source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "smbd/globals.h"
  29
  30 /****************************************************************************
  31  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  32  path or anything including wildcards.
  33  We're assuming here that '/' is not the second byte in any multibyte char
  34  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  35  set.
  36 ****************************************************************************/
  37
  38 /* Custom version for processing POSIX paths. */
  39 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  40
  41 static NTSTATUS check_path_syntax_internal(char *path,
  42                                            bool posix_path,
  43                                            bool *p_last_component_contains_wcard)
  44 {
  45         char *d = path;
  46         const char *s = path;
  47         NTSTATUS ret = NT_STATUS_OK;
  48         bool start_of_name_component = True;
  49         bool stream_started = false;
  50
  51         *p_last_component_contains_wcard = False;
  52
  53         while (*s) {
  54                 if (stream_started) {
  55                         switch (*s) {
  56                         case '/':
  57                         case '\\':
  58                                 return NT_STATUS_OBJECT_NAME_INVALID;
  59                         case ':':
  60                                 if (s[1] == '\0') {
  61                                         return NT_STATUS_OBJECT_NAME_INVALID;
  62                                 }
  63                                 if (strchr_m(&s[1], ':')) {
  64                                         return NT_STATUS_OBJECT_NAME_INVALID;
  65                                 }
  66                                 break;
  67                         }
  68                 }
  69
  70                 if ((*s == ':') && !posix_path && !stream_started) {
  71                         if (*p_last_component_contains_wcard) {
  72                                 return NT_STATUS_OBJECT_NAME_INVALID;
  73                         }
  74                         /* Stream names allow more characters than file names.
  75                            We're overloading posix_path here to allow a wider
  76                            range of characters. If stream_started is true this
  77                            is still a Windows path even if posix_path is true.
  78                            JRA.
  79                         */
  80                         stream_started = true;
  81                         start_of_name_component = false;
  82                         posix_path = true;
  83
  84                         if (s[1] == '\0') {
  85                                 return NT_STATUS_OBJECT_NAME_INVALID;
  86                         }
  87                 }
  88
  89                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
  90                         /*
  91                          * Safe to assume is not the second part of a mb char
  92                          * as this is handled below.
  93                          */
  94                         /* Eat multiple '/' or '\\' */
  95                         while (IS_PATH_SEP(*s,posix_path)) {
  96                                 s++;
  97                         }
  98                         if ((d != path) && (*s != '\0')) {
  99                                 /* We only care about non-leading or trailing '/' or '\\' */
 100                                 *d++ = '/';
 101                         }
 102
 103                         start_of_name_component = True;
 104                         /* New component. */
 105                         *p_last_component_contains_wcard = False;
 106                         continue;
 107                 }
 108
 109                 if (start_of_name_component) {
 110                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 111                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 112
 113                                 /*
 114                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 115                                  */
 116
 117                                 /* If  we just added a '/' - delete it */
 118                                 if ((d > path) && (*(d-1) == '/')) {
 119                                         *(d-1) = '\0';
 120                                         d--;
 121                                 }
 122
 123                                 /* Are we at the start ? Can't go back further if so. */
 124                                 if (d <= path) {
 125                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 126                                         break;
 127                                 }
 128                                 /* Go back one level... */
 129                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 130                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 131                                 /* Decrement d first as d points to the *next* char to write into. */
 132                                 for (d--; d > path; d--) {
 133                                         if (*d == '/')
 134                                                 break;
 135                                 }
 136                                 s += 2; /* Else go past the .. */
 137                                 /* We're still at the start of a name component, just the previous one. */
 138                                 continue;
 139
 140                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 141                                 if (posix_path) {
 142                                         /* Eat the '.' */
 143                                         s++;
 144                                         continue;
 145                                 }
 146                         }
 147
 148                 }
 149
 150                 if (!(*s & 0x80)) {
 151                         if (!posix_path) {
 152                                 if (*s <= 0x1f || *s == '|') {
 153                                         return NT_STATUS_OBJECT_NAME_INVALID;
 154                                 }
 155                                 switch (*s) {
 156                                         case '*':
 157                                         case '?':
 158                                         case '<':
 159                                         case '>':
 160                                         case '"':
 161                                                 *p_last_component_contains_wcard = True;
 162                                                 break;
 163                                         default:
 164                                                 break;
 165                                 }
 166                         }
 167                         *d++ = *s++;
 168                 } else {
 169                         size_t siz;
 170                         /* Get the size of the next MB character. */
 171                         next_codepoint(s,&siz);
 172                         switch(siz) {
 173                                 case 5:
 174                                         *d++ = *s++;
 175                                         /*fall through*/
 176                                 case 4:
 177                                         *d++ = *s++;
 178                                         /*fall through*/
 179                                 case 3:
 180                                         *d++ = *s++;
 181                                         /*fall through*/
 182                                 case 2:
 183                                         *d++ = *s++;
 184                                         /*fall through*/
 185                                 case 1:
 186                                         *d++ = *s++;
 187                                         break;
 188                                 default:
 189                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 190                                         *d = '\0';
 191                                         return NT_STATUS_INVALID_PARAMETER;
 192                         }
 193                 }
 194                 start_of_name_component = False;
 195         }
 196
 197         *d = '\0';
 198
 199         return ret;
 200 }
 201
 202 /****************************************************************************
 203  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 204  No wildcards allowed.
 205 ****************************************************************************/
 206
 207 NTSTATUS check_path_syntax(char *path)
 208 {
 209         bool ignore;
 210         return check_path_syntax_internal(path, False, &ignore);
 211 }
 212
 213 /****************************************************************************
 214  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 215  Wildcards allowed - p_contains_wcard returns true if the last component contained
 216  a wildcard.
 217 ****************************************************************************/
 218
 219 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 220 {
 221         return check_path_syntax_internal(path, False, p_contains_wcard);
 222 }
 223
 224 /****************************************************************************
 225  Check the path for a POSIX client.
 226  We're assuming here that '/' is not the second byte in any multibyte char
 227  set (a safe assumption).
 228 ****************************************************************************/
 229
 230 NTSTATUS check_path_syntax_posix(char *path)
 231 {
 232         bool ignore;
 233         return check_path_syntax_internal(path, True, &ignore);
 234 }
 235
 236 /****************************************************************************
 237  Pull a string and check the path allowing a wilcard - provide for error return.
 238 ****************************************************************************/
 239
 240 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 241                         const char *base_ptr,
 242                         uint16 smb_flags2,
 243                         char **pp_dest,
 244                         const char *src,
 245                         size_t src_len,
 246                         int flags,
 247                         NTSTATUS *err,
 248                         bool *contains_wcard)
 249 {
 250         size_t ret;
 251
 252         *pp_dest = NULL;
 253
 254         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 255                                  src_len, flags);
 256
 257         if (!*pp_dest) {
 258                 *err = NT_STATUS_INVALID_PARAMETER;
 259                 return ret;
 260         }
 261
 262         *contains_wcard = False;
 263
 264         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 265                 /*
 266                  * For a DFS path the function parse_dfs_path()
 267                  * will do the path processing, just make a copy.
 268                  */
 269                 *err = NT_STATUS_OK;
 270                 return ret;
 271         }
 272
 273         if (lp_posix_pathnames()) {
 274                 *err = check_path_syntax_posix(*pp_dest);
 275         } else {
 276                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 277         }
 278
 279         return ret;
 280 }
 281
 282 /****************************************************************************
 283  Pull a string and check the path - provide for error return.
 284 ****************************************************************************/
 285
 286 size_t srvstr_get_path(TALLOC_CTX *ctx,
 287                         const char *base_ptr,
 288                         uint16 smb_flags2,
 289                         char **pp_dest,
 290                         const char *src,
 291                         size_t src_len,
 292                         int flags,
 293                         NTSTATUS *err)
 294 {
 295         bool ignore;
 296         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 297                                      src_len, flags, err, &ignore);
 298 }
 299
 300 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 301                                  char **pp_dest, const char *src, int flags,
 302                                  NTSTATUS *err, bool *contains_wcard)
 303 {
 304         return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
 305                                      pp_dest, src, smbreq_bufrem(req, src),
 306                                      flags, err, contains_wcard);
 307 }
 308
 309 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 310                            char **pp_dest, const char *src, int flags,
 311                            NTSTATUS *err)
 312 {
 313         bool ignore;
 314         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 315                                          flags, err, &ignore);
 316 }
 317
 318 /****************************************************************************
 319  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 320 ****************************************************************************/
 321
 322 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 323                     files_struct *fsp)
 324 {
 325         if (!(fsp) || !(conn)) {
 326                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 327                 return False;
 328         }
 329         if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
 330                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 331                 return False;
 332         }
 333         return True;
 334 }
 335
 336 /****************************************************************************
 337  Check if we have a correct fsp pointing to a file.
 338 ****************************************************************************/
 339
 340 bool check_fsp(connection_struct *conn, struct smb_request *req,
 341                files_struct *fsp)
 342 {
 343         if (!check_fsp_open(conn, req, fsp)) {
 344                 return False;
 345         }
 346         if ((fsp)->is_directory) {
 347                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 348                 return False;
 349         }
 350         if ((fsp)->fh->fd == -1) {
 351                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 352                 return False;
 353         }
 354         (fsp)->num_smb_operations++;
 355         return True;
 356 }
 357
 358 /****************************************************************************
 359  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 360  the CHECK_NTQUOTA_HANDLE_OK macro.
 361 ****************************************************************************/
 362
 363 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 364                               files_struct *fsp)
 365 {
 366         if (!check_fsp_open(conn, req, fsp)) {
 367                 return false;
 368         }
 369
 370         if (fsp->is_directory) {
 371                 return false;
 372         }
 373
 374         if (fsp->fake_file_handle == NULL) {
 375                 return false;
 376         }
 377
 378         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 379                 return false;
 380         }
 381
 382         if (fsp->fake_file_handle->private_data == NULL) {
 383                 return false;
 384         }
 385
 386         return true;
 387 }
 388
 389 /****************************************************************************
 390  Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
 391 ****************************************************************************/
 392
 393 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
 394                       files_struct *fsp)
 395 {
 396         if ((fsp) && (conn) && ((conn)==(fsp)->conn)
 397             && (req->vuid == (fsp)->vuid)) {
 398                 return True;
 399         }
 400
 401         reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 402         return False;
 403 }
 404
 405 static bool netbios_session_retarget(const char *name, int name_type)
 406 {
 407         char *trim_name;
 408         char *trim_name_type;
 409         const char *retarget_parm;
 410         char *retarget;
 411         char *p;
 412         int retarget_type = 0x20;
 413         int retarget_port = 139;
 414         struct sockaddr_storage retarget_addr;
 415         struct sockaddr_in *in_addr;
 416         bool ret = false;
 417         uint8_t outbuf[10];
 418
 419         if (get_socket_port(smbd_server_fd()) != 139) {
 420                 return false;
 421         }
 422
 423         trim_name = talloc_strdup(talloc_tos(), name);
 424         if (trim_name == NULL) {
 425                 goto fail;
 426         }
 427         trim_char(trim_name, ' ', ' ');
 428
 429         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 430                                          name_type);
 431         if (trim_name_type == NULL) {
 432                 goto fail;
 433         }
 434
 435         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 436                                              trim_name_type, NULL);
 437         if (retarget_parm == NULL) {
 438                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 439                                                      trim_name, NULL);
 440         }
 441         if (retarget_parm == NULL) {
 442                 goto fail;
 443         }
 444
 445         retarget = talloc_strdup(trim_name, retarget_parm);
 446         if (retarget == NULL) {
 447                 goto fail;
 448         }
 449
 450         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 451
 452         p = strchr(retarget, ':');
 453         if (p != NULL) {
 454                 *p++ = '\0';
 455                 retarget_port = atoi(p);
 456         }
 457
 458         p = strchr_m(retarget, '#');
 459         if (p != NULL) {
 460                 *p++ = '\0';
 461                 sscanf(p, "%x", &retarget_type);
 462         }
 463
 464         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 465         if (!ret) {
 466                 DEBUG(10, ("could not resolve %s\n", retarget));
 467                 goto fail;
 468         }
 469
 470         if (retarget_addr.ss_family != AF_INET) {
 471                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 472                 goto fail;
 473         }
 474
 475         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 476
 477         _smb_setlen(outbuf, 6);
 478         SCVAL(outbuf, 0, 0x84);
 479         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 480         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 481
 482         if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
 483                           NULL)) {
 484                 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
 485                                     "failed.");
 486         }
 487
 488         ret = true;
 489  fail:
 490         TALLOC_FREE(trim_name);
 491         return ret;
 492 }
 493
 494 /****************************************************************************
 495  Reply to a (netbios-level) special message.
 496 ****************************************************************************/
 497
 498 void reply_special(char *inbuf)
 499 {
 500         int msg_type = CVAL(inbuf,0);
 501         int msg_flags = CVAL(inbuf,1);
 502         fstring name1,name2;
 503         char name_type1, name_type2;
 504         struct smbd_server_connection *sconn = smbd_server_conn;
 505
 506         /*
 507          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 508          * calculation & friends (srv_send_smb uses that) we need the full smb
 509          * header.
 510          */
 511         char outbuf[smb_size];
 512
 513         *name1 = *name2 = 0;
 514
 515         memset(outbuf, '\0', sizeof(outbuf));
 516
 517         smb_setlen(outbuf,0);
 518
 519         switch (msg_type) {
 520         case 0x81: /* session request */
 521
 522                 if (sconn->nbt.got_session) {
 523                         exit_server_cleanly("multiple session request not permitted");
 524                 }
 525
 526                 SCVAL(outbuf,0,0x82);
 527                 SCVAL(outbuf,3,0);
 528                 if (name_len(inbuf+4) > 50 ||
 529                     name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
 530                         DEBUG(0,("Invalid name length in session request\n"));
 531                         return;
 532                 }
 533                 name_type1 = name_extract(inbuf,4,name1);
 534                 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
 535                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 536                          name1, name_type1, name2, name_type2));
 537
 538                 if (netbios_session_retarget(name1, name_type1)) {
 539                         exit_server_cleanly("retargeted client");
 540                 }
 541
 542                 set_local_machine_name(name1, True);
 543                 set_remote_machine_name(name2, True);
 544
 545                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 546                          get_local_machine_name(), get_remote_machine_name(),
 547                          name_type2));
 548
 549                 if (name_type2 == 'R') {
 550                         /* We are being asked for a pathworks session ---
 551                            no thanks! */
 552                         SCVAL(outbuf, 0,0x83);
 553                         break;
 554                 }
 555
 556                 /* only add the client's machine name to the list
 557                    of possibly valid usernames if we are operating
 558                    in share mode security */
 559                 if (lp_security() == SEC_SHARE) {
 560                         add_session_user(sconn, get_remote_machine_name());
 561                 }
 562
 563                 reload_services(True);
 564                 reopen_logs();
 565
 566                 sconn->nbt.got_session = true;
 567                 break;
 568
 569         case 0x89: /* session keepalive request
 570                       (some old clients produce this?) */
 571                 SCVAL(outbuf,0,SMBkeepalive);
 572                 SCVAL(outbuf,3,0);
 573                 break;
 574
 575         case 0x82: /* positive session response */
 576         case 0x83: /* negative session response */
 577         case 0x84: /* retarget session response */
 578                 DEBUG(0,("Unexpected session response\n"));
 579                 break;
 580
 581         case SMBkeepalive: /* session keepalive */
 582         default:
 583                 return;
 584         }
 585
 586         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 587                     msg_type, msg_flags));
 588
 589         srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
 590         return;
 591 }
 592
 593 /****************************************************************************
 594  Reply to a tcon.
 595  conn POINTER CAN BE NULL HERE !
 596 ****************************************************************************/
 597
 598 void reply_tcon(struct smb_request *req)
 599 {
 600         connection_struct *conn = req->conn;
 601         const char *service;
 602         char *service_buf = NULL;
 603         char *password = NULL;
 604         char *dev = NULL;
 605         int pwlen=0;
 606         NTSTATUS nt_status;
 607         const char *p;
 608         DATA_BLOB password_blob;
 609         TALLOC_CTX *ctx = talloc_tos();
 610         struct smbd_server_connection *sconn = smbd_server_conn;
 611
 612         START_PROFILE(SMBtcon);
 613
 614         if (req->buflen < 4) {
 615                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 616                 END_PROFILE(SMBtcon);
 617                 return;
 618         }
 619
 620         p = (const char *)req->buf + 1;
 621         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 622         p += 1;
 623         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 624         p += pwlen+1;
 625         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 626         p += 1;
 627
 628         if (service_buf == NULL || password == NULL || dev == NULL) {
 629                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 630                 END_PROFILE(SMBtcon);
 631                 return;
 632         }
 633         p = strrchr_m(service_buf,'\\');
 634         if (p) {
 635                 service = p+1;
 636         } else {
 637                 service = service_buf;
 638         }
 639
 640         password_blob = data_blob(password, pwlen+1);
 641
 642         conn = make_connection(sconn,service,password_blob,dev,
 643                                req->vuid,&nt_status);
 644         req->conn = conn;
 645
 646         data_blob_clear_free(&password_blob);
 647
 648         if (!conn) {
 649                 reply_nterror(req, nt_status);
 650                 END_PROFILE(SMBtcon);
 651                 return;
 652         }
 653
 654         reply_outbuf(req, 2, 0);
 655         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 656         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 657         SSVAL(req->outbuf,smb_tid,conn->cnum);
 658
 659         DEBUG(3,("tcon service=%s cnum=%d\n",
 660                  service, conn->cnum));
 661
 662         END_PROFILE(SMBtcon);
 663         return;
 664 }
 665
 666 /****************************************************************************
 667  Reply to a tcon and X.
 668  conn POINTER CAN BE NULL HERE !
 669 ****************************************************************************/
 670
 671 void reply_tcon_and_X(struct smb_request *req)
 672 {
 673         connection_struct *conn = req->conn;
 674         const char *service = NULL;
 675         DATA_BLOB password;
 676         TALLOC_CTX *ctx = talloc_tos();
 677         /* what the cleint thinks the device is */
 678         char *client_devicetype = NULL;
 679         /* what the server tells the client the share represents */
 680         const char *server_devicetype;
 681         NTSTATUS nt_status;
 682         int passlen;
 683         char *path = NULL;
 684         const char *p, *q;
 685         uint16 tcon_flags;
 686         struct smbd_server_connection *sconn = smbd_server_conn;
 687
 688         START_PROFILE(SMBtconX);
 689
 690         if (req->wct < 4) {
 691                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 692                 END_PROFILE(SMBtconX);
 693                 return;
 694         }
 695
 696         passlen = SVAL(req->vwv+3, 0);
 697         tcon_flags = SVAL(req->vwv+2, 0);
 698
 699         /* we might have to close an old one */
 700         if ((tcon_flags & 0x1) && conn) {
 701                 close_cnum(conn,req->vuid);
 702                 req->conn = NULL;
 703                 conn = NULL;
 704         }
 705
 706         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 707                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 708                 END_PROFILE(SMBtconX);
 709                 return;
 710         }
 711
 712         if (sconn->smb1.negprot.encrypted_passwords) {
 713                 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
 714                 if (lp_security() == SEC_SHARE) {
 715                         /*
 716                          * Security = share always has a pad byte
 717                          * after the password.
 718                          */
 719                         p = (const char *)req->buf + passlen + 1;
 720                 } else {
 721                         p = (const char *)req->buf + passlen;
 722                 }
 723         } else {
 724                 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
 725                 /* Ensure correct termination */
 726                 password.data[passlen]=0;
 727                 p = (const char *)req->buf + passlen + 1;
 728         }
 729
 730         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 731
 732         if (path == NULL) {
 733                 data_blob_clear_free(&password);
 734                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 735                 END_PROFILE(SMBtconX);
 736                 return;
 737         }
 738
 739         /*
 740          * the service name can be either: \\server\share
 741          * or share directly like on the DELL PowerVault 705
 742          */
 743         if (*path=='\\') {
 744                 q = strchr_m(path+2,'\\');
 745                 if (!q) {
 746                         data_blob_clear_free(&password);
 747                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 748                         END_PROFILE(SMBtconX);
 749                         return;
 750                 }
 751                 service = q+1;
 752         } else {
 753                 service = path;
 754         }
 755
 756         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 757                                 &client_devicetype, p,
 758                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 759
 760         if (client_devicetype == NULL) {
 761                 data_blob_clear_free(&password);
 762                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 763                 END_PROFILE(SMBtconX);
 764                 return;
 765         }
 766
 767         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 768
 769         conn = make_connection(sconn, service, password, client_devicetype,
 770                                req->vuid, &nt_status);
 771         req->conn =conn;
 772
 773         data_blob_clear_free(&password);
 774
 775         if (!conn) {
 776                 reply_nterror(req, nt_status);
 777                 END_PROFILE(SMBtconX);
 778                 return;
 779         }
 780
 781         if ( IS_IPC(conn) )
 782                 server_devicetype = "IPC";
 783         else if ( IS_PRINT(conn) )
 784                 server_devicetype = "LPT1:";
 785         else
 786                 server_devicetype = "A:";
 787
 788         if (get_Protocol() < PROTOCOL_NT1) {
 789                 reply_outbuf(req, 2, 0);
 790                 if (message_push_string(&req->outbuf, server_devicetype,
 791                                         STR_TERMINATE|STR_ASCII) == -1) {
 792                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 793                         END_PROFILE(SMBtconX);
 794                         return;
 795                 }
 796         } else {
 797                 /* NT sets the fstype of IPC$ to the null string */
 798                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 799
 800                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 801                         /* Return permissions. */
 802                         uint32 perm1 = 0;
 803                         uint32 perm2 = 0;
 804
 805                         reply_outbuf(req, 7, 0);
 806
 807                         if (IS_IPC(conn)) {
 808                                 perm1 = FILE_ALL_ACCESS;
 809                                 perm2 = FILE_ALL_ACCESS;
 810                         } else {
 811                                 perm1 = CAN_WRITE(conn) ?
 812                                                 SHARE_ALL_ACCESS :
 813                                                 SHARE_READ_ONLY;
 814                         }
 815
 816                         SIVAL(req->outbuf, smb_vwv3, perm1);
 817                         SIVAL(req->outbuf, smb_vwv5, perm2);
 818                 } else {
 819                         reply_outbuf(req, 3, 0);
 820                 }
 821
 822                 if ((message_push_string(&req->outbuf, server_devicetype,
 823                                          STR_TERMINATE|STR_ASCII) == -1)
 824                     || (message_push_string(&req->outbuf, fstype,
 825                                             STR_TERMINATE) == -1)) {
 826                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 827                         END_PROFILE(SMBtconX);
 828                         return;
 829                 }
 830
 831                 /* what does setting this bit do? It is set by NT4 and
 832                    may affect the ability to autorun mounted cdroms */
 833                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 834                       (lp_csc_policy(SNUM(conn)) << 2));
 835
 836                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
 837                         DEBUG(2,("Serving %s as a Dfs root\n",
 838                                  lp_servicename(SNUM(conn)) ));
 839                         SSVAL(req->outbuf, smb_vwv2,
 840                               SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
 841                 }
 842         }
 843
 844
 845         DEBUG(3,("tconX service=%s \n",
 846                  service));
 847
 848         /* set the incoming and outgoing tid to the just created one */
 849         SSVAL(req->inbuf,smb_tid,conn->cnum);
 850         SSVAL(req->outbuf,smb_tid,conn->cnum);
 851
 852         END_PROFILE(SMBtconX);
 853
 854         req->tid = conn->cnum;
 855         chain_reply(req);
 856         return;
 857 }
 858
 859 /****************************************************************************
 860  Reply to an unknown type.
 861 ****************************************************************************/
 862
 863 void reply_unknown_new(struct smb_request *req, uint8 type)
 864 {
 865         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 866                   smb_fn_name(type), type, type));
 867         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
 868         return;
 869 }
 870
 871 /****************************************************************************
 872  Reply to an ioctl.
 873  conn POINTER CAN BE NULL HERE !
