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 272                                  src_len, flags);
 273
 274         if (!*pp_dest) {
 275                 *err = NT_STATUS_INVALID_PARAMETER;
 276                 return ret;
 277         }
 278
 279         *contains_wcard = False;
 280
 281         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 282                 /*
 283                  * For a DFS path the function parse_dfs_path()
 284                  * will do the path processing, just make a copy.
 285                  */
 286                 *err = NT_STATUS_OK;
 287                 return ret;
 288         }
 289
 290         if (lp_posix_pathnames()) {
 291                 *err = check_path_syntax_posix(*pp_dest);
 292         } else {
 293                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 294         }
 295
 296         return ret;
 297 }
 298
 299 /****************************************************************************
 300  Pull a string and check the path - provide for error return.
 301 ****************************************************************************/
 302
 303 size_t srvstr_get_path(TALLOC_CTX *ctx,
 304                         const char *base_ptr,
 305                         uint16 smb_flags2,
 306                         char **pp_dest,
 307                         const char *src,
 308                         size_t src_len,
 309                         int flags,
 310                         NTSTATUS *err)
 311 {
 312         bool ignore;
 313         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 314                                      src_len, flags, err, &ignore);
 315 }
 316
 317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 318                                  char **pp_dest, const char *src, int flags,
 319                                  NTSTATUS *err, bool *contains_wcard)
 320 {
 321         ssize_t bufrem = smbreq_bufrem(req, src);
 322
 323         if (bufrem < 0) {
 324                 *err = NT_STATUS_INVALID_PARAMETER;
 325                 return 0;
 326         }
 327
 328         return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
 329                                      req->flags2, pp_dest, src, bufrem, flags,
 330                                      err, contains_wcard);
 331 }
 332
 333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 334                            char **pp_dest, const char *src, int flags,
 335                            NTSTATUS *err)
 336 {
 337         bool ignore;
 338         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 339                                          flags, err, &ignore);
 340 }
 341
 342 /**
 343  * pull a string from the smb_buf part of a packet. In this case the
 344  * string can either be null terminated or it can be terminated by the
 345  * end of the smbbuf area
 346  */
 347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
 348                               char **dest, const char *src, int flags)
 349 {
 350         ssize_t bufrem = smbreq_bufrem(req, src);
 351
 352         if (bufrem < 0) {
 353                 return 0;
 354         }
 355
 356         return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
 357                                   bufrem, flags);
 358 }
 359
 360 /****************************************************************************
 361  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 362 ****************************************************************************/
 363
 364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 365                     files_struct *fsp)
 366 {
 367         if ((fsp == NULL) || (conn == NULL)) {
 368                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 369                 return False;
 370         }
 371         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 372                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 373                 return False;
 374         }
 375         return True;
 376 }
 377
 378 /****************************************************************************
 379  Check if we have a correct fsp pointing to a file.
 380 ****************************************************************************/
 381
 382 bool check_fsp(connection_struct *conn, struct smb_request *req,
 383                files_struct *fsp)
 384 {
 385         if (!check_fsp_open(conn, req, fsp)) {
 386                 return False;
 387         }
 388         if (fsp->is_directory) {
 389                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 390                 return False;
 391         }
 392         if (fsp->fh->fd == -1) {
 393                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 394                 return False;
 395         }
 396         fsp->num_smb_operations++;
 397         return True;
 398 }
 399
 400 /****************************************************************************
 401  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 402  the CHECK_NTQUOTA_HANDLE_OK macro.
 403 ****************************************************************************/
 404
 405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 406                               files_struct *fsp)
 407 {
 408         if (!check_fsp_open(conn, req, fsp)) {
 409                 return false;
 410         }
 411
 412         if (fsp->is_directory) {
 413                 return false;
 414         }
 415
 416         if (fsp->fake_file_handle == NULL) {
 417                 return false;
 418         }
 419
 420         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 421                 return false;
 422         }
 423
 424         if (fsp->fake_file_handle->private_data == NULL) {
 425                 return false;
 426         }
 427
 428         return true;
 429 }
 430
 431 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 432                                      const char *name, int name_type)
 433 {
 434         char *trim_name;
 435         char *trim_name_type;
 436         const char *retarget_parm;
 437         char *retarget;
 438         char *p;
 439         int retarget_type = 0x20;
 440         int retarget_port = NBT_SMB_PORT;
 441         struct sockaddr_storage retarget_addr;
 442         struct sockaddr_in *in_addr;
 443         bool ret = false;
 444         uint8_t outbuf[10];
 445
 446         if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
 447                 return false;
 448         }
 449
 450         trim_name = talloc_strdup(talloc_tos(), name);
 451         if (trim_name == NULL) {
 452                 goto fail;
 453         }
 454         trim_char(trim_name, ' ', ' ');
 455
 456         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 457                                          name_type);
 458         if (trim_name_type == NULL) {
 459                 goto fail;
 460         }
 461
 462         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 463                                              trim_name_type, NULL);
 464         if (retarget_parm == NULL) {
 465                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 466                                                      trim_name, NULL);
 467         }
 468         if (retarget_parm == NULL) {
 469                 goto fail;
 470         }
 471
 472         retarget = talloc_strdup(trim_name, retarget_parm);
 473         if (retarget == NULL) {
 474                 goto fail;
 475         }
 476
 477         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 478
 479         p = strchr(retarget, ':');
 480         if (p != NULL) {
 481                 *p++ = '\0';
 482                 retarget_port = atoi(p);
 483         }
 484
 485         p = strchr_m(retarget, '#');
 486         if (p != NULL) {
 487                 *p++ = '\0';
 488                 if (sscanf(p, "%x", &retarget_type) != 1) {
 489                         goto fail;
 490                 }
 491         }
 492
 493         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 494         if (!ret) {
 495                 DEBUG(10, ("could not resolve %s\n", retarget));
 496                 goto fail;
 497         }
 498
 499         if (retarget_addr.ss_family != AF_INET) {
 500                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 501                 goto fail;
 502         }
 503
 504         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 505
 506         _smb_setlen(outbuf, 6);
 507         SCVAL(outbuf, 0, 0x84);
 508         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 509         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 510
 511         if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
 512                           NULL)) {
 513                 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
 514                                     "failed.");
 515         }
 516
 517         ret = true;
 518  fail:
 519         TALLOC_FREE(trim_name);
 520         return ret;
 521 }
 522
 523 static void reply_called_name_not_present(char *outbuf)
 524 {
 525         smb_setlen(outbuf, 1);
 526         SCVAL(outbuf, 0, 0x83);
 527         SCVAL(outbuf, 4, 0x82);
 528 }
 529
 530 /****************************************************************************
 531  Reply to a (netbios-level) special message.
 532 ****************************************************************************/
 533
 534 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
 535 {
 536         int msg_type = CVAL(inbuf,0);
 537         int msg_flags = CVAL(inbuf,1);
 538         /*
 539          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 540          * calculation & friends (srv_send_smb uses that) we need the full smb
 541          * header.
 542          */
 543         char outbuf[smb_size];
 544
 545         memset(outbuf, '\0', sizeof(outbuf));
 546
 547         smb_setlen(outbuf,0);
 548
 549         switch (msg_type) {
 550         case NBSSrequest: /* session request */
 551         {
 552                 /* inbuf_size is guarenteed to be at least 4. */
 553                 fstring name1,name2;
 554                 int name_type1, name_type2;
 555                 int name_len1, name_len2;
 556
 557                 *name1 = *name2 = 0;
 558
 559                 if (sconn->nbt.got_session) {
 560                         exit_server_cleanly("multiple session request not permitted");
 561                 }
 562
 563                 SCVAL(outbuf,0,NBSSpositive);
 564                 SCVAL(outbuf,3,0);
 565
 566                 /* inbuf_size is guaranteed to be at least 4. */
 567                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 568                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 569                         DEBUG(0,("Invalid name length in session request\n"));
 570                         reply_called_name_not_present(outbuf);
 571                         break;
 572                 }
 573                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 574                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 575                         DEBUG(0,("Invalid name length in session request\n"));
 576                         reply_called_name_not_present(outbuf);
 577                         break;
 578                 }
 579
 580                 name_type1 = name_extract((unsigned char *)inbuf,
 581                                 inbuf_size,(unsigned int)4,name1);
 582                 name_type2 = name_extract((unsigned char *)inbuf,
 583                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 584
 585                 if (name_type1 == -1 || name_type2 == -1) {
 586                         DEBUG(0,("Invalid name type in session request\n"));
 587                         reply_called_name_not_present(outbuf);
 588                         break;
 589                 }
 590
 591                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 592                          name1, name_type1, name2, name_type2));
 593
 594                 if (netbios_session_retarget(sconn, name1, name_type1)) {
 595                         exit_server_cleanly("retargeted client");
 596                 }
 597
 598                 /*
 599                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 600                  * "*SMBSERV" arrggg!!!
 601                  */
 602                 if (strequal(name1, "*SMBSERVER     ")
 603                     || strequal(name1, "*SMBSERV       "))  {
 604                         char *raddr;
 605
 606                         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
 607                                                                  talloc_tos());
 608                         if (raddr == NULL) {
 609                                 exit_server_cleanly("could not allocate raddr");
 610                         }
 611
 612                         fstrcpy(name1, raddr);
 613                 }
 614
 615                 set_local_machine_name(name1, True);
 616                 set_remote_machine_name(name2, True);
 617
 618                 if (is_ipaddress(sconn->remote_hostname)) {
 619                         char *p = discard_const_p(char, sconn->remote_hostname);
 620
 621                         talloc_free(p);
 622
 623                         sconn->remote_hostname = talloc_strdup(sconn,
 624                                                 get_remote_machine_name());
 625                         if (sconn->remote_hostname == NULL) {
 626                                 exit_server_cleanly("could not copy remote name");
 627                         }
 628                         sconn->conn->remote_hostname = sconn->remote_hostname;
 629                 }
 630
 631                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 632                          get_local_machine_name(), get_remote_machine_name(),
 633                          name_type2));
 634
 635                 if (name_type2 == 'R') {
 636                         /* We are being asked for a pathworks session ---
 637                            no thanks! */
 638                         reply_called_name_not_present(outbuf);
 639                         break;
 640                 }
 641
 642                 reload_services(sconn, conn_snum_used, true);
 643                 reopen_logs();
 644
 645                 sconn->nbt.got_session = true;
 646                 break;
 647         }
 648
 649         case 0x89: /* session keepalive request
 650                       (some old clients produce this?) */
 651                 SCVAL(outbuf,0,NBSSkeepalive);
 652                 SCVAL(outbuf,3,0);
 653                 break;
 654
 655         case NBSSpositive: /* positive session response */
 656         case NBSSnegative: /* negative session response */
 657         case NBSSretarget: /* retarget session response */
 658                 DEBUG(0,("Unexpected session response\n"));
 659                 break;
 660
 661         case NBSSkeepalive: /* session keepalive */
 662         default:
 663                 return;
 664         }
 665
 666         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 667                     msg_type, msg_flags));
 668
 669         srv_send_smb(sconn, outbuf, false, 0, false, NULL);
 670
 671         if (CVAL(outbuf, 0) != 0x82) {
 672                 exit_server_cleanly("invalid netbios session");
 673         }
 674         return;
 675 }
 676
 677 /****************************************************************************
 678  Reply to a tcon.
 679  conn POINTER CAN BE NULL HERE !
 680 ****************************************************************************/
 681
 682 void reply_tcon(struct smb_request *req)
 683 {
 684         connection_struct *conn = req->conn;
 685         const char *service;
 686         char *service_buf = NULL;
 687         char *password = NULL;
 688         char *dev = NULL;
 689         int pwlen=0;
 690         NTSTATUS nt_status;
 691         const char *p;
 692         TALLOC_CTX *ctx = talloc_tos();
 693         struct smbd_server_connection *sconn = req->sconn;
 694         NTTIME now = timeval_to_nttime(&req->request_time);
 695
 696         START_PROFILE(SMBtcon);
 697
 698         if (req->buflen < 4) {
 699                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 700                 END_PROFILE(SMBtcon);
 701                 return;
 702         }
 703
 704         p = (const char *)req->buf + 1;
 705         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 706         p += 1;
 707         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 708         p += pwlen+1;
 709         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 710         p += 1;
 711
 712         if (service_buf == NULL || password == NULL || dev == NULL) {
 713                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 714                 END_PROFILE(SMBtcon);
 715                 return;
 716         }
 717         p = strrchr_m(service_buf,'\\');
 718         if (p) {
 719                 service = p+1;
 720         } else {
 721                 service = service_buf;
 722         }
 723
 724         conn = make_connection(sconn, now, service, dev,
 725                                req->vuid,&nt_status);
 726         req->conn = conn;
 727
 728         if (!conn) {
 729                 reply_nterror(req, nt_status);
 730                 END_PROFILE(SMBtcon);
 731                 return;
 732         }
 733
 734         reply_outbuf(req, 2, 0);
 735         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 736         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 737         SSVAL(req->outbuf,smb_tid,conn->cnum);
 738
 739         DEBUG(3,("tcon service=%s cnum=%d\n",
 740                  service, conn->cnum));
 741
 742         END_PROFILE(SMBtcon);
 743         return;
 744 }
 745
 746 /****************************************************************************
 747  Reply to a tcon and X.
 748  conn POINTER CAN BE NULL HERE !
 749 ****************************************************************************/
 750
 751 void reply_tcon_and_X(struct smb_request *req)
 752 {
 753         connection_struct *conn = req->conn;
 754         const char *service = NULL;
 755         TALLOC_CTX *ctx = talloc_tos();
 756         /* what the cleint thinks the device is */
 757         char *client_devicetype = NULL;
 758         /* what the server tells the client the share represents */
 759         const char *server_devicetype;
 760         NTSTATUS nt_status;
 761         int passlen;
 762         char *path = NULL;
 763         const char *p, *q;
 764         uint16_t tcon_flags;
 765         struct smbXsrv_session *session = NULL;
 766         NTTIME now = timeval_to_nttime(&req->request_time);
 767         bool session_key_updated = false;
 768         uint16_t optional_support = 0;
 769         struct smbd_server_connection *sconn = req->sconn;
 770
 771         START_PROFILE(SMBtconX);
 772
 773         if (req->wct < 4) {
 774                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 775                 END_PROFILE(SMBtconX);
 776                 return;
 777         }
 778
 779         passlen = SVAL(req->vwv+3, 0);
 780         tcon_flags = SVAL(req->vwv+2, 0);
 781
 782         /* we might have to close an old one */
 783         if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
 784                 struct smbXsrv_tcon *tcon;
 785                 NTSTATUS status;
 786
 787                 tcon = conn->tcon;
 788                 req->conn = NULL;
 789                 conn = NULL;
 790
 791                 /*
 792                  * TODO: cancel all outstanding requests on the tcon
 793                  */
 794                 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
 795                 if (!NT_STATUS_IS_OK(status)) {
 796                         DEBUG(0, ("reply_tcon_and_X: "
 797                                   "smbXsrv_tcon_disconnect() failed: %s\n",
 798                                   nt_errstr(status)));
 799                         /*
 800                          * If we hit this case, there is something completely
 801                          * wrong, so we better disconnect the transport connection.
 802                          */
 803                         END_PROFILE(SMBtconX);
 804                         exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
 805                         return;
 806                 }
 807
 808                 TALLOC_FREE(tcon);
 809         }
 810
 811         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 812                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 813                 END_PROFILE(SMBtconX);
 814                 return;
 815         }
 816
 817         if (sconn->smb1.negprot.encrypted_passwords) {
 818                 p = (const char *)req->buf + passlen;
 819         } else {
 820                 p = (const char *)req->buf + passlen + 1;
 821         }
 822
 823         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 824
 825         if (path == NULL) {
 826                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 827                 END_PROFILE(SMBtconX);
 828                 return;
 829         }
 830
 831         /*
 832          * the service name can be either: \\server\share
 833          * or share directly like on the DELL PowerVault 705
 834          */
 835         if (*path=='\\') {
 836                 q = strchr_m(path+2,'\\');
 837                 if (!q) {
 838                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 839                         END_PROFILE(SMBtconX);
 840                         return;
 841                 }
 842                 service = q+1;
 843         } else {
 844                 service = path;
 845         }
 846
 847         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 848                                 &client_devicetype, p,
 849                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 850
 851         if (client_devicetype == NULL) {
 852                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 853                 END_PROFILE(SMBtconX);
 854                 return;
 855         }
 856
 857         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 858
 859         nt_status = smb1srv_session_lookup(req->sconn->conn,
 860                                            req->vuid, now, &session);
 861         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
 862                 reply_force_doserror(req, ERRSRV, ERRbaduid);
 863                 END_PROFILE(SMBtconX);
 864                 return;
 865         }
 866         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 867                 reply_nterror(req, nt_status);
 868                 END_PROFILE(SMBtconX);
 869                 return;
 870         }
 871         if (!NT_STATUS_IS_OK(nt_status)) {
 872                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 873                 END_PROFILE(SMBtconX);
 874                 return;
 875         }
 876
 877         if (session->global->auth_session_info == NULL) {
 878                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 879                 END_PROFILE(SMBtconX);
 880                 return;
 881         }
 882
 883         /*
 884          * If there is no application key defined yet
 885          * we create one.
 886          *
 887          * This means we setup the application key on the
 888          * first tcon that happens via the given session.
 889          *
 890          * Once the application key is defined, it does not
 891          * change any more.
 892          */
 893         if (session->global->application_key.length == 0 &&
 894             session->global->signing_key.length > 0)
 895         {
 896                 struct smbXsrv_session *x = session;
 897                 struct auth_session_info *session_info =
 898                         session->global->auth_session_info;
 899                 uint8_t session_key[16];
 900
 901                 ZERO_STRUCT(session_key);
 902                 memcpy(session_key, x->global->signing_key.data,
 903                        MIN(x->global->signing_key.length, sizeof(session_key)));
 904
 905                 /*
 906                  * The application key is truncated/padded to 16 bytes
 907                  */
 908                 x->global->application_key = data_blob_talloc(x->global,
 909                                                              session_key,
 910                                                              sizeof(session_key));
 911                 ZERO_STRUCT(session_key);
 912                 if (x->global->application_key.data == NULL) {
 913                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 914                         END_PROFILE(SMBtconX);
 915                         return;
 916                 }
 917
 918                 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
 919                         smb_key_derivation(x->global->application_key.data,
 920                                            x->global->application_key.length,
 921                                            x->global->application_key.data);
 922                         optional_support |= SMB_EXTENDED_SIGNATURES;
 923                 }
 924
 925                 /*
 926                  * Place the application key into the session_info
 927                  */
 928                 data_blob_clear_free(&session_info->session_key);
 929                 session_info->session_key = data_blob_dup_talloc(session_info,
 930                                                 x->global->application_key);
 931                 if (session_info->session_key.data == NULL) {
 932                         data_blob_clear_free(&x->global->application_key);
 933                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 934                         END_PROFILE(SMBtconX);
 935                         return;
 936                 }
 937                 session_key_updated = true;
 938         }
 939
 940         conn = make_connection(sconn, now, service, client_devicetype,
 941                                req->vuid, &nt_status);
 942         req->conn =conn;
 943
 944         if (!conn) {
 945                 if (session_key_updated) {
 946                         struct smbXsrv_session *x = session;
 947                         struct auth_session_info *session_info =
 948                                 session->global->auth_session_info;
 949                         data_blob_clear_free(&x->global->application_key);
 950                         data_blob_clear_free(&session_info->session_key);
 951                 }
 952                 reply_nterror(req, nt_status);
 953                 END_PROFILE(SMBtconX);
 954                 return;
 955         }
 956
 957         if ( IS_IPC(conn) )
 958                 server_devicetype = "IPC";
 959         else if ( IS_PRINT(conn) )
 960                 server_devicetype = "LPT1:";
 961         else
 962                 server_devicetype = "A:";
 963
 964         if (get_Protocol() < PROTOCOL_NT1) {
 965                 reply_outbuf(req, 2, 0);
 966                 if (message_push_string(&req->outbuf, server_devicetype,
 967                                         STR_TERMINATE|STR_ASCII) == -1) {
 968                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 969                         END_PROFILE(SMBtconX);
 970                         return;
 971                 }
 972         } else {
 973                 /* NT sets the fstype of IPC$ to the null string */
 974                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(ctx, SNUM(conn));
 975
 976                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 977                         /* Return permissions. */
 978                         uint32 perm1 = 0;
 979                         uint32 perm2 = 0;
 980
 981                         reply_outbuf(req, 7, 0);
 982
 983                         if (IS_IPC(conn)) {
 984                                 perm1 = FILE_ALL_ACCESS;
 985                                 perm2 = FILE_ALL_ACCESS;
 986                         } else {
 987                                 perm1 = conn->share_access;
 988                         }
 989
 990                         SIVAL(req->outbuf, smb_vwv3, perm1);
 991                         SIVAL(req->outbuf, smb_vwv5, perm2);
 992                 } else {
 993                         reply_outbuf(req, 3, 0);
 994                 }
 995
 996                 if ((message_push_string(&req->outbuf, server_devicetype,
 997                                          STR_TERMINATE|STR_ASCII) == -1)
 998                     || (message_push_string(&req->outbuf, fstype,
 999                                             STR_TERMINATE) == -1)) {
1000                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1001                         END_PROFILE(SMBtconX);
1002                         return;
1003                 }
1004
1005                 /* what does setting this bit do? It is set by NT4 and
1006                    may affect the ability to autorun mounted cdroms */
1007                 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1008                 optional_support |=
1009                         (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1010
1011                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1012                         DEBUG(2,("Serving %s as a Dfs root\n",
1013                                  lp_servicename(ctx, SNUM(conn)) ));
1014                         optional_support |= SMB_SHARE_IN_DFS;
1015                 }
1016
1017                 SSVAL(req->outbuf, smb_vwv2, optional_support);
1018         }
1019
1020         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1021         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
1022
1023         DEBUG(3,("tconX service=%s \n",
1024                  service));
1025
1026         /* set the incoming and outgoing tid to the just created one */
1027         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1028         SSVAL(req->outbuf,smb_tid,conn->cnum);
1029
1030         END_PROFILE(SMBtconX);
1031
1032         req->tid = conn->cnum;
1033 }
1034
1035 /****************************************************************************
1036  Reply to an unknown type.
1037 ****************************************************************************/
1038
1039 void reply_unknown_new(struct smb_request *req, uint8 type)
1040 {
1041         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1042                   smb_fn_name(type), type, type));
1043         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1044         return;
1045 }
1046
1047 /****************************************************************************
1048  Reply to an ioctl.
1049  conn POINTER CAN BE NULL HERE !
1050 ****************************************************************************/
1051
1052 void reply_ioctl(struct smb_request *req)
1053 {
1054         connection_struct *conn = req->conn;
1055         uint16 device;
1056         uint16 function;
1057         uint32 ioctl_code;
1058         int replysize;
1059         char *p;
1060
1061         START_PROFILE(SMBioctl);
1062
1063         if (req->wct < 3) {
1064                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1065                 END_PROFILE(SMBioctl);
1066                 return;
1067         }
1068
1069         device     = SVAL(req->vwv+1, 0);
1070         function   = SVAL(req->vwv+2, 0);
1071         ioctl_code = (device << 16) + function;
1072
1073         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1074
1075         switch (ioctl_code) {
1076             case IOCTL_QUERY_JOB_INFO:
1077                     replysize = 32;
1078                     break;
1079             default:
1080                     reply_force_doserror(req, ERRSRV, ERRnosupport);
1081                     END_PROFILE(SMBioctl);
1082                     return;
1083         }
1084
1085         reply_outbuf(req, 8, replysize+1);
1086         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1087         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1088         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
1089         p = smb_buf(req->outbuf);
1090         memset(p, '\0', replysize+1); /* valgrind-safe. */
1091         p += 1;          /* Allow for alignment */
1092
1093         switch (ioctl_code) {
1094                 case IOCTL_QUERY_JOB_INFO:
1095                 {
1096                         files_struct *fsp = file_fsp(
1097                                 req, SVAL(req->vwv+0, 0));
1098                         if (!fsp) {
1099                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1100                                 END_PROFILE(SMBioctl);
1101                                 return;
1102                         }
1103                         /* Job number */
1104                         SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1105
1106                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
1107                                     lp_netbios_name(), 15,
1108                                     STR_TERMINATE|STR_ASCII);
1109                         if (conn) {
1110                                 srvstr_push((char *)req->outbuf, req->flags2,
1111                                             p+18,
1112                                             lp_servicename(talloc_tos(),
1113                                                            SNUM(conn)),
1114                                             13, STR_TERMINATE|STR_ASCII);
1115                         } else {
1116                                 memset(p+18, 0, 13);
1117                         }
1118                         break;
1119                 }
1120         }
1121
1122         END_PROFILE(SMBioctl);
1123         return;
1124 }
1125
1126 /****************************************************************************
1127  Strange checkpath NTSTATUS mapping.
1128 ****************************************************************************/
1129
1130 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1131 {
1132         /* Strange DOS error code semantics only for checkpath... */
1133         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1134                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1135                         /* We need to map to ERRbadpath */
1136                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1137                 }
1138         }
1139         return status;
1140 }
1141
1142 /****************************************************************************
1143  Reply to a checkpath.
1144 ****************************************************************************/
1145
1146 void reply_checkpath(struct smb_request *req)
1147 {
1148         connection_struct *conn = req->conn;
1149         struct smb_filename *smb_fname = NULL;
1150         char *name = NULL;
1151         NTSTATUS status;
1152         TALLOC_CTX *ctx = talloc_tos();
1153
1154         START_PROFILE(SMBcheckpath);
1155
1156         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1157                             STR_TERMINATE, &status);
1158
1159         if (!NT_STATUS_IS_OK(status)) {
1160                 status = map_checkpath_error(req->flags2, status);
1161                 reply_nterror(req, status);
1162                 END_PROFILE(SMBcheckpath);
1163                 return;
1164         }
1165
1166         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1167
1168         status = filename_convert(ctx,
1169                                 conn,
1170                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1171                                 name,
1172                                 0,
1173                                 NULL,
1174                                 &smb_fname);
1175
1176         if (!NT_STATUS_IS_OK(status)) {
1177                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1178                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1179                                         ERRSRV, ERRbadpath);
1180                         END_PROFILE(SMBcheckpath);
1181                         return;
1182                 }
1183                 goto path_err;
1184         }
1185
1186         if (!VALID_STAT(smb_fname->st) &&
1187             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1188                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1189                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1190                 status = map_nt_error_from_unix(errno);
1191                 goto path_err;
1192         }
1193
1194         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1195                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1196                                 ERRDOS, ERRbadpath);
1197                 goto out;
1198         }
1199
1200         reply_outbuf(req, 0, 0);
1201
1202  path_err:
1203         /* We special case this - as when a Windows machine
1204                 is parsing a path is steps through the components
1205                 one at a time - if a component fails it expects
1206                 ERRbadpath, not ERRbadfile.
1207         */
1208         status = map_checkpath_error(req->flags2, status);
1209         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1210                 /*
1211                  * Windows returns different error codes if
1212                  * the parent directory is valid but not the
1213                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1214                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1215                  * if the path is invalid.