 874 ****************************************************************************/
 875
 876 void reply_ioctl(struct smb_request *req)
 877 {
 878         connection_struct *conn = req->conn;
 879         uint16 device;
 880         uint16 function;
 881         uint32 ioctl_code;
 882         int replysize;
 883         char *p;
 884
 885         START_PROFILE(SMBioctl);
 886
 887         if (req->wct < 3) {
 888                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 889                 END_PROFILE(SMBioctl);
 890                 return;
 891         }
 892
 893         device     = SVAL(req->vwv+1, 0);
 894         function   = SVAL(req->vwv+2, 0);
 895         ioctl_code = (device << 16) + function;
 896
 897         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 898
 899         switch (ioctl_code) {
 900             case IOCTL_QUERY_JOB_INFO:
 901                     replysize = 32;
 902                     break;
 903             default:
 904                     reply_force_doserror(req, ERRSRV, ERRnosupport);
 905                     END_PROFILE(SMBioctl);
 906                     return;
 907         }
 908
 909         reply_outbuf(req, 8, replysize+1);
 910         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 911         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 912         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 913         p = smb_buf(req->outbuf);
 914         memset(p, '\0', replysize+1); /* valgrind-safe. */
 915         p += 1;          /* Allow for alignment */
 916
 917         switch (ioctl_code) {
 918                 case IOCTL_QUERY_JOB_INFO:
 919                 {
 920                         files_struct *fsp = file_fsp(
 921                                 req, SVAL(req->vwv+0, 0));
 922                         if (!fsp) {
 923                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 924                                 END_PROFILE(SMBioctl);
 925                                 return;
 926                         }
 927                         SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
 928                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 929                                     global_myname(), 15,
 930                                     STR_TERMINATE|STR_ASCII);
 931                         if (conn) {
 932                                 srvstr_push((char *)req->outbuf, req->flags2,
 933                                             p+18, lp_servicename(SNUM(conn)),
 934                                             13, STR_TERMINATE|STR_ASCII);
 935                         } else {
 936                                 memset(p+18, 0, 13);
 937                         }
 938                         break;
 939                 }
 940         }
 941
 942         END_PROFILE(SMBioctl);
 943         return;
 944 }
 945
 946 /****************************************************************************
 947  Strange checkpath NTSTATUS mapping.
 948 ****************************************************************************/
 949
 950 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
 951 {
 952         /* Strange DOS error code semantics only for checkpath... */
 953         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 954                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 955                         /* We need to map to ERRbadpath */
 956                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 957                 }
 958         }
 959         return status;
 960 }
 961
 962 /****************************************************************************
 963  Reply to a checkpath.
 964 ****************************************************************************/
 965
 966 void reply_checkpath(struct smb_request *req)
 967 {
 968         connection_struct *conn = req->conn;
 969         struct smb_filename *smb_fname = NULL;
 970         char *name = NULL;
 971         NTSTATUS status;
 972         TALLOC_CTX *ctx = talloc_tos();
 973
 974         START_PROFILE(SMBcheckpath);
 975
 976         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
 977                             STR_TERMINATE, &status);
 978
 979         if (!NT_STATUS_IS_OK(status)) {
 980                 status = map_checkpath_error(req->flags2, status);
 981                 reply_nterror(req, status);
 982                 END_PROFILE(SMBcheckpath);
 983                 return;
 984         }
 985
 986         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
 987
 988         status = filename_convert(ctx,
 989                                 conn,
 990                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
 991                                 name,
 992                                 0,
 993                                 NULL,
 994                                 &smb_fname);
 995
 996         if (!NT_STATUS_IS_OK(status)) {
 997                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
 998                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
 999                                         ERRSRV, ERRbadpath);
1000                         END_PROFILE(SMBcheckpath);
1001                         return;
1002                 }
1003                 goto path_err;
1004         }
1005
1006         if (!VALID_STAT(smb_fname->st) &&
1007             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1008                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1009                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1010                 status = map_nt_error_from_unix(errno);
1011                 goto path_err;
1012         }
1013
1014         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1015                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1016                                 ERRDOS, ERRbadpath);
1017                 goto out;
1018         }
1019
1020         reply_outbuf(req, 0, 0);
1021
1022  path_err:
1023         /* We special case this - as when a Windows machine
1024                 is parsing a path is steps through the components
1025                 one at a time - if a component fails it expects
1026                 ERRbadpath, not ERRbadfile.
1027         */
1028         status = map_checkpath_error(req->flags2, status);
1029         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1030                 /*
1031                  * Windows returns different error codes if
1032                  * the parent directory is valid but not the
1033                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1034                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1035                  * if the path is invalid.
1036                  */
1037                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1038                                 ERRDOS, ERRbadpath);
1039                 goto out;
1040         }
1041
1042         reply_nterror(req, status);
1043
1044  out:
1045         TALLOC_FREE(smb_fname);
1046         END_PROFILE(SMBcheckpath);
1047         return;
1048 }
1049
1050 /****************************************************************************
1051  Reply to a getatr.
1052 ****************************************************************************/
1053
1054 void reply_getatr(struct smb_request *req)
1055 {
1056         connection_struct *conn = req->conn;
1057         struct smb_filename *smb_fname = NULL;
1058         char *fname = NULL;
1059         int mode=0;
1060         SMB_OFF_T size=0;
1061         time_t mtime=0;
1062         const char *p;
1063         NTSTATUS status;
1064         TALLOC_CTX *ctx = talloc_tos();
1065         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1066
1067         START_PROFILE(SMBgetatr);
1068
1069         p = (const char *)req->buf + 1;
1070         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1071         if (!NT_STATUS_IS_OK(status)) {
1072                 reply_nterror(req, status);
1073                 goto out;
1074         }
1075
1076         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1077                 under WfWg - weird! */
1078         if (*fname == '\0') {
1079                 mode = aHIDDEN | aDIR;
1080                 if (!CAN_WRITE(conn)) {
1081                         mode |= aRONLY;
1082                 }
1083                 size = 0;
1084                 mtime = 0;
1085         } else {
1086                 status = filename_convert(ctx,
1087                                 conn,
1088                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1089                                 fname,
1090                                 0,
1091                                 NULL,
1092                                 &smb_fname);
1093                 if (!NT_STATUS_IS_OK(status)) {
1094                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1095                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1096                                                 ERRSRV, ERRbadpath);
1097                                 goto out;
1098                         }
1099                         reply_nterror(req, status);
1100                         goto out;
1101                 }
1102                 if (!VALID_STAT(smb_fname->st) &&
1103                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1104                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1105                                  smb_fname_str_dbg(smb_fname),
1106                                  strerror(errno)));
1107                         reply_nterror(req,  map_nt_error_from_unix(errno));
1108                         goto out;
1109                 }
1110
1111                 mode = dos_mode(conn, smb_fname);
1112                 size = smb_fname->st.st_ex_size;
1113
1114                 if (ask_sharemode) {
1115                         struct timespec write_time_ts;
1116                         struct file_id fileid;
1117
1118                         ZERO_STRUCT(write_time_ts);
1119                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1120                         get_file_infos(fileid, NULL, &write_time_ts);
1121                         if (!null_timespec(write_time_ts)) {
1122                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1123                         }
1124                 }
1125
1126                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1127                 if (mode & aDIR) {
1128                         size = 0;
1129                 }
1130         }
1131
1132         reply_outbuf(req, 10, 0);
1133
1134         SSVAL(req->outbuf,smb_vwv0,mode);
1135         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1136                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1137         } else {
1138                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1139         }
1140         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1141
1142         if (get_Protocol() >= PROTOCOL_NT1) {
1143                 SSVAL(req->outbuf, smb_flg2,
1144                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1145         }
1146
1147         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1148                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1149
1150  out:
1151         TALLOC_FREE(smb_fname);
1152         TALLOC_FREE(fname);
1153         END_PROFILE(SMBgetatr);
1154         return;
1155 }
1156
1157 /****************************************************************************
1158  Reply to a setatr.
1159 ****************************************************************************/
1160
1161 void reply_setatr(struct smb_request *req)
1162 {
1163         struct smb_file_time ft;
1164         connection_struct *conn = req->conn;
1165         struct smb_filename *smb_fname = NULL;
1166         char *fname = NULL;
1167         int mode;
1168         time_t mtime;
1169         const char *p;
1170         NTSTATUS status;
1171         TALLOC_CTX *ctx = talloc_tos();
1172
1173         START_PROFILE(SMBsetatr);
1174
1175         ZERO_STRUCT(ft);
1176
1177         if (req->wct < 2) {
1178                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1179                 goto out;
1180         }
1181
1182         p = (const char *)req->buf + 1;
1183         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1184         if (!NT_STATUS_IS_OK(status)) {
1185                 reply_nterror(req, status);
1186                 goto out;
1187         }
1188
1189         status = filename_convert(ctx,
1190                                 conn,
1191                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1192                                 fname,
1193                                 0,
1194                                 NULL,
1195                                 &smb_fname);
1196         if (!NT_STATUS_IS_OK(status)) {
1197                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1198                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1199                                         ERRSRV, ERRbadpath);
1200                         goto out;
1201                 }
1202                 reply_nterror(req, status);
1203                 goto out;
1204         }
1205
1206         if (smb_fname->base_name[0] == '.' &&
1207             smb_fname->base_name[1] == '\0') {
1208                 /*
1209                  * Not sure here is the right place to catch this
1210                  * condition. Might be moved to somewhere else later -- vl
1211                  */
1212                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1213                 goto out;
1214         }
1215
1216         mode = SVAL(req->vwv+0, 0);
1217         mtime = srv_make_unix_date3(req->vwv+1);
1218
1219         ft.mtime = convert_time_t_to_timespec(mtime);
1220         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1221         if (!NT_STATUS_IS_OK(status)) {
1222                 reply_nterror(req, status);
1223                 goto out;
1224         }
1225
1226         if (mode != FILE_ATTRIBUTE_NORMAL) {
1227                 if (VALID_STAT_OF_DIR(smb_fname->st))
1228                         mode |= aDIR;
1229                 else
1230                         mode &= ~aDIR;
1231
1232                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1233                                      false) != 0) {
1234                         reply_nterror(req, map_nt_error_from_unix(errno));
1235                         goto out;
1236                 }
1237         }
1238
1239         reply_outbuf(req, 0, 0);
1240
1241         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1242                  mode));
1243  out:
1244         TALLOC_FREE(smb_fname);
1245         END_PROFILE(SMBsetatr);
1246         return;
1247 }
1248
1249 /****************************************************************************
1250  Reply to a dskattr.
1251 ****************************************************************************/
1252
1253 void reply_dskattr(struct smb_request *req)
1254 {
1255         connection_struct *conn = req->conn;
1256         uint64_t dfree,dsize,bsize;
1257         START_PROFILE(SMBdskattr);
1258
1259         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1260                 reply_nterror(req, map_nt_error_from_unix(errno));
1261                 END_PROFILE(SMBdskattr);
1262                 return;
1263         }
1264
1265         reply_outbuf(req, 5, 0);
1266
1267         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1268                 double total_space, free_space;
1269                 /* we need to scale this to a number that DOS6 can handle. We
1270                    use floating point so we can handle large drives on systems
1271                    that don't have 64 bit integers
1272
1273                    we end up displaying a maximum of 2G to DOS systems
1274                 */
1275                 total_space = dsize * (double)bsize;
1276                 free_space = dfree * (double)bsize;
1277
1278                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1279                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1280
1281                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1282                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1283
1284                 SSVAL(req->outbuf,smb_vwv0,dsize);
1285                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1286                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1287                 SSVAL(req->outbuf,smb_vwv3,dfree);
1288         } else {
1289                 SSVAL(req->outbuf,smb_vwv0,dsize);
1290                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1291                 SSVAL(req->outbuf,smb_vwv2,512);
1292                 SSVAL(req->outbuf,smb_vwv3,dfree);
1293         }
1294
1295         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1296
1297         END_PROFILE(SMBdskattr);
1298         return;
1299 }
1300
1301 /*
1302  * Utility function to split the filename from the directory.
1303  */
1304 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1305                                      char **fname_dir_out,
1306                                      char **fname_mask_out)
1307 {
1308         const char *p = NULL;
1309         char *fname_dir = NULL;
1310         char *fname_mask = NULL;
1311
1312         p = strrchr_m(fname_in, '/');
1313         if (!p) {
1314                 fname_dir = talloc_strdup(ctx, ".");
1315                 fname_mask = talloc_strdup(ctx, fname_in);
1316         } else {
1317                 fname_dir = talloc_strndup(ctx, fname_in,
1318                     PTR_DIFF(p, fname_in));
1319                 fname_mask = talloc_strdup(ctx, p+1);
1320         }
1321
1322         if (!fname_dir || !fname_mask) {
1323                 TALLOC_FREE(fname_dir);
1324                 TALLOC_FREE(fname_mask);
1325                 return NT_STATUS_NO_MEMORY;
1326         }
1327
1328         *fname_dir_out = fname_dir;
1329         *fname_mask_out = fname_mask;
1330         return NT_STATUS_OK;
1331 }
1332
1333 /****************************************************************************
1334  Reply to a search.
1335  Can be called from SMBsearch, SMBffirst or SMBfunique.
1336 ****************************************************************************/
1337
1338 void reply_search(struct smb_request *req)
1339 {
1340         connection_struct *conn = req->conn;
1341         char *path = NULL;
1342         const char *mask = NULL;
1343         char *directory = NULL;
1344         struct smb_filename *smb_fname = NULL;
1345         char *fname = NULL;
1346         SMB_OFF_T size;
1347         uint32 mode;
1348         struct timespec date;
1349         uint32 dirtype;
1350         unsigned int numentries = 0;
1351         unsigned int maxentries = 0;
1352         bool finished = False;
1353         const char *p;
1354         int status_len;
1355         char status[21];
1356         int dptr_num= -1;
1357         bool check_descend = False;
1358         bool expect_close = False;
1359         NTSTATUS nt_status;
1360         bool mask_contains_wcard = False;
1361         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1362         TALLOC_CTX *ctx = talloc_tos();
1363         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1364         struct dptr_struct *dirptr = NULL;
1365         struct smbd_server_connection *sconn = smbd_server_conn;
1366
1367         START_PROFILE(SMBsearch);
1368
1369         if (req->wct < 2) {
1370                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1371                 goto out;
1372         }
1373
1374         if (lp_posix_pathnames()) {
1375                 reply_unknown_new(req, req->cmd);
1376                 goto out;
1377         }
1378
1379         /* If we were called as SMBffirst then we must expect close. */
1380         if(req->cmd == SMBffirst) {
1381                 expect_close = True;
1382         }
1383
1384         reply_outbuf(req, 1, 3);
1385         maxentries = SVAL(req->vwv+0, 0);
1386         dirtype = SVAL(req->vwv+1, 0);
1387         p = (const char *)req->buf + 1;
1388         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1389                                        &nt_status, &mask_contains_wcard);
1390         if (!NT_STATUS_IS_OK(nt_status)) {
1391                 reply_nterror(req, nt_status);
1392                 goto out;
1393         }
1394
1395         p++;
1396         status_len = SVAL(p, 0);
1397         p += 2;
1398
1399         /* dirtype &= ~aDIR; */
1400
1401         if (status_len == 0) {
1402                 nt_status = filename_convert(ctx, conn,
1403                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1404                                              path,
1405                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1406                                              &mask_contains_wcard,
1407                                              &smb_fname);
1408                 if (!NT_STATUS_IS_OK(nt_status)) {
1409                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1410                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1411                                                 ERRSRV, ERRbadpath);
1412                                 goto out;
1413                         }
1414                         reply_nterror(req, nt_status);
1415                         goto out;
1416                 }
1417
1418                 directory = smb_fname->base_name;
1419
1420                 p = strrchr_m(directory,'/');
1421                 if ((p != NULL) && (*directory != '/')) {
1422                         mask = p + 1;
1423                         directory = talloc_strndup(ctx, directory,
1424                                                    PTR_DIFF(p, directory));
1425                 } else {
1426                         mask = directory;
1427                         directory = talloc_strdup(ctx,".");
1428                 }
1429
1430                 if (!directory) {
1431                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1432                         goto out;
1433                 }
1434
1435                 memset((char *)status,'\0',21);
1436                 SCVAL(status,0,(dirtype & 0x1F));
1437
1438                 nt_status = dptr_create(conn,
1439                                         directory,
1440                                         True,
1441                                         expect_close,
1442                                         req->smbpid,
1443                                         mask,
1444                                         mask_contains_wcard,
1445                                         dirtype,
1446                                         &dirptr);
1447                 if (!NT_STATUS_IS_OK(nt_status)) {
1448                         reply_nterror(req, nt_status);
1449                         goto out;
1450                 }
1451                 dptr_num = dptr_dnum(dirptr);
1452         } else {
1453                 int status_dirtype;
1454                 const char *dirpath;
1455
1456                 memcpy(status,p,21);
1457                 status_dirtype = CVAL(status,0) & 0x1F;
1458                 if (status_dirtype != (dirtype & 0x1F)) {
1459                         dirtype = status_dirtype;
1460                 }
1461
1462                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1463                 if (!dirptr) {
1464                         goto SearchEmpty;
1465                 }
1466                 dirpath = dptr_path(sconn, dptr_num);
1467                 directory = talloc_strdup(ctx, dirpath);
1468                 if (!directory) {
1469                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1470                         goto out;
1471                 }
1472
1473                 mask = dptr_wcard(sconn, dptr_num);
1474                 if (!mask) {
1475                         goto SearchEmpty;
1476                 }
1477                 /*
1478                  * For a 'continue' search we have no string. So
1479                  * check from the initial saved string.
1480                  */
1481                 mask_contains_wcard = ms_has_wild(mask);
1482                 dirtype = dptr_attr(sconn, dptr_num);
1483         }
1484
1485         DEBUG(4,("dptr_num is %d\n",dptr_num));
1486
1487         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1488         dptr_init_search_op(dirptr);
1489
1490         if ((dirtype&0x1F) == aVOLID) {
1491                 char buf[DIR_STRUCT_SIZE];
1492                 memcpy(buf,status,21);
1493                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1494                                 0,aVOLID,0,!allow_long_path_components)) {
1495                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1496                         goto out;
1497                 }
1498                 dptr_fill(sconn, buf+12,dptr_num);
1499                 if (dptr_zero(buf+12) && (status_len==0)) {
1500                         numentries = 1;
1501                 } else {
1502                         numentries = 0;
1503                 }
1504                 if (message_push_blob(&req->outbuf,
1505                                       data_blob_const(buf, sizeof(buf)))
1506                     == -1) {
1507                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1508                         goto out;
1509                 }
1510         } else {
1511                 unsigned int i;
1512                 maxentries = MIN(
1513                         maxentries,
1514                         ((BUFFER_SIZE -
1515                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1516                          /DIR_STRUCT_SIZE));
1517
1518                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1519                         directory,lp_dontdescend(SNUM(conn))));
1520                 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1521                         check_descend = True;
1522                 }
1523
1524                 for (i=numentries;(i<maxentries) && !finished;i++) {
1525                         finished = !get_dir_entry(ctx,
1526                                                   dirptr,
1527                                                   mask,
1528                                                   dirtype,
1529                                                   &fname,
1530                                                   &size,
1531                                                   &mode,
1532                                                   &date,
1533                                                   check_descend,
1534                                                   ask_sharemode);
1535                         if (!finished) {
1536                                 char buf[DIR_STRUCT_SIZE];
1537                                 memcpy(buf,status,21);
1538                                 if (!make_dir_struct(ctx,
1539                                                 buf,
1540                                                 mask,
1541                                                 fname,
1542                                                 size,
1543                                                 mode,
1544                                                 convert_timespec_to_time_t(date),
1545                                                 !allow_long_path_components)) {
1546                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1547                                         goto out;
1548                                 }
1549                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1550                                         break;
1551                                 }
1552                                 if (message_push_blob(&req->outbuf,
1553                                                       data_blob_const(buf, sizeof(buf)))
1554                                     == -1) {
1555                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1556                                         goto out;
1557                                 }
1558                                 numentries++;
1559                         }
1560                 }
1561         }
1562
1563   SearchEmpty:
1564
1565         /* If we were called as SMBffirst with smb_search_id == NULL
1566                 and no entries were found then return error and close dirptr
1567                 (X/Open spec) */
1568
1569         if (numentries == 0) {
1570                 dptr_close(sconn, &dptr_num);
1571         } else if(expect_close && status_len == 0) {
1572                 /* Close the dptr - we know it's gone */
1573                 dptr_close(sconn, &dptr_num);
1574         }
1575
1576         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1577         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1578                 dptr_close(sconn, &dptr_num);
1579         }
1580
1581         if ((numentries == 0) && !mask_contains_wcard) {
1582                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1583                 goto out;
1584         }
1585
1586         SSVAL(req->outbuf,smb_vwv0,numentries);
1587         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1588         SCVAL(smb_buf(req->outbuf),0,5);
1589         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1590
1591         /* The replies here are never long name. */
1592         SSVAL(req->outbuf, smb_flg2,
1593               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1594         if (!allow_long_path_components) {
1595                 SSVAL(req->outbuf, smb_flg2,
1596                       SVAL(req->outbuf, smb_flg2)
1597                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1598         }
1599
1600         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1601         SSVAL(req->outbuf, smb_flg2,
1602               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1603
1604         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1605                 smb_fn_name(req->cmd),
1606                 mask,
1607                 directory,
1608                 dirtype,
1609                 numentries,
1610                 maxentries ));
1611  out:
1612         TALLOC_FREE(directory);
1613         TALLOC_FREE(smb_fname);
1614         END_PROFILE(SMBsearch);
1615         return;
1616 }
1617
1618 /****************************************************************************
1619  Reply to a fclose (stop directory search).
1620 ****************************************************************************/
1621
1622 void reply_fclose(struct smb_request *req)
1623 {
1624         int status_len;
1625         char status[21];
1626         int dptr_num= -2;
1627         const char *p;
1628         char *path = NULL;
1629         NTSTATUS err;
1630         bool path_contains_wcard = False;
1631         TALLOC_CTX *ctx = talloc_tos();
1632         struct smbd_server_connection *sconn = smbd_server_conn;
1633
1634         START_PROFILE(SMBfclose);
1635
1636         if (lp_posix_pathnames()) {
1637                 reply_unknown_new(req, req->cmd);
1638                 END_PROFILE(SMBfclose);
1639                 return;
1640         }
1641
1642         p = (const char *)req->buf + 1;
1643         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1644                                        &err, &path_contains_wcard);
1645         if (!NT_STATUS_IS_OK(err)) {
1646                 reply_nterror(req, err);
1647                 END_PROFILE(SMBfclose);
1648                 return;
1649         }
1650         p++;
1651         status_len = SVAL(p,0);
1652         p += 2;
1653
1654         if (status_len == 0) {
1655                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1656                 END_PROFILE(SMBfclose);
1657                 return;
1658         }
1659
1660         memcpy(status,p,21);
1661
1662         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1663                 /*  Close the dptr - we know it's gone */
1664                 dptr_close(sconn, &dptr_num);
1665         }
1666
1667         reply_outbuf(req, 1, 0);
1668         SSVAL(req->outbuf,smb_vwv0,0);
1669
1670         DEBUG(3,("search close\n"));
1671
1672         END_PROFILE(SMBfclose);
1673         return;
1674 }
1675
1676 /****************************************************************************
1677  Reply to an open.
1678 ****************************************************************************/
1679
1680 void reply_open(struct smb_request *req)
1681 {
1682         connection_struct *conn = req->conn;
1683         struct smb_filename *smb_fname = NULL;
1684         char *fname = NULL;
1685         uint32 fattr=0;
1686         SMB_OFF_T size = 0;
1687         time_t mtime=0;
1688         int info;
1689         files_struct *fsp;
1690         int oplock_request;
1691         int deny_mode;
1692         uint32 dos_attr;
1693         uint32 access_mask;
1694         uint32 share_mode;
1695         uint32 create_disposition;
1696         uint32 create_options = 0;
1697         uint32_t private_flags = 0;
1698         NTSTATUS status;
1699         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1700         TALLOC_CTX *ctx = talloc_tos();
1701
1702         START_PROFILE(SMBopen);
1703
1704         if (req->wct < 2) {
1705                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1706                 goto out;
1707         }
1708
1709         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1710         deny_mode = SVAL(req->vwv+0, 0);
1711         dos_attr = SVAL(req->vwv+1, 0);
1712
1713         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1714                             STR_TERMINATE, &status);
1715         if (!NT_STATUS_IS_OK(status)) {
1716                 reply_nterror(req, status);
1717                 goto out;
1718         }
1719
1720         status = filename_convert(ctx,
1721                                 conn,
1722                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1723                                 fname,
1724                                 0,
1725                                 NULL,
1726                                 &smb_fname);
1727         if (!NT_STATUS_IS_OK(status)) {
1728                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1729                         reply_botherror(req,
1730                                         NT_STATUS_PATH_NOT_COVERED,
1731                                         ERRSRV, ERRbadpath);
1732                         goto out;
1733                 }
1734                 reply_nterror(req, status);
1735                 goto out;
1736         }
1737
1738         if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1739                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1740                                          &share_mode, &create_disposition,
1741                                          &create_options, &private_flags)) {
1742                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1743                 goto out;
1744         }
1745
1746         status = SMB_VFS_CREATE_FILE(
1747                 conn,                                   /* conn */
1748                 req,                                    /* req */
1749                 0,                                      /* root_dir_fid */
1750                 smb_fname,                              /* fname */
1751                 access_mask,                            /* access_mask */
1752                 share_mode,                             /* share_access */
1753                 create_disposition,                     /* create_disposition*/
1754                 create_options,                         /* create_options */
1755                 dos_attr,                               /* file_attributes */
1756                 oplock_request,                         /* oplock_request */
1757                 0,                                      /* allocation_size */
1758                 private_flags,
1759                 NULL,                                   /* sd */
1760                 NULL,                                   /* ea_list */
1761                 &fsp,                                   /* result */
1762                 &info);                                 /* pinfo */
1763
1764         if (!NT_STATUS_IS_OK(status)) {
1765                 if (open_was_deferred(req->mid)) {
1766                         /* We have re-scheduled this call. */
1767                         goto out;
1768                 }
1769                 reply_openerror(req, status);
1770                 goto out;
1771         }
1772
1773         size = smb_fname->st.st_ex_size;
1774         fattr = dos_mode(conn, smb_fname);
1775
1776         /* Deal with other possible opens having a modified
1777            write time. JRA. */
1778         if (ask_sharemode) {
1779                 struct timespec write_time_ts;
1780
1781                 ZERO_STRUCT(write_time_ts);
1782                 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1783                 if (!null_timespec(write_time_ts)) {
1784                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1785                 }
1786         }
1787
1788         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1789
1790         if (fattr & aDIR) {
1791                 DEBUG(3,("attempt to open a directory %s\n",
1792                          fsp_str_dbg(fsp)));
1793                 close_file(req, fsp, ERROR_CLOSE);
1794                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1795                         ERRDOS, ERRnoaccess);
1796                 goto out;
1797         }
1798
1799         reply_outbuf(req, 7, 0);
1800         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1801         SSVAL(req->outbuf,smb_vwv1,fattr);
1802         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1803                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1804         } else {
1805                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1806         }
1807         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1808         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1809
1810         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1811                 SCVAL(req->outbuf,smb_flg,
1812                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1813         }
1814
1815         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1816                 SCVAL(req->outbuf,smb_flg,
1817                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1818         }
1819  out:
1820         TALLOC_FREE(smb_fname);
1821         END_PROFILE(SMBopen);
1822         return;
1823 }
1824
1825 /****************************************************************************