1216                  */
1217                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1218                                 ERRDOS, ERRbadpath);
1219                 goto out;
1220         }
1221
1222         reply_nterror(req, status);
1223
1224  out:
1225         TALLOC_FREE(smb_fname);
1226         END_PROFILE(SMBcheckpath);
1227         return;
1228 }
1229
1230 /****************************************************************************
1231  Reply to a getatr.
1232 ****************************************************************************/
1233
1234 void reply_getatr(struct smb_request *req)
1235 {
1236         connection_struct *conn = req->conn;
1237         struct smb_filename *smb_fname = NULL;
1238         char *fname = NULL;
1239         int mode=0;
1240         off_t size=0;
1241         time_t mtime=0;
1242         const char *p;
1243         NTSTATUS status;
1244         TALLOC_CTX *ctx = talloc_tos();
1245         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1246
1247         START_PROFILE(SMBgetatr);
1248
1249         p = (const char *)req->buf + 1;
1250         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1251         if (!NT_STATUS_IS_OK(status)) {
1252                 reply_nterror(req, status);
1253                 goto out;
1254         }
1255
1256         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1257                 under WfWg - weird! */
1258         if (*fname == '\0') {
1259                 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1260                 if (!CAN_WRITE(conn)) {
1261                         mode |= FILE_ATTRIBUTE_READONLY;
1262                 }
1263                 size = 0;
1264                 mtime = 0;
1265         } else {
1266                 status = filename_convert(ctx,
1267                                 conn,
1268                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1269                                 fname,
1270                                 0,
1271                                 NULL,
1272                                 &smb_fname);
1273                 if (!NT_STATUS_IS_OK(status)) {
1274                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1275                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1276                                                 ERRSRV, ERRbadpath);
1277                                 goto out;
1278                         }
1279                         reply_nterror(req, status);
1280                         goto out;
1281                 }
1282                 if (!VALID_STAT(smb_fname->st) &&
1283                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1284                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1285                                  smb_fname_str_dbg(smb_fname),
1286                                  strerror(errno)));
1287                         reply_nterror(req,  map_nt_error_from_unix(errno));
1288                         goto out;
1289                 }
1290
1291                 mode = dos_mode(conn, smb_fname);
1292                 size = smb_fname->st.st_ex_size;
1293
1294                 if (ask_sharemode) {
1295                         struct timespec write_time_ts;
1296                         struct file_id fileid;
1297
1298                         ZERO_STRUCT(write_time_ts);
1299                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1300                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1301                         if (!null_timespec(write_time_ts)) {
1302                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1303                         }
1304                 }
1305
1306                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1307                 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1308                         size = 0;
1309                 }
1310         }
1311
1312         reply_outbuf(req, 10, 0);
1313
1314         SSVAL(req->outbuf,smb_vwv0,mode);
1315         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1316                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1317         } else {
1318                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1319         }
1320         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1321
1322         if (get_Protocol() >= PROTOCOL_NT1) {
1323                 SSVAL(req->outbuf, smb_flg2,
1324                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1325         }
1326
1327         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1328                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1329
1330  out:
1331         TALLOC_FREE(smb_fname);
1332         TALLOC_FREE(fname);
1333         END_PROFILE(SMBgetatr);
1334         return;
1335 }
1336
1337 /****************************************************************************
1338  Reply to a setatr.
1339 ****************************************************************************/
1340
1341 void reply_setatr(struct smb_request *req)
1342 {
1343         struct smb_file_time ft;
1344         connection_struct *conn = req->conn;
1345         struct smb_filename *smb_fname = NULL;
1346         char *fname = NULL;
1347         int mode;
1348         time_t mtime;
1349         const char *p;
1350         NTSTATUS status;
1351         TALLOC_CTX *ctx = talloc_tos();
1352
1353         START_PROFILE(SMBsetatr);
1354
1355         ZERO_STRUCT(ft);
1356
1357         if (req->wct < 2) {
1358                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1359                 goto out;
1360         }
1361
1362         p = (const char *)req->buf + 1;
1363         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1364         if (!NT_STATUS_IS_OK(status)) {
1365                 reply_nterror(req, status);
1366                 goto out;
1367         }
1368
1369         status = filename_convert(ctx,
1370                                 conn,
1371                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1372                                 fname,
1373                                 0,
1374                                 NULL,
1375                                 &smb_fname);
1376         if (!NT_STATUS_IS_OK(status)) {
1377                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1378                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1379                                         ERRSRV, ERRbadpath);
1380                         goto out;
1381                 }
1382                 reply_nterror(req, status);
1383                 goto out;
1384         }
1385
1386         if (smb_fname->base_name[0] == '.' &&
1387             smb_fname->base_name[1] == '\0') {
1388                 /*
1389                  * Not sure here is the right place to catch this
1390                  * condition. Might be moved to somewhere else later -- vl
1391                  */
1392                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1393                 goto out;
1394         }
1395
1396         mode = SVAL(req->vwv+0, 0);
1397         mtime = srv_make_unix_date3(req->vwv+1);
1398
1399         if (mode != FILE_ATTRIBUTE_NORMAL) {
1400                 if (VALID_STAT_OF_DIR(smb_fname->st))
1401                         mode |= FILE_ATTRIBUTE_DIRECTORY;
1402                 else
1403                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1404
1405                 status = check_access(conn, NULL, smb_fname,
1406                                         FILE_WRITE_ATTRIBUTES);
1407                 if (!NT_STATUS_IS_OK(status)) {
1408                         reply_nterror(req, status);
1409                         goto out;
1410                 }
1411
1412                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1413                                      false) != 0) {
1414                         reply_nterror(req, map_nt_error_from_unix(errno));
1415                         goto out;
1416                 }
1417         }
1418
1419         ft.mtime = convert_time_t_to_timespec(mtime);
1420         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1421         if (!NT_STATUS_IS_OK(status)) {
1422                 reply_nterror(req, status);
1423                 goto out;
1424         }
1425
1426         reply_outbuf(req, 0, 0);
1427
1428         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1429                  mode));
1430  out:
1431         TALLOC_FREE(smb_fname);
1432         END_PROFILE(SMBsetatr);
1433         return;
1434 }
1435
1436 /****************************************************************************
1437  Reply to a dskattr.
1438 ****************************************************************************/
1439
1440 void reply_dskattr(struct smb_request *req)
1441 {
1442         connection_struct *conn = req->conn;
1443         uint64_t dfree,dsize,bsize;
1444         START_PROFILE(SMBdskattr);
1445
1446         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1447                 reply_nterror(req, map_nt_error_from_unix(errno));
1448                 END_PROFILE(SMBdskattr);
1449                 return;
1450         }
1451
1452         reply_outbuf(req, 5, 0);
1453
1454         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1455                 double total_space, free_space;
1456                 /* we need to scale this to a number that DOS6 can handle. We
1457                    use floating point so we can handle large drives on systems
1458                    that don't have 64 bit integers
1459
1460                    we end up displaying a maximum of 2G to DOS systems
1461                 */
1462                 total_space = dsize * (double)bsize;
1463                 free_space = dfree * (double)bsize;
1464
1465                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1466                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1467
1468                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1469                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1470
1471                 SSVAL(req->outbuf,smb_vwv0,dsize);
1472                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1473                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1474                 SSVAL(req->outbuf,smb_vwv3,dfree);
1475         } else {
1476                 SSVAL(req->outbuf,smb_vwv0,dsize);
1477                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1478                 SSVAL(req->outbuf,smb_vwv2,512);
1479                 SSVAL(req->outbuf,smb_vwv3,dfree);
1480         }
1481
1482         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1483
1484         END_PROFILE(SMBdskattr);
1485         return;
1486 }
1487
1488 /*
1489  * Utility function to split the filename from the directory.
1490  */
1491 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1492                                      char **fname_dir_out,
1493                                      char **fname_mask_out)
1494 {
1495         const char *p = NULL;
1496         char *fname_dir = NULL;
1497         char *fname_mask = NULL;
1498
1499         p = strrchr_m(fname_in, '/');
1500         if (!p) {
1501                 fname_dir = talloc_strdup(ctx, ".");
1502                 fname_mask = talloc_strdup(ctx, fname_in);
1503         } else {
1504                 fname_dir = talloc_strndup(ctx, fname_in,
1505                     PTR_DIFF(p, fname_in));
1506                 fname_mask = talloc_strdup(ctx, p+1);
1507         }
1508
1509         if (!fname_dir || !fname_mask) {
1510                 TALLOC_FREE(fname_dir);
1511                 TALLOC_FREE(fname_mask);
1512                 return NT_STATUS_NO_MEMORY;
1513         }
1514
1515         *fname_dir_out = fname_dir;
1516         *fname_mask_out = fname_mask;
1517         return NT_STATUS_OK;
1518 }
1519
1520 /****************************************************************************
1521  Reply to a search.
1522  Can be called from SMBsearch, SMBffirst or SMBfunique.
1523 ****************************************************************************/
1524
1525 void reply_search(struct smb_request *req)
1526 {
1527         connection_struct *conn = req->conn;
1528         char *path = NULL;
1529         const char *mask = NULL;
1530         char *directory = NULL;
1531         struct smb_filename *smb_fname = NULL;
1532         char *fname = NULL;
1533         off_t size;
1534         uint32 mode;
1535         struct timespec date;
1536         uint32 dirtype;
1537         unsigned int numentries = 0;
1538         unsigned int maxentries = 0;
1539         bool finished = False;
1540         const char *p;
1541         int status_len;
1542         char status[21];
1543         int dptr_num= -1;
1544         bool check_descend = False;
1545         bool expect_close = False;
1546         NTSTATUS nt_status;
1547         bool mask_contains_wcard = False;
1548         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1549         TALLOC_CTX *ctx = talloc_tos();
1550         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1551         struct dptr_struct *dirptr = NULL;
1552         struct smbd_server_connection *sconn = req->sconn;
1553
1554         START_PROFILE(SMBsearch);
1555
1556         if (req->wct < 2) {
1557                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1558                 goto out;
1559         }
1560
1561         if (lp_posix_pathnames()) {
1562                 reply_unknown_new(req, req->cmd);
1563                 goto out;
1564         }
1565
1566         /* If we were called as SMBffirst then we must expect close. */
1567         if(req->cmd == SMBffirst) {
1568                 expect_close = True;
1569         }
1570
1571         reply_outbuf(req, 1, 3);
1572         maxentries = SVAL(req->vwv+0, 0);
1573         dirtype = SVAL(req->vwv+1, 0);
1574         p = (const char *)req->buf + 1;
1575         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1576                                        &nt_status, &mask_contains_wcard);
1577         if (!NT_STATUS_IS_OK(nt_status)) {
1578                 reply_nterror(req, nt_status);
1579                 goto out;
1580         }
1581
1582         p++;
1583         status_len = SVAL(p, 0);
1584         p += 2;
1585
1586         /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1587
1588         if (status_len == 0) {
1589                 nt_status = filename_convert(ctx, conn,
1590                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1591                                              path,
1592                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1593                                              &mask_contains_wcard,
1594                                              &smb_fname);
1595                 if (!NT_STATUS_IS_OK(nt_status)) {
1596                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1597                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1598                                                 ERRSRV, ERRbadpath);
1599                                 goto out;
1600                         }
1601                         reply_nterror(req, nt_status);
1602                         goto out;
1603                 }
1604
1605                 directory = smb_fname->base_name;
1606
1607                 p = strrchr_m(directory,'/');
1608                 if ((p != NULL) && (*directory != '/')) {
1609                         mask = p + 1;
1610                         directory = talloc_strndup(ctx, directory,
1611                                                    PTR_DIFF(p, directory));
1612                 } else {
1613                         mask = directory;
1614                         directory = talloc_strdup(ctx,".");
1615                 }
1616
1617                 if (!directory) {
1618                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1619                         goto out;
1620                 }
1621
1622                 memset((char *)status,'\0',21);
1623                 SCVAL(status,0,(dirtype & 0x1F));
1624
1625                 nt_status = dptr_create(conn,
1626                                         NULL, /* req */
1627                                         NULL, /* fsp */
1628                                         directory,
1629                                         True,
1630                                         expect_close,
1631                                         req->smbpid,
1632                                         mask,
1633                                         mask_contains_wcard,
1634                                         dirtype,
1635                                         &dirptr);
1636                 if (!NT_STATUS_IS_OK(nt_status)) {
1637                         reply_nterror(req, nt_status);
1638                         goto out;
1639                 }
1640                 dptr_num = dptr_dnum(dirptr);
1641         } else {
1642                 int status_dirtype;
1643                 const char *dirpath;
1644
1645                 memcpy(status,p,21);
1646                 status_dirtype = CVAL(status,0) & 0x1F;
1647                 if (status_dirtype != (dirtype & 0x1F)) {
1648                         dirtype = status_dirtype;
1649                 }
1650
1651                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1652                 if (!dirptr) {
1653                         goto SearchEmpty;
1654                 }
1655                 dirpath = dptr_path(sconn, dptr_num);
1656                 directory = talloc_strdup(ctx, dirpath);
1657                 if (!directory) {
1658                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1659                         goto out;
1660                 }
1661
1662                 mask = dptr_wcard(sconn, dptr_num);
1663                 if (!mask) {
1664                         goto SearchEmpty;
1665                 }
1666                 /*
1667                  * For a 'continue' search we have no string. So
1668                  * check from the initial saved string.
1669                  */
1670                 mask_contains_wcard = ms_has_wild(mask);
1671                 dirtype = dptr_attr(sconn, dptr_num);
1672         }
1673
1674         DEBUG(4,("dptr_num is %d\n",dptr_num));
1675
1676         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1677         dptr_init_search_op(dirptr);
1678
1679         if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1680                 char buf[DIR_STRUCT_SIZE];
1681                 memcpy(buf,status,21);
1682                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1683                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1684                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1685                         goto out;
1686                 }
1687                 dptr_fill(sconn, buf+12,dptr_num);
1688                 if (dptr_zero(buf+12) && (status_len==0)) {
1689                         numentries = 1;
1690                 } else {
1691                         numentries = 0;
1692                 }
1693                 if (message_push_blob(&req->outbuf,
1694                                       data_blob_const(buf, sizeof(buf)))
1695                     == -1) {
1696                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1697                         goto out;
1698                 }
1699         } else {
1700                 unsigned int i;
1701                 maxentries = MIN(
1702                         maxentries,
1703                         ((BUFFER_SIZE -
1704                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1705                          /DIR_STRUCT_SIZE));
1706
1707                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1708                          directory,lp_dontdescend(ctx, SNUM(conn))));
1709                 if (in_list(directory, lp_dontdescend(ctx, SNUM(conn)),True)) {
1710                         check_descend = True;
1711                 }
1712
1713                 for (i=numentries;(i<maxentries) && !finished;i++) {
1714                         finished = !get_dir_entry(ctx,
1715                                                   dirptr,
1716                                                   mask,
1717                                                   dirtype,
1718                                                   &fname,
1719                                                   &size,
1720                                                   &mode,
1721                                                   &date,
1722                                                   check_descend,
1723                                                   ask_sharemode);
1724                         if (!finished) {
1725                                 char buf[DIR_STRUCT_SIZE];
1726                                 memcpy(buf,status,21);
1727                                 if (!make_dir_struct(ctx,
1728                                                 buf,
1729                                                 mask,
1730                                                 fname,
1731                                                 size,
1732                                                 mode,
1733                                                 convert_timespec_to_time_t(date),
1734                                                 !allow_long_path_components)) {
1735                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1736                                         goto out;
1737                                 }
1738                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1739                                         break;
1740                                 }
1741                                 if (message_push_blob(&req->outbuf,
1742                                                       data_blob_const(buf, sizeof(buf)))
1743                                     == -1) {
1744                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1745                                         goto out;
1746                                 }
1747                                 numentries++;
1748                         }
1749                 }
1750         }
1751
1752   SearchEmpty:
1753
1754         /* If we were called as SMBffirst with smb_search_id == NULL
1755                 and no entries were found then return error and close dirptr
1756                 (X/Open spec) */
1757
1758         if (numentries == 0) {
1759                 dptr_close(sconn, &dptr_num);
1760         } else if(expect_close && status_len == 0) {
1761                 /* Close the dptr - we know it's gone */
1762                 dptr_close(sconn, &dptr_num);
1763         }
1764
1765         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1766         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1767                 dptr_close(sconn, &dptr_num);
1768         }
1769
1770         if ((numentries == 0) && !mask_contains_wcard) {
1771                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1772                 goto out;
1773         }
1774
1775         SSVAL(req->outbuf,smb_vwv0,numentries);
1776         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1777         SCVAL(smb_buf(req->outbuf),0,5);
1778         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1779
1780         /* The replies here are never long name. */
1781         SSVAL(req->outbuf, smb_flg2,
1782               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1783         if (!allow_long_path_components) {
1784                 SSVAL(req->outbuf, smb_flg2,
1785                       SVAL(req->outbuf, smb_flg2)
1786                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1787         }
1788
1789         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1790         SSVAL(req->outbuf, smb_flg2,
1791               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1792
1793         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1794                 smb_fn_name(req->cmd),
1795                 mask,
1796                 directory,
1797                 dirtype,
1798                 numentries,
1799                 maxentries ));
1800  out:
1801         TALLOC_FREE(directory);
1802         TALLOC_FREE(smb_fname);
1803         END_PROFILE(SMBsearch);
1804         return;
1805 }
1806
1807 /****************************************************************************
1808  Reply to a fclose (stop directory search).
1809 ****************************************************************************/
1810
1811 void reply_fclose(struct smb_request *req)
1812 {
1813         int status_len;
1814         char status[21];
1815         int dptr_num= -2;
1816         const char *p;
1817         char *path = NULL;
1818         NTSTATUS err;
1819         bool path_contains_wcard = False;
1820         TALLOC_CTX *ctx = talloc_tos();
1821         struct smbd_server_connection *sconn = req->sconn;
1822
1823         START_PROFILE(SMBfclose);
1824
1825         if (lp_posix_pathnames()) {
1826                 reply_unknown_new(req, req->cmd);
1827                 END_PROFILE(SMBfclose);
1828                 return;
1829         }
1830
1831         p = (const char *)req->buf + 1;
1832         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1833                                        &err, &path_contains_wcard);
1834         if (!NT_STATUS_IS_OK(err)) {
1835                 reply_nterror(req, err);
1836                 END_PROFILE(SMBfclose);
1837                 return;
1838         }
1839         p++;
1840         status_len = SVAL(p,0);
1841         p += 2;
1842
1843         if (status_len == 0) {
1844                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1845                 END_PROFILE(SMBfclose);
1846                 return;
1847         }
1848
1849         memcpy(status,p,21);
1850
1851         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1852                 /*  Close the dptr - we know it's gone */
1853                 dptr_close(sconn, &dptr_num);
1854         }
1855
1856         reply_outbuf(req, 1, 0);
1857         SSVAL(req->outbuf,smb_vwv0,0);
1858
1859         DEBUG(3,("search close\n"));
1860
1861         END_PROFILE(SMBfclose);
1862         return;
1863 }
1864
1865 /****************************************************************************
1866  Reply to an open.
1867 ****************************************************************************/
1868
1869 void reply_open(struct smb_request *req)
1870 {
1871         connection_struct *conn = req->conn;
1872         struct smb_filename *smb_fname = NULL;
1873         char *fname = NULL;
1874         uint32 fattr=0;
1875         off_t size = 0;
1876         time_t mtime=0;
1877         int info;
1878         files_struct *fsp;
1879         int oplock_request;
1880         int deny_mode;
1881         uint32 dos_attr;
1882         uint32 access_mask;
1883         uint32 share_mode;
1884         uint32 create_disposition;
1885         uint32 create_options = 0;
1886         uint32_t private_flags = 0;
1887         NTSTATUS status;
1888         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1889         TALLOC_CTX *ctx = talloc_tos();
1890
1891         START_PROFILE(SMBopen);
1892
1893         if (req->wct < 2) {
1894                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1895                 goto out;
1896         }
1897
1898         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1899         deny_mode = SVAL(req->vwv+0, 0);
1900         dos_attr = SVAL(req->vwv+1, 0);
1901
1902         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1903                             STR_TERMINATE, &status);
1904         if (!NT_STATUS_IS_OK(status)) {
1905                 reply_nterror(req, status);
1906                 goto out;
1907         }
1908
1909         status = filename_convert(ctx,
1910                                 conn,
1911                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1912                                 fname,
1913                                 0,
1914                                 NULL,
1915                                 &smb_fname);
1916         if (!NT_STATUS_IS_OK(status)) {
1917                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1918                         reply_botherror(req,
1919                                         NT_STATUS_PATH_NOT_COVERED,
1920                                         ERRSRV, ERRbadpath);
1921                         goto out;
1922                 }
1923                 reply_nterror(req, status);
1924                 goto out;
1925         }
1926
1927         if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
1928                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1929                                          &share_mode, &create_disposition,
1930                                          &create_options, &private_flags)) {
1931                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1932                 goto out;
1933         }
1934
1935         status = SMB_VFS_CREATE_FILE(
1936                 conn,                                   /* conn */
1937                 req,                                    /* req */
1938                 0,                                      /* root_dir_fid */
1939                 smb_fname,                              /* fname */
1940                 access_mask,                            /* access_mask */
1941                 share_mode,                             /* share_access */
1942                 create_disposition,                     /* create_disposition*/
1943                 create_options,                         /* create_options */
1944                 dos_attr,                               /* file_attributes */
1945                 oplock_request,                         /* oplock_request */
1946                 0,                                      /* allocation_size */
1947                 private_flags,
1948                 NULL,                                   /* sd */
1949                 NULL,                                   /* ea_list */
1950                 &fsp,                                   /* result */
1951                 &info);                                 /* pinfo */
1952
1953         if (!NT_STATUS_IS_OK(status)) {
1954                 if (open_was_deferred(req->sconn, req->mid)) {
1955                         /* We have re-scheduled this call. */
1956                         goto out;
1957                 }
1958                 reply_openerror(req, status);
1959                 goto out;
1960         }
1961
1962         size = smb_fname->st.st_ex_size;
1963         fattr = dos_mode(conn, smb_fname);
1964
1965         /* Deal with other possible opens having a modified
1966            write time. JRA. */
1967         if (ask_sharemode) {
1968                 struct timespec write_time_ts;
1969
1970                 ZERO_STRUCT(write_time_ts);
1971                 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1972                 if (!null_timespec(write_time_ts)) {
1973                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1974                 }
1975         }
1976
1977         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1978
1979         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1980                 DEBUG(3,("attempt to open a directory %s\n",
1981                          fsp_str_dbg(fsp)));
1982                 close_file(req, fsp, ERROR_CLOSE);
1983                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1984                         ERRDOS, ERRnoaccess);
1985                 goto out;
1986         }
1987
1988         reply_outbuf(req, 7, 0);
1989         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1990         SSVAL(req->outbuf,smb_vwv1,fattr);
1991         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1992                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1993         } else {
1994                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1995         }
1996         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1997         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1998
1999         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2000                 SCVAL(req->outbuf,smb_flg,
2001                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2002         }
2003
2004         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2005                 SCVAL(req->outbuf,smb_flg,
2006                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2007         }
2008  out:
2009         TALLOC_FREE(smb_fname);
2010         END_PROFILE(SMBopen);
2011         return;
2012 }
2013
2014 /****************************************************************************
2015  Reply to an open and X.
2016 ****************************************************************************/
2017
2018 void reply_open_and_X(struct smb_request *req)
2019 {
2020         connection_struct *conn = req->conn;
2021         struct smb_filename *smb_fname = NULL;
2022         char *fname = NULL;
2023         uint16 open_flags;
2024         int deny_mode;
2025         uint32 smb_attr;
2026         /* Breakout the oplock request bits so we can set the
2027                 reply bits separately. */
2028         int ex_oplock_request;
2029         int core_oplock_request;
2030         int oplock_request;
2031 #if 0
2032         int smb_sattr = SVAL(req->vwv+4, 0);
2033         uint32 smb_time = make_unix_date3(req->vwv+6);
2034 #endif
2035         int smb_ofun;
2036         uint32 fattr=0;
2037         int mtime=0;
2038         int smb_action = 0;
2039         files_struct *fsp;
2040         NTSTATUS status;
2041         uint64_t allocation_size;
2042         ssize_t retval = -1;
2043         uint32 access_mask;
2044         uint32 share_mode;
2045         uint32 create_disposition;
2046         uint32 create_options = 0;
2047         uint32_t private_flags = 0;
2048         TALLOC_CTX *ctx = talloc_tos();
2049
2050         START_PROFILE(SMBopenX);
2051
2052         if (req->wct < 15) {
2053                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2054                 goto out;
2055         }
2056
2057         open_flags = SVAL(req->vwv+2, 0);
2058         deny_mode = SVAL(req->vwv+3, 0);
2059         smb_attr = SVAL(req->vwv+5, 0);
2060         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2061         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2062         oplock_request = ex_oplock_request | core_oplock_request;
2063         smb_ofun = SVAL(req->vwv+8, 0);
2064         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2065
2066         /* If it's an IPC, pass off the pipe handler. */
2067         if (IS_IPC(conn)) {
2068                 if (lp_nt_pipe_support()) {
2069                         reply_open_pipe_and_X(conn, req);
2070                 } else {
2071                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2072                 }
2073                 goto out;
2074         }
2075
2076         /* XXXX we need to handle passed times, sattr and flags */
2077         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2078                         STR_TERMINATE, &status);
2079         if (!NT_STATUS_IS_OK(status)) {
2080                 reply_nterror(req, status);
2081                 goto out;
2082         }
2083
2084         status = filename_convert(ctx,
2085                                 conn,
2086                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2087                                 fname,
2088                                 0,
2089                                 NULL,
2090                                 &smb_fname);
2091         if (!NT_STATUS_IS_OK(status)) {
2092                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2093                         reply_botherror(req,
2094                                         NT_STATUS_PATH_NOT_COVERED,
2095                                         ERRSRV, ERRbadpath);
2096                         goto out;
2097                 }
2098                 reply_nterror(req, status);
2099                 goto out;
2100         }
2101
2102         if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
2103                                          smb_ofun,
2104                                          &access_mask, &share_mode,
2105                                          &create_disposition,
2106                                          &create_options,
2107                                          &private_flags)) {
2108                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2109                 goto out;
2110         }
2111
2112         status = SMB_VFS_CREATE_FILE(
2113                 conn,                                   /* conn */
2114                 req,                                    /* req */
2115                 0,                                      /* root_dir_fid */
2116                 smb_fname,                              /* fname */
2117                 access_mask,                            /* access_mask */
2118                 share_mode,                             /* share_access */
2119                 create_disposition,                     /* create_disposition*/
2120                 create_options,                         /* create_options */
2121                 smb_attr,                               /* file_attributes */
2122                 oplock_request,                         /* oplock_request */
2123                 0,                                      /* allocation_size */
2124                 private_flags,
2125                 NULL,                                   /* sd */
2126                 NULL,                                   /* ea_list */
2127                 &fsp,                                   /* result */
2128                 &smb_action);                           /* pinfo */
2129
2130         if (!NT_STATUS_IS_OK(status)) {
2131                 if (open_was_deferred(req->sconn, req->mid)) {
2132                         /* We have re-scheduled this call. */
2133                         goto out;
2134                 }
2135                 reply_openerror(req, status);
2136                 goto out;
2137         }
2138
2139         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2140            if the file is truncated or created. */
2141         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2142                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2143                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2144                         close_file(req, fsp, ERROR_CLOSE);
2145                         reply_nterror(req, NT_STATUS_DISK_FULL);
2146                         goto out;
2147                 }
2148                 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2149                 if (retval < 0) {
2150                         close_file(req, fsp, ERROR_CLOSE);
2151                         reply_nterror(req, NT_STATUS_DISK_FULL);
2152                         goto out;
2153                 }
2154                 status = vfs_stat_fsp(fsp);
2155                 if (!NT_STATUS_IS_OK(status)) {
2156                         close_file(req, fsp, ERROR_CLOSE);
2157                         reply_nterror(req, status);
2158                         goto out;
2159                 }
2160         }
2161
2162         fattr = dos_mode(conn, fsp->fsp_name);
2163         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2164         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2165                 close_file(req, fsp, ERROR_CLOSE);
2166                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2167                 goto out;
2168         }
2169
2170         /* If the caller set the extended oplock request bit
2171                 and we granted one (by whatever means) - set the
2172                 correct bit for extended oplock reply.
2173         */
2174
2175         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2176                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2177         }
2178
2179         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2180                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2181         }
2182
2183         /* If the caller set the core oplock request bit
2184                 and we granted one (by whatever means) - set the
2185                 correct bit for core oplock reply.
2186         */
2187
2188         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2189                 reply_outbuf(req, 19, 0);
2190         } else {
2191                 reply_outbuf(req, 15, 0);
2192         }
2193
2194         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2195         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2196
2197         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2198                 SCVAL(req->outbuf, smb_flg,
2199                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2200         }
2201
2202         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2203                 SCVAL(req->outbuf, smb_flg,
2204                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2205         }
2206
2207         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2208         SSVAL(req->outbuf,smb_vwv3,fattr);
2209         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2210                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2211         } else {
2212                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2213         }
2214         SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2215         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2216         SSVAL(req->outbuf,smb_vwv11,smb_action);
2217
2218         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2219                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2220         }
2221
2222  out:
2223         TALLOC_FREE(smb_fname);
2224         END_PROFILE(SMBopenX);
2225         return;
2226 }
2227
2228 /****************************************************************************
2229  Reply to a SMBulogoffX.
2230 ****************************************************************************/
2231
2232 void reply_ulogoffX(struct smb_request *req)
2233 {
2234         struct smbd_server_connection *sconn = req->sconn;
2235         struct user_struct *vuser;
2236         struct smbXsrv_session *session = NULL;
2237         NTSTATUS status;
2238
2239         START_PROFILE(SMBulogoffX);
2240
2241         vuser = get_valid_user_struct(sconn, req->vuid);
2242
2243         if(vuser == NULL) {
2244                 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2245                          (unsigned long long)req->vuid));
2246
2247                 req->vuid = UID_FIELD_INVALID;
2248                 reply_force_doserror(req, ERRSRV, ERRbaduid);
2249                 END_PROFILE(SMBulogoffX);
2250                 return;
2251         }
2252
2253         session = vuser->session;
2254         vuser = NULL;
2255
2256         /*
2257          * TODO: cancel all outstanding requests on the session
2258          */
2259         status = smbXsrv_session_logoff(session);
2260         if (!NT_STATUS_IS_OK(status)) {
2261                 DEBUG(0, ("reply_ulogoff: "
2262                           "smbXsrv_session_logoff() failed: %s\n",
2263                           nt_errstr(status)));
2264                 /*
2265                  * If we hit this case, there is something completely
2266                  * wrong, so we better disconnect the transport connection.