1826  Reply to an open and X.
1827 ****************************************************************************/
1828
1829 void reply_open_and_X(struct smb_request *req)
1830 {
1831         connection_struct *conn = req->conn;
1832         struct smb_filename *smb_fname = NULL;
1833         char *fname = NULL;
1834         uint16 open_flags;
1835         int deny_mode;
1836         uint32 smb_attr;
1837         /* Breakout the oplock request bits so we can set the
1838                 reply bits separately. */
1839         int ex_oplock_request;
1840         int core_oplock_request;
1841         int oplock_request;
1842 #if 0
1843         int smb_sattr = SVAL(req->vwv+4, 0);
1844         uint32 smb_time = make_unix_date3(req->vwv+6);
1845 #endif
1846         int smb_ofun;
1847         uint32 fattr=0;
1848         int mtime=0;
1849         int smb_action = 0;
1850         files_struct *fsp;
1851         NTSTATUS status;
1852         uint64_t allocation_size;
1853         ssize_t retval = -1;
1854         uint32 access_mask;
1855         uint32 share_mode;
1856         uint32 create_disposition;
1857         uint32 create_options = 0;
1858         uint32_t private_flags = 0;
1859         TALLOC_CTX *ctx = talloc_tos();
1860
1861         START_PROFILE(SMBopenX);
1862
1863         if (req->wct < 15) {
1864                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1865                 goto out;
1866         }
1867
1868         open_flags = SVAL(req->vwv+2, 0);
1869         deny_mode = SVAL(req->vwv+3, 0);
1870         smb_attr = SVAL(req->vwv+5, 0);
1871         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1872         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1873         oplock_request = ex_oplock_request | core_oplock_request;
1874         smb_ofun = SVAL(req->vwv+8, 0);
1875         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1876
1877         /* If it's an IPC, pass off the pipe handler. */
1878         if (IS_IPC(conn)) {
1879                 if (lp_nt_pipe_support()) {
1880                         reply_open_pipe_and_X(conn, req);
1881                 } else {
1882                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1883                 }
1884                 goto out;
1885         }
1886
1887         /* XXXX we need to handle passed times, sattr and flags */
1888         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1889                         STR_TERMINATE, &status);
1890         if (!NT_STATUS_IS_OK(status)) {
1891                 reply_nterror(req, status);
1892                 goto out;
1893         }
1894
1895         status = filename_convert(ctx,
1896                                 conn,
1897                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1898                                 fname,
1899                                 0,
1900                                 NULL,
1901                                 &smb_fname);
1902         if (!NT_STATUS_IS_OK(status)) {
1903                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1904                         reply_botherror(req,
1905                                         NT_STATUS_PATH_NOT_COVERED,
1906                                         ERRSRV, ERRbadpath);
1907                         goto out;
1908                 }
1909                 reply_nterror(req, status);
1910                 goto out;
1911         }
1912
1913         if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1914                                          &access_mask, &share_mode,
1915                                          &create_disposition,
1916                                          &create_options,
1917                                          &private_flags)) {
1918                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1919                 goto out;
1920         }
1921
1922         status = SMB_VFS_CREATE_FILE(
1923                 conn,                                   /* conn */
1924                 req,                                    /* req */
1925                 0,                                      /* root_dir_fid */
1926                 smb_fname,                              /* fname */
1927                 access_mask,                            /* access_mask */
1928                 share_mode,                             /* share_access */
1929                 create_disposition,                     /* create_disposition*/
1930                 create_options,                         /* create_options */
1931                 smb_attr,                               /* file_attributes */
1932                 oplock_request,                         /* oplock_request */
1933                 0,                                      /* allocation_size */
1934                 private_flags,
1935                 NULL,                                   /* sd */
1936                 NULL,                                   /* ea_list */
1937                 &fsp,                                   /* result */
1938                 &smb_action);                           /* pinfo */
1939
1940         if (!NT_STATUS_IS_OK(status)) {
1941                 if (open_was_deferred(req->mid)) {
1942                         /* We have re-scheduled this call. */
1943                         goto out;
1944                 }
1945                 reply_openerror(req, status);
1946                 goto out;
1947         }
1948
1949         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1950            if the file is truncated or created. */
1951         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1952                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1953                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1954                         close_file(req, fsp, ERROR_CLOSE);
1955                         reply_nterror(req, NT_STATUS_DISK_FULL);
1956                         goto out;
1957                 }
1958                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1959                 if (retval < 0) {
1960                         close_file(req, fsp, ERROR_CLOSE);
1961                         reply_nterror(req, NT_STATUS_DISK_FULL);
1962                         goto out;
1963                 }
1964                 smb_fname->st.st_ex_size =
1965                     SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1966         }
1967
1968         fattr = dos_mode(conn, smb_fname);
1969         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1970         if (fattr & aDIR) {
1971                 close_file(req, fsp, ERROR_CLOSE);
1972                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1973                 goto out;
1974         }
1975
1976         /* If the caller set the extended oplock request bit
1977                 and we granted one (by whatever means) - set the
1978                 correct bit for extended oplock reply.
1979         */
1980
1981         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1982                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1983         }
1984
1985         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1986                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1987         }
1988
1989         /* If the caller set the core oplock request bit
1990                 and we granted one (by whatever means) - set the
1991                 correct bit for core oplock reply.
1992         */
1993
1994         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1995                 reply_outbuf(req, 19, 0);
1996         } else {
1997                 reply_outbuf(req, 15, 0);
1998         }
1999
2000         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2001                 SCVAL(req->outbuf, smb_flg,
2002                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2003         }
2004
2005         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2006                 SCVAL(req->outbuf, smb_flg,
2007                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2008         }
2009
2010         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2011         SSVAL(req->outbuf,smb_vwv3,fattr);
2012         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2013                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2014         } else {
2015                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2016         }
2017         SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2018         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2019         SSVAL(req->outbuf,smb_vwv11,smb_action);
2020
2021         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2022                 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
2023         }
2024
2025         chain_reply(req);
2026  out:
2027         TALLOC_FREE(smb_fname);
2028         END_PROFILE(SMBopenX);
2029         return;
2030 }
2031
2032 /****************************************************************************
2033  Reply to a SMBulogoffX.
2034 ****************************************************************************/
2035
2036 void reply_ulogoffX(struct smb_request *req)
2037 {
2038         struct smbd_server_connection *sconn = smbd_server_conn;
2039         user_struct *vuser;
2040
2041         START_PROFILE(SMBulogoffX);
2042
2043         vuser = get_valid_user_struct(sconn, req->vuid);
2044
2045         if(vuser == NULL) {
2046                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2047                          req->vuid));
2048         }
2049
2050         /* in user level security we are supposed to close any files
2051                 open by this user */
2052         if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2053                 file_close_user(req->vuid);
2054         }
2055
2056         invalidate_vuid(sconn, req->vuid);
2057
2058         reply_outbuf(req, 2, 0);
2059
2060         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2061
2062         END_PROFILE(SMBulogoffX);
2063         req->vuid = UID_FIELD_INVALID;
2064         chain_reply(req);
2065 }
2066
2067 /****************************************************************************
2068  Reply to a mknew or a create.
2069 ****************************************************************************/
2070
2071 void reply_mknew(struct smb_request *req)
2072 {
2073         connection_struct *conn = req->conn;
2074         struct smb_filename *smb_fname = NULL;
2075         char *fname = NULL;
2076         uint32 fattr = 0;
2077         struct smb_file_time ft;
2078         files_struct *fsp;
2079         int oplock_request = 0;
2080         NTSTATUS status;
2081         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2082         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2083         uint32 create_disposition;
2084         uint32 create_options = 0;
2085         TALLOC_CTX *ctx = talloc_tos();
2086
2087         START_PROFILE(SMBcreate);
2088         ZERO_STRUCT(ft);
2089
2090         if (req->wct < 3) {
2091                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2092                 goto out;
2093         }
2094
2095         fattr = SVAL(req->vwv+0, 0);
2096         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2097
2098         /* mtime. */
2099         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2100
2101         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2102                             STR_TERMINATE, &status);
2103         if (!NT_STATUS_IS_OK(status)) {
2104                 reply_nterror(req, status);
2105                 goto out;
2106         }
2107
2108         status = filename_convert(ctx,
2109                                 conn,
2110                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2111                                 fname,
2112                                 0,
2113                                 NULL,
2114                                 &smb_fname);
2115         if (!NT_STATUS_IS_OK(status)) {
2116                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2117                         reply_botherror(req,
2118                                         NT_STATUS_PATH_NOT_COVERED,
2119                                         ERRSRV, ERRbadpath);
2120                         goto out;
2121                 }
2122                 reply_nterror(req, status);
2123                 goto out;
2124         }
2125
2126         if (fattr & aVOLID) {
2127                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2128                          "please report this\n",
2129                          smb_fname_str_dbg(smb_fname)));
2130         }
2131
2132         if(req->cmd == SMBmknew) {
2133                 /* We should fail if file exists. */
2134                 create_disposition = FILE_CREATE;
2135         } else {
2136                 /* Create if file doesn't exist, truncate if it does. */
2137                 create_disposition = FILE_OVERWRITE_IF;
2138         }
2139
2140         status = SMB_VFS_CREATE_FILE(
2141                 conn,                                   /* conn */
2142                 req,                                    /* req */
2143                 0,                                      /* root_dir_fid */
2144                 smb_fname,                              /* fname */
2145                 access_mask,                            /* access_mask */
2146                 share_mode,                             /* share_access */
2147                 create_disposition,                     /* create_disposition*/
2148                 create_options,                         /* create_options */
2149                 fattr,                                  /* file_attributes */
2150                 oplock_request,                         /* oplock_request */
2151                 0,                                      /* allocation_size */
2152                 0,                                      /* private_flags */
2153                 NULL,                                   /* sd */
2154                 NULL,                                   /* ea_list */
2155                 &fsp,                                   /* result */
2156                 NULL);                                  /* pinfo */
2157
2158         if (!NT_STATUS_IS_OK(status)) {
2159                 if (open_was_deferred(req->mid)) {
2160                         /* We have re-scheduled this call. */
2161                         goto out;
2162                 }
2163                 reply_openerror(req, status);
2164                 goto out;
2165         }
2166
2167         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2168         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2169         if (!NT_STATUS_IS_OK(status)) {
2170                 END_PROFILE(SMBcreate);
2171                 goto out;
2172         }
2173
2174         reply_outbuf(req, 1, 0);
2175         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2176
2177         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2178                 SCVAL(req->outbuf,smb_flg,
2179                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2180         }
2181
2182         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2183                 SCVAL(req->outbuf,smb_flg,
2184                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2185         }
2186
2187         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2188         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2189                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2190                   (unsigned int)fattr));
2191
2192  out:
2193         TALLOC_FREE(smb_fname);
2194         END_PROFILE(SMBcreate);
2195         return;
2196 }
2197
2198 /****************************************************************************
2199  Reply to a create temporary file.
2200 ****************************************************************************/
2201
2202 void reply_ctemp(struct smb_request *req)
2203 {
2204         connection_struct *conn = req->conn;
2205         struct smb_filename *smb_fname = NULL;
2206         char *fname = NULL;
2207         uint32 fattr;
2208         files_struct *fsp;
2209         int oplock_request;
2210         int tmpfd;
2211         char *s;
2212         NTSTATUS status;
2213         TALLOC_CTX *ctx = talloc_tos();
2214
2215         START_PROFILE(SMBctemp);
2216
2217         if (req->wct < 3) {
2218                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2219                 goto out;
2220         }
2221
2222         fattr = SVAL(req->vwv+0, 0);
2223         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2224
2225         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2226                             STR_TERMINATE, &status);
2227         if (!NT_STATUS_IS_OK(status)) {
2228                 reply_nterror(req, status);
2229                 goto out;
2230         }
2231         if (*fname) {
2232                 fname = talloc_asprintf(ctx,
2233                                 "%s/TMXXXXXX",
2234                                 fname);
2235         } else {
2236                 fname = talloc_strdup(ctx, "TMXXXXXX");
2237         }
2238
2239         if (!fname) {
2240                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2241                 goto out;
2242         }
2243
2244         status = filename_convert(ctx, conn,
2245                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2246                                 fname,
2247                                 0,
2248                                 NULL,
2249                                 &smb_fname);
2250         if (!NT_STATUS_IS_OK(status)) {
2251                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2252                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2253                                         ERRSRV, ERRbadpath);
2254                         goto out;
2255                 }
2256                 reply_nterror(req, status);
2257                 goto out;
2258         }
2259
2260         tmpfd = mkstemp(smb_fname->base_name);
2261         if (tmpfd == -1) {
2262                 reply_nterror(req, map_nt_error_from_unix(errno));
2263                 goto out;
2264         }
2265
2266         SMB_VFS_STAT(conn, smb_fname);
2267
2268         /* We should fail if file does not exist. */
2269         status = SMB_VFS_CREATE_FILE(
2270                 conn,                                   /* conn */
2271                 req,                                    /* req */
2272                 0,                                      /* root_dir_fid */
2273                 smb_fname,                              /* fname */
2274                 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2275                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2276                 FILE_OPEN,                              /* create_disposition*/
2277                 0,                                      /* create_options */
2278                 fattr,                                  /* file_attributes */
2279                 oplock_request,                         /* oplock_request */
2280                 0,                                      /* allocation_size */
2281                 0,                                      /* private_flags */
2282                 NULL,                                   /* sd */
2283                 NULL,                                   /* ea_list */
2284                 &fsp,                                   /* result */
2285                 NULL);                                  /* pinfo */
2286
2287         /* close fd from mkstemp() */
2288         close(tmpfd);
2289
2290         if (!NT_STATUS_IS_OK(status)) {
2291                 if (open_was_deferred(req->mid)) {
2292                         /* We have re-scheduled this call. */
2293                         goto out;
2294                 }
2295                 reply_openerror(req, status);
2296                 goto out;
2297         }
2298
2299         reply_outbuf(req, 1, 0);
2300         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2301
2302         /* the returned filename is relative to the directory */
2303         s = strrchr_m(fsp->fsp_name->base_name, '/');
2304         if (!s) {
2305                 s = fsp->fsp_name->base_name;
2306         } else {
2307                 s++;
2308         }
2309
2310 #if 0
2311         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2312            thing in the byte section. JRA */
2313         SSVALS(p, 0, -1); /* what is this? not in spec */
2314 #endif
2315         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2316             == -1) {
2317                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2318                 goto out;
2319         }
2320
2321         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2322                 SCVAL(req->outbuf, smb_flg,
2323                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2324         }
2325
2326         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2327                 SCVAL(req->outbuf, smb_flg,
2328                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2329         }
2330
2331         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2332         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2333                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2334  out:
2335         TALLOC_FREE(smb_fname);
2336         END_PROFILE(SMBctemp);
2337         return;
2338 }
2339
2340 /*******************************************************************
2341  Check if a user is allowed to rename a file.
2342 ********************************************************************/
2343
2344 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2345                         uint16 dirtype)
2346 {
2347         uint32 fmode;
2348
2349         if (!CAN_WRITE(conn)) {
2350                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2351         }
2352
2353         fmode = dos_mode(conn, fsp->fsp_name);
2354         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2355                 return NT_STATUS_NO_SUCH_FILE;
2356         }
2357
2358         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2359                 if (fsp->posix_open) {
2360                         return NT_STATUS_OK;
2361                 }
2362
2363                 /* If no pathnames are open below this
2364                    directory, allow the rename. */
2365
2366                 if (file_find_subpath(fsp)) {
2367                         return NT_STATUS_ACCESS_DENIED;
2368                 }
2369                 return NT_STATUS_OK;
2370         }
2371
2372         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2373                 return NT_STATUS_OK;
2374         }
2375
2376         return NT_STATUS_ACCESS_DENIED;
2377 }
2378
2379 /*******************************************************************
2380  * unlink a file with all relevant access checks
2381  *******************************************************************/
2382
2383 static NTSTATUS do_unlink(connection_struct *conn,
2384                         struct smb_request *req,
2385                         struct smb_filename *smb_fname,
2386                         uint32 dirtype)
2387 {
2388         uint32 fattr;
2389         files_struct *fsp;
2390         uint32 dirtype_orig = dirtype;
2391         NTSTATUS status;
2392         int ret;
2393         bool posix_paths = lp_posix_pathnames();
2394
2395         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2396                   smb_fname_str_dbg(smb_fname),
2397                   dirtype));
2398
2399         if (!CAN_WRITE(conn)) {
2400                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2401         }
2402
2403         if (posix_paths) {
2404                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2405         } else {
2406                 ret = SMB_VFS_STAT(conn, smb_fname);
2407         }
2408         if (ret != 0) {
2409                 return map_nt_error_from_unix(errno);
2410         }
2411
2412         fattr = dos_mode(conn, smb_fname);
2413
2414         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2415                 dirtype = aDIR|aARCH|aRONLY;
2416         }
2417
2418         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2419         if (!dirtype) {
2420                 return NT_STATUS_NO_SUCH_FILE;
2421         }
2422
2423         if (!dir_check_ftype(conn, fattr, dirtype)) {
2424                 if (fattr & aDIR) {
2425                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2426                 }
2427                 return NT_STATUS_NO_SUCH_FILE;
2428         }
2429
2430         if (dirtype_orig & 0x8000) {
2431                 /* These will never be set for POSIX. */
2432                 return NT_STATUS_NO_SUCH_FILE;
2433         }
2434
2435 #if 0
2436         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2437                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2438         }
2439
2440         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2441                 return NT_STATUS_NO_SUCH_FILE;
2442         }
2443
2444         if (dirtype & 0xFF00) {
2445                 /* These will never be set for POSIX. */
2446                 return NT_STATUS_NO_SUCH_FILE;
2447         }
2448
2449         dirtype &= 0xFF;
2450         if (!dirtype) {
2451                 return NT_STATUS_NO_SUCH_FILE;
2452         }
2453
2454         /* Can't delete a directory. */
2455         if (fattr & aDIR) {
2456                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2457         }
2458 #endif
2459
2460 #if 0 /* JRATEST */
2461         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2462                 return NT_STATUS_OBJECT_NAME_INVALID;
2463 #endif /* JRATEST */
2464
2465         /* On open checks the open itself will check the share mode, so
2466            don't do it here as we'll get it wrong. */
2467
2468         status = SMB_VFS_CREATE_FILE
2469                 (conn,                  /* conn */
2470                  req,                   /* req */
2471                  0,                     /* root_dir_fid */
2472                  smb_fname,             /* fname */
2473                  DELETE_ACCESS,         /* access_mask */
2474                  FILE_SHARE_NONE,       /* share_access */
2475                  FILE_OPEN,             /* create_disposition*/
2476                  FILE_NON_DIRECTORY_FILE, /* create_options */
2477                                         /* file_attributes */
2478                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2479                                 FILE_ATTRIBUTE_NORMAL,
2480                  0,                     /* oplock_request */
2481                  0,                     /* allocation_size */
2482                  0,                     /* private_flags */
2483                  NULL,                  /* sd */
2484                  NULL,                  /* ea_list */
2485                  &fsp,                  /* result */
2486                  NULL);                 /* pinfo */
2487
2488         if (!NT_STATUS_IS_OK(status)) {
2489                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2490                            nt_errstr(status)));
2491                 return status;
2492         }
2493
2494         status = can_set_delete_on_close(fsp, fattr);
2495         if (!NT_STATUS_IS_OK(status)) {
2496                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2497                         "(%s)\n",
2498                         smb_fname_str_dbg(smb_fname),
2499                         nt_errstr(status)));
2500                 close_file(req, fsp, NORMAL_CLOSE);
2501                 return status;
2502         }
2503
2504         /* The set is across all open files on this dev/inode pair. */
2505         if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2506                 close_file(req, fsp, NORMAL_CLOSE);
2507                 return NT_STATUS_ACCESS_DENIED;
2508         }
2509
2510         return close_file(req, fsp, NORMAL_CLOSE);
2511 }
2512
2513 /****************************************************************************
2514  The guts of the unlink command, split out so it may be called by the NT SMB
2515  code.
2516 ****************************************************************************/
2517
2518 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2519                           uint32 dirtype, struct smb_filename *smb_fname,
2520                           bool has_wild)
2521 {
2522         char *fname_dir = NULL;
2523         char *fname_mask = NULL;
2524         int count=0;
2525         NTSTATUS status = NT_STATUS_OK;
2526         TALLOC_CTX *ctx = talloc_tos();
2527
2528         /* Split up the directory from the filename/mask. */
2529         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2530                                       &fname_dir, &fname_mask);
2531         if (!NT_STATUS_IS_OK(status)) {
2532                 goto out;
2533         }
2534
2535         /*
2536          * We should only check the mangled cache
2537          * here if unix_convert failed. This means
2538          * that the path in 'mask' doesn't exist
2539          * on the file system and so we need to look
2540          * for a possible mangle. This patch from
2541          * Tine Smukavec <valentin.smukavec@hermes.si>.
2542          */
2543
2544         if (!VALID_STAT(smb_fname->st) &&
2545             mangle_is_mangled(fname_mask, conn->params)) {
2546                 char *new_mask = NULL;
2547                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2548                                             &new_mask, conn->params);
2549                 if (new_mask) {
2550                         TALLOC_FREE(fname_mask);
2551                         fname_mask = new_mask;
2552                 }
2553         }
2554
2555         if (!has_wild) {
2556
2557                 /*
2558                  * Only one file needs to be unlinked. Append the mask back
2559                  * onto the directory.
2560                  */
2561                 TALLOC_FREE(smb_fname->base_name);
2562                 smb_fname->base_name = talloc_asprintf(smb_fname,
2563                                                        "%s/%s",
2564                                                        fname_dir,
2565                                                        fname_mask);
2566                 if (!smb_fname->base_name) {
2567                         status = NT_STATUS_NO_MEMORY;
2568                         goto out;
2569                 }
2570                 if (dirtype == 0) {
2571                         dirtype = FILE_ATTRIBUTE_NORMAL;
2572                 }
2573
2574                 status = check_name(conn, smb_fname->base_name);
2575                 if (!NT_STATUS_IS_OK(status)) {
2576                         goto out;
2577                 }
2578
2579                 status = do_unlink(conn, req, smb_fname, dirtype);
2580                 if (!NT_STATUS_IS_OK(status)) {
2581                         goto out;
2582                 }
2583
2584                 count++;
2585         } else {
2586                 struct smb_Dir *dir_hnd = NULL;
2587                 long offset = 0;
2588                 const char *dname = NULL;
2589                 char *talloced = NULL;
2590
2591                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2592                         status = NT_STATUS_OBJECT_NAME_INVALID;
2593                         goto out;
2594                 }
2595
2596                 if (strequal(fname_mask,"????????.???")) {
2597                         TALLOC_FREE(fname_mask);
2598                         fname_mask = talloc_strdup(ctx, "*");
2599                         if (!fname_mask) {
2600                                 status = NT_STATUS_NO_MEMORY;
2601                                 goto out;
2602                         }
2603                 }
2604
2605                 status = check_name(conn, fname_dir);
2606                 if (!NT_STATUS_IS_OK(status)) {
2607                         goto out;
2608                 }
2609
2610                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2611                                   dirtype);
2612                 if (dir_hnd == NULL) {
2613                         status = map_nt_error_from_unix(errno);
2614                         goto out;
2615                 }
2616
2617                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2618                    the pattern matches against the long name, otherwise the short name
2619                    We don't implement this yet XXXX
2620                 */
2621
2622                 status = NT_STATUS_NO_SUCH_FILE;
2623
2624                 while ((dname = ReadDirName(dir_hnd, &offset,
2625                                             &smb_fname->st, &talloced))) {
2626                         TALLOC_CTX *frame = talloc_stackframe();
2627
2628                         if (!is_visible_file(conn, fname_dir, dname,
2629                                              &smb_fname->st, true)) {
2630                                 TALLOC_FREE(frame);
2631                                 TALLOC_FREE(talloced);
2632                                 continue;
2633                         }
2634
2635                         /* Quick check for "." and ".." */
2636                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2637                                 TALLOC_FREE(frame);
2638                                 TALLOC_FREE(talloced);
2639                                 continue;
2640                         }
2641
2642                         if(!mask_match(dname, fname_mask,
2643                                        conn->case_sensitive)) {
2644                                 TALLOC_FREE(frame);
2645                                 TALLOC_FREE(talloced);
2646                                 continue;
2647                         }
2648
2649                         TALLOC_FREE(smb_fname->base_name);
2650                         smb_fname->base_name =
2651                             talloc_asprintf(smb_fname, "%s/%s",
2652                                             fname_dir, dname);
2653
2654                         if (!smb_fname->base_name) {
2655                                 TALLOC_FREE(dir_hnd);
2656                                 status = NT_STATUS_NO_MEMORY;
2657                                 TALLOC_FREE(frame);
2658                                 TALLOC_FREE(talloced);
2659                                 goto out;
2660                         }
2661
2662                         status = check_name(conn, smb_fname->base_name);
2663                         if (!NT_STATUS_IS_OK(status)) {
2664                                 TALLOC_FREE(dir_hnd);
2665                                 TALLOC_FREE(frame);
2666                                 TALLOC_FREE(talloced);
2667                                 goto out;
2668                         }
2669
2670                         status = do_unlink(conn, req, smb_fname, dirtype);
2671                         if (!NT_STATUS_IS_OK(status)) {
2672                                 TALLOC_FREE(frame);
2673                                 TALLOC_FREE(talloced);
2674                                 continue;
2675                         }
2676
2677                         count++;
2678                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2679                                  smb_fname->base_name));
2680
2681                         TALLOC_FREE(frame);
2682                         TALLOC_FREE(talloced);
2683                 }
2684                 TALLOC_FREE(dir_hnd);
2685         }
2686
2687         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2688                 status = map_nt_error_from_unix(errno);
2689         }
2690
2691  out:
2692         TALLOC_FREE(fname_dir);
2693         TALLOC_FREE(fname_mask);
2694         return status;
2695 }
2696
2697 /****************************************************************************
2698  Reply to a unlink
2699 ****************************************************************************/
2700
2701 void reply_unlink(struct smb_request *req)
2702 {
2703         connection_struct *conn = req->conn;
2704         char *name = NULL;
2705         struct smb_filename *smb_fname = NULL;
2706         uint32 dirtype;
2707         NTSTATUS status;
2708         bool path_contains_wcard = False;
2709         TALLOC_CTX *ctx = talloc_tos();
2710
2711         START_PROFILE(SMBunlink);
2712
2713         if (req->wct < 1) {
2714                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2715                 goto out;
2716         }
2717
2718         dirtype = SVAL(req->vwv+0, 0);
2719
2720         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2721                                   STR_TERMINATE, &status,
2722                                   &path_contains_wcard);
2723         if (!NT_STATUS_IS_OK(status)) {
2724                 reply_nterror(req, status);
2725                 goto out;
2726         }
2727
2728         status = filename_convert(ctx, conn,
2729                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2730                                   name,
2731                                   UCF_COND_ALLOW_WCARD_LCOMP,
2732                                   &path_contains_wcard,
2733                                   &smb_fname);
2734         if (!NT_STATUS_IS_OK(status)) {
2735                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2736                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2737                                         ERRSRV, ERRbadpath);
2738                         goto out;
2739                 }
2740                 reply_nterror(req, status);
2741                 goto out;
2742         }
2743
2744         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2745
2746         status = unlink_internals(conn, req, dirtype, smb_fname,
2747                                   path_contains_wcard);
2748         if (!NT_STATUS_IS_OK(status)) {
2749                 if (open_was_deferred(req->mid)) {
2750                         /* We have re-scheduled this call. */
2751                         goto out;
2752                 }
2753                 reply_nterror(req, status);
2754                 goto out;
2755         }
2756
2757         reply_outbuf(req, 0, 0);
2758  out:
2759         TALLOC_FREE(smb_fname);
2760         END_PROFILE(SMBunlink);
2761         return;
2762 }
2763
2764 /****************************************************************************
2765  Fail for readbraw.
2766 ****************************************************************************/
2767
2768 static void fail_readraw(void)
2769 {
2770         const char *errstr = talloc_asprintf(talloc_tos(),
2771                         "FAIL ! reply_readbraw: socket write fail (%s)",
2772                         strerror(errno));
2773         if (!errstr) {
2774                 errstr = "";
2775         }
2776         exit_server_cleanly(errstr);
2777 }
2778
2779 /****************************************************************************
2780  Fake (read/write) sendfile. Returns -1 on read or write fail.
2781 ****************************************************************************/
2782
2783 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2784                              size_t nread)
2785 {
2786         size_t bufsize;
2787         size_t tosend = nread;
2788         char *buf;
2789
2790         if (nread == 0) {
2791                 return 0;
2792         }
2793
2794         bufsize = MIN(nread, 65536);
2795
2796         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2797                 return -1;
2798         }
2799
2800         while (tosend > 0) {
2801                 ssize_t ret;
2802                 size_t cur_read;
2803
2804                 if (tosend > bufsize) {
2805                         cur_read = bufsize;
2806                 } else {
2807                         cur_read = tosend;
2808                 }
2809                 ret = read_file(fsp,buf,startpos,cur_read);
2810                 if (ret == -1) {
2811                         SAFE_FREE(buf);
2812                         return -1;
2813                 }
2814
2815                 /* If we had a short read, fill with zeros. */
2816                 if (ret < cur_read) {
2817                         memset(buf + ret, '\0', cur_read - ret);
2818                 }
2819
2820                 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2821                         SAFE_FREE(buf);
2822                         return -1;
2823                 }
2824                 tosend -= cur_read;
2825                 startpos += cur_read;
2826         }
2827
2828         SAFE_FREE(buf);
2829         return (ssize_t)nread;
2830 }
2831
2832 #if defined(WITH_SENDFILE)
2833 /****************************************************************************
2834  Deal with the case of sendfile reading less bytes from the file than
2835  requested. Fill with zeros (all we can do).
2836 ****************************************************************************/
2837
2838 static void sendfile_short_send(files_struct *fsp,
2839                                 ssize_t nread,
2840                                 size_t headersize,
2841                                 size_t smb_maxcnt)
2842 {
2843 #define SHORT_SEND_BUFSIZE 1024
2844         if (nread < headersize) {
2845                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2846                         "header for file %s (%s). Terminating\n",
2847                         fsp_str_dbg(fsp), strerror(errno)));
2848                 exit_server_cleanly("sendfile_short_send failed");
2849         }
2850
2851         nread -= headersize;
2852
2853         if (nread < smb_maxcnt) {
2854                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2855                 if (!buf) {
2856                         exit_server_cleanly("sendfile_short_send: "
2857                                 "malloc failed");
2858                 }
2859
2860                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2861                         "with zeros !\n", fsp_str_dbg(fsp)));
2862
2863                 while (nread < smb_maxcnt) {
2864                         /*
2865                          * We asked for the real file size and told sendfile
2866                          * to not go beyond the end of the file. But it can
2867                          * happen that in between our fstat call and the
2868                          * sendfile call the file was truncated. This is very
2869                          * bad because we have already announced the larger
2870                          * number of bytes to the client.
2871                          *
2872                          * The best we can do now is to send 0-bytes, just as
2873                          * a read from a hole in a sparse file would do.
2874                          *
2875                          * This should happen rarely enough that I don't care
2876                          * about efficiency here :-)
2877                          */
2878                         size_t to_write;
2879
2880                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2881                         if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2882                                 exit_server_cleanly("sendfile_short_send: "
2883                                         "write_data failed");
2884                         }
2885                         nread += to_write;
2886                 }
2887                 SAFE_FREE(buf);
2888         }
2889 }
2890 #endif /* defined WITH_SENDFILE */
2891
2892 /****************************************************************************
2893  Return a readbraw error (4 bytes of zero).
2894 ****************************************************************************/
2895
2896 static void reply_readbraw_error(void)
2897 {
2898         char header[4];
2899
2900         SIVAL(header,0,0);
2901
2902         smbd_lock_socket(smbd_server_conn);
2903         if (write_data(smbd_server_fd(),header,4) != 4) {
2904                 fail_readraw();
2905         }
2906         smbd_unlock_socket(smbd_server_conn);
2907 }
2908
2909 /****************************************************************************
2910  Use sendfile in readbraw.
2911 ****************************************************************************/
2912
2913 static void send_file_readbraw(connection_struct *conn,
2914                                struct smb_request *req,
2915                                files_struct *fsp,
2916                                SMB_OFF_T startpos,
2917                                size_t nread,
2918                                ssize_t mincount)
2919 {
2920         char *outbuf = NULL;
2921         ssize_t ret=0;
2922
2923 #if defined(WITH_SENDFILE)
2924         /*
2925          * We can only use sendfile on a non-chained packet
2926          * but we can use on a non-oplocked file. tridge proved this
2927          * on a train in Germany :-). JRA.
2928          * reply_readbraw has already checked the length.
2929          */
2930
2931         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2932             (fsp->wcp == NULL) &&
2933             lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
2934                 ssize_t sendfile_read = -1;
2935                 char header[4];
2936                 DATA_BLOB header_blob;
2937
2938                 _smb_setlen(header,nread);
2939                 header_blob = data_blob_const(header, 4);
2940
2941                 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2942                                 &header_blob, startpos, nread)) == -1) {
2943                         /* Returning ENOSYS means no data at all was sent.
2944                          * Do this as a normal read. */
2945                         if (errno == ENOSYS) {
2946                                 goto normal_readbraw;
2947                         }
2948
2949                         /*
2950                          * Special hack for broken Linux with no working sendfile. If we
2951                          * return EINTR we sent the header but not the rest of the data.
2952                          * Fake this up by doing read/write calls.
2953                          */
2954                         if (errno == EINTR) {
2955                                 /* Ensure we don't do this again. */
2956                                 set_use_sendfile(SNUM(conn), False);
2957                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2958
2959                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
2960                                         DEBUG(0,("send_file_readbraw: "
2961                                                  "fake_sendfile failed for "
2962                                                  "file %s (%s).\n",
2963                                                  fsp_str_dbg(fsp),
2964                                                  strerror(errno)));
2965                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2966                                 }
2967                                 return;
2968                         }
2969
2970                         DEBUG(0,("send_file_readbraw: sendfile failed for "
2971                                  "file %s (%s). Terminating\n",
2972                                  fsp_str_dbg(fsp), strerror(errno)));
2973                         exit_server_cleanly("send_file_readbraw sendfile failed");
2974                 } else if (sendfile_read == 0) {
2975                         /*
2976                          * Some sendfile implementations return 0 to indicate
2977                          * that there was a short read, but nothing was
2978                          * actually written to the socket.  In this case,
2979                          * fallback to the normal read path so the header gets
2980                          * the correct byte count.
2981                          */
2982                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2983                                   "bytes falling back to the normal read: "
2984                                   "%s\n", fsp_str_dbg(fsp)));
2985                         goto normal_readbraw;
2986                 }
2987
2988                 /* Deal with possible short send. */
2989                 if (sendfile_read != 4+nread) {
2990                         sendfile_short_send(fsp, sendfile_read, 4, nread);
2991                 }
2992                 return;
2993         }
2994
2995 normal_readbraw:
2996 #endif
2997
2998         outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2999         if (!outbuf) {
3000                 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3001                         (unsigned)(nread+4)));
3002                 reply_readbraw_error();
3003                 return;
3004         }
3005
3006         if (nread > 0) {
3007                 ret = read_file(fsp,outbuf+4,startpos,nread);
3008 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3009                 if (ret < mincount)
3010                         ret = 0;
3011 #else
3012                 if (ret < nread)
3013                         ret = 0;
3014 #endif
3015         }
3016
3017         _smb_setlen(outbuf,ret);
3018         if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
3019                 fail_readraw();
3020
3021         TALLOC_FREE(outbuf);
3022 }
3023
3024 /****************************************************************************
3025  Reply to a readbraw (core+ protocol).
3026 ****************************************************************************/
3027
3028 void reply_readbraw(struct smb_request *req)
3029 {
3030         connection_struct *conn = req->conn;
3031         ssize_t maxcount,mincount;
3032         size_t nread = 0;
3033         SMB_OFF_T startpos;
3034         files_struct *fsp;
3035         struct lock_struct lock;
3036         SMB_OFF_T size = 0;
3037
3038         START_PROFILE(SMBreadbraw);
3039
3040         if (srv_is_signing_active(smbd_server_conn) ||
3041             is_encrypted_packet(req->inbuf)) {
3042                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3043                         "raw reads/writes are disallowed.");
3044         }
3045
3046         if (req->wct < 8) {
3047                 reply_readbraw_error();
3048                 END_PROFILE(SMBreadbraw);
3049                 return;
3050         }
3051
3052         if (smbd_server_conn->smb1.echo_handler.trusted_fde) {
3053                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of"
3054                          "'fork echo handler = yes'\n"));
3055                 reply_readbraw_error();
3056                 END_PROFILE(SMBreadbraw);
3057                 return;
3058         }
3059
3060         /*
3061          * Special check if an oplock break has been issued
3062          * and the readraw request croses on the wire, we must
3063          * return a zero length response here.
3064          */
3065
3066         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3067
3068         /*
3069          * We have to do a check_fsp by hand here, as
3070          * we must always return 4 zero bytes on error,
3071          * not a NTSTATUS.
3072          */
3073
3074         if (!fsp || !conn || conn != fsp->conn ||
3075                         req->vuid != fsp->vuid ||
3076                         fsp->is_directory || fsp->fh->fd == -1) {
3077                 /*
3078                  * fsp could be NULL here so use the value from the packet. JRA.
3079                  */
3080                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3081                         "- cache prime?\n",
3082                         (int)SVAL(req->vwv+0, 0)));
3083                 reply_readbraw_error();
3084                 END_PROFILE(SMBreadbraw);
3085                 return;
3086         }
3087
3088         /* Do a "by hand" version of CHECK_READ. */
3089         if (!(fsp->can_read ||
3090                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3091                                 (fsp->access_mask & FILE_EXECUTE)))) {
3092                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3093                                 (int)SVAL(req->vwv+0, 0)));
3094                 reply_readbraw_error();
3095                 END_PROFILE(SMBreadbraw);
3096                 return;
3097         }
3098
3099         flush_write_cache(fsp, READRAW_FLUSH);
3100
3101         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3102         if(req->wct == 10) {
3103                 /*
3104                  * This is a large offset (64 bit) read.
3105                  */
3106 #ifdef LARGE_SMB_OFF_T
3107
3108                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3109
3110 #else /* !LARGE_SMB_OFF_T */
3111
3112                 /*
3113                  * Ensure we haven't been sent a >32 bit offset.
3114                  */
3115
3116                 if(IVAL(req->vwv+8, 0) != 0) {
3117                         DEBUG(0,("reply_readbraw: large offset "
3118                                 "(%x << 32) used and we don't support "
3119                                 "64 bit offsets.\n",
3120                         (unsigned int)IVAL(req->vwv+8, 0) ));
3121                         reply_readbraw_error();
3122                         END_PROFILE(SMBreadbraw);
3123                         return;
3124                 }
3125
3126 #endif /* LARGE_SMB_OFF_T */
3127
3128                 if(startpos < 0) {
3129                         DEBUG(0,("reply_readbraw: negative 64 bit "
3130                                 "readraw offset (%.0f) !\n",
3131                                 (double)startpos ));
3132                         reply_readbraw_error();
3133                         END_PROFILE(SMBreadbraw);
3134                         return;
3135                 }
3136         }
3137
3138         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3139         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3140
3141         /* ensure we don't overrun the packet size */
3142         maxcount = MIN(65535,maxcount);
3143
3144         init_strict_lock_struct(fsp, (uint32)req->smbpid,
3145             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3146             &lock);
3147
3148         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3149                 reply_readbraw_error();
3150                 END_PROFILE(SMBreadbraw);
3151                 return;
3152         }
3153
3154         if (fsp_stat(fsp) == 0) {
3155                 size = fsp->fsp_name->st.st_ex_size;
3156         }
3157
3158         if (startpos >= size) {
3159                 nread = 0;
3160         } else {
3161                 nread = MIN(maxcount,(size - startpos));
3162         }
3163
3164 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3165         if (nread < mincount)
3166                 nread = 0;
3167 #endif
3168
3169         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3170                 "min=%lu nread=%lu\n",
3171                 fsp->fnum, (double)startpos,
3172                 (unsigned long)maxcount,
3173                 (unsigned long)mincount,
3174                 (unsigned long)nread ) );
3175
3176         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3177
3178         DEBUG(5,("reply_readbraw finished\n"));
3179
3180         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3181
3182         END_PROFILE(SMBreadbraw);
3183         return;
3184 }
3185
3186 #undef DBGC_CLASS
3187 #define DBGC_CLASS DBGC_LOCKING
3188
3189 /****************************************************************************
3190  Reply to a lockread (core+ protocol).
3191 ****************************************************************************/
3192
3193 void reply_lockread(struct smb_request *req)
3194 {
3195         connection_struct *conn = req->conn;
3196         ssize_t nread = -1;
3197         char *data;
3198         SMB_OFF_T startpos;
3199         size_t numtoread;
3200         NTSTATUS status;
3201         files_struct *fsp;
3202         struct byte_range_lock *br_lck = NULL;
3203         char *p = NULL;
3204         struct smbd_server_connection *sconn = smbd_server_conn;
3205
3206         START_PROFILE(SMBlockread);
3207
3208         if (req->wct < 5) {
3209                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3210                 END_PROFILE(SMBlockread);
3211                 return;
3212         }
3213
3214         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3215
3216         if (!check_fsp(conn, req, fsp)) {
3217                 END_PROFILE(SMBlockread);
3218                 return;
3219         }
3220
3221         if (!CHECK_READ(fsp,req)) {
3222                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3223                 END_PROFILE(SMBlockread);
3224                 return;
3225         }
3226
3227         numtoread = SVAL(req->vwv+1, 0);
3228         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3229
3230         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3231
3232         reply_outbuf(req, 5, numtoread + 3);
3233
3234         data = smb_buf(req->outbuf) + 3;
3235
3236         /*
3237          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3238          * protocol request that predates the read/write lock concept.
3239          * Thus instead of asking for a read lock here we need to ask
3240          * for a write lock. JRA.
3241          * Note that the requested lock size is unaffected by max_recv.
3242          */
3243
3244         br_lck = do_lock(smbd_messaging_context(),
3245                         fsp,
3246                         req->smbpid,
3247                         (uint64_t)numtoread,
3248                         (uint64_t)startpos,
3249                         WRITE_LOCK,
3250                         WINDOWS_LOCK,
3251                         False, /* Non-blocking lock. */
3252                         &status,
3253                         NULL,
3254                         NULL);
3255         TALLOC_FREE(br_lck);
3256
3257         if (NT_STATUS_V(status)) {
3258                 reply_nterror(req, status);
3259                 END_PROFILE(SMBlockread);
3260                 return;
3261         }
3262
3263         /*
3264          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3265          */
3266
3267         if (numtoread > sconn->smb1.negprot.max_recv) {
3268                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3269 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3270                         (unsigned int)numtoread,
3271                         (unsigned int)sconn->smb1.negprot.max_recv));
3272                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3273         }
3274         nread = read_file(fsp,data,startpos,numtoread);
3275
3276         if (nread < 0) {
3277                 reply_nterror(req, map_nt_error_from_unix(errno));
3278                 END_PROFILE(SMBlockread);
3279                 return;
3280         }
3281
3282         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3283
3284         SSVAL(req->outbuf,smb_vwv0,nread);
3285         SSVAL(req->outbuf,smb_vwv5,nread+3);
3286         p = smb_buf(req->outbuf);
3287         SCVAL(p,0,0); /* pad byte. */
3288         SSVAL(p,1,nread);
3289
3290         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3291                  fsp->fnum, (int)numtoread, (int)nread));
3292
3293         END_PROFILE(SMBlockread);
3294         return;
3295 }
3296
3297 #undef DBGC_CLASS
3298 #define DBGC_CLASS DBGC_ALL
3299
3300 /****************************************************************************
3301  Reply to a read.
3302 ****************************************************************************/
3303
3304 void reply_read(struct smb_request *req)
3305 {
3306         connection_struct *conn = req->conn;
3307         size_t numtoread;
3308         ssize_t nread = 0;
3309         char *data;
3310         SMB_OFF_T startpos;
3311         int outsize = 0;
3312         files_struct *fsp;
3313         struct lock_struct lock;
3314         struct smbd_server_connection *sconn = smbd_server_conn;
3315
3316         START_PROFILE(SMBread);
3317
3318         if (req->wct < 3) {
3319                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3320                 END_PROFILE(SMBread);
3321                 return;
3322         }
3323
3324         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3325
3326         if (!check_fsp(conn, req, fsp)) {
3327                 END_PROFILE(SMBread);
3328                 return;
3329         }
3330
3331         if (!CHECK_READ(fsp,req)) {
3332                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3333                 END_PROFILE(SMBread);
3334                 return;
3335         }
3336
3337         numtoread = SVAL(req->vwv+1, 0);
3338         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3339
3340         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3341
3342         /*
3343          * The requested read size cannot be greater than max_recv. JRA.
3344          */
3345         if (numtoread > sconn->smb1.negprot.max_recv) {
3346                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3347 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3348                         (unsigned int)numtoread,
3349                         (unsigned int)sconn->smb1.negprot.max_recv));
3350                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3351         }
3352
3353         reply_outbuf(req, 5, numtoread+3);
3354
3355         data = smb_buf(req->outbuf) + 3;
3356
3357         init_strict_lock_struct(fsp, (uint32)req->smbpid,
3358             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3359             &lock);
3360
3361         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3362                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3363                 END_PROFILE(SMBread);
3364                 return;
3365         }
3366
3367         if (numtoread > 0)
3368                 nread = read_file(fsp,data,startpos,numtoread);
3369
3370         if (nread < 0) {
3371                 reply_nterror(req, map_nt_error_from_unix(errno));
3372                 goto strict_unlock;
3373         }
3374
3375         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3376
3377         SSVAL(req->outbuf,smb_vwv0,nread);
3378         SSVAL(req->outbuf,smb_vwv5,nread+3);
3379         SCVAL(smb_buf(req->outbuf),0,1);
3380         SSVAL(smb_buf(req->outbuf),1,nread);
3381
3382         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3383                 fsp->fnum, (int)numtoread, (int)nread ) );
3384
3385 strict_unlock:
3386         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3387
3388         END_PROFILE(SMBread);
3389         return;
3390 }
3391
3392 /****************************************************************************
3393  Setup readX header.
3394 ****************************************************************************/
3395
3396 static int setup_readX_header(struct smb_request *req, char *outbuf,
3397                               size_t smb_maxcnt)
3398 {
3399         int outsize;
3400         char *data;
3401
3402         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3403         data = smb_buf(outbuf);
3404
3405         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3406
3407         SCVAL(outbuf,smb_vwv0,0xFF);
3408         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3409         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3410         SSVAL(outbuf,smb_vwv6,
3411               req_wct_ofs(req)
3412               + 1               /* the wct field */
3413               + 12 * sizeof(uint16_t) /* vwv */
3414               + 2);             /* the buflen field */
3415         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3416         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3417         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3418         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3419         return outsize;
3420 }
3421
3422 /****************************************************************************
3423  Reply to a read and X - possibly using sendfile.
3424 ****************************************************************************/
3425
3426 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3427                             files_struct *fsp, SMB_OFF_T startpos,
3428                             size_t smb_maxcnt)
3429 {
3430         ssize_t nread = -1;
3431         struct lock_struct lock;
3432         int saved_errno = 0;
3433
3434         if(fsp_stat(fsp) == -1) {
3435                 reply_nterror(req, map_nt_error_from_unix(errno));
3436                 return;
3437         }
3438
3439         init_strict_lock_struct(fsp, (uint32)req->smbpid,
3440             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3441             &lock);
3442
3443         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3444                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3445                 return;
3446         }
3447
3448         if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3449                         (startpos > fsp->fsp_name->st.st_ex_size)
3450                         || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3451                 /*
3452                  * We already know that we would do a short read, so don't
3453                  * try the sendfile() path.
3454                  */
3455                 goto nosendfile_read;
3456         }
3457
3458 #if defined(WITH_SENDFILE)
3459         /*
3460          * We can only use sendfile on a non-chained packet
3461          * but we can use on a non-oplocked file. tridge proved this
3462          * on a train in Germany :-). JRA.
3463          */
3464
3465         if (!req_is_in_chain(req) &&
3466             !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3467             (fsp->wcp == NULL) &&
3468             lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
3469                 uint8 headerbuf[smb_size + 12 * 2];
3470                 DATA_BLOB header;
3471
3472                 /*
3473                  * Set up the packet header before send. We
3474                  * assume here the sendfile will work (get the
3475                  * correct amount of data).
3476                  */
3477
3478                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3479
3480                 construct_reply_common_req(req, (char *)headerbuf);
3481                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3482
3483                 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3484                         /* Returning ENOSYS means no data at all was sent.
3485                            Do this as a normal read. */
3486                         if (errno == ENOSYS) {
3487                                 goto normal_read;
3488                         }
3489
3490                         /*
3491                          * Special hack for broken Linux with no working sendfile. If we
3492                          * return EINTR we sent the header but not the rest of the data.
3493                          * Fake this up by doing read/write calls.
3494                          */
3495
3496                         if (errno == EINTR) {
3497                                 /* Ensure we don't do this again. */
3498                                 set_use_sendfile(SNUM(conn), False);
3499                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3500                                 nread = fake_sendfile(fsp, startpos,
3501                                                       smb_maxcnt);
3502                                 if (nread == -1) {
3503                                         DEBUG(0,("send_file_readX: "
3504                                                  "fake_sendfile failed for "
3505                                                  "file %s (%s).\n",
3506                                                  fsp_str_dbg(fsp),
3507                                                  strerror(errno)));
3508                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3509                                 }
3510                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3511                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3512                                 /* No outbuf here means successful sendfile. */
3513                                 goto strict_unlock;
3514                         }
3515
3516                         DEBUG(0,("send_file_readX: sendfile failed for file "
3517                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3518                                  strerror(errno)));
3519                         exit_server_cleanly("send_file_readX sendfile failed");
3520                 } else if (nread == 0) {
3521                         /*
3522                          * Some sendfile implementations return 0 to indicate
3523                          * that there was a short read, but nothing was
3524                          * actually written to the socket.  In this case,
3525                          * fallback to the normal read path so the header gets
3526                          * the correct byte count.