2267                  */
2268                 END_PROFILE(SMBulogoffX);
2269                 exit_server(__location__ ": smbXsrv_session_logoff failed");
2270                 return;
2271         }
2272
2273         TALLOC_FREE(session);
2274
2275         reply_outbuf(req, 2, 0);
2276         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2277         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2278
2279         DEBUG(3, ("ulogoffX vuid=%llu\n",
2280                   (unsigned long long)req->vuid));
2281
2282         END_PROFILE(SMBulogoffX);
2283         req->vuid = UID_FIELD_INVALID;
2284 }
2285
2286 /****************************************************************************
2287  Reply to a mknew or a create.
2288 ****************************************************************************/
2289
2290 void reply_mknew(struct smb_request *req)
2291 {
2292         connection_struct *conn = req->conn;
2293         struct smb_filename *smb_fname = NULL;
2294         char *fname = NULL;
2295         uint32 fattr = 0;
2296         struct smb_file_time ft;
2297         files_struct *fsp;
2298         int oplock_request = 0;
2299         NTSTATUS status;
2300         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2301         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2302         uint32 create_disposition;
2303         uint32 create_options = 0;
2304         TALLOC_CTX *ctx = talloc_tos();
2305
2306         START_PROFILE(SMBcreate);
2307         ZERO_STRUCT(ft);
2308
2309         if (req->wct < 3) {
2310                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2311                 goto out;
2312         }
2313
2314         fattr = SVAL(req->vwv+0, 0);
2315         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2316
2317         /* mtime. */
2318         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2319
2320         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2321                             STR_TERMINATE, &status);
2322         if (!NT_STATUS_IS_OK(status)) {
2323                 reply_nterror(req, status);
2324                 goto out;
2325         }
2326
2327         status = filename_convert(ctx,
2328                                 conn,
2329                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2330                                 fname,
2331                                 0,
2332                                 NULL,
2333                                 &smb_fname);
2334         if (!NT_STATUS_IS_OK(status)) {
2335                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2336                         reply_botherror(req,
2337                                         NT_STATUS_PATH_NOT_COVERED,
2338                                         ERRSRV, ERRbadpath);
2339                         goto out;
2340                 }
2341                 reply_nterror(req, status);
2342                 goto out;
2343         }
2344
2345         if (fattr & FILE_ATTRIBUTE_VOLUME) {
2346                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2347                          "please report this\n",
2348                          smb_fname_str_dbg(smb_fname)));
2349         }
2350
2351         if(req->cmd == SMBmknew) {
2352                 /* We should fail if file exists. */
2353                 create_disposition = FILE_CREATE;
2354         } else {
2355                 /* Create if file doesn't exist, truncate if it does. */
2356                 create_disposition = FILE_OVERWRITE_IF;
2357         }
2358
2359         status = SMB_VFS_CREATE_FILE(
2360                 conn,                                   /* conn */
2361                 req,                                    /* req */
2362                 0,                                      /* root_dir_fid */
2363                 smb_fname,                              /* fname */
2364                 access_mask,                            /* access_mask */
2365                 share_mode,                             /* share_access */
2366                 create_disposition,                     /* create_disposition*/
2367                 create_options,                         /* create_options */
2368                 fattr,                                  /* file_attributes */
2369                 oplock_request,                         /* oplock_request */
2370                 0,                                      /* allocation_size */
2371                 0,                                      /* private_flags */
2372                 NULL,                                   /* sd */
2373                 NULL,                                   /* ea_list */
2374                 &fsp,                                   /* result */
2375                 NULL);                                  /* pinfo */
2376
2377         if (!NT_STATUS_IS_OK(status)) {
2378                 if (open_was_deferred(req->sconn, req->mid)) {
2379                         /* We have re-scheduled this call. */
2380                         goto out;
2381                 }
2382                 reply_openerror(req, status);
2383                 goto out;
2384         }
2385
2386         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2387         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2388         if (!NT_STATUS_IS_OK(status)) {
2389                 END_PROFILE(SMBcreate);
2390                 goto out;
2391         }
2392
2393         reply_outbuf(req, 1, 0);
2394         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2395
2396         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2397                 SCVAL(req->outbuf,smb_flg,
2398                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2399         }
2400
2401         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2402                 SCVAL(req->outbuf,smb_flg,
2403                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2404         }
2405
2406         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2407         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2408                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2409                   (unsigned int)fattr));
2410
2411  out:
2412         TALLOC_FREE(smb_fname);
2413         END_PROFILE(SMBcreate);
2414         return;
2415 }
2416
2417 /****************************************************************************
2418  Reply to a create temporary file.
2419 ****************************************************************************/
2420
2421 void reply_ctemp(struct smb_request *req)
2422 {
2423         connection_struct *conn = req->conn;
2424         struct smb_filename *smb_fname = NULL;
2425         char *wire_name = NULL;
2426         char *fname = NULL;
2427         uint32 fattr;
2428         files_struct *fsp;
2429         int oplock_request;
2430         char *s;
2431         NTSTATUS status;
2432         int i;
2433         TALLOC_CTX *ctx = talloc_tos();
2434
2435         START_PROFILE(SMBctemp);
2436
2437         if (req->wct < 3) {
2438                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2439                 goto out;
2440         }
2441
2442         fattr = SVAL(req->vwv+0, 0);
2443         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2444
2445         srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2446                             STR_TERMINATE, &status);
2447         if (!NT_STATUS_IS_OK(status)) {
2448                 reply_nterror(req, status);
2449                 goto out;
2450         }
2451
2452         for (i = 0; i < 10; i++) {
2453                 if (*wire_name) {
2454                         fname = talloc_asprintf(ctx,
2455                                         "%s/TMP%s",
2456                                         wire_name,
2457                                         generate_random_str_list(ctx, 5, "0123456789"));
2458                 } else {
2459                         fname = talloc_asprintf(ctx,
2460                                         "TMP%s",
2461                                         generate_random_str_list(ctx, 5, "0123456789"));
2462                 }
2463
2464                 if (!fname) {
2465                         reply_nterror(req, NT_STATUS_NO_MEMORY);
2466                         goto out;
2467                 }
2468
2469                 status = filename_convert(ctx, conn,
2470                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2471                                 fname,
2472                                 0,
2473                                 NULL,
2474                                 &smb_fname);
2475                 if (!NT_STATUS_IS_OK(status)) {
2476                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2477                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2478                                         ERRSRV, ERRbadpath);
2479                                 goto out;
2480                         }
2481                         reply_nterror(req, status);
2482                         goto out;
2483                 }
2484
2485                 /* Create the file. */
2486                 status = SMB_VFS_CREATE_FILE(
2487                         conn,                                   /* conn */
2488                         req,                                    /* req */
2489                         0,                                      /* root_dir_fid */
2490                         smb_fname,                              /* fname */
2491                         FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2492                         FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2493                         FILE_CREATE,                            /* create_disposition*/
2494                         0,                                      /* create_options */
2495                         fattr,                                  /* file_attributes */
2496                         oplock_request,                         /* oplock_request */
2497                         0,                                      /* allocation_size */
2498                         0,                                      /* private_flags */
2499                         NULL,                                   /* sd */
2500                         NULL,                                   /* ea_list */
2501                         &fsp,                                   /* result */
2502                         NULL);                                  /* pinfo */
2503
2504                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2505                         TALLOC_FREE(fname);
2506                         TALLOC_FREE(smb_fname);
2507                         continue;
2508                 }
2509
2510                 if (!NT_STATUS_IS_OK(status)) {
2511                         if (open_was_deferred(req->sconn, req->mid)) {
2512                                 /* We have re-scheduled this call. */
2513                                 goto out;
2514                         }
2515                         reply_openerror(req, status);
2516                         goto out;
2517                 }
2518
2519                 break;
2520         }
2521
2522         if (i == 10) {
2523                 /* Collision after 10 times... */
2524                 reply_nterror(req, status);
2525                 goto out;
2526         }
2527
2528         reply_outbuf(req, 1, 0);
2529         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2530
2531         /* the returned filename is relative to the directory */
2532         s = strrchr_m(fsp->fsp_name->base_name, '/');
2533         if (!s) {
2534                 s = fsp->fsp_name->base_name;
2535         } else {
2536                 s++;
2537         }
2538
2539 #if 0
2540         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2541            thing in the byte section. JRA */
2542         SSVALS(p, 0, -1); /* what is this? not in spec */
2543 #endif
2544         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2545             == -1) {
2546                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2547                 goto out;
2548         }
2549
2550         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2551                 SCVAL(req->outbuf, smb_flg,
2552                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2553         }
2554
2555         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2556                 SCVAL(req->outbuf, smb_flg,
2557                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2558         }
2559
2560         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2561         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2562                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2563  out:
2564         TALLOC_FREE(smb_fname);
2565         TALLOC_FREE(wire_name);
2566         END_PROFILE(SMBctemp);
2567         return;
2568 }
2569
2570 /*******************************************************************
2571  Check if a user is allowed to rename a file.
2572 ********************************************************************/
2573
2574 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2575                         uint16 dirtype)
2576 {
2577         if (!CAN_WRITE(conn)) {
2578                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2579         }
2580
2581         if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2582                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2583                 /* Only bother to read the DOS attribute if we might deny the
2584                    rename on the grounds of attribute missmatch. */
2585                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2586                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2587                         return NT_STATUS_NO_SUCH_FILE;
2588                 }
2589         }
2590
2591         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2592                 if (fsp->posix_open) {
2593                         return NT_STATUS_OK;
2594                 }
2595
2596                 /* If no pathnames are open below this
2597                    directory, allow the rename. */
2598
2599                 if (file_find_subpath(fsp)) {
2600                         return NT_STATUS_ACCESS_DENIED;
2601                 }
2602                 return NT_STATUS_OK;
2603         }
2604
2605         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2606                 return NT_STATUS_OK;
2607         }
2608
2609         return NT_STATUS_ACCESS_DENIED;
2610 }
2611
2612 /*******************************************************************
2613  * unlink a file with all relevant access checks
2614  *******************************************************************/
2615
2616 static NTSTATUS do_unlink(connection_struct *conn,
2617                         struct smb_request *req,
2618                         struct smb_filename *smb_fname,
2619                         uint32 dirtype)
2620 {
2621         uint32 fattr;
2622         files_struct *fsp;
2623         uint32 dirtype_orig = dirtype;
2624         NTSTATUS status;
2625         int ret;
2626         bool posix_paths = lp_posix_pathnames();
2627
2628         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2629                   smb_fname_str_dbg(smb_fname),
2630                   dirtype));
2631
2632         if (!CAN_WRITE(conn)) {
2633                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2634         }
2635
2636         if (posix_paths) {
2637                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2638         } else {
2639                 ret = SMB_VFS_STAT(conn, smb_fname);
2640         }
2641         if (ret != 0) {
2642                 return map_nt_error_from_unix(errno);
2643         }
2644
2645         fattr = dos_mode(conn, smb_fname);
2646
2647         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2648                 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2649         }
2650
2651         dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2652         if (!dirtype) {
2653                 return NT_STATUS_NO_SUCH_FILE;
2654         }
2655
2656         if (!dir_check_ftype(conn, fattr, dirtype)) {
2657                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2658                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2659                 }
2660                 return NT_STATUS_NO_SUCH_FILE;
2661         }
2662
2663         if (dirtype_orig & 0x8000) {
2664                 /* These will never be set for POSIX. */
2665                 return NT_STATUS_NO_SUCH_FILE;
2666         }
2667
2668 #if 0
2669         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2670                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2671         }
2672
2673         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2674                 return NT_STATUS_NO_SUCH_FILE;
2675         }
2676
2677         if (dirtype & 0xFF00) {
2678                 /* These will never be set for POSIX. */
2679                 return NT_STATUS_NO_SUCH_FILE;
2680         }
2681
2682         dirtype &= 0xFF;
2683         if (!dirtype) {
2684                 return NT_STATUS_NO_SUCH_FILE;
2685         }
2686
2687         /* Can't delete a directory. */
2688         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2689                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2690         }
2691 #endif
2692
2693 #if 0 /* JRATEST */
2694         else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2695                 return NT_STATUS_OBJECT_NAME_INVALID;
2696 #endif /* JRATEST */
2697
2698         /* On open checks the open itself will check the share mode, so
2699            don't do it here as we'll get it wrong. */
2700
2701         status = SMB_VFS_CREATE_FILE
2702                 (conn,                  /* conn */
2703                  req,                   /* req */
2704                  0,                     /* root_dir_fid */
2705                  smb_fname,             /* fname */
2706                  DELETE_ACCESS,         /* access_mask */
2707                  FILE_SHARE_NONE,       /* share_access */
2708                  FILE_OPEN,             /* create_disposition*/
2709                  FILE_NON_DIRECTORY_FILE, /* create_options */
2710                                         /* file_attributes */
2711                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2712                                 FILE_ATTRIBUTE_NORMAL,
2713                  0,                     /* oplock_request */
2714                  0,                     /* allocation_size */
2715                  0,                     /* private_flags */
2716                  NULL,                  /* sd */
2717                  NULL,                  /* ea_list */
2718                  &fsp,                  /* result */
2719                  NULL);                 /* pinfo */
2720
2721         if (!NT_STATUS_IS_OK(status)) {
2722                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2723                            nt_errstr(status)));
2724                 return status;
2725         }
2726
2727         status = can_set_delete_on_close(fsp, fattr);
2728         if (!NT_STATUS_IS_OK(status)) {
2729                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2730                         "(%s)\n",
2731                         smb_fname_str_dbg(smb_fname),
2732                         nt_errstr(status)));
2733                 close_file(req, fsp, NORMAL_CLOSE);
2734                 return status;
2735         }
2736
2737         /* The set is across all open files on this dev/inode pair. */
2738         if (!set_delete_on_close(fsp, True,
2739                                 conn->session_info->security_token,
2740                                 conn->session_info->unix_token)) {
2741                 close_file(req, fsp, NORMAL_CLOSE);
2742                 return NT_STATUS_ACCESS_DENIED;
2743         }
2744
2745         return close_file(req, fsp, NORMAL_CLOSE);
2746 }
2747
2748 /****************************************************************************
2749  The guts of the unlink command, split out so it may be called by the NT SMB
2750  code.
2751 ****************************************************************************/
2752
2753 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2754                           uint32 dirtype, struct smb_filename *smb_fname,
2755                           bool has_wild)
2756 {
2757         char *fname_dir = NULL;
2758         char *fname_mask = NULL;
2759         int count=0;
2760         NTSTATUS status = NT_STATUS_OK;
2761         TALLOC_CTX *ctx = talloc_tos();
2762
2763         /* Split up the directory from the filename/mask. */
2764         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2765                                       &fname_dir, &fname_mask);
2766         if (!NT_STATUS_IS_OK(status)) {
2767                 goto out;
2768         }
2769
2770         /*
2771          * We should only check the mangled cache
2772          * here if unix_convert failed. This means
2773          * that the path in 'mask' doesn't exist
2774          * on the file system and so we need to look
2775          * for a possible mangle. This patch from
2776          * Tine Smukavec <valentin.smukavec@hermes.si>.
2777          */
2778
2779         if (!VALID_STAT(smb_fname->st) &&
2780             mangle_is_mangled(fname_mask, conn->params)) {
2781                 char *new_mask = NULL;
2782                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2783                                             &new_mask, conn->params);
2784                 if (new_mask) {
2785                         TALLOC_FREE(fname_mask);
2786                         fname_mask = new_mask;
2787                 }
2788         }
2789
2790         if (!has_wild) {
2791
2792                 /*
2793                  * Only one file needs to be unlinked. Append the mask back
2794                  * onto the directory.
2795                  */
2796                 TALLOC_FREE(smb_fname->base_name);
2797                 if (ISDOT(fname_dir)) {
2798                         /* Ensure we use canonical names on open. */
2799                         smb_fname->base_name = talloc_asprintf(smb_fname,
2800                                                         "%s",
2801                                                         fname_mask);
2802                 } else {
2803                         smb_fname->base_name = talloc_asprintf(smb_fname,
2804                                                         "%s/%s",
2805                                                         fname_dir,
2806                                                         fname_mask);
2807                 }
2808                 if (!smb_fname->base_name) {
2809                         status = NT_STATUS_NO_MEMORY;
2810                         goto out;
2811                 }
2812                 if (dirtype == 0) {
2813                         dirtype = FILE_ATTRIBUTE_NORMAL;
2814                 }
2815
2816                 status = check_name(conn, smb_fname->base_name);
2817                 if (!NT_STATUS_IS_OK(status)) {
2818                         goto out;
2819                 }
2820
2821                 status = do_unlink(conn, req, smb_fname, dirtype);
2822                 if (!NT_STATUS_IS_OK(status)) {
2823                         goto out;
2824                 }
2825
2826                 count++;
2827         } else {
2828                 struct smb_Dir *dir_hnd = NULL;
2829                 long offset = 0;
2830                 const char *dname = NULL;
2831                 char *talloced = NULL;
2832
2833                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2834                         status = NT_STATUS_OBJECT_NAME_INVALID;
2835                         goto out;
2836                 }
2837
2838                 if (strequal(fname_mask,"????????.???")) {
2839                         TALLOC_FREE(fname_mask);
2840                         fname_mask = talloc_strdup(ctx, "*");
2841                         if (!fname_mask) {
2842                                 status = NT_STATUS_NO_MEMORY;
2843                                 goto out;
2844                         }
2845                 }
2846
2847                 status = check_name(conn, fname_dir);
2848                 if (!NT_STATUS_IS_OK(status)) {
2849                         goto out;
2850                 }
2851
2852                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2853                                   dirtype);
2854                 if (dir_hnd == NULL) {
2855                         status = map_nt_error_from_unix(errno);
2856                         goto out;
2857                 }
2858
2859                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2860                    the pattern matches against the long name, otherwise the short name
2861                    We don't implement this yet XXXX
2862                 */
2863
2864                 status = NT_STATUS_NO_SUCH_FILE;
2865
2866                 while ((dname = ReadDirName(dir_hnd, &offset,
2867                                             &smb_fname->st, &talloced))) {
2868                         TALLOC_CTX *frame = talloc_stackframe();
2869
2870                         if (!is_visible_file(conn, fname_dir, dname,
2871                                              &smb_fname->st, true)) {
2872                                 TALLOC_FREE(frame);
2873                                 TALLOC_FREE(talloced);
2874                                 continue;
2875                         }
2876
2877                         /* Quick check for "." and ".." */
2878                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2879                                 TALLOC_FREE(frame);
2880                                 TALLOC_FREE(talloced);
2881                                 continue;
2882                         }
2883
2884                         if(!mask_match(dname, fname_mask,
2885                                        conn->case_sensitive)) {
2886                                 TALLOC_FREE(frame);
2887                                 TALLOC_FREE(talloced);
2888                                 continue;
2889                         }
2890
2891                         TALLOC_FREE(smb_fname->base_name);
2892                         if (ISDOT(fname_dir)) {
2893                                 /* Ensure we use canonical names on open. */
2894                                 smb_fname->base_name =
2895                                         talloc_asprintf(smb_fname, "%s",
2896                                                 dname);
2897                         } else {
2898                                 smb_fname->base_name =
2899                                         talloc_asprintf(smb_fname, "%s/%s",
2900                                                 fname_dir, dname);
2901                         }
2902
2903                         if (!smb_fname->base_name) {
2904                                 TALLOC_FREE(dir_hnd);
2905                                 status = NT_STATUS_NO_MEMORY;
2906                                 TALLOC_FREE(frame);
2907                                 TALLOC_FREE(talloced);
2908                                 goto out;
2909                         }
2910
2911                         status = check_name(conn, smb_fname->base_name);
2912                         if (!NT_STATUS_IS_OK(status)) {
2913                                 TALLOC_FREE(dir_hnd);
2914                                 TALLOC_FREE(frame);
2915                                 TALLOC_FREE(talloced);
2916                                 goto out;
2917                         }
2918
2919                         status = do_unlink(conn, req, smb_fname, dirtype);
2920                         if (!NT_STATUS_IS_OK(status)) {
2921                                 TALLOC_FREE(frame);
2922                                 TALLOC_FREE(talloced);
2923                                 continue;
2924                         }
2925
2926                         count++;
2927                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2928                                  smb_fname->base_name));
2929
2930                         TALLOC_FREE(frame);
2931                         TALLOC_FREE(talloced);
2932                 }
2933                 TALLOC_FREE(dir_hnd);
2934         }
2935
2936         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2937                 status = map_nt_error_from_unix(errno);
2938         }
2939
2940  out:
2941         TALLOC_FREE(fname_dir);
2942         TALLOC_FREE(fname_mask);
2943         return status;
2944 }
2945
2946 /****************************************************************************
2947  Reply to a unlink
2948 ****************************************************************************/
2949
2950 void reply_unlink(struct smb_request *req)
2951 {
2952         connection_struct *conn = req->conn;
2953         char *name = NULL;
2954         struct smb_filename *smb_fname = NULL;
2955         uint32 dirtype;
2956         NTSTATUS status;
2957         bool path_contains_wcard = False;
2958         TALLOC_CTX *ctx = talloc_tos();
2959
2960         START_PROFILE(SMBunlink);
2961
2962         if (req->wct < 1) {
2963                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2964                 goto out;
2965         }
2966
2967         dirtype = SVAL(req->vwv+0, 0);
2968
2969         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2970                                   STR_TERMINATE, &status,
2971                                   &path_contains_wcard);
2972         if (!NT_STATUS_IS_OK(status)) {
2973                 reply_nterror(req, status);
2974                 goto out;
2975         }
2976
2977         status = filename_convert(ctx, conn,
2978                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2979                                   name,
2980                                   UCF_COND_ALLOW_WCARD_LCOMP,
2981                                   &path_contains_wcard,
2982                                   &smb_fname);
2983         if (!NT_STATUS_IS_OK(status)) {
2984                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2985                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2986                                         ERRSRV, ERRbadpath);
2987                         goto out;
2988                 }
2989                 reply_nterror(req, status);
2990                 goto out;
2991         }
2992
2993         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2994
2995         status = unlink_internals(conn, req, dirtype, smb_fname,
2996                                   path_contains_wcard);
2997         if (!NT_STATUS_IS_OK(status)) {
2998                 if (open_was_deferred(req->sconn, req->mid)) {
2999                         /* We have re-scheduled this call. */
3000                         goto out;
3001                 }
3002                 reply_nterror(req, status);
3003                 goto out;
3004         }
3005
3006         reply_outbuf(req, 0, 0);
3007  out:
3008         TALLOC_FREE(smb_fname);
3009         END_PROFILE(SMBunlink);
3010         return;
3011 }
3012
3013 /****************************************************************************
3014  Fail for readbraw.
3015 ****************************************************************************/
3016
3017 static void fail_readraw(void)
3018 {
3019         const char *errstr = talloc_asprintf(talloc_tos(),
3020                         "FAIL ! reply_readbraw: socket write fail (%s)",
3021                         strerror(errno));
3022         if (!errstr) {
3023                 errstr = "";
3024         }
3025         exit_server_cleanly(errstr);
3026 }
3027
3028 /****************************************************************************
3029  Fake (read/write) sendfile. Returns -1 on read or write fail.
3030 ****************************************************************************/
3031
3032 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
3033 {
3034         size_t bufsize;
3035         size_t tosend = nread;
3036         char *buf;
3037
3038         if (nread == 0) {
3039                 return 0;
3040         }
3041
3042         bufsize = MIN(nread, 65536);
3043
3044         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3045                 return -1;
3046         }
3047
3048         while (tosend > 0) {
3049                 ssize_t ret;
3050                 size_t cur_read;
3051
3052                 if (tosend > bufsize) {
3053                         cur_read = bufsize;
3054                 } else {
3055                         cur_read = tosend;
3056                 }
3057                 ret = read_file(fsp,buf,startpos,cur_read);
3058                 if (ret == -1) {
3059                         SAFE_FREE(buf);
3060                         return -1;
3061                 }
3062
3063                 /* If we had a short read, fill with zeros. */
3064                 if (ret < cur_read) {
3065                         memset(buf + ret, '\0', cur_read - ret);
3066                 }
3067
3068                 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
3069                     != cur_read) {
3070                         char addr[INET6_ADDRSTRLEN];
3071                         /*
3072                          * Try and give an error message saying what
3073                          * client failed.
3074                          */
3075                         DEBUG(0, ("write_data failed for client %s. "
3076                                   "Error %s\n",
3077                                   get_peer_addr(fsp->conn->sconn->sock, addr,
3078                                                 sizeof(addr)),
3079                                   strerror(errno)));
3080                         SAFE_FREE(buf);
3081                         return -1;
3082                 }
3083                 tosend -= cur_read;
3084                 startpos += cur_read;
3085         }
3086
3087         SAFE_FREE(buf);
3088         return (ssize_t)nread;
3089 }
3090
3091 /****************************************************************************
3092  Deal with the case of sendfile reading less bytes from the file than
3093  requested. Fill with zeros (all we can do).
3094 ****************************************************************************/
3095
3096 void sendfile_short_send(files_struct *fsp,
3097                                 ssize_t nread,
3098                                 size_t headersize,
3099                                 size_t smb_maxcnt)
3100 {
3101 #define SHORT_SEND_BUFSIZE 1024
3102         if (nread < headersize) {
3103                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3104                         "header for file %s (%s). Terminating\n",
3105                         fsp_str_dbg(fsp), strerror(errno)));
3106                 exit_server_cleanly("sendfile_short_send failed");
3107         }
3108
3109         nread -= headersize;
3110
3111         if (nread < smb_maxcnt) {
3112                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3113                 if (!buf) {
3114                         exit_server_cleanly("sendfile_short_send: "
3115                                 "malloc failed");
3116                 }
3117
3118                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3119                         "with zeros !\n", fsp_str_dbg(fsp)));
3120
3121                 while (nread < smb_maxcnt) {
3122                         /*
3123                          * We asked for the real file size and told sendfile
3124                          * to not go beyond the end of the file. But it can
3125                          * happen that in between our fstat call and the
3126                          * sendfile call the file was truncated. This is very
3127                          * bad because we have already announced the larger
3128                          * number of bytes to the client.
3129                          *
3130                          * The best we can do now is to send 0-bytes, just as
3131                          * a read from a hole in a sparse file would do.
3132                          *
3133                          * This should happen rarely enough that I don't care
3134                          * about efficiency here :-)
3135                          */
3136                         size_t to_write;
3137
3138                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3139                         if (write_data(fsp->conn->sconn->sock, buf, to_write)
3140                             != to_write) {
3141                                 char addr[INET6_ADDRSTRLEN];
3142                                 /*
3143                                  * Try and give an error message saying what
3144                                  * client failed.
3145                                  */
3146                                 DEBUG(0, ("write_data failed for client %s. "
3147                                           "Error %s\n",
3148                                           get_peer_addr(
3149                                                   fsp->conn->sconn->sock, addr,
3150                                                   sizeof(addr)),
3151                                           strerror(errno)));
3152                                 exit_server_cleanly("sendfile_short_send: "
3153                                                     "write_data failed");
3154                         }
3155                         nread += to_write;
3156                 }
3157                 SAFE_FREE(buf);
3158         }
3159 }
3160
3161 /****************************************************************************
3162  Return a readbraw error (4 bytes of zero).
3163 ****************************************************************************/
3164
3165 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3166 {
3167         char header[4];
3168
3169         SIVAL(header,0,0);
3170
3171         smbd_lock_socket(sconn);
3172         if (write_data(sconn->sock,header,4) != 4) {
3173                 char addr[INET6_ADDRSTRLEN];
3174                 /*
3175                  * Try and give an error message saying what
3176                  * client failed.
3177                  */
3178                 DEBUG(0, ("write_data failed for client %s. "
3179                           "Error %s\n",
3180                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
3181                           strerror(errno)));
3182
3183                 fail_readraw();
3184         }
3185         smbd_unlock_socket(sconn);
3186 }
3187
3188 /****************************************************************************
3189  Use sendfile in readbraw.
3190 ****************************************************************************/
3191
3192 static void send_file_readbraw(connection_struct *conn,
3193                                struct smb_request *req,
3194                                files_struct *fsp,
3195                                off_t startpos,
3196                                size_t nread,
3197                                ssize_t mincount)
3198 {
3199         struct smbd_server_connection *sconn = req->sconn;
3200         char *outbuf = NULL;
3201         ssize_t ret=0;
3202
3203         /*
3204          * We can only use sendfile on a non-chained packet
3205          * but we can use on a non-oplocked file. tridge proved this
3206          * on a train in Germany :-). JRA.
3207          * reply_readbraw has already checked the length.
3208          */
3209
3210         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3211             (fsp->wcp == NULL) &&
3212             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3213                 ssize_t sendfile_read = -1;
3214                 char header[4];
3215                 DATA_BLOB header_blob;
3216
3217                 _smb_setlen(header,nread);
3218                 header_blob = data_blob_const(header, 4);
3219
3220                 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3221                                                  &header_blob, startpos,
3222                                                  nread);
3223                 if (sendfile_read == -1) {
3224                         /* Returning ENOSYS means no data at all was sent.
3225                          * Do this as a normal read. */
3226                         if (errno == ENOSYS) {
3227                                 goto normal_readbraw;
3228                         }
3229
3230                         /*
3231                          * Special hack for broken Linux with no working sendfile. If we
3232                          * return EINTR we sent the header but not the rest of the data.
3233                          * Fake this up by doing read/write calls.
3234                          */
3235                         if (errno == EINTR) {
3236                                 /* Ensure we don't do this again. */
3237                                 set_use_sendfile(SNUM(conn), False);
3238                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3239
3240                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
3241                                         DEBUG(0,("send_file_readbraw: "
3242                                                  "fake_sendfile failed for "
3243                                                  "file %s (%s).\n",
3244                                                  fsp_str_dbg(fsp),
3245                                                  strerror(errno)));
3246                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3247                                 }
3248                                 return;
3249                         }
3250
3251                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3252                                  "file %s (%s). Terminating\n",
3253                                  fsp_str_dbg(fsp), strerror(errno)));
3254                         exit_server_cleanly("send_file_readbraw sendfile failed");
3255                 } else if (sendfile_read == 0) {
3256                         /*
3257                          * Some sendfile implementations return 0 to indicate
3258                          * that there was a short read, but nothing was
3259                          * actually written to the socket.  In this case,
3260                          * fallback to the normal read path so the header gets
3261                          * the correct byte count.
3262                          */
3263                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3264                                   "bytes falling back to the normal read: "
3265                                   "%s\n", fsp_str_dbg(fsp)));
3266                         goto normal_readbraw;
3267                 }
3268
3269                 /* Deal with possible short send. */
3270                 if (sendfile_read != 4+nread) {
3271                         sendfile_short_send(fsp, sendfile_read, 4, nread);
3272                 }
3273                 return;
3274         }
3275
3276 normal_readbraw:
3277
3278         outbuf = talloc_array(NULL, char, nread+4);
3279         if (!outbuf) {
3280                 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3281                         (unsigned)(nread+4)));
3282                 reply_readbraw_error(sconn);
3283                 return;
3284         }
3285
3286         if (nread > 0) {
3287                 ret = read_file(fsp,outbuf+4,startpos,nread);
3288 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3289                 if (ret < mincount)
3290                         ret = 0;
3291 #else
3292                 if (ret < nread)
3293                         ret = 0;
3294 #endif
3295         }
3296
3297         _smb_setlen(outbuf,ret);
3298         if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3299                 char addr[INET6_ADDRSTRLEN];
3300                 /*
3301                  * Try and give an error message saying what
3302                  * client failed.