3527                          */
3528                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3529                                   "falling back to the normal read: %s\n",
3530                                   fsp_str_dbg(fsp)));
3531                         goto normal_read;
3532                 }
3533
3534                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3535                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3536
3537                 /* Deal with possible short send. */
3538                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3539                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3540                 }
3541                 /* No outbuf here means successful sendfile. */
3542                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3543                 SMB_PERFCOUNT_END(&req->pcd);
3544                 goto strict_unlock;
3545         }
3546
3547 normal_read:
3548
3549 #endif
3550
3551         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3552                 uint8 headerbuf[smb_size + 2*12];
3553
3554                 construct_reply_common_req(req, (char *)headerbuf);
3555                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3556
3557                 /* Send out the header. */
3558                 if (write_data(smbd_server_fd(), (char *)headerbuf,
3559                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3560                         DEBUG(0,("send_file_readX: write_data failed for file "
3561                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3562                                  strerror(errno)));
3563                         exit_server_cleanly("send_file_readX sendfile failed");
3564                 }
3565                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3566                 if (nread == -1) {
3567                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3568                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3569                                  strerror(errno)));
3570                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3571                 }
3572                 goto strict_unlock;
3573         }
3574
3575 nosendfile_read:
3576
3577         reply_outbuf(req, 12, smb_maxcnt);
3578
3579         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3580         saved_errno = errno;
3581
3582         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3583
3584         if (nread < 0) {
3585                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3586                 return;
3587         }
3588
3589         setup_readX_header(req, (char *)req->outbuf, nread);
3590
3591         DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3592                     fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3593
3594         chain_reply(req);
3595         return;
3596
3597  strict_unlock:
3598         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3599         TALLOC_FREE(req->outbuf);
3600         return;
3601 }
3602
3603 /****************************************************************************
3604  Reply to a read and X.
3605 ****************************************************************************/
3606
3607 void reply_read_and_X(struct smb_request *req)
3608 {
3609         connection_struct *conn = req->conn;
3610         files_struct *fsp;
3611         SMB_OFF_T startpos;
3612         size_t smb_maxcnt;
3613         bool big_readX = False;
3614 #if 0
3615         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3616 #endif
3617
3618         START_PROFILE(SMBreadX);
3619
3620         if ((req->wct != 10) && (req->wct != 12)) {
3621                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3622                 return;
3623         }
3624
3625         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3626         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3627         smb_maxcnt = SVAL(req->vwv+5, 0);
3628
3629         /* If it's an IPC, pass off the pipe handler. */
3630         if (IS_IPC(conn)) {
3631                 reply_pipe_read_and_X(req);
3632                 END_PROFILE(SMBreadX);
3633                 return;
3634         }
3635
3636         if (!check_fsp(conn, req, fsp)) {
3637                 END_PROFILE(SMBreadX);
3638                 return;
3639         }
3640
3641         if (!CHECK_READ(fsp,req)) {
3642                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3643                 END_PROFILE(SMBreadX);
3644                 return;
3645         }
3646
3647         if (global_client_caps & CAP_LARGE_READX) {
3648                 size_t upper_size = SVAL(req->vwv+7, 0);
3649                 smb_maxcnt |= (upper_size<<16);
3650                 if (upper_size > 1) {
3651                         /* Can't do this on a chained packet. */
3652                         if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3653                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3654                                 END_PROFILE(SMBreadX);
3655                                 return;
3656                         }
3657                         /* We currently don't do this on signed or sealed data. */
3658                         if (srv_is_signing_active(smbd_server_conn) ||
3659                             is_encrypted_packet(req->inbuf)) {
3660                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3661                                 END_PROFILE(SMBreadX);
3662                                 return;
3663                         }
3664                         /* Is there room in the reply for this data ? */
3665                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3666                                 reply_nterror(req,
3667                                               NT_STATUS_INVALID_PARAMETER);
3668                                 END_PROFILE(SMBreadX);
3669                                 return;
3670                         }
3671                         big_readX = True;
3672                 }
3673         }
3674
3675         if (req->wct == 12) {
3676 #ifdef LARGE_SMB_OFF_T
3677                 /*
3678                  * This is a large offset (64 bit) read.
3679                  */
3680                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3681
3682 #else /* !LARGE_SMB_OFF_T */
3683
3684                 /*
3685                  * Ensure we haven't been sent a >32 bit offset.
3686                  */
3687
3688                 if(IVAL(req->vwv+10, 0) != 0) {
3689                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3690                                  "used and we don't support 64 bit offsets.\n",
3691                                  (unsigned int)IVAL(req->vwv+10, 0) ));
3692                         END_PROFILE(SMBreadX);
3693                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3694                         return;
3695                 }
3696
3697 #endif /* LARGE_SMB_OFF_T */
3698
3699         }
3700
3701         if (!big_readX &&
3702             schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3703                 goto out;
3704         }
3705
3706         smbd_lock_socket(smbd_server_conn);
3707         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3708         smbd_unlock_socket(smbd_server_conn);
3709
3710  out:
3711         END_PROFILE(SMBreadX);
3712         return;
3713 }
3714
3715 /****************************************************************************
3716  Error replies to writebraw must have smb_wct == 1. Fix this up.
3717 ****************************************************************************/
3718
3719 void error_to_writebrawerr(struct smb_request *req)
3720 {
3721         uint8 *old_outbuf = req->outbuf;
3722
3723         reply_outbuf(req, 1, 0);
3724
3725         memcpy(req->outbuf, old_outbuf, smb_size);
3726         TALLOC_FREE(old_outbuf);
3727 }
3728
3729 /****************************************************************************
3730  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3731 ****************************************************************************/
3732
3733 void reply_writebraw(struct smb_request *req)
3734 {
3735         connection_struct *conn = req->conn;
3736         char *buf = NULL;
3737         ssize_t nwritten=0;
3738         ssize_t total_written=0;
3739         size_t numtowrite=0;
3740         size_t tcount;
3741         SMB_OFF_T startpos;
3742         char *data=NULL;
3743         bool write_through;
3744         files_struct *fsp;
3745         struct lock_struct lock;
3746         NTSTATUS status;
3747
3748         START_PROFILE(SMBwritebraw);
3749
3750         /*
3751          * If we ever reply with an error, it must have the SMB command
3752          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3753          * we're finished.
3754          */
3755         SCVAL(req->inbuf,smb_com,SMBwritec);
3756
3757         if (srv_is_signing_active(smbd_server_conn)) {
3758                 END_PROFILE(SMBwritebraw);
3759                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3760                                 "raw reads/writes are disallowed.");
3761         }
3762
3763         if (req->wct < 12) {
3764                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3765                 error_to_writebrawerr(req);
3766                 END_PROFILE(SMBwritebraw);
3767                 return;
3768         }
3769
3770         if (smbd_server_conn->smb1.echo_handler.trusted_fde) {
3771                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of"
3772                          "'fork echo handler = yes'\n"));
3773                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3774                 error_to_writebrawerr(req);
3775                 END_PROFILE(SMBwritebraw);
3776                 return;
3777         }
3778
3779         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3780         if (!check_fsp(conn, req, fsp)) {
3781                 error_to_writebrawerr(req);
3782                 END_PROFILE(SMBwritebraw);
3783                 return;
3784         }
3785
3786         if (!CHECK_WRITE(fsp)) {
3787                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3788                 error_to_writebrawerr(req);
3789                 END_PROFILE(SMBwritebraw);
3790                 return;
3791         }
3792
3793         tcount = IVAL(req->vwv+1, 0);
3794         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3795         write_through = BITSETW(req->vwv+7,0);
3796
3797         /* We have to deal with slightly different formats depending
3798                 on whether we are using the core+ or lanman1.0 protocol */
3799
3800         if(get_Protocol() <= PROTOCOL_COREPLUS) {
3801                 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3802                 data = smb_buf(req->inbuf);
3803         } else {
3804                 numtowrite = SVAL(req->vwv+10, 0);
3805                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3806         }
3807
3808         /* Ensure we don't write bytes past the end of this packet. */
3809         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3810                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3811                 error_to_writebrawerr(req);
3812                 END_PROFILE(SMBwritebraw);
3813                 return;
3814         }
3815
3816         if (fsp->print_file) {
3817                 startpos = printfile_offset(fsp, startpos);
3818         } else {
3819                 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3820                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3821                     &lock);
3822
3823                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3824                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3825                         error_to_writebrawerr(req);
3826                         END_PROFILE(SMBwritebraw);
3827                         return;
3828                 }
3829         }
3830
3831         if (numtowrite>0) {
3832                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3833         }
3834
3835         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3836                         "wrote=%d sync=%d\n",
3837                 fsp->fnum, (double)startpos, (int)numtowrite,
3838                 (int)nwritten, (int)write_through));
3839
3840         if (nwritten < (ssize_t)numtowrite)  {
3841                 reply_nterror(req, NT_STATUS_DISK_FULL);
3842                 error_to_writebrawerr(req);
3843                 goto strict_unlock;
3844         }
3845
3846         total_written = nwritten;
3847
3848         /* Allocate a buffer of 64k + length. */
3849         buf = TALLOC_ARRAY(NULL, char, 65540);
3850         if (!buf) {
3851                 reply_nterror(req, NT_STATUS_NO_MEMORY);
3852                 error_to_writebrawerr(req);
3853                 goto strict_unlock;
3854         }
3855
3856         /* Return a SMBwritebraw message to the redirector to tell
3857          * it to send more bytes */
3858
3859         memcpy(buf, req->inbuf, smb_size);
3860         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3861         SCVAL(buf,smb_com,SMBwritebraw);
3862         SSVALS(buf,smb_vwv0,0xFFFF);
3863         show_msg(buf);
3864         if (!srv_send_smb(smbd_server_fd(),
3865                           buf,
3866                           false, 0, /* no signing */
3867                           IS_CONN_ENCRYPTED(conn),
3868                           &req->pcd)) {
3869                 exit_server_cleanly("reply_writebraw: srv_send_smb "
3870                         "failed.");
3871         }
3872
3873         /* Now read the raw data into the buffer and write it */
3874         status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3875                                  &numtowrite);
3876         if (!NT_STATUS_IS_OK(status)) {
3877                 exit_server_cleanly("secondary writebraw failed");
3878         }
3879
3880         /* Set up outbuf to return the correct size */
3881         reply_outbuf(req, 1, 0);
3882
3883         if (numtowrite != 0) {
3884
3885                 if (numtowrite > 0xFFFF) {
3886                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3887                                 "raw requested (%u). Terminating\n",
3888                                 (unsigned int)numtowrite ));
3889                         exit_server_cleanly("secondary writebraw failed");
3890                 }
3891
3892                 if (tcount > nwritten+numtowrite) {
3893                         DEBUG(3,("reply_writebraw: Client overestimated the "
3894                                 "write %d %d %d\n",
3895                                 (int)tcount,(int)nwritten,(int)numtowrite));
3896                 }
3897
3898                 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3899
3900                 if (!NT_STATUS_IS_OK(status)) {
3901                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3902                                  "raw read failed (%s). Terminating\n",
3903                                  nt_errstr(status)));
3904                         exit_server_cleanly("secondary writebraw failed");
3905                 }
3906
3907                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3908                 if (nwritten == -1) {
3909                         TALLOC_FREE(buf);
3910                         reply_nterror(req, map_nt_error_from_unix(errno));
3911                         error_to_writebrawerr(req);
3912                         goto strict_unlock;
3913                 }
3914
3915                 if (nwritten < (ssize_t)numtowrite) {
3916                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
3917                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
3918                 }
3919
3920                 if (nwritten > 0) {
3921                         total_written += nwritten;
3922                 }
3923         }
3924
3925         TALLOC_FREE(buf);
3926         SSVAL(req->outbuf,smb_vwv0,total_written);
3927
3928         status = sync_file(conn, fsp, write_through);
3929         if (!NT_STATUS_IS_OK(status)) {
3930                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3931                          fsp_str_dbg(fsp), nt_errstr(status)));
3932                 reply_nterror(req, status);
3933                 error_to_writebrawerr(req);
3934                 goto strict_unlock;
3935         }
3936
3937         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3938                 "wrote=%d\n",
3939                 fsp->fnum, (double)startpos, (int)numtowrite,
3940                 (int)total_written));
3941
3942         if (!fsp->print_file) {
3943                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3944         }
3945
3946         /* We won't return a status if write through is not selected - this
3947          * follows what WfWg does */
3948         END_PROFILE(SMBwritebraw);
3949
3950         if (!write_through && total_written==tcount) {
3951
3952 #if RABBIT_PELLET_FIX
3953                 /*
3954                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3955                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3956                  * JRA.
3957                  */
3958                 if (!send_keepalive(smbd_server_fd())) {
3959                         exit_server_cleanly("reply_writebraw: send of "
3960                                 "keepalive failed");
3961                 }
3962 #endif
3963                 TALLOC_FREE(req->outbuf);
3964         }
3965         return;
3966
3967 strict_unlock:
3968         if (!fsp->print_file) {
3969                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3970         }
3971
3972         END_PROFILE(SMBwritebraw);
3973         return;
3974 }
3975
3976 #undef DBGC_CLASS
3977 #define DBGC_CLASS DBGC_LOCKING
3978
3979 /****************************************************************************
3980  Reply to a writeunlock (core+).
3981 ****************************************************************************/
3982
3983 void reply_writeunlock(struct smb_request *req)
3984 {
3985         connection_struct *conn = req->conn;
3986         ssize_t nwritten = -1;
3987         size_t numtowrite;
3988         SMB_OFF_T startpos;
3989         const char *data;
3990         NTSTATUS status = NT_STATUS_OK;
3991         files_struct *fsp;
3992         struct lock_struct lock;
3993         int saved_errno = 0;
3994
3995         START_PROFILE(SMBwriteunlock);
3996
3997         if (req->wct < 5) {
3998                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3999                 END_PROFILE(SMBwriteunlock);
4000                 return;
4001         }
4002
4003         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4004
4005         if (!check_fsp(conn, req, fsp)) {
4006                 END_PROFILE(SMBwriteunlock);
4007                 return;
4008         }
4009
4010         if (!CHECK_WRITE(fsp)) {
4011                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4012                 END_PROFILE(SMBwriteunlock);
4013                 return;
4014         }
4015
4016         numtowrite = SVAL(req->vwv+1, 0);
4017         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4018         data = (const char *)req->buf + 3;
4019
4020         if (fsp->print_file) {
4021                 startpos = printfile_offset(fsp, startpos);
4022         } else if (numtowrite) {
4023                 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4024                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4025                     &lock);
4026
4027                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4028                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4029                         END_PROFILE(SMBwriteunlock);
4030                         return;
4031                 }
4032         }
4033
4034         /* The special X/Open SMB protocol handling of
4035            zero length writes is *NOT* done for
4036            this call */
4037         if(numtowrite == 0) {
4038                 nwritten = 0;
4039         } else {
4040                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4041                 saved_errno = errno;
4042         }
4043
4044         status = sync_file(conn, fsp, False /* write through */);
4045         if (!NT_STATUS_IS_OK(status)) {
4046                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4047                          fsp_str_dbg(fsp), nt_errstr(status)));
4048                 reply_nterror(req, status);
4049                 goto strict_unlock;
4050         }
4051
4052         if(nwritten < 0) {
4053                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4054                 goto strict_unlock;
4055         }
4056
4057         if((nwritten < numtowrite) && (numtowrite != 0)) {
4058                 reply_nterror(req, NT_STATUS_DISK_FULL);
4059                 goto strict_unlock;
4060         }
4061
4062         if (numtowrite && !fsp->print_file) {
4063                 status = do_unlock(smbd_messaging_context(),
4064                                 fsp,
4065                                 req->smbpid,
4066                                 (uint64_t)numtowrite,
4067                                 (uint64_t)startpos,
4068                                 WINDOWS_LOCK);
4069
4070                 if (NT_STATUS_V(status)) {
4071                         reply_nterror(req, status);
4072                         goto strict_unlock;
4073                 }
4074         }
4075
4076         reply_outbuf(req, 1, 0);
4077
4078         SSVAL(req->outbuf,smb_vwv0,nwritten);
4079
4080         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4081                  fsp->fnum, (int)numtowrite, (int)nwritten));
4082
4083 strict_unlock:
4084         if (numtowrite && !fsp->print_file) {
4085                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4086         }
4087
4088         END_PROFILE(SMBwriteunlock);
4089         return;
4090 }
4091
4092 #undef DBGC_CLASS
4093 #define DBGC_CLASS DBGC_ALL
4094
4095 /****************************************************************************
4096  Reply to a write.
4097 ****************************************************************************/
4098
4099 void reply_write(struct smb_request *req)
4100 {
4101         connection_struct *conn = req->conn;
4102         size_t numtowrite;
4103         ssize_t nwritten = -1;
4104         SMB_OFF_T startpos;
4105         const char *data;
4106         files_struct *fsp;
4107         struct lock_struct lock;
4108         NTSTATUS status;
4109         int saved_errno = 0;
4110
4111         START_PROFILE(SMBwrite);
4112
4113         if (req->wct < 5) {
4114                 END_PROFILE(SMBwrite);
4115                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4116                 return;
4117         }
4118
4119         /* If it's an IPC, pass off the pipe handler. */
4120         if (IS_IPC(conn)) {
4121                 reply_pipe_write(req);
4122                 END_PROFILE(SMBwrite);
4123                 return;
4124         }
4125
4126         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4127
4128         if (!check_fsp(conn, req, fsp)) {
4129                 END_PROFILE(SMBwrite);
4130                 return;
4131         }
4132
4133         if (!CHECK_WRITE(fsp)) {
4134                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4135                 END_PROFILE(SMBwrite);
4136                 return;
4137         }
4138
4139         numtowrite = SVAL(req->vwv+1, 0);
4140         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4141         data = (const char *)req->buf + 3;
4142
4143         if (fsp->print_file) {
4144                 startpos = printfile_offset(fsp, startpos);
4145         } else {
4146                 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4147                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4148                         &lock);
4149
4150                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4151                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4152                         END_PROFILE(SMBwrite);
4153                         return;
4154                 }
4155         }
4156
4157         /*
4158          * X/Open SMB protocol says that if smb_vwv1 is
4159          * zero then the file size should be extended or
4160          * truncated to the size given in smb_vwv[2-3].
4161          */
4162
4163         if(numtowrite == 0) {
4164                 /*
4165                  * This is actually an allocate call, and set EOF. JRA.
4166                  */
4167                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4168                 if (nwritten < 0) {
4169                         reply_nterror(req, NT_STATUS_DISK_FULL);
4170                         goto strict_unlock;
4171                 }
4172                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4173                 if (nwritten < 0) {
4174                         reply_nterror(req, NT_STATUS_DISK_FULL);
4175                         goto strict_unlock;
4176                 }
4177                 trigger_write_time_update_immediate(fsp);
4178         } else {
4179                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4180         }
4181
4182         status = sync_file(conn, fsp, False);
4183         if (!NT_STATUS_IS_OK(status)) {
4184                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4185                          fsp_str_dbg(fsp), nt_errstr(status)));
4186                 reply_nterror(req, status);
4187                 goto strict_unlock;
4188         }
4189
4190         if(nwritten < 0) {
4191                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4192                 goto strict_unlock;
4193         }
4194
4195         if((nwritten == 0) && (numtowrite != 0)) {
4196                 reply_nterror(req, NT_STATUS_DISK_FULL);
4197                 goto strict_unlock;
4198         }
4199
4200         reply_outbuf(req, 1, 0);
4201
4202         SSVAL(req->outbuf,smb_vwv0,nwritten);
4203
4204         if (nwritten < (ssize_t)numtowrite) {
4205                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4206                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4207         }
4208
4209         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4210
4211 strict_unlock:
4212         if (!fsp->print_file) {
4213                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4214         }
4215
4216         END_PROFILE(SMBwrite);
4217         return;
4218 }
4219
4220 /****************************************************************************
4221  Ensure a buffer is a valid writeX for recvfile purposes.
4222 ****************************************************************************/
4223
4224 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4225                                                 (2*14) + /* word count (including bcc) */ \
4226                                                 1 /* pad byte */)
4227
4228 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4229 {
4230         size_t numtowrite;
4231         connection_struct *conn = NULL;
4232         unsigned int doff = 0;
4233         size_t len = smb_len_large(inbuf);
4234         struct smbd_server_connection *sconn = smbd_server_conn;
4235
4236         if (is_encrypted_packet(inbuf)) {
4237                 /* Can't do this on encrypted
4238                  * connections. */
4239                 return false;
4240         }
4241
4242         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4243                 return false;
4244         }
4245
4246         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4247                         CVAL(inbuf,smb_wct) != 14) {
4248                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4249                         "invalid word length.\n"));
4250                 return false;
4251         }
4252
4253         conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4254         if (conn == NULL) {
4255                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4256                 return false;
4257         }
4258         if (IS_IPC(conn)) {
4259                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4260                 return false;
4261         }
4262         if (IS_PRINT(conn)) {
4263                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4264                 return false;
4265         }
4266         doff = SVAL(inbuf,smb_vwv11);
4267
4268         numtowrite = SVAL(inbuf,smb_vwv10);
4269
4270         if (len > doff && len - doff > 0xFFFF) {
4271                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4272         }
4273
4274         if (numtowrite == 0) {
4275                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4276                 return false;
4277         }
4278
4279         /* Ensure the sizes match up. */
4280         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4281                 /* no pad byte...old smbclient :-( */
4282                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4283                         (unsigned int)doff,
4284                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4285                 return false;
4286         }
4287
4288         if (len - doff != numtowrite) {
4289                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4290                         "len = %u, doff = %u, numtowrite = %u\n",
4291                         (unsigned int)len,
4292                         (unsigned int)doff,
4293                         (unsigned int)numtowrite ));
4294                 return false;
4295         }
4296
4297         DEBUG(10,("is_valid_writeX_buffer: true "
4298                 "len = %u, doff = %u, numtowrite = %u\n",
4299                 (unsigned int)len,
4300                 (unsigned int)doff,
4301                 (unsigned int)numtowrite ));
4302
4303         return true;
4304 }
4305
4306 /****************************************************************************
4307  Reply to a write and X.
4308 ****************************************************************************/
4309
4310 void reply_write_and_X(struct smb_request *req)
4311 {
4312         connection_struct *conn = req->conn;
4313         files_struct *fsp;
4314         struct lock_struct lock;
4315         SMB_OFF_T startpos;
4316         size_t numtowrite;
4317         bool write_through;
4318         ssize_t nwritten;
4319         unsigned int smb_doff;
4320         unsigned int smblen;
4321         char *data;
4322         NTSTATUS status;
4323
4324         START_PROFILE(SMBwriteX);
4325
4326         if ((req->wct != 12) && (req->wct != 14)) {
4327                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4328                 END_PROFILE(SMBwriteX);
4329                 return;
4330         }
4331
4332         numtowrite = SVAL(req->vwv+10, 0);
4333         smb_doff = SVAL(req->vwv+11, 0);
4334         smblen = smb_len(req->inbuf);
4335
4336         if (req->unread_bytes > 0xFFFF ||
4337                         (smblen > smb_doff &&
4338                                 smblen - smb_doff > 0xFFFF)) {
4339                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4340         }
4341
4342         if (req->unread_bytes) {
4343                 /* Can't do a recvfile write on IPC$ */
4344                 if (IS_IPC(conn)) {
4345                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4346                         END_PROFILE(SMBwriteX);
4347                         return;
4348                 }
4349                 if (numtowrite != req->unread_bytes) {
4350                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4351                         END_PROFILE(SMBwriteX);
4352                         return;
4353                 }
4354         } else {
4355                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4356                                 smb_doff + numtowrite > smblen) {
4357                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4358                         END_PROFILE(SMBwriteX);
4359                         return;
4360                 }
4361         }
4362
4363         /* If it's an IPC, pass off the pipe handler. */
4364         if (IS_IPC(conn)) {
4365                 if (req->unread_bytes) {
4366                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4367                         END_PROFILE(SMBwriteX);
4368                         return;
4369                 }
4370                 reply_pipe_write_and_X(req);
4371                 END_PROFILE(SMBwriteX);
4372                 return;
4373         }
4374
4375         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4376         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4377         write_through = BITSETW(req->vwv+7,0);
4378
4379         if (!check_fsp(conn, req, fsp)) {
4380                 END_PROFILE(SMBwriteX);
4381                 return;
4382         }
4383
4384         if (!CHECK_WRITE(fsp)) {
4385                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4386                 END_PROFILE(SMBwriteX);
4387                 return;
4388         }
4389
4390         data = smb_base(req->inbuf) + smb_doff;
4391
4392         if(req->wct == 14) {
4393 #ifdef LARGE_SMB_OFF_T
4394                 /*
4395                  * This is a large offset (64 bit) write.
4396                  */
4397                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4398
4399 #else /* !LARGE_SMB_OFF_T */
4400
4401                 /*
4402                  * Ensure we haven't been sent a >32 bit offset.
4403                  */
4404
4405                 if(IVAL(req->vwv+12, 0) != 0) {
4406                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4407                                  "used and we don't support 64 bit offsets.\n",
4408                                  (unsigned int)IVAL(req->vwv+12, 0) ));
4409                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4410                         END_PROFILE(SMBwriteX);
4411                         return;
4412                 }
4413
4414 #endif /* LARGE_SMB_OFF_T */
4415         }
4416
4417         init_strict_lock_struct(fsp, (uint32)req->smbpid,
4418             (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4419             &lock);
4420
4421         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4422                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4423                 END_PROFILE(SMBwriteX);
4424                 return;
4425         }
4426
4427         /* X/Open SMB protocol says that, unlike SMBwrite
4428         if the length is zero then NO truncation is
4429         done, just a write of zero. To truncate a file,
4430         use SMBwrite. */
4431
4432         if(numtowrite == 0) {
4433                 nwritten = 0;
4434         } else {
4435
4436                 if ((req->unread_bytes == 0) &&
4437                     schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4438                                              numtowrite)) {
4439                         goto strict_unlock;
4440                 }
4441
4442                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4443         }
4444
4445         if(nwritten < 0) {
4446                 reply_nterror(req, map_nt_error_from_unix(errno));
4447                 goto strict_unlock;
4448         }
4449
4450         if((nwritten == 0) && (numtowrite != 0)) {
4451                 reply_nterror(req, NT_STATUS_DISK_FULL);
4452                 goto strict_unlock;
4453         }
4454
4455         reply_outbuf(req, 6, 0);
4456         SSVAL(req->outbuf,smb_vwv2,nwritten);
4457         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4458
4459         if (nwritten < (ssize_t)numtowrite) {
4460                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4461                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4462         }
4463
4464         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4465                 fsp->fnum, (int)numtowrite, (int)nwritten));
4466
4467         status = sync_file(conn, fsp, write_through);
4468         if (!NT_STATUS_IS_OK(status)) {
4469                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4470                          fsp_str_dbg(fsp), nt_errstr(status)));
4471                 reply_nterror(req, status);
4472                 goto strict_unlock;
4473         }
4474
4475         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4476
4477         END_PROFILE(SMBwriteX);
4478         chain_reply(req);
4479         return;
4480
4481 strict_unlock:
4482         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4483
4484         END_PROFILE(SMBwriteX);
4485         return;
4486 }
4487
4488 /****************************************************************************
4489  Reply to a lseek.
4490 ****************************************************************************/
4491
4492 void reply_lseek(struct smb_request *req)
4493 {
4494         connection_struct *conn = req->conn;
4495         SMB_OFF_T startpos;
4496         SMB_OFF_T res= -1;
4497         int mode,umode;
4498         files_struct *fsp;
4499
4500         START_PROFILE(SMBlseek);
4501
4502         if (req->wct < 4) {
4503                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4504                 END_PROFILE(SMBlseek);
4505                 return;
4506         }
4507
4508         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4509
4510         if (!check_fsp(conn, req, fsp)) {
4511                 return;
4512         }
4513
4514         flush_write_cache(fsp, SEEK_FLUSH);
4515
4516         mode = SVAL(req->vwv+1, 0) & 3;
4517         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4518         startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4519
4520         switch (mode) {
4521                 case 0:
4522                         umode = SEEK_SET;
4523                         res = startpos;
4524                         break;
4525                 case 1:
4526                         umode = SEEK_CUR;
4527                         res = fsp->fh->pos + startpos;
4528                         break;
4529                 case 2:
4530                         umode = SEEK_END;
4531                         break;
4532                 default:
4533                         umode = SEEK_SET;
4534                         res = startpos;
4535                         break;
4536         }
4537
4538         if (umode == SEEK_END) {
4539                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4540                         if(errno == EINVAL) {
4541                                 SMB_OFF_T current_pos = startpos;
4542
4543                                 if(fsp_stat(fsp) == -1) {
4544                                         reply_nterror(req,
4545                                                 map_nt_error_from_unix(errno));
4546                                         END_PROFILE(SMBlseek);
4547                                         return;
4548                                 }
4549
4550                                 current_pos += fsp->fsp_name->st.st_ex_size;
4551                                 if(current_pos < 0)
4552                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4553                         }
4554                 }
4555
4556                 if(res == -1) {
4557                         reply_nterror(req, map_nt_error_from_unix(errno));
4558                         END_PROFILE(SMBlseek);
4559                         return;
4560                 }
4561         }
4562
4563         fsp->fh->pos = res;
4564
4565         reply_outbuf(req, 2, 0);
4566         SIVAL(req->outbuf,smb_vwv0,res);
4567
4568         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4569                 fsp->fnum, (double)startpos, (double)res, mode));
4570
4571         END_PROFILE(SMBlseek);
4572         return;
4573 }
4574
4575 /****************************************************************************
4576  Reply to a flush.
4577 ****************************************************************************/
4578
4579 void reply_flush(struct smb_request *req)
4580 {
4581         connection_struct *conn = req->conn;
4582         uint16 fnum;
4583         files_struct *fsp;
4584
4585         START_PROFILE(SMBflush);
4586
4587         if (req->wct < 1) {
4588                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4589                 return;
4590         }
4591
4592         fnum = SVAL(req->vwv+0, 0);
4593         fsp = file_fsp(req, fnum);
4594
4595         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4596                 return;
4597         }
4598
4599         if (!fsp) {
4600                 file_sync_all(conn);
4601         } else {
4602                 NTSTATUS status = sync_file(conn, fsp, True);
4603                 if (!NT_STATUS_IS_OK(status)) {
4604                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4605                                 fsp_str_dbg(fsp), nt_errstr(status)));
4606                         reply_nterror(req, status);
4607                         END_PROFILE(SMBflush);
4608                         return;
4609                 }
4610         }
4611
4612         reply_outbuf(req, 0, 0);
4613
4614         DEBUG(3,("flush\n"));
4615         END_PROFILE(SMBflush);
4616         return;
4617 }
4618
4619 /****************************************************************************
4620  Reply to a exit.
4621  conn POINTER CAN BE NULL HERE !
4622 ****************************************************************************/
4623
4624 void reply_exit(struct smb_request *req)
4625 {
4626         START_PROFILE(SMBexit);
4627
4628         file_close_pid(req->smbpid, req->vuid);
4629
4630         reply_outbuf(req, 0, 0);
4631
4632         DEBUG(3,("exit\n"));
4633
4634         END_PROFILE(SMBexit);
4635         return;
4636 }
4637
4638 /****************************************************************************
4639  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4640 ****************************************************************************/
4641
4642 void reply_close(struct smb_request *req)
4643 {
4644         connection_struct *conn = req->conn;
4645         NTSTATUS status = NT_STATUS_OK;
4646         files_struct *fsp = NULL;
4647         START_PROFILE(SMBclose);
4648
4649         if (req->wct < 3) {
4650                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4651                 END_PROFILE(SMBclose);
4652                 return;
4653         }
4654
4655         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4656
4657         /*
4658          * We can only use check_fsp if we know it's not a directory.
4659          */
4660
4661         if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4662                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4663                 END_PROFILE(SMBclose);
4664                 return;
4665         }
4666
4667         if(fsp->is_directory) {
4668                 /*
4669                  * Special case - close NT SMB directory handle.
4670                  */
4671                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4672                 status = close_file(req, fsp, NORMAL_CLOSE);
4673         } else {
4674                 time_t t;
4675                 /*
4676                  * Close ordinary file.
4677                  */
4678
4679                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4680                          fsp->fh->fd, fsp->fnum,
4681                          conn->num_files_open));
4682
4683                 /*
4684                  * Take care of any time sent in the close.
4685                  */
4686
4687                 t = srv_make_unix_date3(req->vwv+1);
4688                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4689
4690                 /*
4691                  * close_file() returns the unix errno if an error
4692                  * was detected on close - normally this is due to
4693                  * a disk full error. If not then it was probably an I/O error.
4694                  */
4695
4696                 status = close_file(req, fsp, NORMAL_CLOSE);
4697         }
4698
4699         if (!NT_STATUS_IS_OK(status)) {
4700                 reply_nterror(req, status);
4701                 END_PROFILE(SMBclose);
4702                 return;
4703         }
4704
4705         reply_outbuf(req, 0, 0);
4706         END_PROFILE(SMBclose);
4707         return;
4708 }
4709
4710 /****************************************************************************
4711  Reply to a writeclose (Core+ protocol).
4712 ****************************************************************************/
4713
4714 void reply_writeclose(struct smb_request *req)
4715 {
4716         connection_struct *conn = req->conn;
4717         size_t numtowrite;
4718         ssize_t nwritten = -1;
4719         NTSTATUS close_status = NT_STATUS_OK;
4720         SMB_OFF_T startpos;
4721         const char *data;
4722         struct timespec mtime;
4723         files_struct *fsp;
4724         struct lock_struct lock;
4725
4726         START_PROFILE(SMBwriteclose);
4727
4728         if (req->wct < 6) {
4729                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4730                 END_PROFILE(SMBwriteclose);
4731                 return;
4732         }
4733
4734         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4735
4736         if (!check_fsp(conn, req, fsp)) {
4737                 END_PROFILE(SMBwriteclose);
4738                 return;
4739         }
4740         if (!CHECK_WRITE(fsp)) {
4741                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4742                 END_PROFILE(SMBwriteclose);
4743                 return;
4744         }
4745
4746         numtowrite = SVAL(req->vwv+1, 0);
4747         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4748         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4749         data = (const char *)req->buf + 1;
4750
4751         if (fsp->print_file) {
4752                 startpos = printfile_offset(fsp, startpos);
4753         } else if (numtowrite) {
4754                 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4755                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4756                     &lock);
4757
4758                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4759                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4760                         END_PROFILE(SMBwriteclose);
4761                         return;
4762                 }
4763         }
4764
4765         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4766
4767         set_close_write_time(fsp, mtime);
4768
4769         /*
4770          * More insanity. W2K only closes the file if writelen > 0.
4771          * JRA.
4772          */
4773
4774         if (numtowrite) {
4775                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4776                          "file %s\n", fsp_str_dbg(fsp)));
4777                 close_status = close_file(req, fsp, NORMAL_CLOSE);
4778         }
4779
4780         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4781                  fsp->fnum, (int)numtowrite, (int)nwritten,
4782                  conn->num_files_open));
4783
4784         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4785                 reply_nterror(req, NT_STATUS_DISK_FULL);
4786                 goto strict_unlock;
4787         }
4788
4789         if(!NT_STATUS_IS_OK(close_status)) {
4790                 reply_nterror(req, close_status);
4791                 goto strict_unlock;
4792         }
4793
4794         reply_outbuf(req, 1, 0);
4795
4796         SSVAL(req->outbuf,smb_vwv0,nwritten);
4797
4798 strict_unlock:
4799         if (numtowrite && !fsp->print_file) {
4800                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4801         }
4802
4803         END_PROFILE(SMBwriteclose);
4804         return;
4805 }
4806
4807 #undef DBGC_CLASS
4808 #define DBGC_CLASS DBGC_LOCKING
4809
4810 /****************************************************************************
4811  Reply to a lock.
4812 ****************************************************************************/
4813
4814 void reply_lock(struct smb_request *req)
4815 {
4816         connection_struct *conn = req->conn;
4817         uint64_t count,offset;
4818         NTSTATUS status;
4819         files_struct *fsp;
4820         struct byte_range_lock *br_lck = NULL;
4821
4822         START_PROFILE(SMBlock);
4823
4824         if (req->wct < 5) {
4825                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4826                 END_PROFILE(SMBlock);
4827                 return;
4828         }
4829
4830         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4831
4832         if (!check_fsp(conn, req, fsp)) {
4833                 END_PROFILE(SMBlock);
4834                 return;
4835         }
4836
4837         count = (uint64_t)IVAL(req->vwv+1, 0);
4838         offset = (uint64_t)IVAL(req->vwv+3, 0);
4839
4840         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4841                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4842
4843         br_lck = do_lock(smbd_messaging_context(),
4844                         fsp,
4845                         req->smbpid,
4846                         count,
4847                         offset,
4848                         WRITE_LOCK,
4849                         WINDOWS_LOCK,
4850                         False, /* Non-blocking lock. */
4851                         &status,
4852                         NULL,
4853                         NULL);
4854
4855         TALLOC_FREE(br_lck);
4856
4857         if (NT_STATUS_V(status)) {
4858                 reply_nterror(req, status);
4859                 END_PROFILE(SMBlock);
4860                 return;
4861         }
4862
4863         reply_outbuf(req, 0, 0);
4864
4865         END_PROFILE(SMBlock);
4866         return;
4867 }
4868
4869 /****************************************************************************
4870  Reply to a unlock.
4871 ****************************************************************************/
4872
4873 void reply_unlock(struct smb_request *req)
4874 {
4875         connection_struct *conn = req->conn;
4876         uint64_t count,offset;
4877         NTSTATUS status;
4878         files_struct *fsp;
4879
4880         START_PROFILE(SMBunlock);
4881
4882         if (req->wct < 5) {
4883                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4884                 END_PROFILE(SMBunlock);
4885                 return;
4886         }
4887
4888         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4889
4890         if (!check_fsp(conn, req, fsp)) {
4891                 END_PROFILE(SMBunlock);
4892                 return;
4893         }
4894
4895         count = (uint64_t)IVAL(req->vwv+1, 0);
4896         offset = (uint64_t)IVAL(req->vwv+3, 0);
4897
4898         status = do_unlock(smbd_messaging_context(),
4899                         fsp,
4900                         req->smbpid,
4901                         count,
4902                         offset,
4903                         WINDOWS_LOCK);
4904
4905         if (NT_STATUS_V(status)) {
4906                 reply_nterror(req, status);
4907                 END_PROFILE(SMBunlock);
4908                 return;
4909         }
4910
4911         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4912                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4913
4914         reply_outbuf(req, 0, 0);
4915
4916         END_PROFILE(SMBunlock);
4917         return;
4918 }
4919
4920 #undef DBGC_CLASS
4921 #define DBGC_CLASS DBGC_ALL
4922
4923 /****************************************************************************
4924  Reply to a tdis.
4925  conn POINTER CAN BE NULL HERE !
4926 ****************************************************************************/
4927
4928 void reply_tdis(struct smb_request *req)
4929 {
4930         connection_struct *conn = req->conn;
4931         START_PROFILE(SMBtdis);
4932
4933         if (!conn) {
4934                 DEBUG(4,("Invalid connection in tdis\n"));
4935                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
4936                 END_PROFILE(SMBtdis);
4937                 return;
4938         }
4939
4940         conn->used = False;
4941
4942         close_cnum(conn,req->vuid);
4943         req->conn = NULL;
4944
4945         reply_outbuf(req, 0, 0);
4946         END_PROFILE(SMBtdis);
4947         return;
4948 }
4949
4950 /****************************************************************************
4951  Reply to a echo.
4952  conn POINTER CAN BE NULL HERE !
4953 ****************************************************************************/
4954
4955 void reply_echo(struct smb_request *req)
4956 {
4957         connection_struct *conn = req->conn;
4958         struct smb_perfcount_data local_pcd;
4959         struct smb_perfcount_data *cur_pcd;
4960         int smb_reverb;
4961         int seq_num;
4962
4963         START_PROFILE(SMBecho);
4964
4965         smb_init_perfcount_data(&local_pcd);
4966
4967         if (req->wct < 1) {
4968                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4969                 END_PROFILE(SMBecho);
4970                 return;
4971         }
4972
4973         smb_reverb = SVAL(req->vwv+0, 0);
4974
4975         reply_outbuf(req, 1, req->buflen);
4976
4977         /* copy any incoming data back out */
4978         if (req->buflen > 0) {
4979                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4980         }
4981
4982         if (smb_reverb > 100) {
4983                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4984                 smb_reverb = 100;
4985         }
4986
4987         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4988
4989                 /* this makes sure we catch the request pcd */
4990                 if (seq_num == smb_reverb) {
4991                         cur_pcd = &req->pcd;
4992                 } else {
4993                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4994                         cur_pcd = &local_pcd;
4995                 }
4996
4997                 SSVAL(req->outbuf,smb_vwv0,seq_num);
4998
4999                 show_msg((char *)req->outbuf);
5000                 if (!srv_send_smb(smbd_server_fd(),
5001                                 (char *)req->outbuf,
5002                                 true, req->seqnum+1,
5003                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5004                                 cur_pcd))
5005                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5006         }
5007
5008         DEBUG(3,("echo %d times\n", smb_reverb));
5009
5010         TALLOC_FREE(req->outbuf);
5011
5012         END_PROFILE(SMBecho);
5013         return;
5014 }
5015
5016 /****************************************************************************
5017  Reply to a printopen.
5018 ****************************************************************************/
5019
5020 void reply_printopen(struct smb_request *req)
5021 {
5022         connection_struct *conn = req->conn;
5023         files_struct *fsp;
5024         NTSTATUS status;
5025
5026         START_PROFILE(SMBsplopen);
5027
5028         if (req->wct < 2) {
5029                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5030                 END_PROFILE(SMBsplopen);
5031                 return;
5032         }
5033
5034         if (!CAN_PRINT(conn)) {
5035                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5036                 END_PROFILE(SMBsplopen);
5037                 return;
5038         }
5039
5040         status = file_new(req, conn, &fsp);
5041         if(!NT_STATUS_IS_OK(status)) {
5042                 reply_nterror(req, status);
5043                 END_PROFILE(SMBsplopen);
5044                 return;
5045         }
5046
5047         /* Open for exclusive use, write only. */
5048         status = print_fsp_open(req, conn, NULL, req->vuid, fsp);
5049
5050         if (!NT_STATUS_IS_OK(status)) {
5051                 file_free(req, fsp);
5052                 reply_nterror(req, status);
5053                 END_PROFILE(SMBsplopen);
5054                 return;
5055         }
5056
5057         reply_outbuf(req, 1, 0);
5058         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5059
5060         DEBUG(3,("openprint fd=%d fnum=%d\n",
5061                  fsp->fh->fd, fsp->fnum));
5062
5063         END_PROFILE(SMBsplopen);
5064         return;
5065 }
5066
5067 /****************************************************************************
5068  Reply to a printclose.
5069 ****************************************************************************/
5070
5071 void reply_printclose(struct smb_request *req)
5072 {
5073         connection_struct *conn = req->conn;
5074         files_struct *fsp;
5075         NTSTATUS status;
5076
5077         START_PROFILE(SMBsplclose);
5078
5079         if (req->wct < 1) {
5080                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5081                 END_PROFILE(SMBsplclose);
5082                 return;
5083         }
5084
5085         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5086
5087         if (!check_fsp(conn, req, fsp)) {
5088                 END_PROFILE(SMBsplclose);
5089                 return;
5090         }
5091
5092         if (!CAN_PRINT(conn)) {
5093                 reply_force_doserror(req, ERRSRV, ERRerror);
5094                 END_PROFILE(SMBsplclose);
5095                 return;
5096         }
5097
5098         DEBUG(3,("printclose fd=%d fnum=%d\n",
5099                  fsp->fh->fd,fsp->fnum));
5100
5101         status = close_file(req, fsp, NORMAL_CLOSE);
5102
5103         if(!NT_STATUS_IS_OK(status)) {
5104                 reply_nterror(req, status);
5105                 END_PROFILE(SMBsplclose);
5106                 return;
5107         }
5108
5109         reply_outbuf(req, 0, 0);
5110
5111         END_PROFILE(SMBsplclose);
5112         return;
5113 }
5114
5115 /****************************************************************************
5116  Reply to a printqueue.
5117 ****************************************************************************/
5118
5119 void reply_printqueue(struct smb_request *req)
5120 {
5121         connection_struct *conn = req->conn;
5122         int max_count;
5123         int start_index;
5124
5125         START_PROFILE(SMBsplretq);
5126
5127         if (req->wct < 2) {
5128                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5129                 END_PROFILE(SMBsplretq);
5130                 return;
5131         }
5132
5133         max_count = SVAL(req->vwv+0, 0);
5134         start_index = SVAL(req->vwv+1, 0);
5135
5136         /* we used to allow the client to get the cnum wrong, but that
5137            is really quite gross and only worked when there was only
5138            one printer - I think we should now only accept it if they
5139            get it right (tridge) */
5140         if (!CAN_PRINT(conn)) {
5141                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5142                 END_PROFILE(SMBsplretq);
5143                 return;
5144         }
5145
5146         reply_outbuf(req, 2, 3);
5147         SSVAL(req->outbuf,smb_vwv0,0);
5148         SSVAL(req->outbuf,smb_vwv1,0);
5149         SCVAL(smb_buf(req->outbuf),0,1);
5150         SSVAL(smb_buf(req->outbuf),1,0);
5151
5152         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5153                  start_index, max_count));
5154
5155         {
5156                 print_queue_struct *queue = NULL;
5157                 print_status_struct status;
5158                 int count = print_queue_status(SNUM(conn), &queue, &status);
5159                 int num_to_get = ABS(max_count);
5160                 int first = (max_count>0?start_index:start_index+max_count+1);
5161                 int i;
5162
5163                 if (first >= count)
5164                         num_to_get = 0;
5165                 else
5166                         num_to_get = MIN(num_to_get,count-first);
5167
5168
5169                 for (i=first;i<first+num_to_get;i++) {
5170                         char blob[28];
5171                         char *p = blob;
5172
5173                         srv_put_dos_date2(p,0,queue[i].time);
5174                         SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
5175                         SSVAL(p,5, queue[i].job);
5176                         SIVAL(p,7,queue[i].size);
5177                         SCVAL(p,11,0);
5178                         srvstr_push(blob, req->flags2, p+12,
5179                                     queue[i].fs_user, 16, STR_ASCII);
5180
5181                         if (message_push_blob(
5182                                     &req->outbuf,
5183                                     data_blob_const(
5184                                             blob, sizeof(blob))) == -1) {
5185                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5186                                 END_PROFILE(SMBsplretq);
5187                                 return;
5188                         }
5189                 }
5190
5191                 if (count > 0) {
5192                         SSVAL(req->outbuf,smb_vwv0,count);
5193                         SSVAL(req->outbuf,smb_vwv1,
5194                               (max_count>0?first+count:first-1));
5195                         SCVAL(smb_buf(req->outbuf),0,1);
5196                         SSVAL(smb_buf(req->outbuf),1,28*count);
5197                 }
5198
5199                 SAFE_FREE(queue);
5200
5201                 DEBUG(3,("%d entries returned in queue\n",count));
5202         }
5203
5204         END_PROFILE(SMBsplretq);
5205         return;
5206 }
5207
5208 /****************************************************************************
5209  Reply to a printwrite.
5210 ****************************************************************************/
5211
5212 void reply_printwrite(struct smb_request *req)
5213 {
5214         connection_struct *conn = req->conn;
5215         int numtowrite;
5216         const char *data;
5217         files_struct *fsp;
5218
5219         START_PROFILE(SMBsplwr);
5220
5221         if (req->wct < 1) {
5222                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5223                 END_PROFILE(SMBsplwr);
5224                 return;
5225         }
5226
5227         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5228
5229         if (!check_fsp(conn, req, fsp)) {
5230                 END_PROFILE(SMBsplwr);
5231                 return;
5232         }
5233
5234         if (!CAN_PRINT(conn)) {
5235                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5236                 END_PROFILE(SMBsplwr);
5237                 return;
5238         }
5239
5240         if (!CHECK_WRITE(fsp)) {
5241                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5242                 END_PROFILE(SMBsplwr);
5243                 return;
5244         }
5245
5246         numtowrite = SVAL(req->buf, 1);
5247
5248         if (req->buflen < numtowrite + 3) {
5249                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5250                 END_PROFILE(SMBsplwr);
5251                 return;
5252         }
5253
5254         data = (const char *)req->buf + 3;
5255
5256         if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5257                 reply_nterror(req, map_nt_error_from_unix(errno));
5258                 END_PROFILE(SMBsplwr);
5259                 return;
5260         }
5261
5262         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5263
5264         END_PROFILE(SMBsplwr);
5265         return;
5266 }
5267
5268 /****************************************************************************
5269  Reply to a mkdir.
5270 ****************************************************************************/
5271
5272 void reply_mkdir(struct smb_request *req)
5273 {
5274         connection_struct *conn = req->conn;
5275         struct smb_filename *smb_dname = NULL;
5276         char *directory = NULL;
5277         NTSTATUS status;
5278         TALLOC_CTX *ctx = talloc_tos();
5279
5280         START_PROFILE(SMBmkdir);
5281
5282         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5283                             STR_TERMINATE, &status);
5284         if (!NT_STATUS_IS_OK(status)) {
5285                 reply_nterror(req, status);
5286                 goto out;
5287         }
5288
5289         status = filename_convert(ctx, conn,
5290                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5291                                  directory,
5292                                  0,
5293                                  NULL,
5294                                  &smb_dname);
5295         if (!NT_STATUS_IS_OK(status)) {
5296                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5297                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5298                                         ERRSRV, ERRbadpath);
5299                         goto out;
5300                 }
5301                 reply_nterror(req, status);
5302                 goto out;
5303         }
5304
5305         status = create_directory(conn, req, smb_dname);
5306
5307         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5308
5309         if (!NT_STATUS_IS_OK(status)) {
5310
5311                 if (!use_nt_status()
5312                     && NT_STATUS_EQUAL(status,
5313                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5314                         /*
5315                          * Yes, in the DOS error code case we get a
5316                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5317                          * samba4 torture test.