3303                  */
3304                 DEBUG(0, ("write_data failed for client %s. "
3305                           "Error %s\n",
3306                           get_peer_addr(fsp->conn->sconn->sock, addr,
3307                                         sizeof(addr)),
3308                           strerror(errno)));
3309
3310                 fail_readraw();
3311         }
3312
3313         TALLOC_FREE(outbuf);
3314 }
3315
3316 /****************************************************************************
3317  Reply to a readbraw (core+ protocol).
3318 ****************************************************************************/
3319
3320 void reply_readbraw(struct smb_request *req)
3321 {
3322         connection_struct *conn = req->conn;
3323         struct smbd_server_connection *sconn = req->sconn;
3324         ssize_t maxcount,mincount;
3325         size_t nread = 0;
3326         off_t startpos;
3327         files_struct *fsp;
3328         struct lock_struct lock;
3329         off_t size = 0;
3330
3331         START_PROFILE(SMBreadbraw);
3332
3333         if (srv_is_signing_active(sconn) || req->encrypted) {
3334                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3335                         "raw reads/writes are disallowed.");
3336         }
3337
3338         if (req->wct < 8) {
3339                 reply_readbraw_error(sconn);
3340                 END_PROFILE(SMBreadbraw);
3341                 return;
3342         }
3343
3344         if (sconn->smb1.echo_handler.trusted_fde) {
3345                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3346                          "'async smb echo handler = yes'\n"));
3347                 reply_readbraw_error(sconn);
3348                 END_PROFILE(SMBreadbraw);
3349                 return;
3350         }
3351
3352         /*
3353          * Special check if an oplock break has been issued
3354          * and the readraw request croses on the wire, we must
3355          * return a zero length response here.
3356          */
3357
3358         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3359
3360         /*
3361          * We have to do a check_fsp by hand here, as
3362          * we must always return 4 zero bytes on error,
3363          * not a NTSTATUS.
3364          */
3365
3366         if (!fsp || !conn || conn != fsp->conn ||
3367                         req->vuid != fsp->vuid ||
3368                         fsp->is_directory || fsp->fh->fd == -1) {
3369                 /*
3370                  * fsp could be NULL here so use the value from the packet. JRA.
3371                  */
3372                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3373                         "- cache prime?\n",
3374                         (int)SVAL(req->vwv+0, 0)));
3375                 reply_readbraw_error(sconn);
3376                 END_PROFILE(SMBreadbraw);
3377                 return;
3378         }
3379
3380         /* Do a "by hand" version of CHECK_READ. */
3381         if (!(fsp->can_read ||
3382                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3383                                 (fsp->access_mask & FILE_EXECUTE)))) {
3384                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3385                                 (int)SVAL(req->vwv+0, 0)));
3386                 reply_readbraw_error(sconn);
3387                 END_PROFILE(SMBreadbraw);
3388                 return;
3389         }
3390
3391         flush_write_cache(fsp, READRAW_FLUSH);
3392
3393         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3394         if(req->wct == 10) {
3395                 /*
3396                  * This is a large offset (64 bit) read.
3397                  */
3398
3399                 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3400
3401                 if(startpos < 0) {
3402                         DEBUG(0,("reply_readbraw: negative 64 bit "
3403                                 "readraw offset (%.0f) !\n",
3404                                 (double)startpos ));
3405                         reply_readbraw_error(sconn);
3406                         END_PROFILE(SMBreadbraw);
3407                         return;
3408                 }
3409         }
3410
3411         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3412         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3413
3414         /* ensure we don't overrun the packet size */
3415         maxcount = MIN(65535,maxcount);
3416
3417         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3418             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3419             &lock);
3420
3421         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3422                 reply_readbraw_error(sconn);
3423                 END_PROFILE(SMBreadbraw);
3424                 return;
3425         }
3426
3427         if (fsp_stat(fsp) == 0) {
3428                 size = fsp->fsp_name->st.st_ex_size;
3429         }
3430
3431         if (startpos >= size) {
3432                 nread = 0;
3433         } else {
3434                 nread = MIN(maxcount,(size - startpos));
3435         }
3436
3437 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3438         if (nread < mincount)
3439                 nread = 0;
3440 #endif
3441
3442         DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3443                 "min=%lu nread=%lu\n",
3444                 fsp_fnum_dbg(fsp), (double)startpos,
3445                 (unsigned long)maxcount,
3446                 (unsigned long)mincount,
3447                 (unsigned long)nread ) );
3448
3449         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3450
3451         DEBUG(5,("reply_readbraw finished\n"));
3452
3453         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3454
3455         END_PROFILE(SMBreadbraw);
3456         return;
3457 }
3458
3459 #undef DBGC_CLASS
3460 #define DBGC_CLASS DBGC_LOCKING
3461
3462 /****************************************************************************
3463  Reply to a lockread (core+ protocol).
3464 ****************************************************************************/
3465
3466 void reply_lockread(struct smb_request *req)
3467 {
3468         connection_struct *conn = req->conn;
3469         ssize_t nread = -1;
3470         char *data;
3471         off_t startpos;
3472         size_t numtoread;
3473         NTSTATUS status;
3474         files_struct *fsp;
3475         struct byte_range_lock *br_lck = NULL;
3476         char *p = NULL;
3477         struct smbd_server_connection *sconn = req->sconn;
3478
3479         START_PROFILE(SMBlockread);
3480
3481         if (req->wct < 5) {
3482                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3483                 END_PROFILE(SMBlockread);
3484                 return;
3485         }
3486
3487         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3488
3489         if (!check_fsp(conn, req, fsp)) {
3490                 END_PROFILE(SMBlockread);
3491                 return;
3492         }
3493
3494         if (!CHECK_READ(fsp,req)) {
3495                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3496                 END_PROFILE(SMBlockread);
3497                 return;
3498         }
3499
3500         numtoread = SVAL(req->vwv+1, 0);
3501         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3502
3503         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3504
3505         reply_outbuf(req, 5, numtoread + 3);
3506
3507         data = smb_buf(req->outbuf) + 3;
3508
3509         /*
3510          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3511          * protocol request that predates the read/write lock concept.
3512          * Thus instead of asking for a read lock here we need to ask
3513          * for a write lock. JRA.
3514          * Note that the requested lock size is unaffected by max_recv.
3515          */
3516
3517         br_lck = do_lock(req->sconn->msg_ctx,
3518                         fsp,
3519                         (uint64_t)req->smbpid,
3520                         (uint64_t)numtoread,
3521                         (uint64_t)startpos,
3522                         WRITE_LOCK,
3523                         WINDOWS_LOCK,
3524                         False, /* Non-blocking lock. */
3525                         &status,
3526                         NULL,
3527                         NULL);
3528         TALLOC_FREE(br_lck);
3529
3530         if (NT_STATUS_V(status)) {
3531                 reply_nterror(req, status);
3532                 END_PROFILE(SMBlockread);
3533                 return;
3534         }
3535
3536         /*
3537          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3538          */
3539
3540         if (numtoread > sconn->smb1.negprot.max_recv) {
3541                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3542 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3543                         (unsigned int)numtoread,
3544                         (unsigned int)sconn->smb1.negprot.max_recv));
3545                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3546         }
3547         nread = read_file(fsp,data,startpos,numtoread);
3548
3549         if (nread < 0) {
3550                 reply_nterror(req, map_nt_error_from_unix(errno));
3551                 END_PROFILE(SMBlockread);
3552                 return;
3553         }
3554
3555         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3556
3557         SSVAL(req->outbuf,smb_vwv0,nread);
3558         SSVAL(req->outbuf,smb_vwv5,nread+3);
3559         p = smb_buf(req->outbuf);
3560         SCVAL(p,0,0); /* pad byte. */
3561         SSVAL(p,1,nread);
3562
3563         DEBUG(3,("lockread %s num=%d nread=%d\n",
3564                  fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3565
3566         END_PROFILE(SMBlockread);
3567         return;
3568 }
3569
3570 #undef DBGC_CLASS
3571 #define DBGC_CLASS DBGC_ALL
3572
3573 /****************************************************************************
3574  Reply to a read.
3575 ****************************************************************************/
3576
3577 void reply_read(struct smb_request *req)
3578 {
3579         connection_struct *conn = req->conn;
3580         size_t numtoread;
3581         ssize_t nread = 0;
3582         char *data;
3583         off_t startpos;
3584         int outsize = 0;
3585         files_struct *fsp;
3586         struct lock_struct lock;
3587         struct smbd_server_connection *sconn = req->sconn;
3588
3589         START_PROFILE(SMBread);
3590
3591         if (req->wct < 3) {
3592                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3593                 END_PROFILE(SMBread);
3594                 return;
3595         }
3596
3597         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3598
3599         if (!check_fsp(conn, req, fsp)) {
3600                 END_PROFILE(SMBread);
3601                 return;
3602         }
3603
3604         if (!CHECK_READ(fsp,req)) {
3605                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3606                 END_PROFILE(SMBread);
3607                 return;
3608         }
3609
3610         numtoread = SVAL(req->vwv+1, 0);
3611         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3612
3613         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3614
3615         /*
3616          * The requested read size cannot be greater than max_recv. JRA.
3617          */
3618         if (numtoread > sconn->smb1.negprot.max_recv) {
3619                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3620 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3621                         (unsigned int)numtoread,
3622                         (unsigned int)sconn->smb1.negprot.max_recv));
3623                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3624         }
3625
3626         reply_outbuf(req, 5, numtoread+3);
3627
3628         data = smb_buf(req->outbuf) + 3;
3629
3630         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3631             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3632             &lock);
3633
3634         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3635                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3636                 END_PROFILE(SMBread);
3637                 return;
3638         }
3639
3640         if (numtoread > 0)
3641                 nread = read_file(fsp,data,startpos,numtoread);
3642
3643         if (nread < 0) {
3644                 reply_nterror(req, map_nt_error_from_unix(errno));
3645                 goto strict_unlock;
3646         }
3647
3648         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3649
3650         SSVAL(req->outbuf,smb_vwv0,nread);
3651         SSVAL(req->outbuf,smb_vwv5,nread+3);
3652         SCVAL(smb_buf(req->outbuf),0,1);
3653         SSVAL(smb_buf(req->outbuf),1,nread);
3654
3655         DEBUG(3, ("read %s num=%d nread=%d\n",
3656                   fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3657
3658 strict_unlock:
3659         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3660
3661         END_PROFILE(SMBread);
3662         return;
3663 }
3664
3665 /****************************************************************************
3666  Setup readX header.
3667 ****************************************************************************/
3668
3669 static int setup_readX_header(struct smb_request *req, char *outbuf,
3670                               size_t smb_maxcnt)
3671 {
3672         int outsize;
3673
3674         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3675
3676         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3677
3678         SCVAL(outbuf,smb_vwv0,0xFF);
3679         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3680         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3681         SSVAL(outbuf,smb_vwv6,
3682               (smb_wct - 4)     /* offset from smb header to wct */
3683               + 1               /* the wct field */
3684               + 12 * sizeof(uint16_t) /* vwv */
3685               + 2);             /* the buflen field */
3686         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3687         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3688         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3689         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3690         return outsize;
3691 }
3692
3693 /****************************************************************************
3694  Reply to a read and X - possibly using sendfile.
3695 ****************************************************************************/
3696
3697 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3698                             files_struct *fsp, off_t startpos,
3699                             size_t smb_maxcnt)
3700 {
3701         ssize_t nread = -1;
3702         struct lock_struct lock;
3703         int saved_errno = 0;
3704
3705         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3706             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3707             &lock);
3708
3709         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3710                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3711                 return;
3712         }
3713
3714         /*
3715          * We can only use sendfile on a non-chained packet
3716          * but we can use on a non-oplocked file. tridge proved this
3717          * on a train in Germany :-). JRA.
3718          */
3719
3720         if (!req_is_in_chain(req) &&
3721             !req->encrypted &&
3722             (fsp->base_fsp == NULL) &&
3723             (fsp->wcp == NULL) &&
3724             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3725                 uint8 headerbuf[smb_size + 12 * 2];
3726                 DATA_BLOB header;
3727
3728                 if(fsp_stat(fsp) == -1) {
3729                         reply_nterror(req, map_nt_error_from_unix(errno));
3730                         goto strict_unlock;
3731                 }
3732
3733                 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3734                     (startpos > fsp->fsp_name->st.st_ex_size) ||
3735                     (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3736                         /*
3737                          * We already know that we would do a short read, so don't
3738                          * try the sendfile() path.
3739                          */
3740                         goto nosendfile_read;
3741                 }
3742
3743                 /*
3744                  * Set up the packet header before send. We
3745                  * assume here the sendfile will work (get the
3746                  * correct amount of data).
3747                  */
3748
3749                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3750
3751                 construct_reply_common_req(req, (char *)headerbuf);
3752                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3753
3754                 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3755                                          startpos, smb_maxcnt);
3756                 if (nread == -1) {
3757                         /* Returning ENOSYS means no data at all was sent.
3758                            Do this as a normal read. */
3759                         if (errno == ENOSYS) {
3760                                 goto normal_read;
3761                         }
3762
3763                         /*
3764                          * Special hack for broken Linux with no working sendfile. If we
3765                          * return EINTR we sent the header but not the rest of the data.
3766                          * Fake this up by doing read/write calls.
3767                          */
3768
3769                         if (errno == EINTR) {
3770                                 /* Ensure we don't do this again. */
3771                                 set_use_sendfile(SNUM(conn), False);
3772                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3773                                 nread = fake_sendfile(fsp, startpos,
3774                                                       smb_maxcnt);
3775                                 if (nread == -1) {
3776                                         DEBUG(0,("send_file_readX: "
3777                                                  "fake_sendfile failed for "
3778                                                  "file %s (%s).\n",
3779                                                  fsp_str_dbg(fsp),
3780                                                  strerror(errno)));
3781                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3782                                 }
3783                                 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3784                                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3785                                 /* No outbuf here means successful sendfile. */
3786                                 goto strict_unlock;
3787                         }
3788
3789                         DEBUG(0,("send_file_readX: sendfile failed for file "
3790                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3791                                  strerror(errno)));
3792                         exit_server_cleanly("send_file_readX sendfile failed");
3793                 } else if (nread == 0) {
3794                         /*
3795                          * Some sendfile implementations return 0 to indicate
3796                          * that there was a short read, but nothing was
3797                          * actually written to the socket.  In this case,
3798                          * fallback to the normal read path so the header gets
3799                          * the correct byte count.
3800                          */
3801                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3802                                   "falling back to the normal read: %s\n",
3803                                   fsp_str_dbg(fsp)));
3804                         goto normal_read;
3805                 }
3806
3807                 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3808                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3809
3810                 /* Deal with possible short send. */
3811                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3812                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3813                 }
3814                 /* No outbuf here means successful sendfile. */
3815                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3816                 SMB_PERFCOUNT_END(&req->pcd);
3817                 goto strict_unlock;
3818         }
3819
3820 normal_read:
3821
3822         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3823                 uint8 headerbuf[smb_size + 2*12];
3824
3825                 construct_reply_common_req(req, (char *)headerbuf);
3826                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3827
3828                 /* Send out the header. */
3829                 if (write_data(req->sconn->sock, (char *)headerbuf,
3830                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3831
3832                         char addr[INET6_ADDRSTRLEN];
3833                         /*
3834                          * Try and give an error message saying what
3835                          * client failed.
3836                          */
3837                         DEBUG(0, ("write_data failed for client %s. "
3838                                   "Error %s\n",
3839                                   get_peer_addr(req->sconn->sock, addr,
3840                                                 sizeof(addr)),
3841                                   strerror(errno)));
3842
3843                         DEBUG(0,("send_file_readX: write_data failed for file "
3844                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3845                                  strerror(errno)));
3846                         exit_server_cleanly("send_file_readX sendfile failed");
3847                 }
3848                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3849                 if (nread == -1) {
3850                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3851                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3852                                  strerror(errno)));
3853                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3854                 }
3855                 goto strict_unlock;
3856         }
3857
3858 nosendfile_read:
3859
3860         reply_outbuf(req, 12, smb_maxcnt);
3861         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3862         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
3863
3864         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3865         saved_errno = errno;
3866
3867         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3868
3869         if (nread < 0) {
3870                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3871                 return;
3872         }
3873
3874         setup_readX_header(req, (char *)req->outbuf, nread);
3875
3876         DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3877                   fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3878         return;
3879
3880  strict_unlock:
3881         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3882         TALLOC_FREE(req->outbuf);
3883         return;
3884 }
3885
3886 /****************************************************************************
3887  Work out how much space we have for a read return.
3888 ****************************************************************************/
3889
3890 static size_t calc_max_read_pdu(const struct smb_request *req)
3891 {
3892         if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3893                 return req->sconn->smb1.sessions.max_send;
3894         }
3895
3896         if (!lp_large_readwrite()) {
3897                 return req->sconn->smb1.sessions.max_send;
3898         }
3899
3900         if (req_is_in_chain(req)) {
3901                 return req->sconn->smb1.sessions.max_send;
3902         }
3903
3904         if (req->encrypted) {
3905                 /*
3906                  * Don't take encrypted traffic up to the
3907                  * limit. There are padding considerations
3908                  * that make that tricky.
3909                  */
3910                 return req->sconn->smb1.sessions.max_send;
3911         }
3912
3913         if (srv_is_signing_active(req->sconn)) {
3914                 return 0x1FFFF;
3915         }
3916
3917         if (!lp_unix_extensions()) {
3918                 return 0x1FFFF;
3919         }
3920
3921         /*
3922          * We can do ultra-large POSIX reads.
3923          */
3924         return 0xFFFFFF;
3925 }
3926
3927 /****************************************************************************
3928  Calculate how big a read can be. Copes with all clients. It's always
3929  safe to return a short read - Windows does this.
3930 ****************************************************************************/
3931
3932 static size_t calc_read_size(const struct smb_request *req,
3933                              size_t upper_size,
3934                              size_t lower_size)
3935 {
3936         size_t max_pdu = calc_max_read_pdu(req);
3937         size_t total_size = 0;
3938         size_t hdr_len = MIN_SMB_SIZE + VWV(12);
3939         size_t max_len = max_pdu - hdr_len;
3940
3941         /*
3942          * Windows explicitly ignores upper size of 0xFFFF.
3943          * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3944          * We must do the same as these will never fit even in
3945          * an extended size NetBIOS packet.
3946          */
3947         if (upper_size == 0xFFFF) {
3948                 upper_size = 0;
3949         }
3950
3951         if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3952                 upper_size = 0;
3953         }
3954
3955         total_size = ((upper_size<<16) | lower_size);
3956
3957         /*
3958          * LARGE_READX test shows it's always safe to return
3959          * a short read. Windows does so.
3960          */
3961         return MIN(total_size, max_len);
3962 }
3963
3964 /****************************************************************************
3965  Reply to a read and X.
3966 ****************************************************************************/
3967
3968 void reply_read_and_X(struct smb_request *req)
3969 {
3970         connection_struct *conn = req->conn;
3971         files_struct *fsp;
3972         off_t startpos;
3973         size_t smb_maxcnt;
3974         size_t upper_size;
3975         bool big_readX = False;
3976 #if 0
3977         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3978 #endif
3979
3980         START_PROFILE(SMBreadX);
3981
3982         if ((req->wct != 10) && (req->wct != 12)) {
3983                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3984                 return;
3985         }
3986
3987         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3988         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3989         smb_maxcnt = SVAL(req->vwv+5, 0);
3990
3991         /* If it's an IPC, pass off the pipe handler. */
3992         if (IS_IPC(conn)) {
3993                 reply_pipe_read_and_X(req);
3994                 END_PROFILE(SMBreadX);
3995                 return;
3996         }
3997
3998         if (!check_fsp(conn, req, fsp)) {
3999                 END_PROFILE(SMBreadX);
4000                 return;
4001         }
4002
4003         if (!CHECK_READ(fsp,req)) {
4004                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4005                 END_PROFILE(SMBreadX);
4006                 return;
4007         }
4008
4009         upper_size = SVAL(req->vwv+7, 0);
4010         smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4011         if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4012                 /*
4013                  * This is a heuristic to avoid keeping large
4014                  * outgoing buffers around over long-lived aio
4015                  * requests.
4016                  */
4017                 big_readX = True;
4018         }
4019
4020         if (req->wct == 12) {
4021                 /*
4022                  * This is a large offset (64 bit) read.
4023                  */
4024                 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4025
4026         }
4027
4028         if (!big_readX) {
4029                 NTSTATUS status = schedule_aio_read_and_X(conn,
4030                                         req,
4031                                         fsp,
4032                                         startpos,
4033                                         smb_maxcnt);
4034                 if (NT_STATUS_IS_OK(status)) {
4035                         /* Read scheduled - we're done. */
4036                         goto out;
4037                 }
4038                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4039                         /* Real error - report to client. */
4040                         END_PROFILE(SMBreadX);
4041                         reply_nterror(req, status);
4042                         return;
4043                 }
4044                 /* NT_STATUS_RETRY - fall back to sync read. */
4045         }
4046
4047         smbd_lock_socket(req->sconn);
4048         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4049         smbd_unlock_socket(req->sconn);
4050
4051  out:
4052         END_PROFILE(SMBreadX);
4053         return;
4054 }
4055
4056 /****************************************************************************
4057  Error replies to writebraw must have smb_wct == 1. Fix this up.
4058 ****************************************************************************/
4059
4060 void error_to_writebrawerr(struct smb_request *req)
4061 {
4062         uint8 *old_outbuf = req->outbuf;
4063
4064         reply_outbuf(req, 1, 0);
4065
4066         memcpy(req->outbuf, old_outbuf, smb_size);
4067         TALLOC_FREE(old_outbuf);
4068 }
4069
4070 /****************************************************************************
4071  Read 4 bytes of a smb packet and return the smb length of the packet.
4072  Store the result in the buffer. This version of the function will
4073  never return a session keepalive (length of zero).
4074  Timeout is in milliseconds.
4075 ****************************************************************************/
4076
4077 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4078                                 size_t *len)
4079 {
4080         uint8_t msgtype = NBSSkeepalive;
4081
4082         while (msgtype == NBSSkeepalive) {
4083                 NTSTATUS status;
4084
4085                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4086                                                           len);
4087                 if (!NT_STATUS_IS_OK(status)) {
4088                         char addr[INET6_ADDRSTRLEN];
4089                         /* Try and give an error message
4090                          * saying what client failed. */
4091                         DEBUG(0, ("read_fd_with_timeout failed for "
4092                                   "client %s read error = %s.\n",
4093                                   get_peer_addr(fd,addr,sizeof(addr)),
4094                                   nt_errstr(status)));
4095                         return status;
4096                 }
4097
4098                 msgtype = CVAL(inbuf, 0);
4099         }
4100
4101         DEBUG(10,("read_smb_length: got smb length of %lu\n",
4102                   (unsigned long)len));
4103
4104         return NT_STATUS_OK;
4105 }
4106
4107 /****************************************************************************
4108  Reply to a writebraw (core+ or LANMAN1.0 protocol).
4109 ****************************************************************************/
4110
4111 void reply_writebraw(struct smb_request *req)
4112 {
4113         connection_struct *conn = req->conn;
4114         char *buf = NULL;
4115         ssize_t nwritten=0;
4116         ssize_t total_written=0;
4117         size_t numtowrite=0;
4118         size_t tcount;
4119         off_t startpos;
4120         const char *data=NULL;
4121         bool write_through;
4122         files_struct *fsp;
4123         struct lock_struct lock;
4124         NTSTATUS status;
4125
4126         START_PROFILE(SMBwritebraw);
4127
4128         /*
4129          * If we ever reply with an error, it must have the SMB command
4130          * type of SMBwritec, not SMBwriteBraw, as this tells the client
4131          * we're finished.
4132          */
4133         SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4134
4135         if (srv_is_signing_active(req->sconn)) {
4136                 END_PROFILE(SMBwritebraw);
4137                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4138                                 "raw reads/writes are disallowed.");
4139         }
4140
4141         if (req->wct < 12) {
4142                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4143                 error_to_writebrawerr(req);
4144                 END_PROFILE(SMBwritebraw);
4145                 return;
4146         }
4147
4148         if (req->sconn->smb1.echo_handler.trusted_fde) {
4149                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4150                          "'async smb echo handler = yes'\n"));
4151                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4152                 error_to_writebrawerr(req);
4153                 END_PROFILE(SMBwritebraw);
4154                 return;
4155         }
4156
4157         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4158         if (!check_fsp(conn, req, fsp)) {
4159                 error_to_writebrawerr(req);
4160                 END_PROFILE(SMBwritebraw);
4161                 return;
4162         }
4163
4164         if (!CHECK_WRITE(fsp)) {
4165                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4166                 error_to_writebrawerr(req);
4167                 END_PROFILE(SMBwritebraw);
4168                 return;
4169         }
4170
4171         tcount = IVAL(req->vwv+1, 0);
4172         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4173         write_through = BITSETW(req->vwv+7,0);
4174
4175         /* We have to deal with slightly different formats depending
4176                 on whether we are using the core+ or lanman1.0 protocol */
4177
4178         if(get_Protocol() <= PROTOCOL_COREPLUS) {
4179                 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4180                 data = smb_buf_const(req->inbuf);
4181         } else {
4182                 numtowrite = SVAL(req->vwv+10, 0);
4183                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4184         }
4185
4186         /* Ensure we don't write bytes past the end of this packet. */
4187         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4188                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4189                 error_to_writebrawerr(req);
4190                 END_PROFILE(SMBwritebraw);
4191                 return;
4192         }
4193
4194         if (!fsp->print_file) {
4195                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4196                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4197                     &lock);
4198
4199                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4200                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4201                         error_to_writebrawerr(req);
4202                         END_PROFILE(SMBwritebraw);
4203                         return;
4204                 }
4205         }
4206
4207         if (numtowrite>0) {
4208                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4209         }
4210
4211         DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4212                         "wrote=%d sync=%d\n",
4213                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4214                 (int)nwritten, (int)write_through));
4215
4216         if (nwritten < (ssize_t)numtowrite)  {
4217                 reply_nterror(req, NT_STATUS_DISK_FULL);
4218                 error_to_writebrawerr(req);
4219                 goto strict_unlock;
4220         }
4221
4222         total_written = nwritten;
4223
4224         /* Allocate a buffer of 64k + length. */
4225         buf = talloc_array(NULL, char, 65540);
4226         if (!buf) {
4227                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4228                 error_to_writebrawerr(req);
4229                 goto strict_unlock;
4230         }
4231
4232         /* Return a SMBwritebraw message to the redirector to tell
4233          * it to send more bytes */
4234
4235         memcpy(buf, req->inbuf, smb_size);
4236         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4237         SCVAL(buf,smb_com,SMBwritebraw);
4238         SSVALS(buf,smb_vwv0,0xFFFF);
4239         show_msg(buf);
4240         if (!srv_send_smb(req->sconn,
4241                           buf,
4242                           false, 0, /* no signing */
4243                           IS_CONN_ENCRYPTED(conn),
4244                           &req->pcd)) {
4245                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4246                         "failed.");
4247         }
4248
4249         /* Now read the raw data into the buffer and write it */
4250         status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4251                                  &numtowrite);
4252         if (!NT_STATUS_IS_OK(status)) {
4253                 exit_server_cleanly("secondary writebraw failed");
4254         }
4255
4256         /* Set up outbuf to return the correct size */
4257         reply_outbuf(req, 1, 0);
4258
4259         if (numtowrite != 0) {
4260
4261                 if (numtowrite > 0xFFFF) {
4262                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4263                                 "raw requested (%u). Terminating\n",
4264                                 (unsigned int)numtowrite ));
4265                         exit_server_cleanly("secondary writebraw failed");
4266                 }
4267
4268                 if (tcount > nwritten+numtowrite) {
4269                         DEBUG(3,("reply_writebraw: Client overestimated the "
4270                                 "write %d %d %d\n",
4271                                 (int)tcount,(int)nwritten,(int)numtowrite));
4272                 }
4273
4274                 status = read_data(req->sconn->sock, buf+4, numtowrite);
4275
4276                 if (!NT_STATUS_IS_OK(status)) {
4277                         char addr[INET6_ADDRSTRLEN];
4278                         /* Try and give an error message
4279                          * saying what client failed. */
4280                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4281                                   "raw read failed (%s) for client %s. "
4282                                   "Terminating\n", nt_errstr(status),
4283                                   get_peer_addr(req->sconn->sock, addr,
4284                                                 sizeof(addr))));
4285                         exit_server_cleanly("secondary writebraw failed");
4286                 }
4287
4288                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4289                 if (nwritten == -1) {
4290                         TALLOC_FREE(buf);
4291                         reply_nterror(req, map_nt_error_from_unix(errno));
4292                         error_to_writebrawerr(req);
4293                         goto strict_unlock;
4294                 }
4295
4296                 if (nwritten < (ssize_t)numtowrite) {
4297                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4298                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4299                 }
4300
4301                 if (nwritten > 0) {
4302                         total_written += nwritten;
4303                 }
4304         }
4305
4306         TALLOC_FREE(buf);
4307         SSVAL(req->outbuf,smb_vwv0,total_written);
4308
4309         status = sync_file(conn, fsp, write_through);
4310         if (!NT_STATUS_IS_OK(status)) {
4311                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4312                          fsp_str_dbg(fsp), nt_errstr(status)));
4313                 reply_nterror(req, status);
4314                 error_to_writebrawerr(req);
4315                 goto strict_unlock;
4316         }
4317
4318         DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4319                 "wrote=%d\n",
4320                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4321                 (int)total_written));
4322
4323         if (!fsp->print_file) {
4324                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4325         }
4326
4327         /* We won't return a status if write through is not selected - this
4328          * follows what WfWg does */
4329         END_PROFILE(SMBwritebraw);
4330
4331         if (!write_through && total_written==tcount) {
4332
4333 #if RABBIT_PELLET_FIX
4334                 /*
4335                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4336                  * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4337                  * JRA.