5318                          */
5319                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5320                 }
5321
5322                 reply_nterror(req, status);
5323                 goto out;
5324         }
5325
5326         reply_outbuf(req, 0, 0);
5327
5328         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5329  out:
5330         TALLOC_FREE(smb_dname);
5331         END_PROFILE(SMBmkdir);
5332         return;
5333 }
5334
5335 /****************************************************************************
5336  Reply to a rmdir.
5337 ****************************************************************************/
5338
5339 void reply_rmdir(struct smb_request *req)
5340 {
5341         connection_struct *conn = req->conn;
5342         struct smb_filename *smb_dname = NULL;
5343         char *directory = NULL;
5344         NTSTATUS status;
5345         TALLOC_CTX *ctx = talloc_tos();
5346         files_struct *fsp = NULL;
5347         int info = 0;
5348         struct smbd_server_connection *sconn = smbd_server_conn;
5349
5350         START_PROFILE(SMBrmdir);
5351
5352         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5353                             STR_TERMINATE, &status);
5354         if (!NT_STATUS_IS_OK(status)) {
5355                 reply_nterror(req, status);
5356                 goto out;
5357         }
5358
5359         status = filename_convert(ctx, conn,
5360                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5361                                  directory,
5362                                  0,
5363                                  NULL,
5364                                  &smb_dname);
5365         if (!NT_STATUS_IS_OK(status)) {
5366                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5367                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5368                                         ERRSRV, ERRbadpath);
5369                         goto out;
5370                 }
5371                 reply_nterror(req, status);
5372                 goto out;
5373         }
5374
5375         if (is_ntfs_stream_smb_fname(smb_dname)) {
5376                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5377                 goto out;
5378         }
5379
5380         status = SMB_VFS_CREATE_FILE(
5381                 conn,                                   /* conn */
5382                 req,                                    /* req */
5383                 0,                                      /* root_dir_fid */
5384                 smb_dname,                              /* fname */
5385                 DELETE_ACCESS,                          /* access_mask */
5386                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5387                         FILE_SHARE_DELETE),
5388                 FILE_OPEN,                              /* create_disposition*/
5389                 FILE_DIRECTORY_FILE,                    /* create_options */
5390                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5391                 0,                                      /* oplock_request */
5392                 0,                                      /* allocation_size */
5393                 0,                                      /* private_flags */
5394                 NULL,                                   /* sd */
5395                 NULL,                                   /* ea_list */
5396                 &fsp,                                   /* result */
5397                 &info);                                 /* pinfo */
5398
5399         if (!NT_STATUS_IS_OK(status)) {
5400                 if (open_was_deferred(req->mid)) {
5401                         /* We have re-scheduled this call. */
5402                         goto out;
5403                 }
5404                 reply_nterror(req, status);
5405                 goto out;
5406         }
5407
5408         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5409         if (!NT_STATUS_IS_OK(status)) {
5410                 close_file(req, fsp, ERROR_CLOSE);
5411                 reply_nterror(req, status);
5412                 goto out;
5413         }
5414
5415         if (!set_delete_on_close(fsp, true, &conn->server_info->utok)) {
5416                 close_file(req, fsp, ERROR_CLOSE);
5417                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5418                 goto out;
5419         }
5420
5421         status = close_file(req, fsp, NORMAL_CLOSE);
5422         if (!NT_STATUS_IS_OK(status)) {
5423                 reply_nterror(req, status);
5424         } else {
5425                 reply_outbuf(req, 0, 0);
5426         }
5427
5428         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5429
5430         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5431  out:
5432         TALLOC_FREE(smb_dname);
5433         END_PROFILE(SMBrmdir);
5434         return;
5435 }
5436
5437 /*******************************************************************
5438  Resolve wildcards in a filename rename.
5439 ********************************************************************/
5440
5441 static bool resolve_wildcards(TALLOC_CTX *ctx,
5442                                 const char *name1,
5443                                 const char *name2,
5444                                 char **pp_newname)
5445 {
5446         char *name2_copy = NULL;
5447         char *root1 = NULL;
5448         char *root2 = NULL;
5449         char *ext1 = NULL;
5450         char *ext2 = NULL;
5451         char *p,*p2, *pname1, *pname2;
5452
5453         name2_copy = talloc_strdup(ctx, name2);
5454         if (!name2_copy) {
5455                 return False;
5456         }
5457
5458         pname1 = strrchr_m(name1,'/');
5459         pname2 = strrchr_m(name2_copy,'/');
5460
5461         if (!pname1 || !pname2) {
5462                 return False;
5463         }
5464
5465         /* Truncate the copy of name2 at the last '/' */
5466         *pname2 = '\0';
5467
5468         /* Now go past the '/' */
5469         pname1++;
5470         pname2++;
5471
5472         root1 = talloc_strdup(ctx, pname1);
5473         root2 = talloc_strdup(ctx, pname2);
5474
5475         if (!root1 || !root2) {
5476                 return False;
5477         }
5478
5479         p = strrchr_m(root1,'.');
5480         if (p) {
5481                 *p = 0;
5482                 ext1 = talloc_strdup(ctx, p+1);
5483         } else {
5484                 ext1 = talloc_strdup(ctx, "");
5485         }
5486         p = strrchr_m(root2,'.');
5487         if (p) {
5488                 *p = 0;
5489                 ext2 = talloc_strdup(ctx, p+1);
5490         } else {
5491                 ext2 = talloc_strdup(ctx, "");
5492         }
5493
5494         if (!ext1 || !ext2) {
5495                 return False;
5496         }
5497
5498         p = root1;
5499         p2 = root2;
5500         while (*p2) {
5501                 if (*p2 == '?') {
5502                         /* Hmmm. Should this be mb-aware ? */
5503                         *p2 = *p;
5504                         p2++;
5505                 } else if (*p2 == '*') {
5506                         *p2 = '\0';
5507                         root2 = talloc_asprintf(ctx, "%s%s",
5508                                                 root2,
5509                                                 p);
5510                         if (!root2) {
5511                                 return False;
5512                         }
5513                         break;
5514                 } else {
5515                         p2++;
5516                 }
5517                 if (*p) {
5518                         p++;
5519                 }
5520         }
5521
5522         p = ext1;
5523         p2 = ext2;
5524         while (*p2) {
5525                 if (*p2 == '?') {
5526                         /* Hmmm. Should this be mb-aware ? */
5527                         *p2 = *p;
5528                         p2++;
5529                 } else if (*p2 == '*') {
5530                         *p2 = '\0';
5531                         ext2 = talloc_asprintf(ctx, "%s%s",
5532                                                 ext2,
5533                                                 p);
5534                         if (!ext2) {
5535                                 return False;
5536                         }
5537                         break;
5538                 } else {
5539                         p2++;
5540                 }
5541                 if (*p) {
5542                         p++;
5543                 }
5544         }
5545
5546         if (*ext2) {
5547                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5548                                 name2_copy,
5549                                 root2,
5550                                 ext2);
5551         } else {
5552                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5553                                 name2_copy,
5554                                 root2);
5555         }
5556
5557         if (!*pp_newname) {
5558                 return False;
5559         }
5560
5561         return True;
5562 }
5563
5564 /****************************************************************************
5565  Ensure open files have their names updated. Updated to notify other smbd's
5566  asynchronously.
5567 ****************************************************************************/
5568
5569 static void rename_open_files(connection_struct *conn,
5570                               struct share_mode_lock *lck,
5571                               const struct smb_filename *smb_fname_dst)
5572 {
5573         files_struct *fsp;
5574         bool did_rename = False;
5575         NTSTATUS status;
5576
5577         for(fsp = file_find_di_first(lck->id); fsp;
5578             fsp = file_find_di_next(fsp)) {
5579                 /* fsp_name is a relative path under the fsp. To change this for other
5580                    sharepaths we need to manipulate relative paths. */
5581                 /* TODO - create the absolute path and manipulate the newname
5582                    relative to the sharepath. */
5583                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5584                         continue;
5585                 }
5586                 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5587                            "(file_id %s) from %s -> %s\n", fsp->fnum,
5588                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5589                            smb_fname_str_dbg(smb_fname_dst)));
5590
5591                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5592                 if (NT_STATUS_IS_OK(status)) {
5593                         did_rename = True;
5594                 }
5595         }
5596
5597         if (!did_rename) {
5598                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5599                            "for %s\n", file_id_string_tos(&lck->id),
5600                            smb_fname_str_dbg(smb_fname_dst)));
5601         }
5602
5603         /* Send messages to all smbd's (not ourself) that the name has changed. */
5604         rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5605                               smb_fname_dst);
5606
5607 }
5608
5609 /****************************************************************************
5610  We need to check if the source path is a parent directory of the destination
5611  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5612  refuse the rename with a sharing violation. Under UNIX the above call can
5613  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5614  probably need to check that the client is a Windows one before disallowing
5615  this as a UNIX client (one with UNIX extensions) can know the source is a
5616  symlink and make this decision intelligently. Found by an excellent bug
5617  report from <AndyLiebman@aol.com>.
5618 ****************************************************************************/
5619
5620 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5621                                      const struct smb_filename *smb_fname_dst)
5622 {
5623         const char *psrc = smb_fname_src->base_name;
5624         const char *pdst = smb_fname_dst->base_name;
5625         size_t slen;
5626
5627         if (psrc[0] == '.' && psrc[1] == '/') {
5628                 psrc += 2;
5629         }
5630         if (pdst[0] == '.' && pdst[1] == '/') {
5631                 pdst += 2;
5632         }
5633         if ((slen = strlen(psrc)) > strlen(pdst)) {
5634                 return False;
5635         }
5636         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5637 }
5638
5639 /*
5640  * Do the notify calls from a rename
5641  */
5642
5643 static void notify_rename(connection_struct *conn, bool is_dir,
5644                           const struct smb_filename *smb_fname_src,
5645                           const struct smb_filename *smb_fname_dst)
5646 {
5647         char *parent_dir_src = NULL;
5648         char *parent_dir_dst = NULL;
5649         uint32 mask;
5650
5651         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5652                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5653
5654         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5655                             &parent_dir_src, NULL) ||
5656             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5657                             &parent_dir_dst, NULL)) {
5658                 goto out;
5659         }
5660
5661         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5662                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5663                              smb_fname_src->base_name);
5664                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5665                              smb_fname_dst->base_name);
5666         }
5667         else {
5668                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5669                              smb_fname_src->base_name);
5670                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5671                              smb_fname_dst->base_name);
5672         }
5673
5674         /* this is a strange one. w2k3 gives an additional event for
5675            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5676            files, but not directories */
5677         if (!is_dir) {
5678                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5679                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5680                              |FILE_NOTIFY_CHANGE_CREATION,
5681                              smb_fname_dst->base_name);
5682         }
5683  out:
5684         TALLOC_FREE(parent_dir_src);
5685         TALLOC_FREE(parent_dir_dst);
5686 }
5687
5688 /****************************************************************************
5689  Rename an open file - given an fsp.
5690 ****************************************************************************/
5691
5692 NTSTATUS rename_internals_fsp(connection_struct *conn,
5693                         files_struct *fsp,
5694                         const struct smb_filename *smb_fname_dst_in,
5695                         uint32 attrs,
5696                         bool replace_if_exists)
5697 {
5698         TALLOC_CTX *ctx = talloc_tos();
5699         struct smb_filename *smb_fname_dst = NULL;
5700         NTSTATUS status = NT_STATUS_OK;
5701         struct share_mode_lock *lck = NULL;
5702         bool dst_exists, old_is_stream, new_is_stream;
5703
5704         status = check_name(conn, smb_fname_dst_in->base_name);
5705         if (!NT_STATUS_IS_OK(status)) {
5706                 return status;
5707         }
5708
5709         /* Make a copy of the dst smb_fname structs */
5710
5711         status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5712         if (!NT_STATUS_IS_OK(status)) {
5713                 goto out;
5714         }
5715
5716         /* Ensure the dst smb_fname contains a '/' */
5717         if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5718                 char * tmp;
5719                 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5720                                       smb_fname_dst->base_name);
5721                 if (!tmp) {
5722                         status = NT_STATUS_NO_MEMORY;
5723                         goto out;
5724                 }
5725                 TALLOC_FREE(smb_fname_dst->base_name);
5726                 smb_fname_dst->base_name = tmp;
5727         }
5728
5729         /*
5730          * Check for special case with case preserving and not
5731          * case sensitive. If the old last component differs from the original
5732          * last component only by case, then we should allow
5733          * the rename (user is trying to change the case of the
5734          * filename).
5735          */
5736         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5737             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5738             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5739                 char *last_slash;
5740                 char *fname_dst_lcomp_base_mod = NULL;
5741                 struct smb_filename *smb_fname_orig_lcomp = NULL;
5742
5743                 /*
5744                  * Get the last component of the destination name.  Note that
5745                  * we guarantee that destination name contains a '/' character
5746                  * above.
5747                  */
5748                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5749                 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5750                 if (!fname_dst_lcomp_base_mod) {
5751                         status = NT_STATUS_NO_MEMORY;
5752                         goto out;
5753                 }
5754
5755                 /*
5756                  * Create an smb_filename struct using the original last
5757                  * component of the destination.
5758                  */
5759                 status = create_synthetic_smb_fname_split(ctx,
5760                     smb_fname_dst->original_lcomp, NULL,
5761                     &smb_fname_orig_lcomp);
5762                 if (!NT_STATUS_IS_OK(status)) {
5763                         TALLOC_FREE(fname_dst_lcomp_base_mod);
5764                         goto out;
5765                 }
5766
5767                 /* If the base names only differ by case, use original. */
5768                 if(!strcsequal(fname_dst_lcomp_base_mod,
5769                                smb_fname_orig_lcomp->base_name)) {
5770                         char *tmp;
5771                         /*
5772                          * Replace the modified last component with the
5773                          * original.
5774                          */
5775                         *last_slash = '\0'; /* Truncate at the '/' */
5776                         tmp = talloc_asprintf(smb_fname_dst,
5777                                         "%s/%s",
5778                                         smb_fname_dst->base_name,
5779                                         smb_fname_orig_lcomp->base_name);
5780                         if (tmp == NULL) {
5781                                 status = NT_STATUS_NO_MEMORY;
5782                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5783                                 TALLOC_FREE(smb_fname_orig_lcomp);
5784                                 goto out;
5785                         }
5786                         TALLOC_FREE(smb_fname_dst->base_name);
5787                         smb_fname_dst->base_name = tmp;
5788                 }
5789
5790                 /* If the stream_names only differ by case, use original. */
5791                 if(!strcsequal(smb_fname_dst->stream_name,
5792                                smb_fname_orig_lcomp->stream_name)) {
5793                         char *tmp = NULL;
5794                         /* Use the original stream. */
5795                         tmp = talloc_strdup(smb_fname_dst,
5796                                             smb_fname_orig_lcomp->stream_name);
5797                         if (tmp == NULL) {
5798                                 status = NT_STATUS_NO_MEMORY;
5799                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5800                                 TALLOC_FREE(smb_fname_orig_lcomp);
5801                                 goto out;
5802                         }
5803                         TALLOC_FREE(smb_fname_dst->stream_name);
5804                         smb_fname_dst->stream_name = tmp;
5805                 }
5806                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5807                 TALLOC_FREE(smb_fname_orig_lcomp);
5808         }
5809
5810         /*
5811          * If the src and dest names are identical - including case,
5812          * don't do the rename, just return success.
5813          */
5814
5815         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5816             strcsequal(fsp->fsp_name->stream_name,
5817                        smb_fname_dst->stream_name)) {
5818                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
5819                           "- returning success\n",
5820                           smb_fname_str_dbg(smb_fname_dst)));
5821                 status = NT_STATUS_OK;
5822                 goto out;
5823         }
5824
5825         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
5826         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
5827
5828         /* Return the correct error code if both names aren't streams. */
5829         if (!old_is_stream && new_is_stream) {
5830                 status = NT_STATUS_OBJECT_NAME_INVALID;
5831                 goto out;
5832         }
5833
5834         if (old_is_stream && !new_is_stream) {
5835                 status = NT_STATUS_INVALID_PARAMETER;
5836                 goto out;
5837         }
5838
5839         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
5840
5841         if(!replace_if_exists && dst_exists) {
5842                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
5843                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
5844                           smb_fname_str_dbg(smb_fname_dst)));
5845                 status = NT_STATUS_OBJECT_NAME_COLLISION;
5846                 goto out;
5847         }
5848
5849         if (dst_exists) {
5850                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
5851                     &smb_fname_dst->st);
5852                 files_struct *dst_fsp = file_find_di_first(fileid);
5853                 /* The file can be open when renaming a stream */
5854                 if (dst_fsp && !new_is_stream) {
5855                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5856                         status = NT_STATUS_ACCESS_DENIED;
5857                         goto out;
5858                 }
5859         }
5860
5861         /* Ensure we have a valid stat struct for the source. */
5862         status = vfs_stat_fsp(fsp);
5863         if (!NT_STATUS_IS_OK(status)) {
5864                 goto out;
5865         }
5866
5867         status = can_rename(conn, fsp, attrs);
5868
5869         if (!NT_STATUS_IS_OK(status)) {
5870                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
5871                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
5872                           smb_fname_str_dbg(smb_fname_dst)));
5873                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5874                         status = NT_STATUS_ACCESS_DENIED;
5875                 goto out;
5876         }
5877
5878         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
5879                 status = NT_STATUS_ACCESS_DENIED;
5880         }
5881
5882         lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5883                                   NULL);
5884
5885         /*
5886          * We have the file open ourselves, so not being able to get the
5887          * corresponding share mode lock is a fatal error.
5888          */
5889
5890         SMB_ASSERT(lck != NULL);
5891
5892         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
5893                 uint32 create_options = fsp->fh->private_options;
5894
5895                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
5896                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
5897                           smb_fname_str_dbg(smb_fname_dst)));
5898
5899                 if (lp_map_archive(SNUM(conn)) ||
5900                     lp_store_dos_attributes(SNUM(conn))) {
5901                         /* We must set the archive bit on the newly
5902                            renamed file. */
5903                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
5904                                 uint32_t old_dosmode = dos_mode(conn,
5905                                                         smb_fname_dst);
5906                                 file_set_dosmode(conn,
5907                                         smb_fname_dst,
5908                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
5909                                         NULL,
5910                                         true);
5911                         }
5912                 }
5913
5914                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
5915                               smb_fname_dst);
5916
5917                 rename_open_files(conn, lck, smb_fname_dst);
5918
5919                 /*
5920                  * A rename acts as a new file create w.r.t. allowing an initial delete
5921                  * on close, probably because in Windows there is a new handle to the
5922                  * new file. If initial delete on close was requested but not
5923                  * originally set, we need to set it here. This is probably not 100% correct,
5924                  * but will work for the CIFSFS client which in non-posix mode
5925                  * depends on these semantics. JRA.
5926                  */
5927
5928                 if (create_options & FILE_DELETE_ON_CLOSE) {
5929                         status = can_set_delete_on_close(fsp, 0);
5930
5931                         if (NT_STATUS_IS_OK(status)) {
5932                                 /* Note that here we set the *inital* delete on close flag,
5933                                  * not the regular one. The magic gets handled in close. */
5934                                 fsp->initial_delete_on_close = True;
5935                         }
5936                 }
5937                 TALLOC_FREE(lck);
5938                 status = NT_STATUS_OK;
5939                 goto out;
5940         }
5941
5942         TALLOC_FREE(lck);
5943
5944         if (errno == ENOTDIR || errno == EISDIR) {
5945                 status = NT_STATUS_OBJECT_NAME_COLLISION;
5946         } else {
5947                 status = map_nt_error_from_unix(errno);
5948         }
5949
5950         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
5951                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
5952                   smb_fname_str_dbg(smb_fname_dst)));
5953
5954  out:
5955         TALLOC_FREE(smb_fname_dst);
5956
5957         return status;
5958 }
5959
5960 /****************************************************************************
5961  The guts of the rename command, split out so it may be called by the NT SMB
5962  code.
5963 ****************************************************************************/
5964
5965 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5966                         connection_struct *conn,
5967                         struct smb_request *req,
5968                         struct smb_filename *smb_fname_src,
5969                         struct smb_filename *smb_fname_dst,
5970                         uint32 attrs,
5971                         bool replace_if_exists,
5972                         bool src_has_wild,
5973                         bool dest_has_wild,
5974                         uint32_t access_mask)
5975 {
5976         char *fname_src_dir = NULL;
5977         char *fname_src_mask = NULL;
5978         int count=0;
5979         NTSTATUS status = NT_STATUS_OK;
5980         struct smb_Dir *dir_hnd = NULL;
5981         const char *dname = NULL;
5982         char *talloced = NULL;
5983         long offset = 0;
5984         int create_options = 0;
5985         bool posix_pathnames = lp_posix_pathnames();
5986
5987         /*
5988          * Split the old name into directory and last component
5989          * strings. Note that unix_convert may have stripped off a
5990          * leading ./ from both name and newname if the rename is
5991          * at the root of the share. We need to make sure either both
5992          * name and newname contain a / character or neither of them do
5993          * as this is checked in resolve_wildcards().
5994          */
5995
5996         /* Split up the directory from the filename/mask. */
5997         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
5998                                       &fname_src_dir, &fname_src_mask);
5999         if (!NT_STATUS_IS_OK(status)) {
6000                 status = NT_STATUS_NO_MEMORY;
6001                 goto out;
6002         }
6003
6004         /*
6005          * We should only check the mangled cache
6006          * here if unix_convert failed. This means
6007          * that the path in 'mask' doesn't exist
6008          * on the file system and so we need to look
6009          * for a possible mangle. This patch from
6010          * Tine Smukavec <valentin.smukavec@hermes.si>.
6011          */
6012
6013         if (!VALID_STAT(smb_fname_src->st) &&
6014             mangle_is_mangled(fname_src_mask, conn->params)) {
6015                 char *new_mask = NULL;
6016                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6017                                             conn->params);
6018                 if (new_mask) {
6019                         TALLOC_FREE(fname_src_mask);
6020                         fname_src_mask = new_mask;
6021                 }
6022         }
6023
6024         if (!src_has_wild) {
6025                 files_struct *fsp;
6026
6027                 /*
6028                  * Only one file needs to be renamed. Append the mask back
6029                  * onto the directory.
6030                  */
6031                 TALLOC_FREE(smb_fname_src->base_name);
6032                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6033                                                            "%s/%s",
6034                                                            fname_src_dir,
6035                                                            fname_src_mask);
6036                 if (!smb_fname_src->base_name) {
6037                         status = NT_STATUS_NO_MEMORY;
6038                         goto out;
6039                 }
6040
6041                 /* Ensure dst fname contains a '/' also */
6042                 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6043                         char *tmp;
6044                         tmp = talloc_asprintf(smb_fname_dst, "./%s",
6045                                               smb_fname_dst->base_name);
6046                         if (!tmp) {
6047                                 status = NT_STATUS_NO_MEMORY;
6048                                 goto out;
6049                         }
6050                         TALLOC_FREE(smb_fname_dst->base_name);
6051                         smb_fname_dst->base_name = tmp;
6052                 }
6053
6054                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6055                           "case_preserve = %d, short case preserve = %d, "
6056                           "directory = %s, newname = %s, "
6057                           "last_component_dest = %s\n",
6058                           conn->case_sensitive, conn->case_preserve,
6059                           conn->short_case_preserve,
6060                           smb_fname_str_dbg(smb_fname_src),
6061                           smb_fname_str_dbg(smb_fname_dst),
6062                           smb_fname_dst->original_lcomp));
6063
6064                 /* The dest name still may have wildcards. */
6065                 if (dest_has_wild) {
6066                         char *fname_dst_mod = NULL;
6067                         if (!resolve_wildcards(smb_fname_dst,
6068                                                smb_fname_src->base_name,
6069                                                smb_fname_dst->base_name,
6070                                                &fname_dst_mod)) {
6071                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6072                                           "%s %s failed\n",
6073                                           smb_fname_src->base_name,
6074                                           smb_fname_dst->base_name));
6075                                 status = NT_STATUS_NO_MEMORY;
6076                                 goto out;
6077                         }
6078                         TALLOC_FREE(smb_fname_dst->base_name);
6079                         smb_fname_dst->base_name = fname_dst_mod;
6080                 }
6081
6082                 ZERO_STRUCT(smb_fname_src->st);
6083                 if (posix_pathnames) {
6084                         SMB_VFS_LSTAT(conn, smb_fname_src);
6085                 } else {
6086                         SMB_VFS_STAT(conn, smb_fname_src);
6087                 }
6088
6089                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6090                         create_options |= FILE_DIRECTORY_FILE;
6091                 }
6092
6093                 status = SMB_VFS_CREATE_FILE(
6094                         conn,                           /* conn */
6095                         req,                            /* req */
6096                         0,                              /* root_dir_fid */
6097                         smb_fname_src,                  /* fname */
6098                         access_mask,                    /* access_mask */
6099                         (FILE_SHARE_READ |              /* share_access */
6100                             FILE_SHARE_WRITE),
6101                         FILE_OPEN,                      /* create_disposition*/
6102                         create_options,                 /* create_options */
6103                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6104                         0,                              /* oplock_request */
6105                         0,                              /* allocation_size */
6106                         0,                              /* private_flags */
6107                         NULL,                           /* sd */
6108                         NULL,                           /* ea_list */
6109                         &fsp,                           /* result */
6110                         NULL);                          /* pinfo */
6111
6112                 if (!NT_STATUS_IS_OK(status)) {
6113                         DEBUG(3, ("Could not open rename source %s: %s\n",
6114                                   smb_fname_str_dbg(smb_fname_src),
6115                                   nt_errstr(status)));
6116                         goto out;
6117                 }
6118
6119                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6120                                               attrs, replace_if_exists);
6121
6122                 close_file(req, fsp, NORMAL_CLOSE);
6123
6124                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6125                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6126                           smb_fname_str_dbg(smb_fname_dst)));
6127
6128                 goto out;
6129         }
6130
6131         /*
6132          * Wildcards - process each file that matches.