4338                  */
4339                 if (!send_keepalive(req->sconn->sock)) {
4340                         exit_server_cleanly("reply_writebraw: send of "
4341                                 "keepalive failed");
4342                 }
4343 #endif
4344                 TALLOC_FREE(req->outbuf);
4345         }
4346         return;
4347
4348 strict_unlock:
4349         if (!fsp->print_file) {
4350                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4351         }
4352
4353         END_PROFILE(SMBwritebraw);
4354         return;
4355 }
4356
4357 #undef DBGC_CLASS
4358 #define DBGC_CLASS DBGC_LOCKING
4359
4360 /****************************************************************************
4361  Reply to a writeunlock (core+).
4362 ****************************************************************************/
4363
4364 void reply_writeunlock(struct smb_request *req)
4365 {
4366         connection_struct *conn = req->conn;
4367         ssize_t nwritten = -1;
4368         size_t numtowrite;
4369         off_t startpos;
4370         const char *data;
4371         NTSTATUS status = NT_STATUS_OK;
4372         files_struct *fsp;
4373         struct lock_struct lock;
4374         int saved_errno = 0;
4375
4376         START_PROFILE(SMBwriteunlock);
4377
4378         if (req->wct < 5) {
4379                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4380                 END_PROFILE(SMBwriteunlock);
4381                 return;
4382         }
4383
4384         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4385
4386         if (!check_fsp(conn, req, fsp)) {
4387                 END_PROFILE(SMBwriteunlock);
4388                 return;
4389         }
4390
4391         if (!CHECK_WRITE(fsp)) {
4392                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4393                 END_PROFILE(SMBwriteunlock);
4394                 return;
4395         }
4396
4397         numtowrite = SVAL(req->vwv+1, 0);
4398         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4399         data = (const char *)req->buf + 3;
4400
4401         if (!fsp->print_file && numtowrite > 0) {
4402                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4403                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4404                     &lock);
4405
4406                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4407                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4408                         END_PROFILE(SMBwriteunlock);
4409                         return;
4410                 }
4411         }
4412
4413         /* The special X/Open SMB protocol handling of
4414            zero length writes is *NOT* done for
4415            this call */
4416         if(numtowrite == 0) {
4417                 nwritten = 0;
4418         } else {
4419                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4420                 saved_errno = errno;
4421         }
4422
4423         status = sync_file(conn, fsp, False /* write through */);
4424         if (!NT_STATUS_IS_OK(status)) {
4425                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4426                          fsp_str_dbg(fsp), nt_errstr(status)));
4427                 reply_nterror(req, status);
4428                 goto strict_unlock;
4429         }
4430
4431         if(nwritten < 0) {
4432                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4433                 goto strict_unlock;
4434         }
4435
4436         if((nwritten < numtowrite) && (numtowrite != 0)) {
4437                 reply_nterror(req, NT_STATUS_DISK_FULL);
4438                 goto strict_unlock;
4439         }
4440
4441         if (numtowrite && !fsp->print_file) {
4442                 status = do_unlock(req->sconn->msg_ctx,
4443                                 fsp,
4444                                 (uint64_t)req->smbpid,
4445                                 (uint64_t)numtowrite,
4446                                 (uint64_t)startpos,
4447                                 WINDOWS_LOCK);
4448
4449                 if (NT_STATUS_V(status)) {
4450                         reply_nterror(req, status);
4451                         goto strict_unlock;
4452                 }
4453         }
4454
4455         reply_outbuf(req, 1, 0);
4456
4457         SSVAL(req->outbuf,smb_vwv0,nwritten);
4458
4459         DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4460                   fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4461
4462 strict_unlock:
4463         if (numtowrite && !fsp->print_file) {
4464                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4465         }
4466
4467         END_PROFILE(SMBwriteunlock);
4468         return;
4469 }
4470
4471 #undef DBGC_CLASS
4472 #define DBGC_CLASS DBGC_ALL
4473
4474 /****************************************************************************
4475  Reply to a write.
4476 ****************************************************************************/
4477
4478 void reply_write(struct smb_request *req)
4479 {
4480         connection_struct *conn = req->conn;
4481         size_t numtowrite;
4482         ssize_t nwritten = -1;
4483         off_t startpos;
4484         const char *data;
4485         files_struct *fsp;
4486         struct lock_struct lock;
4487         NTSTATUS status;
4488         int saved_errno = 0;
4489
4490         START_PROFILE(SMBwrite);
4491
4492         if (req->wct < 5) {
4493                 END_PROFILE(SMBwrite);
4494                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4495                 return;
4496         }
4497
4498         /* If it's an IPC, pass off the pipe handler. */
4499         if (IS_IPC(conn)) {
4500                 reply_pipe_write(req);
4501                 END_PROFILE(SMBwrite);
4502                 return;
4503         }
4504
4505         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4506
4507         if (!check_fsp(conn, req, fsp)) {
4508                 END_PROFILE(SMBwrite);
4509                 return;
4510         }
4511
4512         if (!CHECK_WRITE(fsp)) {
4513                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4514                 END_PROFILE(SMBwrite);
4515                 return;
4516         }
4517
4518         numtowrite = SVAL(req->vwv+1, 0);
4519         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4520         data = (const char *)req->buf + 3;
4521
4522         if (!fsp->print_file) {
4523                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4524                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4525                         &lock);
4526
4527                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4528                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4529                         END_PROFILE(SMBwrite);
4530                         return;
4531                 }
4532         }
4533
4534         /*
4535          * X/Open SMB protocol says that if smb_vwv1 is
4536          * zero then the file size should be extended or
4537          * truncated to the size given in smb_vwv[2-3].
4538          */
4539
4540         if(numtowrite == 0) {
4541                 /*
4542                  * This is actually an allocate call, and set EOF. JRA.
4543                  */
4544                 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4545                 if (nwritten < 0) {
4546                         reply_nterror(req, NT_STATUS_DISK_FULL);
4547                         goto strict_unlock;
4548                 }
4549                 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4550                 if (nwritten < 0) {
4551                         reply_nterror(req, NT_STATUS_DISK_FULL);
4552                         goto strict_unlock;
4553                 }
4554                 trigger_write_time_update_immediate(fsp);
4555         } else {
4556                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4557         }
4558
4559         status = sync_file(conn, fsp, False);
4560         if (!NT_STATUS_IS_OK(status)) {
4561                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4562                          fsp_str_dbg(fsp), nt_errstr(status)));
4563                 reply_nterror(req, status);
4564                 goto strict_unlock;
4565         }
4566
4567         if(nwritten < 0) {
4568                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4569                 goto strict_unlock;
4570         }
4571
4572         if((nwritten == 0) && (numtowrite != 0)) {
4573                 reply_nterror(req, NT_STATUS_DISK_FULL);
4574                 goto strict_unlock;
4575         }
4576
4577         reply_outbuf(req, 1, 0);
4578
4579         SSVAL(req->outbuf,smb_vwv0,nwritten);
4580
4581         if (nwritten < (ssize_t)numtowrite) {
4582                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4583                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4584         }
4585
4586         DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4587
4588 strict_unlock:
4589         if (!fsp->print_file) {
4590                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4591         }
4592
4593         END_PROFILE(SMBwrite);
4594         return;
4595 }
4596
4597 /****************************************************************************
4598  Ensure a buffer is a valid writeX for recvfile purposes.
4599 ****************************************************************************/
4600
4601 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4602                                                 (2*14) + /* word count (including bcc) */ \
4603                                                 1 /* pad byte */)
4604
4605 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4606                             const uint8_t *inbuf)
4607 {
4608         size_t numtowrite;
4609         connection_struct *conn = NULL;
4610         unsigned int doff = 0;
4611         size_t len = smb_len_large(inbuf);
4612         struct smbXsrv_tcon *tcon;
4613         NTSTATUS status;
4614         NTTIME now = 0;
4615
4616         if (is_encrypted_packet(sconn, inbuf)) {
4617                 /* Can't do this on encrypted
4618                  * connections. */
4619                 return false;
4620         }
4621
4622         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4623                 return false;
4624         }
4625
4626         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4627                         CVAL(inbuf,smb_wct) != 14) {
4628                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4629                         "invalid word length.\n"));
4630                 return false;
4631         }
4632
4633         status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
4634                                      now, &tcon);
4635         if (!NT_STATUS_IS_OK(status)) {
4636                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4637                 return false;
4638         }
4639         conn = tcon->compat;
4640
4641         if (IS_IPC(conn)) {
4642                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4643                 return false;
4644         }
4645         if (IS_PRINT(conn)) {
4646                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4647                 return false;
4648         }
4649         doff = SVAL(inbuf,smb_vwv11);
4650
4651         numtowrite = SVAL(inbuf,smb_vwv10);
4652
4653         if (len > doff && len - doff > 0xFFFF) {
4654                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4655         }
4656
4657         if (numtowrite == 0) {
4658                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4659                 return false;
4660         }
4661
4662         /* Ensure the sizes match up. */
4663         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4664                 /* no pad byte...old smbclient :-( */
4665                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4666                         (unsigned int)doff,
4667                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4668                 return false;
4669         }
4670
4671         if (len - doff != numtowrite) {
4672                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4673                         "len = %u, doff = %u, numtowrite = %u\n",
4674                         (unsigned int)len,
4675                         (unsigned int)doff,
4676                         (unsigned int)numtowrite ));
4677                 return false;
4678         }
4679
4680         DEBUG(10,("is_valid_writeX_buffer: true "
4681                 "len = %u, doff = %u, numtowrite = %u\n",
4682                 (unsigned int)len,
4683                 (unsigned int)doff,
4684                 (unsigned int)numtowrite ));
4685
4686         return true;
4687 }
4688
4689 /****************************************************************************
4690  Reply to a write and X.
4691 ****************************************************************************/
4692
4693 void reply_write_and_X(struct smb_request *req)
4694 {
4695         connection_struct *conn = req->conn;
4696         files_struct *fsp;
4697         struct lock_struct lock;
4698         off_t startpos;
4699         size_t numtowrite;
4700         bool write_through;
4701         ssize_t nwritten;
4702         unsigned int smb_doff;
4703         unsigned int smblen;
4704         const char *data;
4705         NTSTATUS status;
4706         int saved_errno = 0;
4707
4708         START_PROFILE(SMBwriteX);
4709
4710         if ((req->wct != 12) && (req->wct != 14)) {
4711                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4712                 goto out;
4713         }
4714
4715         numtowrite = SVAL(req->vwv+10, 0);
4716         smb_doff = SVAL(req->vwv+11, 0);
4717         smblen = smb_len(req->inbuf);
4718
4719         if (req->unread_bytes > 0xFFFF ||
4720                         (smblen > smb_doff &&
4721                                 smblen - smb_doff > 0xFFFF)) {
4722                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4723         }
4724
4725         if (req->unread_bytes) {
4726                 /* Can't do a recvfile write on IPC$ */
4727                 if (IS_IPC(conn)) {
4728                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4729                         goto out;
4730                 }
4731                 if (numtowrite != req->unread_bytes) {
4732                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4733                         goto out;
4734                 }
4735         } else {
4736                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4737                                 smb_doff + numtowrite > smblen) {
4738                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4739                         goto out;
4740                 }
4741         }
4742
4743         /* If it's an IPC, pass off the pipe handler. */
4744         if (IS_IPC(conn)) {
4745                 if (req->unread_bytes) {
4746                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4747                         goto out;
4748                 }
4749                 reply_pipe_write_and_X(req);
4750                 goto out;
4751         }
4752
4753         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4754         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4755         write_through = BITSETW(req->vwv+7,0);
4756
4757         if (!check_fsp(conn, req, fsp)) {
4758                 goto out;
4759         }
4760
4761         if (!CHECK_WRITE(fsp)) {
4762                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4763                 goto out;
4764         }
4765
4766         data = smb_base(req->inbuf) + smb_doff;
4767
4768         if(req->wct == 14) {
4769                 /*
4770                  * This is a large offset (64 bit) write.
4771                  */
4772                 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4773
4774         }
4775
4776         /* X/Open SMB protocol says that, unlike SMBwrite
4777         if the length is zero then NO truncation is
4778         done, just a write of zero. To truncate a file,
4779         use SMBwrite. */
4780
4781         if(numtowrite == 0) {
4782                 nwritten = 0;
4783         } else {
4784                 if (req->unread_bytes == 0) {
4785                         status = schedule_aio_write_and_X(conn,
4786                                                 req,
4787                                                 fsp,
4788                                                 data,
4789                                                 startpos,
4790                                                 numtowrite);
4791
4792                         if (NT_STATUS_IS_OK(status)) {
4793                                 /* write scheduled - we're done. */
4794                                 goto out;
4795                         }
4796                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4797                                 /* Real error - report to client. */
4798                                 reply_nterror(req, status);
4799                                 goto out;
4800                         }
4801                         /* NT_STATUS_RETRY - fall through to sync write. */
4802                 }
4803
4804                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4805                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4806                     &lock);
4807
4808                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4809                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4810                         goto out;
4811                 }
4812
4813                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4814                 saved_errno = errno;
4815
4816                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4817         }
4818
4819         if(nwritten < 0) {
4820                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4821                 goto out;
4822         }
4823
4824         if((nwritten == 0) && (numtowrite != 0)) {
4825                 reply_nterror(req, NT_STATUS_DISK_FULL);
4826                 goto out;
4827         }
4828
4829         reply_outbuf(req, 6, 0);
4830         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4831         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
4832         SSVAL(req->outbuf,smb_vwv2,nwritten);
4833         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4834
4835         DEBUG(3,("writeX %s num=%d wrote=%d\n",
4836                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4837
4838         status = sync_file(conn, fsp, write_through);
4839         if (!NT_STATUS_IS_OK(status)) {
4840                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4841                          fsp_str_dbg(fsp), nt_errstr(status)));
4842                 reply_nterror(req, status);
4843                 goto out;
4844         }
4845
4846         END_PROFILE(SMBwriteX);
4847         return;
4848
4849 out:
4850         if (req->unread_bytes) {
4851                 /* writeX failed. drain socket. */
4852                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4853                                 req->unread_bytes) {
4854                         smb_panic("failed to drain pending bytes");
4855                 }
4856                 req->unread_bytes = 0;
4857         }
4858
4859         END_PROFILE(SMBwriteX);
4860         return;
4861 }
4862
4863 /****************************************************************************
4864  Reply to a lseek.
4865 ****************************************************************************/
4866
4867 void reply_lseek(struct smb_request *req)
4868 {
4869         connection_struct *conn = req->conn;
4870         off_t startpos;
4871         off_t res= -1;
4872         int mode,umode;
4873         files_struct *fsp;
4874
4875         START_PROFILE(SMBlseek);
4876
4877         if (req->wct < 4) {
4878                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4879                 END_PROFILE(SMBlseek);
4880                 return;
4881         }
4882
4883         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4884
4885         if (!check_fsp(conn, req, fsp)) {
4886                 return;
4887         }
4888
4889         flush_write_cache(fsp, SEEK_FLUSH);
4890
4891         mode = SVAL(req->vwv+1, 0) & 3;
4892         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4893         startpos = (off_t)IVALS(req->vwv+2, 0);
4894
4895         switch (mode) {
4896                 case 0:
4897                         umode = SEEK_SET;
4898                         res = startpos;
4899                         break;
4900                 case 1:
4901                         umode = SEEK_CUR;
4902                         res = fsp->fh->pos + startpos;
4903                         break;
4904                 case 2:
4905                         umode = SEEK_END;
4906                         break;
4907                 default:
4908                         umode = SEEK_SET;
4909                         res = startpos;
4910                         break;
4911         }
4912
4913         if (umode == SEEK_END) {
4914                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4915                         if(errno == EINVAL) {
4916                                 off_t current_pos = startpos;
4917
4918                                 if(fsp_stat(fsp) == -1) {
4919                                         reply_nterror(req,
4920                                                 map_nt_error_from_unix(errno));
4921                                         END_PROFILE(SMBlseek);
4922                                         return;
4923                                 }
4924
4925                                 current_pos += fsp->fsp_name->st.st_ex_size;
4926                                 if(current_pos < 0)
4927                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4928                         }
4929                 }
4930
4931                 if(res == -1) {
4932                         reply_nterror(req, map_nt_error_from_unix(errno));
4933                         END_PROFILE(SMBlseek);
4934                         return;
4935                 }
4936         }
4937
4938         fsp->fh->pos = res;
4939
4940         reply_outbuf(req, 2, 0);
4941         SIVAL(req->outbuf,smb_vwv0,res);
4942
4943         DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4944                 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4945
4946         END_PROFILE(SMBlseek);
4947         return;
4948 }
4949
4950 /****************************************************************************
4951  Reply to a flush.
4952 ****************************************************************************/
4953
4954 void reply_flush(struct smb_request *req)
4955 {
4956         connection_struct *conn = req->conn;
4957         uint16 fnum;
4958         files_struct *fsp;
4959
4960         START_PROFILE(SMBflush);
4961
4962         if (req->wct < 1) {
4963                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4964                 return;
4965         }
4966
4967         fnum = SVAL(req->vwv+0, 0);
4968         fsp = file_fsp(req, fnum);
4969
4970         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4971                 return;
4972         }
4973
4974         if (!fsp) {
4975                 file_sync_all(conn);
4976         } else {
4977                 NTSTATUS status = sync_file(conn, fsp, True);
4978                 if (!NT_STATUS_IS_OK(status)) {
4979                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4980                                 fsp_str_dbg(fsp), nt_errstr(status)));
4981                         reply_nterror(req, status);
4982                         END_PROFILE(SMBflush);
4983                         return;
4984                 }
4985         }
4986
4987         reply_outbuf(req, 0, 0);
4988
4989         DEBUG(3,("flush\n"));
4990         END_PROFILE(SMBflush);
4991         return;
4992 }
4993
4994 /****************************************************************************
4995  Reply to a exit.
4996  conn POINTER CAN BE NULL HERE !
4997 ****************************************************************************/
4998
4999 void reply_exit(struct smb_request *req)
5000 {
5001         START_PROFILE(SMBexit);
5002
5003         file_close_pid(req->sconn, req->smbpid, req->vuid);
5004
5005         reply_outbuf(req, 0, 0);
5006
5007         DEBUG(3,("exit\n"));
5008
5009         END_PROFILE(SMBexit);
5010         return;
5011 }
5012
5013 struct reply_close_state {
5014         files_struct *fsp;
5015         struct smb_request *smbreq;
5016 };
5017
5018 static void do_smb1_close(struct tevent_req *req);
5019
5020 void reply_close(struct smb_request *req)
5021 {
5022         connection_struct *conn = req->conn;
5023         NTSTATUS status = NT_STATUS_OK;
5024         files_struct *fsp = NULL;
5025         START_PROFILE(SMBclose);
5026
5027         if (req->wct < 3) {
5028                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5029                 END_PROFILE(SMBclose);
5030                 return;
5031         }
5032
5033         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5034
5035         /*
5036          * We can only use check_fsp if we know it's not a directory.
5037          */
5038
5039         if (!check_fsp_open(conn, req, fsp)) {
5040                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5041                 END_PROFILE(SMBclose);
5042                 return;
5043         }
5044
5045         DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5046                   fsp->is_directory ? "directory" : "file",
5047                   fsp->fh->fd, fsp_fnum_dbg(fsp),
5048                   conn->num_files_open));
5049
5050         if (!fsp->is_directory) {
5051                 time_t t;
5052
5053                 /*
5054                  * Take care of any time sent in the close.
5055                  */
5056
5057                 t = srv_make_unix_date3(req->vwv+1);
5058                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5059         }
5060
5061         if (fsp->num_aio_requests != 0) {
5062
5063                 struct reply_close_state *state;
5064
5065                 DEBUG(10, ("closing with aio %u requests pending\n",
5066                            fsp->num_aio_requests));
5067
5068                 /*
5069                  * We depend on the aio_extra destructor to take care of this
5070                  * close request once fsp->num_aio_request drops to 0.
5071                  */
5072
5073                 fsp->deferred_close = tevent_wait_send(
5074                         fsp, fsp->conn->sconn->ev_ctx);
5075                 if (fsp->deferred_close == NULL) {
5076                         status = NT_STATUS_NO_MEMORY;
5077                         goto done;
5078                 }
5079
5080                 state = talloc(fsp, struct reply_close_state);
5081                 if (state == NULL) {
5082                         TALLOC_FREE(fsp->deferred_close);
5083                         status = NT_STATUS_NO_MEMORY;
5084                         goto done;
5085                 }
5086                 state->fsp = fsp;
5087                 state->smbreq = talloc_move(fsp, &req);
5088                 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5089                                         state);
5090                 END_PROFILE(SMBclose);
5091                 return;
5092         }
5093
5094         /*
5095          * close_file() returns the unix errno if an error was detected on
5096          * close - normally this is due to a disk full error. If not then it
5097          * was probably an I/O error.
5098          */
5099
5100         status = close_file(req, fsp, NORMAL_CLOSE);
5101 done:
5102         if (!NT_STATUS_IS_OK(status)) {
5103                 reply_nterror(req, status);
5104                 END_PROFILE(SMBclose);
5105                 return;
5106         }
5107
5108         reply_outbuf(req, 0, 0);
5109         END_PROFILE(SMBclose);
5110         return;
5111 }
5112
5113 static void do_smb1_close(struct tevent_req *req)
5114 {
5115         struct reply_close_state *state = tevent_req_callback_data(
5116                 req, struct reply_close_state);
5117         struct smb_request *smbreq;
5118         NTSTATUS status;
5119         int ret;
5120
5121         ret = tevent_wait_recv(req);
5122         TALLOC_FREE(req);
5123         if (ret != 0) {
5124                 DEBUG(10, ("tevent_wait_recv returned %s\n",
5125                            strerror(ret)));
5126                 /*
5127                  * Continue anyway, this should never happen
5128                  */
5129         }
5130
5131         /*
5132          * fsp->smb2_close_request right now is a talloc grandchild of
5133          * fsp. When we close_file(fsp), it would go with it. No chance to
5134          * reply...
5135          */
5136         smbreq = talloc_move(talloc_tos(), &state->smbreq);
5137
5138         status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5139         if (NT_STATUS_IS_OK(status)) {
5140                 reply_outbuf(smbreq, 0, 0);
5141         } else {
5142                 reply_nterror(smbreq, status);
5143         }
5144         if (!srv_send_smb(smbreq->sconn,
5145                         (char *)smbreq->outbuf,
5146                         true,
5147                         smbreq->seqnum+1,
5148                         IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5149                         NULL)) {
5150                 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5151                                     "failed.");
5152         }
5153         TALLOC_FREE(smbreq);
5154 }
5155
5156 /****************************************************************************
5157  Reply to a writeclose (Core+ protocol).
5158 ****************************************************************************/
5159
5160 void reply_writeclose(struct smb_request *req)
5161 {
5162         connection_struct *conn = req->conn;
5163         size_t numtowrite;
5164         ssize_t nwritten = -1;
5165         NTSTATUS close_status = NT_STATUS_OK;
5166         off_t startpos;
5167         const char *data;
5168         struct timespec mtime;
5169         files_struct *fsp;
5170         struct lock_struct lock;
5171
5172         START_PROFILE(SMBwriteclose);
5173
5174         if (req->wct < 6) {
5175                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5176                 END_PROFILE(SMBwriteclose);
5177                 return;
5178         }
5179
5180         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5181
5182         if (!check_fsp(conn, req, fsp)) {
5183                 END_PROFILE(SMBwriteclose);
5184                 return;
5185         }
5186         if (!CHECK_WRITE(fsp)) {
5187                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5188                 END_PROFILE(SMBwriteclose);
5189                 return;
5190         }
5191
5192         numtowrite = SVAL(req->vwv+1, 0);
5193         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5194         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5195         data = (const char *)req->buf + 1;
5196
5197         if (!fsp->print_file) {
5198                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5199                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5200                     &lock);
5201
5202                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5203                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5204                         END_PROFILE(SMBwriteclose);
5205                         return;
5206                 }
5207         }
5208
5209         nwritten = write_file(req,fsp,data,startpos,numtowrite);
5210
5211         set_close_write_time(fsp, mtime);
5212
5213         /*
5214          * More insanity. W2K only closes the file if writelen > 0.
5215          * JRA.
5216          */
5217
5218         if (numtowrite) {
5219                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5220                          "file %s\n", fsp_str_dbg(fsp)));
5221                 close_status = close_file(req, fsp, NORMAL_CLOSE);
5222         }
5223
5224         DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5225                  fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5226                  conn->num_files_open));
5227
5228         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5229                 reply_nterror(req, NT_STATUS_DISK_FULL);
5230                 goto strict_unlock;
5231         }
5232
5233         if(!NT_STATUS_IS_OK(close_status)) {
5234                 reply_nterror(req, close_status);
5235                 goto strict_unlock;
5236         }
5237
5238         reply_outbuf(req, 1, 0);
5239
5240         SSVAL(req->outbuf,smb_vwv0,nwritten);
5241
5242 strict_unlock:
5243         if (numtowrite && !fsp->print_file) {
5244                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5245         }
5246
5247         END_PROFILE(SMBwriteclose);
5248         return;
5249 }
5250
5251 #undef DBGC_CLASS
5252 #define DBGC_CLASS DBGC_LOCKING
5253
5254 /****************************************************************************
5255  Reply to a lock.
5256 ****************************************************************************/
5257
5258 void reply_lock(struct smb_request *req)
5259 {
5260         connection_struct *conn = req->conn;
5261         uint64_t count,offset;
5262         NTSTATUS status;
5263         files_struct *fsp;
5264         struct byte_range_lock *br_lck = NULL;
5265
5266         START_PROFILE(SMBlock);
5267
5268         if (req->wct < 5) {
5269                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5270                 END_PROFILE(SMBlock);
5271                 return;
5272         }
5273
5274         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5275
5276         if (!check_fsp(conn, req, fsp)) {
5277                 END_PROFILE(SMBlock);
5278                 return;
5279         }
5280
5281         count = (uint64_t)IVAL(req->vwv+1, 0);
5282         offset = (uint64_t)IVAL(req->vwv+3, 0);
5283
5284         DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5285                  fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5286
5287         br_lck = do_lock(req->sconn->msg_ctx,
5288                         fsp,
5289                         (uint64_t)req->smbpid,
5290                         count,
5291                         offset,
5292                         WRITE_LOCK,
5293                         WINDOWS_LOCK,
5294                         False, /* Non-blocking lock. */
5295                         &status,
5296                         NULL,
5297                         NULL);
5298
5299         TALLOC_FREE(br_lck);
5300
5301         if (NT_STATUS_V(status)) {
5302                 reply_nterror(req, status);
5303                 END_PROFILE(SMBlock);
5304                 return;
5305         }
5306
5307         reply_outbuf(req, 0, 0);
5308
5309         END_PROFILE(SMBlock);
5310         return;
5311 }
5312
5313 /****************************************************************************
5314  Reply to a unlock.
5315 ****************************************************************************/
5316
5317 void reply_unlock(struct smb_request *req)
5318 {
5319         connection_struct *conn = req->conn;
5320         uint64_t count,offset;
5321         NTSTATUS status;
5322         files_struct *fsp;
5323
5324         START_PROFILE(SMBunlock);
5325
5326         if (req->wct < 5) {
5327                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5328                 END_PROFILE(SMBunlock);
5329                 return;
5330         }
5331
5332         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5333
5334         if (!check_fsp(conn, req, fsp)) {
5335                 END_PROFILE(SMBunlock);
5336                 return;
5337         }
5338
5339         count = (uint64_t)IVAL(req->vwv+1, 0);
5340         offset = (uint64_t)IVAL(req->vwv+3, 0);
5341
5342         status = do_unlock(req->sconn->msg_ctx,
5343                         fsp,
5344                         (uint64_t)req->smbpid,
5345                         count,
5346                         offset,
5347                         WINDOWS_LOCK);
5348
5349         if (NT_STATUS_V(status)) {
5350                 reply_nterror(req, status);
5351                 END_PROFILE(SMBunlock);
5352                 return;
5353         }
5354
5355         DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5356                     fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5357
5358         reply_outbuf(req, 0, 0);
5359
5360         END_PROFILE(SMBunlock);
5361         return;
5362 }
5363
5364 #undef DBGC_CLASS
5365 #define DBGC_CLASS DBGC_ALL
5366
5367 /****************************************************************************
5368  Reply to a tdis.
5369  conn POINTER CAN BE NULL HERE !
5370 ****************************************************************************/
5371
5372 void reply_tdis(struct smb_request *req)
5373 {
5374         NTSTATUS status;
5375         connection_struct *conn = req->conn;
5376         struct smbXsrv_tcon *tcon;
5377
5378         START_PROFILE(SMBtdis);
5379
5380         if (!conn) {
5381                 DEBUG(4,("Invalid connection in tdis\n"));
5382                 reply_force_doserror(req, ERRSRV, ERRinvnid);
5383                 END_PROFILE(SMBtdis);
5384                 return;
5385         }
5386
5387         tcon = conn->tcon;
5388         req->conn = NULL;
5389
5390         /*
5391          * TODO: cancel all outstanding requests on the tcon
5392          */
5393         status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5394         if (!NT_STATUS_IS_OK(status)) {
5395                 DEBUG(0, ("reply_tdis: "
5396                           "smbXsrv_tcon_disconnect() failed: %s\n",
5397                           nt_errstr(status)));
5398                 /*
5399                  * If we hit this case, there is something completely
5400                  * wrong, so we better disconnect the transport connection.
5401                  */
5402                 END_PROFILE(SMBtdis);
5403                 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5404                 return;
5405         }
5406
5407         TALLOC_FREE(tcon);
5408
5409         reply_outbuf(req, 0, 0);
5410         END_PROFILE(SMBtdis);
5411         return;
5412 }
5413
5414 /****************************************************************************
5415  Reply to a echo.
5416  conn POINTER CAN BE NULL HERE !
5417 ****************************************************************************/
5418
5419 void reply_echo(struct smb_request *req)
5420 {
5421         connection_struct *conn = req->conn;
5422         struct smb_perfcount_data local_pcd;
5423         struct smb_perfcount_data *cur_pcd;
5424         int smb_reverb;
5425         int seq_num;
5426
5427         START_PROFILE(SMBecho);
5428
5429         smb_init_perfcount_data(&local_pcd);
5430
5431         if (req->wct < 1) {
5432                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5433                 END_PROFILE(SMBecho);
5434                 return;
5435         }
5436
5437         smb_reverb = SVAL(req->vwv+0, 0);
5438
5439         reply_outbuf(req, 1, req->buflen);
5440
5441         /* copy any incoming data back out */
5442         if (req->buflen > 0) {
5443                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5444         }
5445
5446         if (smb_reverb > 100) {
5447                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5448                 smb_reverb = 100;
5449         }
5450
5451         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5452
5453                 /* this makes sure we catch the request pcd */
5454                 if (seq_num == smb_reverb) {
5455                         cur_pcd = &req->pcd;
5456                 } else {
5457                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5458                         cur_pcd = &local_pcd;
5459                 }
5460
5461                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5462
5463                 show_msg((char *)req->outbuf);
5464                 if (!srv_send_smb(req->sconn,
5465                                 (char *)req->outbuf,
5466                                 true, req->seqnum+1,
5467                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5468                                 cur_pcd))
5469                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5470         }
5471
5472         DEBUG(3,("echo %d times\n", smb_reverb));
5473
5474         TALLOC_FREE(req->outbuf);
5475
5476         END_PROFILE(SMBecho);
5477         return;
5478 }
5479
5480 /****************************************************************************
5481  Reply to a printopen.
5482 ****************************************************************************/
5483
5484 void reply_printopen(struct smb_request *req)
5485 {
5486         connection_struct *conn = req->conn;
5487         files_struct *fsp;
5488         NTSTATUS status;
5489
5490         START_PROFILE(SMBsplopen);
5491
5492         if (req->wct < 2) {
5493                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5494                 END_PROFILE(SMBsplopen);
5495                 return;
5496         }
5497
5498         if (!CAN_PRINT(conn)) {
5499                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5500                 END_PROFILE(SMBsplopen);
5501                 return;
5502         }
5503
5504         status = file_new(req, conn, &fsp);
5505         if(!NT_STATUS_IS_OK(status)) {
5506                 reply_nterror(req, status);
5507                 END_PROFILE(SMBsplopen);
5508                 return;
5509         }
5510
5511         /* Open for exclusive use, write only. */
5512         status = print_spool_open(fsp, NULL, req->vuid);
5513
5514         if (!NT_STATUS_IS_OK(status)) {
5515                 file_free(req, fsp);
5516                 reply_nterror(req, status);
5517                 END_PROFILE(SMBsplopen);
5518                 return;
5519         }
5520
5521         reply_outbuf(req, 1, 0);
5522         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5523
5524         DEBUG(3,("openprint fd=%d %s\n",
5525                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5526
5527         END_PROFILE(SMBsplopen);
5528         return;
5529 }
5530
5531 /****************************************************************************
5532  Reply to a printclose.
5533 ****************************************************************************/
5534
5535 void reply_printclose(struct smb_request *req)
5536 {
5537         connection_struct *conn = req->conn;
5538         files_struct *fsp;
5539         NTSTATUS status;
5540
5541         START_PROFILE(SMBsplclose);
5542
5543         if (req->wct < 1) {
5544                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5545                 END_PROFILE(SMBsplclose);
5546                 return;
5547         }
5548
5549         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5550
5551         if (!check_fsp(conn, req, fsp)) {
5552                 END_PROFILE(SMBsplclose);
5553                 return;
5554         }
5555
5556         if (!CAN_PRINT(conn)) {
5557                 reply_force_doserror(req, ERRSRV, ERRerror);
5558                 END_PROFILE(SMBsplclose);
5559                 return;
5560         }
5561
5562         DEBUG(3,("printclose fd=%d %s\n",
5563                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5564
5565         status = close_file(req, fsp, NORMAL_CLOSE);
5566
5567         if(!NT_STATUS_IS_OK(status)) {
5568                 reply_nterror(req, status);
5569                 END_PROFILE(SMBsplclose);
5570                 return;
5571         }
5572
5573         reply_outbuf(req, 0, 0);
5574
5575         END_PROFILE(SMBsplclose);
5576         return;
5577 }
5578
5579 /****************************************************************************
5580  Reply to a printqueue.
5581 ****************************************************************************/
5582
5583 void reply_printqueue(struct smb_request *req)
5584 {
5585         connection_struct *conn = req->conn;
5586         int max_count;
5587         int start_index;
5588
5589         START_PROFILE(SMBsplretq);
5590
5591         if (req->wct < 2) {
5592                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5593                 END_PROFILE(SMBsplretq);
5594                 return;
5595         }
5596
5597         max_count = SVAL(req->vwv+0, 0);
5598         start_index = SVAL(req->vwv+1, 0);
5599
5600         /* we used to allow the client to get the cnum wrong, but that
5601            is really quite gross and only worked when there was only
5602            one printer - I think we should now only accept it if they
5603            get it right (tridge) */
5604         if (!CAN_PRINT(conn)) {
5605                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5606                 END_PROFILE(SMBsplretq);
5607                 return;
5608         }
5609
5610         reply_outbuf(req, 2, 3);
5611         SSVAL(req->outbuf,smb_vwv0,0);
5612         SSVAL(req->outbuf,smb_vwv1,0);
5613         SCVAL(smb_buf(req->outbuf),0,1);
5614         SSVAL(smb_buf(req->outbuf),1,0);
5615
5616         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5617                  start_index, max_count));
5618
5619         {
5620                 TALLOC_CTX *mem_ctx = talloc_tos();
5621                 NTSTATUS status;
5622                 WERROR werr;
5623                 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5624                 struct rpc_pipe_client *cli = NULL;
5625                 struct dcerpc_binding_handle *b = NULL;
5626                 struct policy_handle handle;
5627                 struct spoolss_DevmodeContainer devmode_ctr;
5628                 union spoolss_JobInfo *info;
5629                 uint32_t count;
5630                 uint32_t num_to_get;
5631                 uint32_t first;
5632                 uint32_t i;
5633
5634                 ZERO_STRUCT(handle);
5635
5636                 status = rpc_pipe_open_interface(conn,
5637                                                  &ndr_table_spoolss.syntax_id,
5638                                                  conn->session_info,
5639                                                  conn->sconn->remote_address,
5640                                                  conn->sconn->msg_ctx,
5641                                                  &cli);
5642                 if (!NT_STATUS_IS_OK(status)) {
5643                         DEBUG(0, ("reply_printqueue: "
5644                                   "could not connect to spoolss: %s\n",
5645                                   nt_errstr(status)));
5646                         reply_nterror(req, status);
5647                         goto out;
5648                 }
5649                 b = cli->binding_handle;
5650
5651                 ZERO_STRUCT(devmode_ctr);
5652
5653                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5654                                                 sharename,
5655                                                 NULL, devmode_ctr,
5656                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5657                                                 &handle,
5658                                                 &werr);
5659                 if (!NT_STATUS_IS_OK(status)) {
5660                         reply_nterror(req, status);
5661                         goto out;
5662                 }
5663                 if (!W_ERROR_IS_OK(werr)) {
5664                         reply_nterror(req, werror_to_ntstatus(werr));
5665                         goto out;
5666                 }
5667
5668                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5669                                                &handle,
5670                                                0, /* firstjob */
5671                                                0xff, /* numjobs */
5672                                                2, /* level */
5673                                                0, /* offered */
5674                                                &count,
5675                                                &info);
5676                 if (!W_ERROR_IS_OK(werr)) {
5677                         reply_nterror(req, werror_to_ntstatus(werr));
5678                         goto out;
5679                 }
5680
5681                 if (max_count > 0) {
5682                         first = start_index;
5683                 } else {
5684                         first = start_index + max_count + 1;
5685                 }
5686
5687                 if (first >= count) {
5688                         num_to_get = first;
5689                 } else {
5690                         num_to_get = first + MIN(ABS(max_count), count - first);
5691                 }
5692
5693                 for (i = first; i < num_to_get; i++) {
5694                         char blob[28];
5695                         char *p = blob;
5696                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5697                         int qstatus;
5698                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5699                                                         info[i].info2.job_id);
5700
5701                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5702                                 qstatus = 2;
5703                         } else {
5704                                 qstatus = 3;
5705                         }
5706
5707                         srv_put_dos_date2(p, 0, qtime);
5708                         SCVAL(p, 4, qstatus);
5709                         SSVAL(p, 5, qrapjobid);
5710                         SIVAL(p, 7, info[i].info2.size);
5711                         SCVAL(p, 11, 0);
5712                         srvstr_push(blob, req->flags2, p+12,
5713                                     info[i].info2.notify_name, 16, STR_ASCII);
5714
5715                         if (message_push_blob(
5716                                     &req->outbuf,
5717                                     data_blob_const(
5718                                             blob, sizeof(blob))) == -1) {
5719                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5720                                 goto out;
5721                         }
5722                 }
5723
5724                 if (count > 0) {
5725                         SSVAL(req->outbuf,smb_vwv0,count);
5726                         SSVAL(req->outbuf,smb_vwv1,
5727                               (max_count>0?first+count:first-1));
5728                         SCVAL(smb_buf(req->outbuf),0,1);
5729                         SSVAL(smb_buf(req->outbuf),1,28*count);
5730                 }
5731
5732
5733                 DEBUG(3, ("%u entries returned in queue\n",
5734                           (unsigned)count));
5735
5736 out:
5737                 if (b && is_valid_policy_hnd(&handle)) {
5738                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5739                 }
5740
5741         }
5742
5743         END_PROFILE(SMBsplretq);
5744         return;
5745 }
5746
5747 /****************************************************************************
5748  Reply to a printwrite.
5749 ****************************************************************************/
5750
5751 void reply_printwrite(struct smb_request *req)
5752 {
5753         connection_struct *conn = req->conn;
5754         int numtowrite;
5755         const char *data;
5756         files_struct *fsp;
5757
5758         START_PROFILE(SMBsplwr);
5759
5760         if (req->wct < 1) {
5761                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5762                 END_PROFILE(SMBsplwr);
5763                 return;
5764         }
5765
5766         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5767
5768         if (!check_fsp(conn, req, fsp)) {
5769                 END_PROFILE(SMBsplwr);
5770                 return;
5771         }
5772
5773         if (!fsp->print_file) {
5774                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5775                 END_PROFILE(SMBsplwr);
5776                 return;
5777         }
5778
5779         if (!CHECK_WRITE(fsp)) {
5780                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5781                 END_PROFILE(SMBsplwr);
5782                 return;
5783         }
5784
5785         numtowrite = SVAL(req->buf, 1);
5786
5787         if (req->buflen < numtowrite + 3) {
5788                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5789                 END_PROFILE(SMBsplwr);
5790                 return;
5791         }
5792
5793         data = (const char *)req->buf + 3;
5794
5795         if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5796                 reply_nterror(req, map_nt_error_from_unix(errno));
5797                 END_PROFILE(SMBsplwr);
5798                 return;
5799         }
5800
5801         DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5802
5803         END_PROFILE(SMBsplwr);
5804         return;
5805 }
5806
5807 /****************************************************************************
5808  Reply to a mkdir.
5809 ****************************************************************************/
5810
5811 void reply_mkdir(struct smb_request *req)
5812 {
5813         connection_struct *conn = req->conn;
5814         struct smb_filename *smb_dname = NULL;
5815         char *directory = NULL;
5816         NTSTATUS status;
5817         TALLOC_CTX *ctx = talloc_tos();
5818
5819         START_PROFILE(SMBmkdir);
5820
5821         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5822                             STR_TERMINATE, &status);
5823         if (!NT_STATUS_IS_OK(status)) {
5824                 reply_nterror(req, status);
5825                 goto out;
5826         }
5827
5828         status = filename_convert(ctx, conn,
5829                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5830                                  directory,
5831                                  0,
5832                                  NULL,
5833                                  &smb_dname);
5834         if (!NT_STATUS_IS_OK(status)) {
5835                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5836                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5837                                         ERRSRV, ERRbadpath);
5838                         goto out;
5839                 }
5840                 reply_nterror(req, status);
5841                 goto out;
5842         }
5843
5844         status = create_directory(conn, req, smb_dname);
5845
5846         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5847
5848         if (!NT_STATUS_IS_OK(status)) {
5849
5850                 if (!use_nt_status()
5851                     && NT_STATUS_EQUAL(status,
5852                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5853                         /*
5854                          * Yes, in the DOS error code case we get a
5855                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5856                          * samba4 torture test.
5857                          */
5858                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5859                 }
5860
5861                 reply_nterror(req, status);
5862                 goto out;
5863         }
5864
5865         reply_outbuf(req, 0, 0);
5866
5867         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5868  out:
5869         TALLOC_FREE(smb_dname);
5870         END_PROFILE(SMBmkdir);
5871         return;
5872 }
5873
5874 /****************************************************************************
5875  Reply to a rmdir.
5876 ****************************************************************************/
5877
5878 void reply_rmdir(struct smb_request *req)
5879 {
5880         connection_struct *conn = req->conn;
5881         struct smb_filename *smb_dname = NULL;
5882         char *directory = NULL;
5883         NTSTATUS status;
5884         TALLOC_CTX *ctx = talloc_tos();
5885         files_struct *fsp = NULL;
5886         int info = 0;
5887         struct smbd_server_connection *sconn = req->sconn;
5888
5889         START_PROFILE(SMBrmdir);
5890
5891         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5892                             STR_TERMINATE, &status);
5893         if (!NT_STATUS_IS_OK(status)) {
5894                 reply_nterror(req, status);
5895                 goto out;
5896         }
5897
5898         status = filename_convert(ctx, conn,
5899                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5900                                  directory,
5901                                  0,
5902                                  NULL,
5903                                  &smb_dname);
5904         if (!NT_STATUS_IS_OK(status)) {
5905                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5906                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5907                                         ERRSRV, ERRbadpath);
5908                         goto out;
5909                 }
5910                 reply_nterror(req, status);
5911                 goto out;
5912         }
5913
5914         if (is_ntfs_stream_smb_fname(smb_dname)) {
5915                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5916                 goto out;
5917         }
5918
5919         status = SMB_VFS_CREATE_FILE(
5920                 conn,                                   /* conn */
5921                 req,                                    /* req */
5922                 0,                                      /* root_dir_fid */
5923                 smb_dname,                              /* fname */
5924                 DELETE_ACCESS,                          /* access_mask */
5925                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5926                         FILE_SHARE_DELETE),
5927                 FILE_OPEN,                              /* create_disposition*/
5928                 FILE_DIRECTORY_FILE,                    /* create_options */
5929                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5930                 0,                                      /* oplock_request */
5931                 0,                                      /* allocation_size */
5932                 0,                                      /* private_flags */
5933                 NULL,                                   /* sd */
5934                 NULL,                                   /* ea_list */
5935                 &fsp,                                   /* result */
5936                 &info);                                 /* pinfo */
5937
5938         if (!NT_STATUS_IS_OK(status)) {
5939                 if (open_was_deferred(req->sconn, req->mid)) {
5940                         /* We have re-scheduled this call. */
5941                         goto out;
5942                 }
5943                 reply_nterror(req, status);
5944                 goto out;
5945         }
5946
5947         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5948         if (!NT_STATUS_IS_OK(status)) {
5949                 close_file(req, fsp, ERROR_CLOSE);
5950                 reply_nterror(req, status);
5951                 goto out;
5952         }
5953
5954         if (!set_delete_on_close(fsp, true,
5955                         conn->session_info->security_token,
5956                         conn->session_info->unix_token)) {
5957                 close_file(req, fsp, ERROR_CLOSE);
5958                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5959                 goto out;
5960         }
5961
5962         status = close_file(req, fsp, NORMAL_CLOSE);
5963         if (!NT_STATUS_IS_OK(status)) {
5964                 reply_nterror(req, status);
5965         } else {
5966                 reply_outbuf(req, 0, 0);
5967         }
5968
5969         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5970
5971         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5972  out:
5973         TALLOC_FREE(smb_dname);
5974         END_PROFILE(SMBrmdir);
5975         return;
5976 }
5977
5978 /*******************************************************************
5979  Resolve wildcards in a filename rename.
5980 ********************************************************************/
5981
5982 static bool resolve_wildcards(TALLOC_CTX *ctx,
5983                                 const char *name1,
5984                                 const char *name2,
5985                                 char **pp_newname)
5986 {
5987         char *name2_copy = NULL;
5988         char *root1 = NULL;
5989         char *root2 = NULL;
5990         char *ext1 = NULL;
5991         char *ext2 = NULL;
5992         char *p,*p2, *pname1, *pname2;
5993
5994         name2_copy = talloc_strdup(ctx, name2);
5995         if (!name2_copy) {
5996                 return False;
5997         }
5998
5999         pname1 = strrchr_m(name1,'/');
6000         pname2 = strrchr_m(name2_copy,'/');
6001
6002         if (!pname1 || !pname2) {
6003                 return False;
6004         }
6005
6006         /* Truncate the copy of name2 at the last '/' */
6007         *pname2 = '\0';
6008
6009         /* Now go past the '/' */
6010         pname1++;
6011         pname2++;
6012
6013         root1 = talloc_strdup(ctx, pname1);
6014         root2 = talloc_strdup(ctx, pname2);
6015
6016         if (!root1 || !root2) {
6017                 return False;
6018         }
6019
6020         p = strrchr_m(root1,'.');
6021         if (p) {
6022                 *p = 0;
6023                 ext1 = talloc_strdup(ctx, p+1);
6024         } else {
6025                 ext1 = talloc_strdup(ctx, "");
6026         }
6027         p = strrchr_m(root2,'.');
6028         if (p) {
6029                 *p = 0;
6030                 ext2 = talloc_strdup(ctx, p+1);
6031         } else {
6032                 ext2 = talloc_strdup(ctx, "");
6033         }
6034
6035         if (!ext1 || !ext2) {
6036                 return False;
6037         }
6038
6039         p = root1;
6040         p2 = root2;
6041         while (*p2) {
6042                 if (*p2 == '?') {
6043                         /* Hmmm. Should this be mb-aware ? */
6044                         *p2 = *p;
6045                         p2++;
6046                 } else if (*p2 == '*') {
6047                         *p2 = '\0';
6048                         root2 = talloc_asprintf(ctx, "%s%s",
6049                                                 root2,
6050                                                 p);
6051                         if (!root2) {
6052                                 return False;
6053                         }
6054                         break;
6055                 } else {
6056                         p2++;
6057                 }
6058                 if (*p) {
6059                         p++;
6060                 }
6061         }
6062
6063         p = ext1;
6064         p2 = ext2;
6065         while (*p2) {
6066                 if (*p2 == '?') {
6067                         /* Hmmm. Should this be mb-aware ? */
6068                         *p2 = *p;
6069                         p2++;
6070                 } else if (*p2 == '*') {
6071                         *p2 = '\0';
6072                         ext2 = talloc_asprintf(ctx, "%s%s",
6073                                                 ext2,
6074                                                 p);
6075                         if (!ext2) {
6076                                 return False;
6077                         }
6078                         break;
6079                 } else {
6080                         p2++;
6081                 }
6082                 if (*p) {
6083                         p++;
6084                 }
6085         }
6086
6087         if (*ext2) {
6088                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6089                                 name2_copy,
6090                                 root2,
6091                                 ext2);
6092         } else {
6093                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6094                                 name2_copy,
6095                                 root2);
6096         }
6097
6098         if (!*pp_newname) {
6099                 return False;
6100         }
6101
6102         return True;
6103 }
6104
6105 /****************************************************************************
6106  Ensure open files have their names updated. Updated to notify other smbd's
6107  asynchronously.
6108 ****************************************************************************/
6109
6110 static void rename_open_files(connection_struct *conn,
6111                               struct share_mode_lock *lck,
6112                               uint32_t orig_name_hash,
6113                               const struct smb_filename *smb_fname_dst)
6114 {
6115         files_struct *fsp;
6116         bool did_rename = False;
6117         NTSTATUS status;
6118         uint32_t new_name_hash = 0;
6119
6120         for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
6121             fsp = file_find_di_next(fsp)) {
6122                 /* fsp_name is a relative path under the fsp. To change this for other
6123                    sharepaths we need to manipulate relative paths. */
6124                 /* TODO - create the absolute path and manipulate the newname
6125                    relative to the sharepath. */
6126                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6127                         continue;
6128                 }
6129                 if (fsp->name_hash != orig_name_hash) {
6130                         continue;
6131                 }
6132                 DEBUG(10, ("rename_open_files: renaming file %s "
6133                            "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6134                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6135                            smb_fname_str_dbg(smb_fname_dst)));
6136
6137                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6138                 if (NT_STATUS_IS_OK(status)) {
6139                         did_rename = True;
6140                         new_name_hash = fsp->name_hash;
6141                 }
6142         }
6143
6144         if (!did_rename) {
6145                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6146                            "for %s\n", file_id_string_tos(&lck->data->id),
6147                            smb_fname_str_dbg(smb_fname_dst)));
6148         }
6149
6150         /* Send messages to all smbd's (not ourself) that the name has changed. */
6151         rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
6152                               orig_name_hash, new_name_hash,
6153                               smb_fname_dst);
6154
6155 }
6156
6157 /****************************************************************************
6158  We need to check if the source path is a parent directory of the destination
6159  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6160  refuse the rename with a sharing violation. Under UNIX the above call can
6161  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6162  probably need to check that the client is a Windows one before disallowing
6163  this as a UNIX client (one with UNIX extensions) can know the source is a
6164  symlink and make this decision intelligently. Found by an excellent bug
6165  report from <AndyLiebman@aol.com>.
6166 ****************************************************************************/
6167
6168 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6169                                      const struct smb_filename *smb_fname_dst)
6170 {
6171         const char *psrc = smb_fname_src->base_name;
6172         const char *pdst = smb_fname_dst->base_name;
6173         size_t slen;
6174
6175         if (psrc[0] == '.' && psrc[1] == '/') {
6176                 psrc += 2;
6177         }
6178         if (pdst[0] == '.' && pdst[1] == '/') {
6179                 pdst += 2;
6180         }
6181         if ((slen = strlen(psrc)) > strlen(pdst)) {
6182                 return False;
6183         }
6184         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6185 }
6186
6187 /*
6188  * Do the notify calls from a rename
6189  */
6190
6191 static void notify_rename(connection_struct *conn, bool is_dir,
6192                           const struct smb_filename *smb_fname_src,
6193                           const struct smb_filename *smb_fname_dst)
6194 {
6195         char *parent_dir_src = NULL;
6196         char *parent_dir_dst = NULL;
6197         uint32 mask;
6198
6199         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6200                 : FILE_NOTIFY_CHANGE_FILE_NAME;
6201
6202         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6203                             &parent_dir_src, NULL) ||
6204             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6205                             &parent_dir_dst, NULL)) {
6206                 goto out;
6207         }
6208
6209         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6210                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6211                              smb_fname_src->base_name);
6212                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6213                              smb_fname_dst->base_name);
6214         }
6215         else {
6216                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6217                              smb_fname_src->base_name);
6218                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6219                              smb_fname_dst->base_name);
6220         }
6221
6222         /* this is a strange one. w2k3 gives an additional event for
6223            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6224            files, but not directories */
6225         if (!is_dir) {
6226                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6227                              FILE_NOTIFY_CHANGE_ATTRIBUTES
6228                              |FILE_NOTIFY_CHANGE_CREATION,
6229                              smb_fname_dst->base_name);
6230         }
6231  out:
6232         TALLOC_FREE(parent_dir_src);
6233         TALLOC_FREE(parent_dir_dst);
6234 }
6235
6236 /****************************************************************************
6237  Returns an error if the parent directory for a filename is open in an
6238  incompatible way.
6239 ****************************************************************************/
6240
6241 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6242                                         const struct smb_filename *smb_fname_dst_in)
6243 {
6244         char *parent_dir = NULL;
6245         struct smb_filename smb_fname_parent;
6246         struct file_id id;
6247         files_struct *fsp = NULL;
6248         int ret;
6249
6250         if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6251                         &parent_dir, NULL)) {
6252                 return NT_STATUS_NO_MEMORY;
6253         }
6254         ZERO_STRUCT(smb_fname_parent);
6255         smb_fname_parent.base_name = parent_dir;
6256
6257         ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6258         if (ret == -1) {
6259                 return map_nt_error_from_unix(errno);
6260         }
6261
6262         /*
6263          * We're only checking on this smbd here, mostly good
6264          * enough.. and will pass tests.
6265          */
6266
6267         id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6268         for (fsp = file_find_di_first(conn->sconn, id); fsp;
6269                         fsp = file_find_di_next(fsp)) {
6270                 if (fsp->access_mask & DELETE_ACCESS) {
6271                         return NT_STATUS_SHARING_VIOLATION;
6272                 }
6273         }
6274         return NT_STATUS_OK;
6275 }
6276
6277 /****************************************************************************
6278  Rename an open file - given an fsp.
6279 ****************************************************************************/
6280
6281 NTSTATUS rename_internals_fsp(connection_struct *conn,
6282                         files_struct *fsp,
6283                         const struct smb_filename *smb_fname_dst_in,
6284                         uint32 attrs,
6285                         bool replace_if_exists)
6286 {
6287         TALLOC_CTX *ctx = talloc_tos();
6288         struct smb_filename *smb_fname_dst = NULL;
6289         NTSTATUS status = NT_STATUS_OK;
6290         struct share_mode_lock *lck = NULL;
6291         bool dst_exists, old_is_stream, new_is_stream;
6292
6293         status = check_name(conn, smb_fname_dst_in->base_name);
6294         if (!NT_STATUS_IS_OK(status)) {
6295                 return status;
6296         }
6297
6298         status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6299         if (!NT_STATUS_IS_OK(status)) {
6300                 return status;
6301         }
6302
6303         /* Make a copy of the dst smb_fname structs */
6304
6305         smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6306         if (smb_fname_dst == NULL) {
6307                 status = NT_STATUS_NO_MEMORY;
6308                 goto out;
6309         }
6310
6311         /*
6312          * Check for special case with case preserving and not
6313          * case sensitive. If the old last component differs from the original
6314          * last component only by case, then we should allow
6315          * the rename (user is trying to change the case of the
6316          * filename).
6317          */
6318         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6319             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6320             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6321                 char *last_slash;
6322                 char *fname_dst_lcomp_base_mod = NULL;
6323                 struct smb_filename *smb_fname_orig_lcomp = NULL;
6324
6325                 /*
6326                  * Get the last component of the destination name.
6327                  */
6328                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6329                 if (last_slash) {
6330                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6331                 } else {
6332                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6333                 }
6334                 if (!fname_dst_lcomp_base_mod) {
6335                         status = NT_STATUS_NO_MEMORY;
6336                         goto out;
6337                 }
6338
6339                 /*
6340                  * Create an smb_filename struct using the original last
6341                  * component of the destination.
6342                  */
6343                 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6344                         ctx, smb_fname_dst->original_lcomp, NULL);
6345                 if (smb_fname_orig_lcomp == NULL) {
6346                         status = NT_STATUS_NO_MEMORY;
6347                         TALLOC_FREE(fname_dst_lcomp_base_mod);
6348                         goto out;
6349                 }
6350
6351                 /* If the base names only differ by case, use original. */
6352                 if(!strcsequal(fname_dst_lcomp_base_mod,
6353                                smb_fname_orig_lcomp->base_name)) {
6354                         char *tmp;
6355                         /*
6356                          * Replace the modified last component with the
6357                          * original.
6358                          */
6359                         if (last_slash) {
6360                                 *last_slash = '\0'; /* Truncate at the '/' */
6361                                 tmp = talloc_asprintf(smb_fname_dst,
6362                                         "%s/%s",
6363                                         smb_fname_dst->base_name,
6364                                         smb_fname_orig_lcomp->base_name);
6365                         } else {
6366                                 tmp = talloc_asprintf(smb_fname_dst,
6367                                         "%s",
6368                                         smb_fname_orig_lcomp->base_name);
6369                         }
6370                         if (tmp == NULL) {
6371                                 status = NT_STATUS_NO_MEMORY;
6372                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6373                                 TALLOC_FREE(smb_fname_orig_lcomp);
6374                                 goto out;
6375                         }
6376                         TALLOC_FREE(smb_fname_dst->base_name);
6377                         smb_fname_dst->base_name = tmp;
6378                 }
6379
6380                 /* If the stream_names only differ by case, use original. */
6381                 if(!strcsequal(smb_fname_dst->stream_name,
6382                                smb_fname_orig_lcomp->stream_name)) {
6383                         char *tmp = NULL;
6384                         /* Use the original stream. */
6385                         tmp = talloc_strdup(smb_fname_dst,
6386                                             smb_fname_orig_lcomp->stream_name);
6387                         if (tmp == NULL) {
6388                                 status = NT_STATUS_NO_MEMORY;
6389                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6390                                 TALLOC_FREE(smb_fname_orig_lcomp);
6391                                 goto out;
6392                         }
6393                         TALLOC_FREE(smb_fname_dst->stream_name);
6394                         smb_fname_dst->stream_name = tmp;
6395                 }
6396                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6397                 TALLOC_FREE(smb_fname_orig_lcomp);
6398         }
6399
6400         /*
6401          * If the src and dest names are identical - including case,
6402          * don't do the rename, just return success.
6403          */
6404
6405         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6406             strcsequal(fsp->fsp_name->stream_name,
6407                        smb_fname_dst->stream_name)) {
6408                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6409                           "- returning success\n",
6410                           smb_fname_str_dbg(smb_fname_dst)));
6411                 status = NT_STATUS_OK;
6412                 goto out;
6413         }
6414
6415         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6416         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6417
6418         /* Return the correct error code if both names aren't streams. */
6419         if (!old_is_stream && new_is_stream) {
6420                 status = NT_STATUS_OBJECT_NAME_INVALID;
6421                 goto out;
6422         }
6423
6424         if (old_is_stream && !new_is_stream) {
6425                 status = NT_STATUS_INVALID_PARAMETER;
6426                 goto out;
6427         }
6428
6429         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6430
6431         if(!replace_if_exists && dst_exists) {
6432                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6433                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6434                           smb_fname_str_dbg(smb_fname_dst)));
6435                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6436                 goto out;
6437         }
6438
6439         if (dst_exists) {
6440                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6441                     &smb_fname_dst->st);
6442                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6443                                                            fileid);
6444                 /* The file can be open when renaming a stream */
6445                 if (dst_fsp && !new_is_stream) {
6446                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6447                         status = NT_STATUS_ACCESS_DENIED;
6448                         goto out;
6449                 }
6450         }
6451
6452         /* Ensure we have a valid stat struct for the source. */
6453         status = vfs_stat_fsp(fsp);
6454         if (!NT_STATUS_IS_OK(status)) {
6455                 goto out;
6456         }
6457
6458         status = can_rename(conn, fsp, attrs);
6459
6460         if (!NT_STATUS_IS_OK(status)) {
6461                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6462                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6463                           smb_fname_str_dbg(smb_fname_dst)));
6464                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6465                         status = NT_STATUS_ACCESS_DENIED;
6466                 goto out;
6467         }
6468
6469         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6470                 status = NT_STATUS_ACCESS_DENIED;
6471         }
6472
6473         lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6474
6475         /*
6476          * We have the file open ourselves, so not being able to get the
6477          * corresponding share mode lock is a fatal error.
6478          */
6479
6480         SMB_ASSERT(lck != NULL);
6481
6482         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6483                 uint32 create_options = fsp->fh->private_options;
6484
6485                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6486                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6487                           smb_fname_str_dbg(smb_fname_dst)));
6488
6489                 if (!fsp->is_directory &&
6490                     !lp_posix_pathnames() &&
6491                     (lp_map_archive(SNUM(conn)) ||
6492                     lp_store_dos_attributes(SNUM(conn)))) {
6493                         /* We must set the archive bit on the newly
6494                            renamed file. */
6495                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6496                                 uint32_t old_dosmode = dos_mode(conn,
6497                                                         smb_fname_dst);
6498                                 file_set_dosmode(conn,
6499                                         smb_fname_dst,
6500                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6501                                         NULL,
6502                                         true);
6503                         }
6504                 }
6505
6506                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6507                               smb_fname_dst);
6508
6509                 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6510
6511                 /*
6512                  * A rename acts as a new file create w.r.t. allowing an initial delete
6513                  * on close, probably because in Windows there is a new handle to the
6514                  * new file. If initial delete on close was requested but not
6515                  * originally set, we need to set it here. This is probably not 100% correct,
6516                  * but will work for the CIFSFS client which in non-posix mode
6517                  * depends on these semantics. JRA.
6518                  */
6519
6520                 if (create_options & FILE_DELETE_ON_CLOSE) {
6521                         status = can_set_delete_on_close(fsp, 0);
6522
6523                         if (NT_STATUS_IS_OK(status)) {
6524                                 /* Note that here we set the *inital* delete on close flag,
6525                                  * not the regular one. The magic gets handled in close. */
6526                                 fsp->initial_delete_on_close = True;
6527                         }
6528                 }
6529                 TALLOC_FREE(lck);
6530                 status = NT_STATUS_OK;
6531                 goto out;
6532         }
6533
6534         TALLOC_FREE(lck);
6535
6536         if (errno == ENOTDIR || errno == EISDIR) {
6537                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6538         } else {
6539                 status = map_nt_error_from_unix(errno);
6540         }
6541
6542         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6543                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6544                   smb_fname_str_dbg(smb_fname_dst)));
6545
6546  out:
6547         TALLOC_FREE(smb_fname_dst);
6548
6549         return status;
6550 }
6551
6552 /****************************************************************************
6553  The guts of the rename command, split out so it may be called by the NT SMB
6554  code.
6555 ****************************************************************************/
6556
6557 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6558                         connection_struct *conn,
6559                         struct smb_request *req,
6560                         struct smb_filename *smb_fname_src,
6561                         struct smb_filename *smb_fname_dst,
6562                         uint32 attrs,
6563                         bool replace_if_exists,
6564                         bool src_has_wild,
6565                         bool dest_has_wild,
6566                         uint32_t access_mask)
6567 {
6568         char *fname_src_dir = NULL;
6569         char *fname_src_mask = NULL;
6570         int count=0;
6571         NTSTATUS status = NT_STATUS_OK;
6572         struct smb_Dir *dir_hnd = NULL;
6573         const char *dname = NULL;
6574         char *talloced = NULL;
6575         long offset = 0;
6576         int create_options = 0;
6577         bool posix_pathnames = lp_posix_pathnames();
6578         int rc;
6579
6580         /*
6581          * Split the old name into directory and last component
6582          * strings. Note that unix_convert may have stripped off a
6583          * leading ./ from both name and newname if the rename is
6584          * at the root of the share. We need to make sure either both
6585          * name and newname contain a / character or neither of them do
6586          * as this is checked in resolve_wildcards().
6587          */
6588
6589         /* Split up the directory from the filename/mask. */
6590         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6591                                       &fname_src_dir, &fname_src_mask);
6592         if (!NT_STATUS_IS_OK(status)) {
6593                 status = NT_STATUS_NO_MEMORY;
6594                 goto out;
6595         }
6596
6597         /*
6598          * We should only check the mangled cache
6599          * here if unix_convert failed. This means
6600          * that the path in 'mask' doesn't exist
6601          * on the file system and so we need to look
6602          * for a possible mangle. This patch from
6603          * Tine Smukavec <valentin.smukavec@hermes.si>.
6604          */
6605
6606         if (!VALID_STAT(smb_fname_src->st) &&
6607             mangle_is_mangled(fname_src_mask, conn->params)) {
6608                 char *new_mask = NULL;
6609                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6610                                             conn->params);
6611                 if (new_mask) {
6612                         TALLOC_FREE(fname_src_mask);
6613                         fname_src_mask = new_mask;
6614                 }
6615         }
6616
6617         if (!src_has_wild) {
6618                 files_struct *fsp;
6619
6620                 /*
6621                  * Only one file needs to be renamed. Append the mask back
6622                  * onto the directory.
6623                  */
6624                 TALLOC_FREE(smb_fname_src->base_name);
6625                 if (ISDOT(fname_src_dir)) {
6626                         /* Ensure we use canonical names on open. */
6627                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6628                                                         "%s",
6629                                                         fname_src_mask);
6630                 } else {
6631                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6632                                                         "%s/%s",
6633                                                         fname_src_dir,
6634                                                         fname_src_mask);
6635                 }
6636                 if (!smb_fname_src->base_name) {
6637                         status = NT_STATUS_NO_MEMORY;
6638                         goto out;
6639                 }
6640
6641                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6642                           "case_preserve = %d, short case preserve = %d, "
6643                           "directory = %s, newname = %s, "
6644                           "last_component_dest = %s\n",
6645                           conn->case_sensitive, conn->case_preserve,
6646                           conn->short_case_preserve,
6647                           smb_fname_str_dbg(smb_fname_src),
6648                           smb_fname_str_dbg(smb_fname_dst),
6649                           smb_fname_dst->original_lcomp));
6650
6651                 /* The dest name still may have wildcards. */
6652                 if (dest_has_wild) {
6653                         char *fname_dst_mod = NULL;
6654                         if (!resolve_wildcards(smb_fname_dst,
6655                                                smb_fname_src->base_name,
6656                                                smb_fname_dst->base_name,
6657                                                &fname_dst_mod)) {
6658                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6659                                           "%s %s failed\n",
6660                                           smb_fname_src->base_name,
6661                                           smb_fname_dst->base_name));
6662                                 status = NT_STATUS_NO_MEMORY;
6663                                 goto out;
6664                         }
6665                         TALLOC_FREE(smb_fname_dst->base_name);
6666                         smb_fname_dst->base_name = fname_dst_mod;
6667                 }
6668
6669                 ZERO_STRUCT(smb_fname_src->st);
6670                 if (posix_pathnames) {
6671                         rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6672                 } else {
6673                         rc = SMB_VFS_STAT(conn, smb_fname_src);
6674                 }
6675                 if (rc == -1) {
6676                         status = map_nt_error_from_unix_common(errno);
6677                         goto out;
6678                 }
6679
6680                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6681                         create_options |= FILE_DIRECTORY_FILE;
6682                 }
6683
6684                 status = SMB_VFS_CREATE_FILE(
6685                         conn,                           /* conn */
6686                         req,                            /* req */
6687                         0,                              /* root_dir_fid */
6688                         smb_fname_src,                  /* fname */
6689                         access_mask,                    /* access_mask */
6690                         (FILE_SHARE_READ |              /* share_access */
6691                             FILE_SHARE_WRITE),
6692                         FILE_OPEN,                      /* create_disposition*/
6693                         create_options,                 /* create_options */
6694                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6695                         0,                              /* oplock_request */
6696                         0,                              /* allocation_size */
6697                         0,                              /* private_flags */
6698                         NULL,                           /* sd */
6699                         NULL,                           /* ea_list */
6700                         &fsp,                           /* result */
6701                         NULL);                          /* pinfo */
6702
6703                 if (!NT_STATUS_IS_OK(status)) {
6704                         DEBUG(3, ("Could not open rename source %s: %s\n",
6705                                   smb_fname_str_dbg(smb_fname_src),
6706                                   nt_errstr(status)));
6707                         goto out;
6708                 }
6709
6710                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6711                                               attrs, replace_if_exists);
6712
6713                 close_file(req, fsp, NORMAL_CLOSE);
6714
6715                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6716                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6717                           smb_fname_str_dbg(smb_fname_dst)));
6718
6719                 goto out;
6720         }
6721
6722         /*
6723          * Wildcards - process each file that matches.
6724          */
6725         if (strequal(fname_src_mask, "????????.???")) {
6726                 TALLOC_FREE(fname_src_mask);
6727                 fname_src_mask = talloc_strdup(ctx, "*");
6728                 if (!fname_src_mask) {
6729                         status = NT_STATUS_NO_MEMORY;
6730                         goto out;
6731                 }
6732         }
6733
6734         status = check_name(conn, fname_src_dir);
6735         if (!NT_STATUS_IS_OK(status)) {
6736                 goto out;
6737         }
6738
6739         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6740                           attrs);
6741         if (dir_hnd == NULL) {
6742                 status = map_nt_error_from_unix(errno);
6743                 goto out;
6744         }
6745
6746         status = NT_STATUS_NO_SUCH_FILE;
6747         /*
6748          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6749          * - gentest fix. JRA
6750          */
6751
6752         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6753                                     &talloced))) {
6754                 files_struct *fsp = NULL;
6755                 char *destname = NULL;
6756                 bool sysdir_entry = False;
6757
6758                 /* Quick check for "." and ".." */
6759                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6760                         if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6761                                 sysdir_entry = True;
6762                         } else {
6763                                 TALLOC_FREE(talloced);
6764                                 continue;
6765                         }
6766                 }
6767
6768                 if (!is_visible_file(conn, fname_src_dir, dname,
6769                                      &smb_fname_src->st, false)) {
6770                         TALLOC_FREE(talloced);
6771                         continue;
6772                 }
6773
6774                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6775                         TALLOC_FREE(talloced);
6776                         continue;
6777                 }
6778
6779                 if (sysdir_entry) {
6780                         status = NT_STATUS_OBJECT_NAME_INVALID;
6781                         break;
6782                 }
6783
6784                 TALLOC_FREE(smb_fname_src->base_name);
6785                 if (ISDOT(fname_src_dir)) {
6786                         /* Ensure we use canonical names on open. */
6787                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6788                                                         "%s",
6789                                                         dname);
6790                 } else {
6791                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6792                                                         "%s/%s",
6793                                                         fname_src_dir,
6794                                                         dname);
6795                 }
6796                 if (!smb_fname_src->base_name) {
6797                         status = NT_STATUS_NO_MEMORY;
6798                         goto out;
6799                 }
6800
6801                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6802                                        smb_fname_dst->base_name,
6803                                        &destname)) {
6804                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6805                                   smb_fname_src->base_name, destname));
6806                         TALLOC_FREE(talloced);
6807                         continue;
6808                 }
6809                 if (!destname) {
6810                         status = NT_STATUS_NO_MEMORY;
6811                         goto out;
6812                 }
6813
6814                 TALLOC_FREE(smb_fname_dst->base_name);
6815                 smb_fname_dst->base_name = destname;
6816
6817                 ZERO_STRUCT(smb_fname_src->st);
6818                 if (posix_pathnames) {
6819                         SMB_VFS_LSTAT(conn, smb_fname_src);
6820                 } else {
6821                         SMB_VFS_STAT(conn, smb_fname_src);
6822                 }
6823
6824                 create_options = 0;
6825
6826                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6827                         create_options |= FILE_DIRECTORY_FILE;
6828                 }
6829
6830                 status = SMB_VFS_CREATE_FILE(
6831                         conn,                           /* conn */
6832                         req,                            /* req */
6833                         0,                              /* root_dir_fid */
6834                         smb_fname_src,                  /* fname */
6835                         access_mask,                    /* access_mask */
6836                         (FILE_SHARE_READ |              /* share_access */
6837                             FILE_SHARE_WRITE),
6838                         FILE_OPEN,                      /* create_disposition*/
6839                         create_options,                 /* create_options */
6840                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6841                         0,                              /* oplock_request */
6842                         0,                              /* allocation_size */
6843                         0,                              /* private_flags */
6844                         NULL,                           /* sd */
6845                         NULL,                           /* ea_list */
6846                         &fsp,                           /* result */
6847                         NULL);                          /* pinfo */
6848
6849                 if (!NT_STATUS_IS_OK(status)) {
6850                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6851                                  "returned %s rename %s -> %s\n",
6852                                  nt_errstr(status),
6853                                  smb_fname_str_dbg(smb_fname_src),
6854                                  smb_fname_str_dbg(smb_fname_dst)));
6855                         break;
6856                 }
6857
6858                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6859                                                               dname);
6860                 if (!smb_fname_dst->original_lcomp) {
6861                         status = NT_STATUS_NO_MEMORY;
6862                         goto out;
6863                 }
6864
6865                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6866                                               attrs, replace_if_exists);
6867
6868                 close_file(req, fsp, NORMAL_CLOSE);
6869
6870                 if (!NT_STATUS_IS_OK(status)) {
6871                         DEBUG(3, ("rename_internals_fsp returned %s for "
6872                                   "rename %s -> %s\n", nt_errstr(status),
6873                                   smb_fname_str_dbg(smb_fname_src),
6874                                   smb_fname_str_dbg(smb_fname_dst)));
6875                         break;
6876                 }
6877
6878                 count++;
6879
6880                 DEBUG(3,("rename_internals: doing rename on %s -> "
6881                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6882                          smb_fname_str_dbg(smb_fname_src)));
6883                 TALLOC_FREE(talloced);
6884         }
6885         TALLOC_FREE(dir_hnd);
6886
6887         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6888                 status = map_nt_error_from_unix(errno);
6889         }
6890
6891  out:
6892         TALLOC_FREE(talloced);
6893         TALLOC_FREE(fname_src_dir);
6894         TALLOC_FREE(fname_src_mask);
6895         return status;
6896 }
6897
6898 /****************************************************************************
6899  Reply to a mv.
6900 ****************************************************************************/
6901
6902 void reply_mv(struct smb_request *req)
6903 {
6904         connection_struct *conn = req->conn;
6905         char *name = NULL;
6906         char *newname = NULL;
6907         const char *p;
6908         uint32 attrs;
6909         NTSTATUS status;
6910         bool src_has_wcard = False;
6911         bool dest_has_wcard = False;
6912         TALLOC_CTX *ctx = talloc_tos();
6913         struct smb_filename *smb_fname_src = NULL;
6914         struct smb_filename *smb_fname_dst = NULL;
6915         uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6916         uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6917         bool stream_rename = false;
6918
6919         START_PROFILE(SMBmv);
6920
6921         if (req->wct < 1) {
6922                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6923                 goto out;
6924         }
6925
6926         attrs = SVAL(req->vwv+0, 0);
6927
6928         p = (const char *)req->buf + 1;
6929         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6930                                        &status, &src_has_wcard);
6931         if (!NT_STATUS_IS_OK(status)) {
6932                 reply_nterror(req, status);
6933                 goto out;
6934         }
6935         p++;
6936         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6937                                        &status, &dest_has_wcard);
6938         if (!NT_STATUS_IS_OK(status)) {
6939                 reply_nterror(req, status);
6940                 goto out;
6941         }
6942
6943         if (!lp_posix_pathnames()) {
6944                 /* The newname must begin with a ':' if the
6945                    name contains a ':'. */
6946                 if (strchr_m(name, ':')) {
6947                         if (newname[0] != ':') {
6948                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6949                                 goto out;
6950                         }
6951                         stream_rename = true;
6952                 }
6953         }
6954
6955         status = filename_convert(ctx,
6956                                   conn,
6957                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6958                                   name,
6959                                   src_ucf_flags,
6960                                   &src_has_wcard,
6961                                   &smb_fname_src);
6962
6963         if (!NT_STATUS_IS_OK(status)) {
6964                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6965                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6966                                         ERRSRV, ERRbadpath);
6967                         goto out;
6968                 }
6969                 reply_nterror(req, status);
6970                 goto out;
6971         }
6972
6973         status = filename_convert(ctx,
6974                                   conn,
6975                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6976                                   newname,
6977                                   dst_ucf_flags,
6978                                   &dest_has_wcard,
6979                                   &smb_fname_dst);
6980
6981         if (!NT_STATUS_IS_OK(status)) {
6982                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6983                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6984                                         ERRSRV, ERRbadpath);
6985                         goto out;
6986                 }
6987                 reply_nterror(req, status);
6988                 goto out;
6989         }
6990
6991         if (stream_rename) {
6992                 /* smb_fname_dst->base_name must be the same as
6993                    smb_fname_src->base_name. */
6994                 TALLOC_FREE(smb_fname_dst->base_name);
6995                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6996                                                 smb_fname_src->base_name);
6997                 if (!smb_fname_dst->base_name) {
6998                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6999                         goto out;
7000                 }
7001         }
7002
7003         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7004                  smb_fname_str_dbg(smb_fname_dst)));
7005
7006         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7007                                   attrs, False, src_has_wcard, dest_has_wcard,
7008                                   DELETE_ACCESS);
7009         if (!NT_STATUS_IS_OK(status)) {
7010                 if (open_was_deferred(req->sconn, req->mid)) {
7011                         /* We have re-scheduled this call. */
7012                         goto out;
7013                 }
7014                 reply_nterror(req, status);
7015                 goto out;
7016         }
7017
7018         reply_outbuf(req, 0, 0);
7019  out:
7020         TALLOC_FREE(smb_fname_src);
7021         TALLOC_FREE(smb_fname_dst);
7022         END_PROFILE(SMBmv);
7023         return;
7024 }
7025
7026 /*******************************************************************
7027  Copy a file as part of a reply_copy.
7028 ******************************************************************/
7029
7030 /*
7031  * TODO: check error codes on all callers
7032  */
7033
7034 NTSTATUS copy_file(TALLOC_CTX *ctx,
7035                         connection_struct *conn,
7036                         struct smb_filename *smb_fname_src,
7037                         struct smb_filename *smb_fname_dst,
7038                         int ofun,
7039                         int count,
7040                         bool target_is_directory)
7041 {
7042         struct smb_filename *smb_fname_dst_tmp = NULL;
7043         off_t ret=-1;
7044         files_struct *fsp1,*fsp2;
7045         uint32 dosattrs;
7046         uint32 new_create_disposition;
7047         NTSTATUS status;
7048
7049
7050         smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7051         if (smb_fname_dst_tmp == NULL) {
7052                 return NT_STATUS_NO_MEMORY;
7053         }
7054
7055         /*
7056          * If the target is a directory, extract the last component from the
7057          * src filename and append it to the dst filename
7058          */
7059         if (target_is_directory) {
7060                 const char *p;
7061
7062                 /* dest/target can't be a stream if it's a directory. */
7063                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7064
7065                 p = strrchr_m(smb_fname_src->base_name,'/');
7066                 if (p) {
7067                         p++;
7068                 } else {
7069                         p = smb_fname_src->base_name;
7070                 }
7071                 smb_fname_dst_tmp->base_name =
7072                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7073                                            p);
7074                 if (!smb_fname_dst_tmp->base_name) {
7075                         status = NT_STATUS_NO_MEMORY;
7076                         goto out;
7077                 }
7078         }
7079
7080         status = vfs_file_exist(conn, smb_fname_src);
7081         if (!NT_STATUS_IS_OK(status)) {
7082                 goto out;
7083         }
7084
7085         if (!target_is_directory && count) {
7086                 new_create_disposition = FILE_OPEN;
7087         } else {
7088                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7089                                                  0, ofun,
7090                                                  NULL, NULL,
7091                                                  &new_create_disposition,
7092                                                  NULL,
7093                                                  NULL)) {
7094                         status = NT_STATUS_INVALID_PARAMETER;
7095                         goto out;
7096                 }
7097         }
7098
7099         /* Open the src file for reading. */
7100         status = SMB_VFS_CREATE_FILE(
7101                 conn,                                   /* conn */
7102                 NULL,                                   /* req */
7103                 0,                                      /* root_dir_fid */
7104                 smb_fname_src,                          /* fname */
7105                 FILE_GENERIC_READ,                      /* access_mask */
7106                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7107                 FILE_OPEN,                              /* create_disposition*/
7108                 0,                                      /* create_options */
7109                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
7110                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7111                 0,                                      /* allocation_size */
7112                 0,                                      /* private_flags */
7113                 NULL,                                   /* sd */
7114                 NULL,                                   /* ea_list */
7115                 &fsp1,                                  /* result */
7116                 NULL);                                  /* psbuf */
7117
7118         if (!NT_STATUS_IS_OK(status)) {
7119                 goto out;
7120         }
7121
7122         dosattrs = dos_mode(conn, smb_fname_src);
7123
7124         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7125                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7126         }
7127
7128         /* Open the dst file for writing. */
7129         status = SMB_VFS_CREATE_FILE(
7130                 conn,                                   /* conn */
7131                 NULL,                                   /* req */
7132                 0,                                      /* root_dir_fid */
7133                 smb_fname_dst,                          /* fname */
7134                 FILE_GENERIC_WRITE,                     /* access_mask */
7135                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7136                 new_create_disposition,                 /* create_disposition*/
7137                 0,                                      /* create_options */
7138                 dosattrs,                               /* file_attributes */
7139                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7140                 0,                                      /* allocation_size */
7141                 0,                                      /* private_flags */
7142                 NULL,                                   /* sd */
7143                 NULL,                                   /* ea_list */
7144                 &fsp2,                                  /* result */
7145                 NULL);                                  /* psbuf */
7146
7147         if (!NT_STATUS_IS_OK(status)) {
7148                 close_file(NULL, fsp1, ERROR_CLOSE);
7149                 goto out;
7150         }
7151
7152         if (ofun & OPENX_FILE_EXISTS_OPEN) {
7153                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7154                 if (ret == -1) {
7155                         DEBUG(0, ("error - vfs lseek returned error %s\n",
7156                                 strerror(errno)));
7157                         status = map_nt_error_from_unix(errno);
7158                         close_file(NULL, fsp1, ERROR_CLOSE);
7159                         close_file(NULL, fsp2, ERROR_CLOSE);
7160                         goto out;
7161                 }
7162         }
7163
7164         /* Do the actual copy. */
7165         if (smb_fname_src->st.st_ex_size) {
7166                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7167         } else {
7168                 ret = 0;
7169         }
7170
7171         close_file(NULL, fsp1, NORMAL_CLOSE);
7172
7173         /* Ensure the modtime is set correctly on the destination file. */
7174         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7175
7176         /*
7177          * As we are opening fsp1 read-only we only expect
7178          * an error on close on fsp2 if we are out of space.
7179          * Thus we don't look at the error return from the
7180          * close of fsp1.
7181          */
7182         status = close_file(NULL, fsp2, NORMAL_CLOSE);
7183
7184         if (!NT_STATUS_IS_OK(status)) {
7185                 goto out;
7186         }
7187
7188         if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7189                 status = NT_STATUS_DISK_FULL;
7190                 goto out;
7191         }
7192
7193         status = NT_STATUS_OK;
7194
7195  out:
7196         TALLOC_FREE(smb_fname_dst_tmp);
7197         return status;
7198 }
7199
7200 /****************************************************************************
7201  Reply to a file copy.
7202 ****************************************************************************/
7203
7204 void reply_copy(struct smb_request *req)
7205 {
7206         connection_struct *conn = req->conn;
7207         struct smb_filename *smb_fname_src = NULL;
7208         struct smb_filename *smb_fname_dst = NULL;
7209         char *fname_src = NULL;
7210         char *fname_dst = NULL;
7211         char *fname_src_mask = NULL;
7212         char *fname_src_dir = NULL;
7213         const char *p;
7214         int count=0;
7215         int error = ERRnoaccess;
7216         int tid2;
7217         int ofun;
7218         int flags;
7219         bool target_is_directory=False;
7220         bool source_has_wild = False;
7221         bool dest_has_wild = False;
7222         NTSTATUS status;
7223         TALLOC_CTX *ctx = talloc_tos();
7224
7225         START_PROFILE(SMBcopy);
7226
7227         if (req->wct < 3) {
7228                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7229                 goto out;
7230         }
7231
7232         tid2 = SVAL(req->vwv+0, 0);
7233         ofun = SVAL(req->vwv+1, 0);
7234         flags = SVAL(req->vwv+2, 0);
7235
7236         p = (const char *)req->buf;
7237         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7238                                        &status, &source_has_wild);
7239         if (!NT_STATUS_IS_OK(status)) {
7240                 reply_nterror(req, status);
7241                 goto out;
7242         }
7243         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7244                                        &status, &dest_has_wild);
7245         if (!NT_STATUS_IS_OK(status)) {
7246                 reply_nterror(req, status);
7247                 goto out;
7248         }
7249
7250         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7251
7252         if (tid2 != conn->cnum) {
7253                 /* can't currently handle inter share copies XXXX */
7254                 DEBUG(3,("Rejecting inter-share copy\n"));
7255                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7256                 goto out;
7257         }
7258
7259         status = filename_convert(ctx, conn,
7260                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7261                                   fname_src,
7262                                   UCF_COND_ALLOW_WCARD_LCOMP,
7263                                   &source_has_wild,
7264                                   &smb_fname_src);
7265         if (!NT_STATUS_IS_OK(status)) {
7266                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7267                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7268                                         ERRSRV, ERRbadpath);
7269                         goto out;
7270                 }
7271                 reply_nterror(req, status);
7272                 goto out;
7273         }
7274
7275         status = filename_convert(ctx, conn,
7276                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7277                                   fname_dst,
7278                                   UCF_COND_ALLOW_WCARD_LCOMP,
7279                                   &dest_has_wild,
7280                                   &smb_fname_dst);
7281         if (!NT_STATUS_IS_OK(status)) {
7282                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7283                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7284                                         ERRSRV, ERRbadpath);
7285                         goto out;
7286                 }
7287                 reply_nterror(req, status);
7288                 goto out;
7289         }
7290
7291         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7292
7293         if ((flags&1) && target_is_directory) {
7294                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7295                 goto out;
7296         }
7297
7298         if ((flags&2) && !target_is_directory) {
7299                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7300                 goto out;
7301         }
7302
7303         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7304                 /* wants a tree copy! XXXX */
7305                 DEBUG(3,("Rejecting tree copy\n"));
7306                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7307                 goto out;
7308         }
7309
7310         /* Split up the directory from the filename/mask. */
7311         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7312                                       &fname_src_dir, &fname_src_mask);
7313         if (!NT_STATUS_IS_OK(status)) {
7314                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7315                 goto out;
7316         }
7317
7318         /*
7319          * We should only check the mangled cache
7320          * here if unix_convert failed. This means
7321          * that the path in 'mask' doesn't exist
7322          * on the file system and so we need to look
7323          * for a possible mangle. This patch from
7324          * Tine Smukavec <valentin.smukavec@hermes.si>.
7325          */
7326         if (!VALID_STAT(smb_fname_src->st) &&
7327             mangle_is_mangled(fname_src_mask, conn->params)) {
7328                 char *new_mask = NULL;
7329                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7330                                             &new_mask, conn->params);
7331
7332                 /* Use demangled name if one was successfully found. */
7333                 if (new_mask) {
7334                         TALLOC_FREE(fname_src_mask);
7335                         fname_src_mask = new_mask;
7336                 }
7337         }
7338
7339         if (!source_has_wild) {
7340
7341                 /*
7342                  * Only one file needs to be copied. Append the mask back onto
7343                  * the directory.
7344                  */
7345                 TALLOC_FREE(smb_fname_src->base_name);
7346                 if (ISDOT(fname_src_dir)) {
7347                         /* Ensure we use canonical names on open. */
7348                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7349                                                         "%s",
7350                                                         fname_src_mask);
7351                 } else {
7352                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7353                                                         "%s/%s",
7354                                                         fname_src_dir,
7355                                                         fname_src_mask);
7356                 }
7357                 if (!smb_fname_src->base_name) {
7358                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7359                         goto out;
7360                 }
7361
7362                 if (dest_has_wild) {
7363                         char *fname_dst_mod = NULL;
7364                         if (!resolve_wildcards(smb_fname_dst,
7365                                                smb_fname_src->base_name,
7366                                                smb_fname_dst->base_name,
7367                                                &fname_dst_mod)) {
7368                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7369                                 goto out;
7370                         }
7371                         TALLOC_FREE(smb_fname_dst->base_name);
7372                         smb_fname_dst->base_name = fname_dst_mod;
7373                 }
7374
7375                 status = check_name(conn, smb_fname_src->base_name);
7376                 if (!NT_STATUS_IS_OK(status)) {
7377                         reply_nterror(req, status);
7378                         goto out;
7379                 }
7380
7381                 status = check_name(conn, smb_fname_dst->base_name);
7382                 if (!NT_STATUS_IS_OK(status)) {
7383                         reply_nterror(req, status);
7384                         goto out;
7385                 }
7386
7387                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7388                                    ofun, count, target_is_directory);
7389
7390                 if(!NT_STATUS_IS_OK(status)) {
7391                         reply_nterror(req, status);
7392                         goto out;
7393                 } else {
7394                         count++;
7395                 }
7396         } else {
7397                 struct smb_Dir *dir_hnd = NULL;
7398                 const char *dname = NULL;
7399                 char *talloced = NULL;
7400                 long offset = 0;
7401
7402                 /*
7403                  * There is a wildcard that requires us to actually read the
7404                  * src dir and copy each file matching the mask to the dst.
7405                  * Right now streams won't be copied, but this could
7406                  * presumably be added with a nested loop for reach dir entry.
7407                  */
7408                 SMB_ASSERT(!smb_fname_src->stream_name);
7409                 SMB_ASSERT(!smb_fname_dst->stream_name);
7410
7411                 smb_fname_src->stream_name = NULL;
7412                 smb_fname_dst->stream_name = NULL;
7413
7414                 if (strequal(fname_src_mask,"????????.???")) {
7415                         TALLOC_FREE(fname_src_mask);
7416                         fname_src_mask = talloc_strdup(ctx, "*");
7417                         if (!fname_src_mask) {
7418                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7419                                 goto out;
7420                         }
7421                 }
7422
7423                 status = check_name(conn, fname_src_dir);
7424                 if (!NT_STATUS_IS_OK(status)) {
7425                         reply_nterror(req, status);
7426                         goto out;
7427                 }
7428
7429                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7430                 if (dir_hnd == NULL) {
7431                         status = map_nt_error_from_unix(errno);
7432                         reply_nterror(req, status);
7433                         goto out;
7434                 }
7435
7436                 error = ERRbadfile;
7437
7438                 /* Iterate over the src dir copying each entry to the dst. */
7439                 while ((dname = ReadDirName(dir_hnd, &offset,
7440                                             &smb_fname_src->st, &talloced))) {
7441                         char *destname = NULL;
7442
7443                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7444                                 TALLOC_FREE(talloced);
7445                                 continue;
7446                         }
7447
7448                         if (!is_visible_file(conn, fname_src_dir, dname,
7449                                              &smb_fname_src->st, false)) {
7450                                 TALLOC_FREE(talloced);
7451                                 continue;
7452                         }
7453
7454                         if(!mask_match(dname, fname_src_mask,
7455                                        conn->case_sensitive)) {
7456                                 TALLOC_FREE(talloced);
7457                                 continue;
7458                         }
7459
7460                         error = ERRnoaccess;
7461
7462                         /* Get the src smb_fname struct setup. */
7463                         TALLOC_FREE(smb_fname_src->base_name);
7464                         if (ISDOT(fname_src_dir)) {
7465                                 /* Ensure we use canonical names on open. */
7466                                 smb_fname_src->base_name =
7467                                         talloc_asprintf(smb_fname_src, "%s",
7468                                                 dname);
7469                         } else {
7470                                 smb_fname_src->base_name =
7471                                         talloc_asprintf(smb_fname_src, "%s/%s",
7472                                                 fname_src_dir, dname);
7473                         }
7474
7475                         if (!smb_fname_src->base_name) {
7476                                 TALLOC_FREE(dir_hnd);
7477                                 TALLOC_FREE(talloced);
7478                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7479                                 goto out;
7480                         }
7481
7482                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7483                                                smb_fname_dst->base_name,
7484                                                &destname)) {
7485                                 TALLOC_FREE(talloced);
7486                                 continue;
7487                         }
7488                         if (!destname) {
7489                                 TALLOC_FREE(dir_hnd);
7490                                 TALLOC_FREE(talloced);
7491                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7492                                 goto out;
7493                         }
7494
7495                         TALLOC_FREE(smb_fname_dst->base_name);
7496                         smb_fname_dst->base_name = destname;
7497
7498                         status = check_name(conn, smb_fname_src->base_name);
7499                         if (!NT_STATUS_IS_OK(status)) {
7500                                 TALLOC_FREE(dir_hnd);
7501                                 TALLOC_FREE(talloced);
7502                                 reply_nterror(req, status);
7503                                 goto out;
7504                         }
7505
7506                         status = check_name(conn, smb_fname_dst->base_name);
7507                         if (!NT_STATUS_IS_OK(status)) {
7508                                 TALLOC_FREE(dir_hnd);
7509                                 TALLOC_FREE(talloced);
7510                                 reply_nterror(req, status);
7511                                 goto out;
7512                         }
7513
7514                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7515                                 smb_fname_src->base_name,
7516                                 smb_fname_dst->base_name));
7517
7518                         status = copy_file(ctx, conn, smb_fname_src,
7519                                            smb_fname_dst, ofun, count,
7520                                            target_is_directory);
7521                         if (NT_STATUS_IS_OK(status)) {
7522                                 count++;
7523                         }
7524
7525                         TALLOC_FREE(talloced);
7526                 }
7527                 TALLOC_FREE(dir_hnd);
7528         }
7529
7530         if (count == 0) {
7531                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7532                 goto out;
7533         }
7534
7535         reply_outbuf(req, 1, 0);
7536         SSVAL(req->outbuf,smb_vwv0,count);
7537  out:
7538         TALLOC_FREE(smb_fname_src);
7539         TALLOC_FREE(smb_fname_dst);
7540         TALLOC_FREE(fname_src);
7541         TALLOC_FREE(fname_dst);
7542         TALLOC_FREE(fname_src_mask);
7543         TALLOC_FREE(fname_src_dir);
7544
7545         END_PROFILE(SMBcopy);
7546         return;
7547 }
7548
7549 #undef DBGC_CLASS
7550 #define DBGC_CLASS DBGC_LOCKING
7551
7552 /****************************************************************************
7553  Get a lock pid, dealing with large count requests.
7554 ****************************************************************************/
7555
7556 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7557                     bool large_file_format)
7558 {
7559         if(!large_file_format)
7560                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7561         else
7562                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7563 }
7564
7565 /****************************************************************************
7566  Get a lock count, dealing with large count requests.
7567 ****************************************************************************/
7568
7569 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7570                         bool large_file_format)
7571 {
7572         uint64_t count = 0;
7573
7574         if(!large_file_format) {
7575                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7576         } else {
7577
7578 #if defined(HAVE_LONGLONG)
7579                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7580                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7581 #else /* HAVE_LONGLONG */
7582
7583                 /*
7584                  * NT4.x seems to be broken in that it sends large file (64 bit)
7585                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7586                  * negotiated. For boxes without large unsigned ints truncate the
7587                  * lock count by dropping the top 32 bits.
7588                  */
7589
7590                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7591                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7592                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7593                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7594                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7595                 }
7596
7597                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7598 #endif /* HAVE_LONGLONG */
7599         }
7600
7601         return count;
7602 }
7603
7604 #if !defined(HAVE_LONGLONG)
7605 /****************************************************************************
7606  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7607 ****************************************************************************/
7608
7609 static uint32 map_lock_offset(uint32 high, uint32 low)
7610 {
7611         unsigned int i;
7612         uint32 mask = 0;
7613         uint32 highcopy = high;
7614
7615         /*
7616          * Try and find out how many significant bits there are in high.
7617          */
7618
7619         for(i = 0; highcopy; i++)
7620                 highcopy >>= 1;
7621
7622         /*
7623          * We use 31 bits not 32 here as POSIX
7624          * lock offsets may not be negative.
7625          */
7626
7627         mask = (~0) << (31 - i);
7628
7629         if(low & mask)
7630                 return 0; /* Fail. */
7631
7632         high <<= (31 - i);
7633
7634         return (high|low);
7635 }
7636 #endif /* !defined(HAVE_LONGLONG) */
7637
7638 /****************************************************************************
7639  Get a lock offset, dealing with large offset requests.
7640 ****************************************************************************/
7641
7642 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7643                          bool large_file_format, bool *err)
7644 {
7645         uint64_t offset = 0;
7646
7647         *err = False;
7648
7649         if(!large_file_format) {
7650                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7651         } else {
7652
7653 #if defined(HAVE_LONGLONG)
7654                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7655                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7656 #else /* HAVE_LONGLONG */
7657
7658                 /*
7659                  * NT4.x seems to be broken in that it sends large file (64 bit)
7660                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7661                  * negotiated. For boxes without large unsigned ints mangle the
7662                  * lock offset by mapping the top 32 bits onto the lower 32.
7663                  */
7664
7665                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7666                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7667                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7668                         uint32 new_low = 0;
7669
7670                         if((new_low = map_lock_offset(high, low)) == 0) {
7671                                 *err = True;
7672                                 return (uint64_t)-1;
7673                         }
7674
7675                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7676                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7677                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7678                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7679                 }
7680
7681                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7682 #endif /* HAVE_LONGLONG */
7683         }
7684
7685         return offset;
7686 }
7687
7688 NTSTATUS smbd_do_locking(struct smb_request *req,
7689                          files_struct *fsp,
7690                          uint8_t type,
7691                          int32_t timeout,
7692                          uint16_t num_ulocks,
7693                          struct smbd_lock_element *ulocks,
7694                          uint16_t num_locks,
7695                          struct smbd_lock_element *locks,
7696                          bool *async)
7697 {
7698         connection_struct *conn = req->conn;
7699         int i;
7700         NTSTATUS status = NT_STATUS_OK;
7701
7702         *async = false;
7703
7704         /* Data now points at the beginning of the list
7705            of smb_unlkrng structs */
7706         for(i = 0; i < (int)num_ulocks; i++) {
7707                 struct smbd_lock_element *e = &ulocks[i];
7708
7709                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7710                           "pid %u, file %s\n",
7711                           (double)e->offset,
7712                           (double)e->count,
7713                           (unsigned int)e->smblctx,
7714                           fsp_str_dbg(fsp)));
7715
7716                 if (e->brltype != UNLOCK_LOCK) {
7717                         /* this can only happen with SMB2 */
7718                         return NT_STATUS_INVALID_PARAMETER;
7719                 }
7720
7721                 status = do_unlock(req->sconn->msg_ctx,
7722                                 fsp,
7723                                 e->smblctx,
7724                                 e->count,
7725                                 e->offset,
7726                                 WINDOWS_LOCK);
7727
7728                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7729                     nt_errstr(status)));
7730
7731                 if (!NT_STATUS_IS_OK(status)) {
7732                         return status;
7733                 }
7734         }
7735
7736         /* Setup the timeout in seconds. */
7737
7738         if (!lp_blocking_locks(SNUM(conn))) {
7739                 timeout = 0;
7740         }
7741
7742         /* Data now points at the beginning of the list
7743            of smb_lkrng structs */
7744
7745         for(i = 0; i < (int)num_locks; i++) {
7746                 struct smbd_lock_element *e = &locks[i];
7747
7748                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7749                           "%llu, file %s timeout = %d\n",
7750                           (double)e->offset,
7751                           (double)e->count,
7752                           (unsigned long long)e->smblctx,
7753                           fsp_str_dbg(fsp),
7754                           (int)timeout));
7755
7756                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7757                         struct blocking_lock_record *blr = NULL;
7758
7759                         if (num_locks > 1) {
7760                                 /*
7761                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7762                                  * if the lock vector contains one entry. When given mutliple cancel
7763                                  * requests in a single PDU we expect the server to return an
7764                                  * error. Windows servers seem to accept the request but only
7765                                  * cancel the first lock.
7766                                  * JRA - Do what Windows does (tm) :-).
7767                                  */
7768
7769 #if 0
7770                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7771                                 return NT_STATUS_DOS(ERRDOS,
7772                                                 ERRcancelviolation);
7773 #else
7774                                 /* Windows behavior. */
7775                                 if (i != 0) {
7776                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7777                                                 "cancel request\n"));
7778                                         continue;
7779                                 }
7780 #endif
7781                         }
7782
7783                         if (lp_blocking_locks(SNUM(conn))) {
7784
7785                                 /* Schedule a message to ourselves to
7786                                    remove the blocking lock record and
7787                                    return the right error. */
7788
7789                                 blr = blocking_lock_cancel_smb1(fsp,
7790                                                 e->smblctx,
7791                                                 e->offset,
7792                                                 e->count,
7793                                                 WINDOWS_LOCK,
7794                                                 type,
7795                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7796                                 if (blr == NULL) {
7797                                         return NT_STATUS_DOS(
7798                                                         ERRDOS,
7799                                                         ERRcancelviolation);
7800                                 }
7801                         }
7802                         /* Remove a matching pending lock. */
7803                         status = do_lock_cancel(fsp,
7804                                                 e->smblctx,
7805                                                 e->count,
7806                                                 e->offset,
7807                                                 WINDOWS_LOCK,
7808                                                 blr);
7809                 } else {
7810                         bool blocking_lock = timeout ? true : false;
7811                         bool defer_lock = false;
7812                         struct byte_range_lock *br_lck;
7813                         uint64_t block_smblctx;
7814
7815                         br_lck = do_lock(req->sconn->msg_ctx,
7816                                         fsp,
7817                                         e->smblctx,
7818                                         e->count,
7819                                         e->offset,
7820                                         e->brltype,
7821                                         WINDOWS_LOCK,
7822                                         blocking_lock,
7823                                         &status,
7824                                         &block_smblctx,
7825                                         NULL);
7826
7827                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7828                                 /* Windows internal resolution for blocking locks seems
7829                                    to be about 200ms... Don't wait for less than that. JRA. */
7830                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7831                                         timeout = lp_lock_spin_time();
7832                                 }
7833                                 defer_lock = true;
7834                         }
7835
7836                         /* If a lock sent with timeout of zero would fail, and
7837                          * this lock has been requested multiple times,
7838                          * according to brl_lock_failed() we convert this
7839                          * request to a blocking lock with a timeout of between
7840                          * 150 - 300 milliseconds.
7841                          *
7842                          * If lp_lock_spin_time() has been set to 0, we skip
7843                          * this blocking retry and fail immediately.
7844                          *
7845                          * Replacement for do_lock_spin(). JRA. */
7846
7847                         if (!req->sconn->using_smb2 &&
7848                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7849                             lp_lock_spin_time() && !blocking_lock &&
7850                             NT_STATUS_EQUAL((status),
7851                                 NT_STATUS_FILE_LOCK_CONFLICT))
7852                         {
7853                                 defer_lock = true;
7854                                 timeout = lp_lock_spin_time();
7855                         }
7856
7857                         if (br_lck && defer_lock) {
7858                                 /*
7859                                  * A blocking lock was requested. Package up
7860                                  * this smb into a queued request and push it
7861                                  * onto the blocking lock queue.
7862                                  */
7863                                 if(push_blocking_lock_request(br_lck,
7864                                                         req,
7865                                                         fsp,
7866                                                         timeout,
7867                                                         i,
7868                                                         e->smblctx,
7869                                                         e->brltype,
7870                                                         WINDOWS_LOCK,
7871                                                         e->offset,
7872                                                         e->count,
7873                                                         block_smblctx)) {
7874                                         TALLOC_FREE(br_lck);
7875                                         *async = true;
7876                                         return NT_STATUS_OK;
7877                                 }
7878                         }
7879
7880                         TALLOC_FREE(br_lck);
7881                 }
7882
7883                 if (!NT_STATUS_IS_OK(status)) {
7884                         break;
7885                 }
7886         }
7887
7888         /* If any of the above locks failed, then we must unlock
7889            all of the previous locks (X/Open spec). */
7890
7891         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7892
7893                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7894                         i = -1; /* we want to skip the for loop */
7895                 }
7896
7897                 /*
7898                  * Ensure we don't do a remove on the lock that just failed,
7899                  * as under POSIX rules, if we have a lock already there, we
7900                  * will delete it (and we shouldn't) .....
7901                  */
7902                 for(i--; i >= 0; i--) {
7903                         struct smbd_lock_element *e = &locks[i];
7904
7905                         do_unlock(req->sconn->msg_ctx,
7906                                 fsp,
7907                                 e->smblctx,
7908                                 e->count,
7909                                 e->offset,
7910                                 WINDOWS_LOCK);
7911                 }
7912                 return status;
7913         }
7914
7915         DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
7916                   fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
7917
7918         return NT_STATUS_OK;
7919 }
7920
7921 /****************************************************************************
7922  Reply to a lockingX request.
7923 ****************************************************************************/
7924
7925 void reply_lockingX(struct smb_request *req)
7926 {
7927         connection_struct *conn = req->conn;
7928         files_struct *fsp;
7929         unsigned char locktype;
7930         unsigned char oplocklevel;
7931         uint16 num_ulocks;
7932         uint16 num_locks;
7933         int32 lock_timeout;
7934         int i;
7935         const uint8_t *data;
7936         bool large_file_format;
7937         bool err;
7938         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7939         struct smbd_lock_element *ulocks;
7940         struct smbd_lock_element *locks;
7941         bool async = false;
7942
7943         START_PROFILE(SMBlockingX);
7944
7945         if (req->wct < 8) {
7946                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7947                 END_PROFILE(SMBlockingX);
7948                 return;
7949         }
7950
7951         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7952         locktype = CVAL(req->vwv+3, 0);
7953         oplocklevel = CVAL(req->vwv+3, 1);
7954         num_ulocks = SVAL(req->vwv+6, 0);
7955         num_locks = SVAL(req->vwv+7, 0);
7956         lock_timeout = IVAL(req->vwv+4, 0);
7957         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7958
7959         if (!check_fsp(conn, req, fsp)) {
7960                 END_PROFILE(SMBlockingX);
7961                 return;
7962         }
7963
7964         data = req->buf;
7965
7966         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7967                 /* we don't support these - and CANCEL_LOCK makes w2k
7968                    and XP reboot so I don't really want to be
7969                    compatible! (tridge) */
7970                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7971                 END_PROFILE(SMBlockingX);
7972                 return;
7973         }
7974
7975         /* Check if this is an oplock break on a file
7976            we have granted an oplock on.
7977         */
7978         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7979                 /* Client can insist on breaking to none. */
7980                 bool break_to_none = (oplocklevel == 0);
7981                 bool result;
7982
7983                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7984                          "for %s\n", (unsigned int)oplocklevel,
7985                          fsp_fnum_dbg(fsp)));
7986
7987                 /*
7988                  * Make sure we have granted an exclusive or batch oplock on
7989                  * this file.
7990                  */
7991
7992                 if (fsp->oplock_type == 0) {
7993
7994                         /* The Samba4 nbench simulator doesn't understand
7995                            the difference between break to level2 and break
7996                            to none from level2 - it sends oplock break
7997                            replies in both cases. Don't keep logging an error
7998                            message here - just ignore it. JRA. */
7999
8000                         DEBUG(5,("reply_lockingX: Error : oplock break from "
8001                                  "client for %s (oplock=%d) and no "
8002                                  "oplock granted on this file (%s).\n",
8003                                  fsp_fnum_dbg(fsp), fsp->oplock_type,
8004                                  fsp_str_dbg(fsp)));
8005
8006                         /* if this is a pure oplock break request then don't
8007                          * send a reply */
8008                         if (num_locks == 0 && num_ulocks == 0) {
8009                                 END_PROFILE(SMBlockingX);
8010                                 return;
8011                         } else {
8012                                 END_PROFILE(SMBlockingX);
8013                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8014                                 return;
8015                         }
8016                 }
8017
8018                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8019                     (break_to_none)) {
8020                         result = remove_oplock(fsp);
8021                 } else {
8022                         result = downgrade_oplock(fsp);
8023                 }
8024
8025                 if (!result) {
8026                         DEBUG(0, ("reply_lockingX: error in removing "
8027                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
8028                         /* Hmmm. Is this panic justified? */
8029                         smb_panic("internal tdb error");
8030                 }
8031
8032                 /* if this is a pure oplock break request then don't send a
8033                  * reply */
8034                 if (num_locks == 0 && num_ulocks == 0) {
8035                         /* Sanity check - ensure a pure oplock break is not a
8036                            chained request. */
8037                         if(CVAL(req->vwv+0, 0) != 0xff)
8038                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
8039                                          "break is a chained %d request !\n",
8040                                          (unsigned int)CVAL(req->vwv+0, 0)));
8041                         END_PROFILE(SMBlockingX);
8042                         return;
8043                 }
8044         }
8045
8046         if (req->buflen <
8047             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8048                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8049                 END_PROFILE(SMBlockingX);
8050                 return;
8051         }
8052
8053         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8054         if (ulocks == NULL) {
8055                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8056                 END_PROFILE(SMBlockingX);
8057                 return;
8058         }
8059
8060         locks = talloc_array(req, struct smbd_lock_element, num_locks);
8061         if (locks == NULL) {
8062                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8063                 END_PROFILE(SMBlockingX);
8064                 return;
8065         }
8066
8067         /* Data now points at the beginning of the list
8068            of smb_unlkrng structs */
8069         for(i = 0; i < (int)num_ulocks; i++) {
8070                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8071                 ulocks[i].count = get_lock_count(data, i, large_file_format);
8072                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8073                 ulocks[i].brltype = UNLOCK_LOCK;
8074
8075                 /*
8076                  * There is no error code marked "stupid client bug".... :-).
8077                  */
8078                 if(err) {
8079                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8080                         END_PROFILE(SMBlockingX);
8081                         return;
8082                 }
8083         }
8084
8085         /* Now do any requested locks */
8086         data += ((large_file_format ? 20 : 10)*num_ulocks);
8087
8088         /* Data now points at the beginning of the list
8089            of smb_lkrng structs */
8090
8091         for(i = 0; i < (int)num_locks; i++) {
8092                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8093                 locks[i].count = get_lock_count(data, i, large_file_format);
8094                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8095
8096                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8097                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8098                                 locks[i].brltype = PENDING_READ_LOCK;
8099                         } else {
8100                                 locks[i].brltype = READ_LOCK;
8101                         }
8102                 } else {
8103                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8104                                 locks[i].brltype = PENDING_WRITE_LOCK;
8105                         } else {
8106                                 locks[i].brltype = WRITE_LOCK;
8107                         }
8108                 }
8109
8110                 /*
8111                  * There is no error code marked "stupid client bug".... :-).
8112                  */
8113                 if(err) {
8114                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8115                         END_PROFILE(SMBlockingX);
8116                         return;
8117                 }
8118         }
8119
8120         status = smbd_do_locking(req, fsp,
8121                                  locktype, lock_timeout,
8122                                  num_ulocks, ulocks,
8123                                  num_locks, locks,
8124                                  &async);
8125         if (!NT_STATUS_IS_OK(status)) {
8126                 END_PROFILE(SMBlockingX);
8127                 reply_nterror(req, status);
8128                 return;
8129         }
8130         if (async) {
8131                 END_PROFILE(SMBlockingX);
8132                 return;
8133         }
8134
8135         reply_outbuf(req, 2, 0);
8136         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8137         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
8138
8139         DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8140                   fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8141
8142         END_PROFILE(SMBlockingX);
8143 }
8144
8145 #undef DBGC_CLASS
8146 #define DBGC_CLASS DBGC_ALL
8147
8148 /****************************************************************************
8149  Reply to a SMBreadbmpx (read block multiplex) request.
8150  Always reply with an error, if someone has a platform really needs this,
8151  please contact vl@samba.org
8152 ****************************************************************************/
8153
8154 void reply_readbmpx(struct smb_request *req)
8155 {
8156         START_PROFILE(SMBreadBmpx);
8157         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8158         END_PROFILE(SMBreadBmpx);
8159         return;
8160 }
8161
8162 /****************************************************************************
8163  Reply to a SMBreadbs (read block multiplex secondary) request.
8164  Always reply with an error, if someone has a platform really needs this,
8165  please contact vl@samba.org
8166 ****************************************************************************/
8167
8168 void reply_readbs(struct smb_request *req)
8169 {
8170         START_PROFILE(SMBreadBs);
8171         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8172         END_PROFILE(SMBreadBs);
8173         return;
8174 }
8175
8176 /****************************************************************************
8177  Reply to a SMBsetattrE.
8178 ****************************************************************************/
8179
8180 void reply_setattrE(struct smb_request *req)
8181 {
8182         connection_struct *conn = req->conn;
8183         struct smb_file_time ft;
8184         files_struct *fsp;
8185         NTSTATUS status;
8186
8187         START_PROFILE(SMBsetattrE);
8188         ZERO_STRUCT(ft);
8189
8190         if (req->wct < 7) {
8191                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8192                 goto out;
8193         }
8194
8195         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8196
8197         if(!fsp || (fsp->conn != conn)) {
8198                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8199                 goto out;
8200         }
8201
8202         /*
8203          * Convert the DOS times into unix times.
8204          */
8205
8206         ft.atime = convert_time_t_to_timespec(
8207             srv_make_unix_date2(req->vwv+3));
8208         ft.mtime = convert_time_t_to_timespec(
8209             srv_make_unix_date2(req->vwv+5));
8210         ft.create_time = convert_time_t_to_timespec(
8211             srv_make_unix_date2(req->vwv+1));
8212
8213         reply_outbuf(req, 0, 0);
8214
8215         /*
8216          * Patch from Ray Frush <frush@engr.colostate.edu>
8217          * Sometimes times are sent as zero - ignore them.
8218          */
8219
8220         /* Ensure we have a valid stat struct for the source. */
8221         status = vfs_stat_fsp(fsp);
8222         if (!NT_STATUS_IS_OK(status)) {
8223                 reply_nterror(req, status);
8224                 goto out;
8225         }
8226
8227         if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8228                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8229                 goto out;
8230         }
8231
8232         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8233         if (!NT_STATUS_IS_OK(status)) {
8234                 reply_nterror(req, status);
8235                 goto out;
8236         }
8237
8238         DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8239                " createtime=%u\n",
8240                 fsp_fnum_dbg(fsp),
8241                 (unsigned int)ft.atime.tv_sec,
8242                 (unsigned int)ft.mtime.tv_sec,
8243                 (unsigned int)ft.create_time.tv_sec
8244                 ));
8245  out:
8246         END_PROFILE(SMBsetattrE);
8247         return;
8248 }
8249
8250
8251 /* Back from the dead for OS/2..... JRA. */
8252
8253 /****************************************************************************
8254  Reply to a SMBwritebmpx (write block multiplex primary) request.
8255  Always reply with an error, if someone has a platform really needs this,
8256  please contact vl@samba.org
8257 ****************************************************************************/
8258
8259 void reply_writebmpx(struct smb_request *req)
8260 {
8261         START_PROFILE(SMBwriteBmpx);
8262         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8263         END_PROFILE(SMBwriteBmpx);
8264         return;
8265 }
8266
8267 /****************************************************************************
8268  Reply to a SMBwritebs (write block multiplex secondary) request.
8269  Always reply with an error, if someone has a platform really needs this,
8270  please contact vl@samba.org
8271 ****************************************************************************/
8272
8273 void reply_writebs(struct smb_request *req)
8274 {
8275         START_PROFILE(SMBwriteBs);
8276         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8277         END_PROFILE(SMBwriteBs);
8278         return;
8279 }
8280
8281 /****************************************************************************
8282  Reply to a SMBgetattrE.
8283 ****************************************************************************/
8284
8285 void reply_getattrE(struct smb_request *req)
8286 {
8287         connection_struct *conn = req->conn;
8288         int mode;
8289         files_struct *fsp;
8290         struct timespec create_ts;
8291
8292         START_PROFILE(SMBgetattrE);
8293
8294         if (req->wct < 1) {
8295                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8296                 END_PROFILE(SMBgetattrE);
8297                 return;
8298         }
8299
8300         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8301
8302         if(!fsp || (fsp->conn != conn)) {
8303                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8304                 END_PROFILE(SMBgetattrE);
8305                 return;
8306         }
8307
8308         /* Do an fstat on this file */
8309         if(fsp_stat(fsp)) {
8310                 reply_nterror(req, map_nt_error_from_unix(errno));
8311                 END_PROFILE(SMBgetattrE);
8312                 return;
8313         }
8314
8315         mode = dos_mode(conn, fsp->fsp_name);
8316
8317         /*
8318          * Convert the times into dos times. Set create
8319          * date to be last modify date as UNIX doesn't save
8320          * this.
8321          */
8322
8323         reply_outbuf(req, 11, 0);
8324
8325         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8326         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8327         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8328                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8329         /* Should we check pending modtime here ? JRA */
8330         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8331                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8332
8333         if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8334                 SIVAL(req->outbuf, smb_vwv6, 0);
8335                 SIVAL(req->outbuf, smb_vwv8, 0);
8336         } else {
8337                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8338                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8339                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8340         }
8341         SSVAL(req->outbuf,smb_vwv10, mode);
8342
8343         DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8344
8345         END_PROFILE(SMBgetattrE);
8346         return;
8347 }