6133          */
6134         if (strequal(fname_src_mask, "????????.???")) {
6135                 TALLOC_FREE(fname_src_mask);
6136                 fname_src_mask = talloc_strdup(ctx, "*");
6137                 if (!fname_src_mask) {
6138                         status = NT_STATUS_NO_MEMORY;
6139                         goto out;
6140                 }
6141         }
6142
6143         status = check_name(conn, fname_src_dir);
6144         if (!NT_STATUS_IS_OK(status)) {
6145                 goto out;
6146         }
6147
6148         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6149                           attrs);
6150         if (dir_hnd == NULL) {
6151                 status = map_nt_error_from_unix(errno);
6152                 goto out;
6153         }
6154
6155         status = NT_STATUS_NO_SUCH_FILE;
6156         /*
6157          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6158          * - gentest fix. JRA
6159          */
6160
6161         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6162                                     &talloced))) {
6163                 files_struct *fsp = NULL;
6164                 char *destname = NULL;
6165                 bool sysdir_entry = False;
6166
6167                 /* Quick check for "." and ".." */
6168                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6169                         if (attrs & aDIR) {
6170                                 sysdir_entry = True;
6171                         } else {
6172                                 TALLOC_FREE(talloced);
6173                                 continue;
6174                         }
6175                 }
6176
6177                 if (!is_visible_file(conn, fname_src_dir, dname,
6178                                      &smb_fname_src->st, false)) {
6179                         TALLOC_FREE(talloced);
6180                         continue;
6181                 }
6182
6183                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6184                         TALLOC_FREE(talloced);
6185                         continue;
6186                 }
6187
6188                 if (sysdir_entry) {
6189                         status = NT_STATUS_OBJECT_NAME_INVALID;
6190                         break;
6191                 }
6192
6193                 TALLOC_FREE(smb_fname_src->base_name);
6194                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6195                                                            "%s/%s",
6196                                                            fname_src_dir,
6197                                                            dname);
6198                 if (!smb_fname_src->base_name) {
6199                         status = NT_STATUS_NO_MEMORY;
6200                         goto out;
6201                 }
6202
6203                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6204                                        smb_fname_dst->base_name,
6205                                        &destname)) {
6206                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6207                                   smb_fname_src->base_name, destname));
6208                         TALLOC_FREE(talloced);
6209                         continue;
6210                 }
6211                 if (!destname) {
6212                         status = NT_STATUS_NO_MEMORY;
6213                         goto out;
6214                 }
6215
6216                 TALLOC_FREE(smb_fname_dst->base_name);
6217                 smb_fname_dst->base_name = destname;
6218
6219                 ZERO_STRUCT(smb_fname_src->st);
6220                 if (posix_pathnames) {
6221                         SMB_VFS_LSTAT(conn, smb_fname_src);
6222                 } else {
6223                         SMB_VFS_STAT(conn, smb_fname_src);
6224                 }
6225
6226                 create_options = 0;
6227
6228                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6229                         create_options |= FILE_DIRECTORY_FILE;
6230                 }
6231
6232                 status = SMB_VFS_CREATE_FILE(
6233                         conn,                           /* conn */
6234                         req,                            /* req */
6235                         0,                              /* root_dir_fid */
6236                         smb_fname_src,                  /* fname */
6237                         access_mask,                    /* access_mask */
6238                         (FILE_SHARE_READ |              /* share_access */
6239                             FILE_SHARE_WRITE),
6240                         FILE_OPEN,                      /* create_disposition*/
6241                         create_options,                 /* create_options */
6242                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6243                         0,                              /* oplock_request */
6244                         0,                              /* allocation_size */
6245                         0,                              /* private_flags */
6246                         NULL,                           /* sd */
6247                         NULL,                           /* ea_list */
6248                         &fsp,                           /* result */
6249                         NULL);                          /* pinfo */
6250
6251                 if (!NT_STATUS_IS_OK(status)) {
6252                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6253                                  "returned %s rename %s -> %s\n",
6254                                  nt_errstr(status),
6255                                  smb_fname_str_dbg(smb_fname_src),
6256                                  smb_fname_str_dbg(smb_fname_dst)));
6257                         break;
6258                 }
6259
6260                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6261                                                               dname);
6262                 if (!smb_fname_dst->original_lcomp) {
6263                         status = NT_STATUS_NO_MEMORY;
6264                         goto out;
6265                 }
6266
6267                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6268                                               attrs, replace_if_exists);
6269
6270                 close_file(req, fsp, NORMAL_CLOSE);
6271
6272                 if (!NT_STATUS_IS_OK(status)) {
6273                         DEBUG(3, ("rename_internals_fsp returned %s for "
6274                                   "rename %s -> %s\n", nt_errstr(status),
6275                                   smb_fname_str_dbg(smb_fname_src),
6276                                   smb_fname_str_dbg(smb_fname_dst)));
6277                         break;
6278                 }
6279
6280                 count++;
6281
6282                 DEBUG(3,("rename_internals: doing rename on %s -> "
6283                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6284                          smb_fname_str_dbg(smb_fname_src)));
6285                 TALLOC_FREE(talloced);
6286         }
6287         TALLOC_FREE(dir_hnd);
6288
6289         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6290                 status = map_nt_error_from_unix(errno);
6291         }
6292
6293  out:
6294         TALLOC_FREE(talloced);
6295         TALLOC_FREE(fname_src_dir);
6296         TALLOC_FREE(fname_src_mask);
6297         return status;
6298 }
6299
6300 /****************************************************************************
6301  Reply to a mv.
6302 ****************************************************************************/
6303
6304 void reply_mv(struct smb_request *req)
6305 {
6306         connection_struct *conn = req->conn;
6307         char *name = NULL;
6308         char *newname = NULL;
6309         const char *p;
6310         uint32 attrs;
6311         NTSTATUS status;
6312         bool src_has_wcard = False;
6313         bool dest_has_wcard = False;
6314         TALLOC_CTX *ctx = talloc_tos();
6315         struct smb_filename *smb_fname_src = NULL;
6316         struct smb_filename *smb_fname_dst = NULL;
6317
6318         START_PROFILE(SMBmv);
6319
6320         if (req->wct < 1) {
6321                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6322                 goto out;
6323         }
6324
6325         attrs = SVAL(req->vwv+0, 0);
6326
6327         p = (const char *)req->buf + 1;
6328         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6329                                        &status, &src_has_wcard);
6330         if (!NT_STATUS_IS_OK(status)) {
6331                 reply_nterror(req, status);
6332                 goto out;
6333         }
6334         p++;
6335         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6336                                        &status, &dest_has_wcard);
6337         if (!NT_STATUS_IS_OK(status)) {
6338                 reply_nterror(req, status);
6339                 goto out;
6340         }
6341
6342         status = filename_convert(ctx,
6343                                   conn,
6344                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6345                                   name,
6346                                   UCF_COND_ALLOW_WCARD_LCOMP,
6347                                   &src_has_wcard,
6348                                   &smb_fname_src);
6349
6350         if (!NT_STATUS_IS_OK(status)) {
6351                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6352                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6353                                         ERRSRV, ERRbadpath);
6354                         goto out;
6355                 }
6356                 reply_nterror(req, status);
6357                 goto out;
6358         }
6359
6360         status = filename_convert(ctx,
6361                                   conn,
6362                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6363                                   newname,
6364                                   UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6365                                   &dest_has_wcard,
6366                                   &smb_fname_dst);
6367
6368         if (!NT_STATUS_IS_OK(status)) {
6369                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6370                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6371                                         ERRSRV, ERRbadpath);
6372                         goto out;
6373                 }
6374                 reply_nterror(req, status);
6375                 goto out;
6376         }
6377
6378         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6379                  smb_fname_str_dbg(smb_fname_dst)));
6380
6381         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6382                                   attrs, False, src_has_wcard, dest_has_wcard,
6383                                   DELETE_ACCESS);
6384         if (!NT_STATUS_IS_OK(status)) {
6385                 if (open_was_deferred(req->mid)) {
6386                         /* We have re-scheduled this call. */
6387                         goto out;
6388                 }
6389                 reply_nterror(req, status);
6390                 goto out;
6391         }
6392
6393         reply_outbuf(req, 0, 0);
6394  out:
6395         TALLOC_FREE(smb_fname_src);
6396         TALLOC_FREE(smb_fname_dst);
6397         END_PROFILE(SMBmv);
6398         return;
6399 }
6400
6401 /*******************************************************************
6402  Copy a file as part of a reply_copy.
6403 ******************************************************************/
6404
6405 /*
6406  * TODO: check error codes on all callers
6407  */
6408
6409 NTSTATUS copy_file(TALLOC_CTX *ctx,
6410                         connection_struct *conn,
6411                         struct smb_filename *smb_fname_src,
6412                         struct smb_filename *smb_fname_dst,
6413                         int ofun,
6414                         int count,
6415                         bool target_is_directory)
6416 {
6417         struct smb_filename *smb_fname_dst_tmp = NULL;
6418         SMB_OFF_T ret=-1;
6419         files_struct *fsp1,*fsp2;
6420         uint32 dosattrs;
6421         uint32 new_create_disposition;
6422         NTSTATUS status;
6423
6424
6425         status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6426         if (!NT_STATUS_IS_OK(status)) {
6427                 return status;
6428         }
6429
6430         /*
6431          * If the target is a directory, extract the last component from the
6432          * src filename and append it to the dst filename
6433          */
6434         if (target_is_directory) {
6435                 const char *p;
6436
6437                 /* dest/target can't be a stream if it's a directory. */
6438                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6439
6440                 p = strrchr_m(smb_fname_src->base_name,'/');
6441                 if (p) {
6442                         p++;
6443                 } else {
6444                         p = smb_fname_src->base_name;
6445                 }
6446                 smb_fname_dst_tmp->base_name =
6447                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6448                                            p);
6449                 if (!smb_fname_dst_tmp->base_name) {
6450                         status = NT_STATUS_NO_MEMORY;
6451                         goto out;
6452                 }
6453         }
6454
6455         status = vfs_file_exist(conn, smb_fname_src);
6456         if (!NT_STATUS_IS_OK(status)) {
6457                 goto out;
6458         }
6459
6460         if (!target_is_directory && count) {
6461                 new_create_disposition = FILE_OPEN;
6462         } else {
6463                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6464                                                  NULL, NULL,
6465                                                  &new_create_disposition,
6466                                                  NULL,
6467                                                  NULL)) {
6468                         status = NT_STATUS_INVALID_PARAMETER;
6469                         goto out;
6470                 }
6471         }
6472
6473         /* Open the src file for reading. */
6474         status = SMB_VFS_CREATE_FILE(
6475                 conn,                                   /* conn */
6476                 NULL,                                   /* req */
6477                 0,                                      /* root_dir_fid */
6478                 smb_fname_src,                          /* fname */
6479                 FILE_GENERIC_READ,                      /* access_mask */
6480                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6481                 FILE_OPEN,                              /* create_disposition*/
6482                 0,                                      /* create_options */
6483                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
6484                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6485                 0,                                      /* allocation_size */
6486                 0,                                      /* private_flags */
6487                 NULL,                                   /* sd */
6488                 NULL,                                   /* ea_list */
6489                 &fsp1,                                  /* result */
6490                 NULL);                                  /* psbuf */
6491
6492         if (!NT_STATUS_IS_OK(status)) {
6493                 goto out;
6494         }
6495
6496         dosattrs = dos_mode(conn, smb_fname_src);
6497
6498         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6499                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6500         }
6501
6502         /* Open the dst file for writing. */
6503         status = SMB_VFS_CREATE_FILE(
6504                 conn,                                   /* conn */
6505                 NULL,                                   /* req */
6506                 0,                                      /* root_dir_fid */
6507                 smb_fname_dst,                          /* fname */
6508                 FILE_GENERIC_WRITE,                     /* access_mask */
6509                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6510                 new_create_disposition,                 /* create_disposition*/
6511                 0,                                      /* create_options */
6512                 dosattrs,                               /* file_attributes */
6513                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6514                 0,                                      /* allocation_size */
6515                 0,                                      /* private_flags */
6516                 NULL,                                   /* sd */
6517                 NULL,                                   /* ea_list */
6518                 &fsp2,                                  /* result */
6519                 NULL);                                  /* psbuf */
6520
6521         if (!NT_STATUS_IS_OK(status)) {
6522                 close_file(NULL, fsp1, ERROR_CLOSE);
6523                 goto out;
6524         }
6525
6526         if ((ofun&3) == 1) {
6527                 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6528                         DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6529                         /*
6530                          * Stop the copy from occurring.
6531                          */
6532                         ret = -1;
6533                         smb_fname_src->st.st_ex_size = 0;
6534                 }
6535         }
6536
6537         /* Do the actual copy. */
6538         if (smb_fname_src->st.st_ex_size) {
6539                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6540         }
6541
6542         close_file(NULL, fsp1, NORMAL_CLOSE);
6543
6544         /* Ensure the modtime is set correctly on the destination file. */
6545         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6546
6547         /*
6548          * As we are opening fsp1 read-only we only expect
6549          * an error on close on fsp2 if we are out of space.
6550          * Thus we don't look at the error return from the
6551          * close of fsp1.
6552          */
6553         status = close_file(NULL, fsp2, NORMAL_CLOSE);
6554
6555         if (!NT_STATUS_IS_OK(status)) {
6556                 goto out;
6557         }
6558
6559         if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6560                 status = NT_STATUS_DISK_FULL;
6561                 goto out;
6562         }
6563
6564         status = NT_STATUS_OK;
6565
6566  out:
6567         TALLOC_FREE(smb_fname_dst_tmp);
6568         return status;
6569 }
6570
6571 /****************************************************************************
6572  Reply to a file copy.
6573 ****************************************************************************/
6574
6575 void reply_copy(struct smb_request *req)
6576 {
6577         connection_struct *conn = req->conn;
6578         struct smb_filename *smb_fname_src = NULL;
6579         struct smb_filename *smb_fname_dst = NULL;
6580         char *fname_src = NULL;
6581         char *fname_dst = NULL;
6582         char *fname_src_mask = NULL;
6583         char *fname_src_dir = NULL;
6584         const char *p;
6585         int count=0;
6586         int error = ERRnoaccess;
6587         int tid2;
6588         int ofun;
6589         int flags;
6590         bool target_is_directory=False;
6591         bool source_has_wild = False;
6592         bool dest_has_wild = False;
6593         NTSTATUS status;
6594         TALLOC_CTX *ctx = talloc_tos();
6595
6596         START_PROFILE(SMBcopy);
6597
6598         if (req->wct < 3) {
6599                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6600                 goto out;
6601         }
6602
6603         tid2 = SVAL(req->vwv+0, 0);
6604         ofun = SVAL(req->vwv+1, 0);
6605         flags = SVAL(req->vwv+2, 0);
6606
6607         p = (const char *)req->buf;
6608         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6609                                        &status, &source_has_wild);
6610         if (!NT_STATUS_IS_OK(status)) {
6611                 reply_nterror(req, status);
6612                 goto out;
6613         }
6614         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6615                                        &status, &dest_has_wild);
6616         if (!NT_STATUS_IS_OK(status)) {
6617                 reply_nterror(req, status);
6618                 goto out;
6619         }
6620
6621         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6622
6623         if (tid2 != conn->cnum) {
6624                 /* can't currently handle inter share copies XXXX */
6625                 DEBUG(3,("Rejecting inter-share copy\n"));
6626                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6627                 goto out;
6628         }
6629
6630         status = filename_convert(ctx, conn,
6631                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6632                                   fname_src,
6633                                   UCF_COND_ALLOW_WCARD_LCOMP,
6634                                   &source_has_wild,
6635                                   &smb_fname_src);
6636         if (!NT_STATUS_IS_OK(status)) {
6637                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6638                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6639                                         ERRSRV, ERRbadpath);
6640                         goto out;
6641                 }
6642                 reply_nterror(req, status);
6643                 goto out;
6644         }
6645
6646         status = filename_convert(ctx, conn,
6647                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6648                                   fname_dst,
6649                                   UCF_COND_ALLOW_WCARD_LCOMP,
6650                                   &dest_has_wild,
6651                                   &smb_fname_dst);
6652         if (!NT_STATUS_IS_OK(status)) {
6653                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6654                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6655                                         ERRSRV, ERRbadpath);
6656                         goto out;
6657                 }
6658                 reply_nterror(req, status);
6659                 goto out;
6660         }
6661
6662         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6663
6664         if ((flags&1) && target_is_directory) {
6665                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6666                 goto out;
6667         }
6668
6669         if ((flags&2) && !target_is_directory) {
6670                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6671                 goto out;
6672         }
6673
6674         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6675                 /* wants a tree copy! XXXX */
6676                 DEBUG(3,("Rejecting tree copy\n"));
6677                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6678                 goto out;
6679         }
6680
6681         /* Split up the directory from the filename/mask. */
6682         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6683                                       &fname_src_dir, &fname_src_mask);
6684         if (!NT_STATUS_IS_OK(status)) {
6685                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6686                 goto out;
6687         }
6688
6689         /*
6690          * We should only check the mangled cache
6691          * here if unix_convert failed. This means
6692          * that the path in 'mask' doesn't exist
6693          * on the file system and so we need to look
6694          * for a possible mangle. This patch from
6695          * Tine Smukavec <valentin.smukavec@hermes.si>.
6696          */
6697         if (!VALID_STAT(smb_fname_src->st) &&
6698             mangle_is_mangled(fname_src_mask, conn->params)) {
6699                 char *new_mask = NULL;
6700                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6701                                             &new_mask, conn->params);
6702
6703                 /* Use demangled name if one was successfully found. */
6704                 if (new_mask) {
6705                         TALLOC_FREE(fname_src_mask);
6706                         fname_src_mask = new_mask;
6707                 }
6708         }
6709
6710         if (!source_has_wild) {
6711
6712                 /*
6713                  * Only one file needs to be copied. Append the mask back onto
6714                  * the directory.
6715                  */
6716                 TALLOC_FREE(smb_fname_src->base_name);
6717                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6718                                                            "%s/%s",
6719                                                            fname_src_dir,
6720                                                            fname_src_mask);
6721                 if (!smb_fname_src->base_name) {
6722                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6723                         goto out;
6724                 }
6725
6726                 if (dest_has_wild) {
6727                         char *fname_dst_mod = NULL;
6728                         if (!resolve_wildcards(smb_fname_dst,
6729                                                smb_fname_src->base_name,
6730                                                smb_fname_dst->base_name,
6731                                                &fname_dst_mod)) {
6732                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6733                                 goto out;
6734                         }
6735                         TALLOC_FREE(smb_fname_dst->base_name);
6736                         smb_fname_dst->base_name = fname_dst_mod;
6737                 }
6738
6739                 status = check_name(conn, smb_fname_src->base_name);
6740                 if (!NT_STATUS_IS_OK(status)) {
6741                         reply_nterror(req, status);
6742                         goto out;
6743                 }
6744
6745                 status = check_name(conn, smb_fname_dst->base_name);
6746                 if (!NT_STATUS_IS_OK(status)) {
6747                         reply_nterror(req, status);
6748                         goto out;
6749                 }
6750
6751                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6752                                    ofun, count, target_is_directory);
6753
6754                 if(!NT_STATUS_IS_OK(status)) {
6755                         reply_nterror(req, status);
6756                         goto out;
6757                 } else {
6758                         count++;
6759                 }
6760         } else {
6761                 struct smb_Dir *dir_hnd = NULL;
6762                 const char *dname = NULL;
6763                 char *talloced = NULL;
6764                 long offset = 0;
6765
6766                 /*
6767                  * There is a wildcard that requires us to actually read the
6768                  * src dir and copy each file matching the mask to the dst.
6769                  * Right now streams won't be copied, but this could
6770                  * presumably be added with a nested loop for reach dir entry.
6771                  */
6772                 SMB_ASSERT(!smb_fname_src->stream_name);
6773                 SMB_ASSERT(!smb_fname_dst->stream_name);
6774
6775                 smb_fname_src->stream_name = NULL;
6776                 smb_fname_dst->stream_name = NULL;
6777
6778                 if (strequal(fname_src_mask,"????????.???")) {
6779                         TALLOC_FREE(fname_src_mask);
6780                         fname_src_mask = talloc_strdup(ctx, "*");
6781                         if (!fname_src_mask) {
6782                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6783                                 goto out;
6784                         }
6785                 }
6786
6787                 status = check_name(conn, fname_src_dir);
6788                 if (!NT_STATUS_IS_OK(status)) {
6789                         reply_nterror(req, status);
6790                         goto out;
6791                 }
6792
6793                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6794                 if (dir_hnd == NULL) {
6795                         status = map_nt_error_from_unix(errno);
6796                         reply_nterror(req, status);
6797                         goto out;
6798                 }
6799
6800                 error = ERRbadfile;
6801
6802                 /* Iterate over the src dir copying each entry to the dst. */
6803                 while ((dname = ReadDirName(dir_hnd, &offset,
6804                                             &smb_fname_src->st, &talloced))) {
6805                         char *destname = NULL;
6806
6807                         if (ISDOT(dname) || ISDOTDOT(dname)) {
6808                                 TALLOC_FREE(talloced);
6809                                 continue;
6810                         }
6811
6812                         if (!is_visible_file(conn, fname_src_dir, dname,
6813                                              &smb_fname_src->st, false)) {
6814                                 TALLOC_FREE(talloced);
6815                                 continue;
6816                         }
6817
6818                         if(!mask_match(dname, fname_src_mask,
6819                                        conn->case_sensitive)) {
6820                                 TALLOC_FREE(talloced);
6821                                 continue;
6822                         }
6823
6824                         error = ERRnoaccess;
6825
6826                         /* Get the src smb_fname struct setup. */
6827                         TALLOC_FREE(smb_fname_src->base_name);
6828                         smb_fname_src->base_name =
6829                             talloc_asprintf(smb_fname_src, "%s/%s",
6830                                             fname_src_dir, dname);
6831
6832                         if (!smb_fname_src->base_name) {
6833                                 TALLOC_FREE(dir_hnd);
6834                                 TALLOC_FREE(talloced);
6835                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6836                                 goto out;
6837                         }
6838
6839                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6840                                                smb_fname_dst->base_name,
6841                                                &destname)) {
6842                                 TALLOC_FREE(talloced);
6843                                 continue;
6844                         }
6845                         if (!destname) {
6846                                 TALLOC_FREE(dir_hnd);
6847                                 TALLOC_FREE(talloced);
6848                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6849                                 goto out;
6850                         }
6851
6852                         TALLOC_FREE(smb_fname_dst->base_name);
6853                         smb_fname_dst->base_name = destname;
6854
6855                         status = check_name(conn, smb_fname_src->base_name);
6856                         if (!NT_STATUS_IS_OK(status)) {
6857                                 TALLOC_FREE(dir_hnd);
6858                                 TALLOC_FREE(talloced);
6859                                 reply_nterror(req, status);
6860                                 goto out;
6861                         }
6862
6863                         status = check_name(conn, smb_fname_dst->base_name);
6864                         if (!NT_STATUS_IS_OK(status)) {
6865                                 TALLOC_FREE(dir_hnd);
6866                                 TALLOC_FREE(talloced);
6867                                 reply_nterror(req, status);
6868                                 goto out;
6869                         }
6870
6871                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
6872                                 smb_fname_src->base_name,
6873                                 smb_fname_dst->base_name));
6874
6875                         status = copy_file(ctx, conn, smb_fname_src,
6876                                            smb_fname_dst, ofun, count,
6877                                            target_is_directory);
6878                         if (NT_STATUS_IS_OK(status)) {
6879                                 count++;
6880                         }
6881
6882                         TALLOC_FREE(talloced);
6883                 }
6884                 TALLOC_FREE(dir_hnd);
6885         }
6886
6887         if (count == 0) {
6888                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
6889                 goto out;
6890         }
6891
6892         reply_outbuf(req, 1, 0);
6893         SSVAL(req->outbuf,smb_vwv0,count);
6894  out:
6895         TALLOC_FREE(smb_fname_src);
6896         TALLOC_FREE(smb_fname_dst);
6897         TALLOC_FREE(fname_src);
6898         TALLOC_FREE(fname_dst);
6899         TALLOC_FREE(fname_src_mask);
6900         TALLOC_FREE(fname_src_dir);
6901
6902         END_PROFILE(SMBcopy);
6903         return;
6904 }
6905
6906 #undef DBGC_CLASS
6907 #define DBGC_CLASS DBGC_LOCKING
6908
6909 /****************************************************************************
6910  Get a lock pid, dealing with large count requests.
6911 ****************************************************************************/
6912
6913 uint32 get_lock_pid(const uint8_t *data, int data_offset,
6914                     bool large_file_format)
6915 {
6916         if(!large_file_format)
6917                 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6918         else
6919                 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6920 }
6921
6922 /****************************************************************************
6923  Get a lock count, dealing with large count requests.
6924 ****************************************************************************/
6925
6926 uint64_t get_lock_count(const uint8_t *data, int data_offset,
6927                         bool large_file_format)
6928 {
6929         uint64_t count = 0;
6930
6931         if(!large_file_format) {
6932                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6933         } else {
6934
6935 #if defined(HAVE_LONGLONG)
6936                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6937                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6938 #else /* HAVE_LONGLONG */
6939
6940                 /*
6941                  * NT4.x seems to be broken in that it sends large file (64 bit)
6942                  * lockingX calls even if the CAP_LARGE_FILES was *not*
6943                  * negotiated. For boxes without large unsigned ints truncate the
6944                  * lock count by dropping the top 32 bits.
6945                  */
6946
6947                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6948                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6949                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6950                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6951                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6952                 }
6953
6954                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6955 #endif /* HAVE_LONGLONG */
6956         }
6957
6958         return count;
6959 }
6960
6961 #if !defined(HAVE_LONGLONG)
6962 /****************************************************************************
6963  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6964 ****************************************************************************/
6965
6966 static uint32 map_lock_offset(uint32 high, uint32 low)
6967 {
6968         unsigned int i;
6969         uint32 mask = 0;
6970         uint32 highcopy = high;
6971
6972         /*
6973          * Try and find out how many significant bits there are in high.
6974          */
6975
6976         for(i = 0; highcopy; i++)
6977                 highcopy >>= 1;
6978
6979         /*
6980          * We use 31 bits not 32 here as POSIX
6981          * lock offsets may not be negative.
6982          */
6983
6984         mask = (~0) << (31 - i);
6985
6986         if(low & mask)
6987                 return 0; /* Fail. */
6988
6989         high <<= (31 - i);
6990
6991         return (high|low);
6992 }
6993 #endif /* !defined(HAVE_LONGLONG) */
6994
6995 /****************************************************************************
6996  Get a lock offset, dealing with large offset requests.
6997 ****************************************************************************/
6998
6999 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7000                          bool large_file_format, bool *err)
7001 {
7002         uint64_t offset = 0;
7003
7004         *err = False;
7005
7006         if(!large_file_format) {
7007                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7008         } else {
7009
7010 #if defined(HAVE_LONGLONG)
7011                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7012                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7013 #else /* HAVE_LONGLONG */
7014
7015                 /*
7016                  * NT4.x seems to be broken in that it sends large file (64 bit)
7017                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7018                  * negotiated. For boxes without large unsigned ints mangle the
7019                  * lock offset by mapping the top 32 bits onto the lower 32.
7020                  */
7021
7022                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7023                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7024                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7025                         uint32 new_low = 0;
7026
7027                         if((new_low = map_lock_offset(high, low)) == 0) {
7028                                 *err = True;
7029                                 return (uint64_t)-1;
7030                         }
7031
7032                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7033                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7034                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7035                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7036                 }
7037
7038                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7039 #endif /* HAVE_LONGLONG */
7040         }
7041
7042         return offset;
7043 }
7044
7045 NTSTATUS smbd_do_locking(struct smb_request *req,
7046                          files_struct *fsp,
7047                          uint8_t type,
7048                          int32_t timeout,
7049                          uint16_t num_ulocks,
7050                          struct smbd_lock_element *ulocks,
7051                          uint16_t num_locks,
7052                          struct smbd_lock_element *locks,
7053                          bool *async)
7054 {
7055         connection_struct *conn = req->conn;
7056         int i;
7057         NTSTATUS status = NT_STATUS_OK;
7058
7059         *async = false;
7060
7061         /* Data now points at the beginning of the list
7062            of smb_unlkrng structs */
7063         for(i = 0; i < (int)num_ulocks; i++) {
7064                 struct smbd_lock_element *e = &ulocks[i];
7065
7066                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7067                           "pid %u, file %s\n",
7068                           (double)e->offset,
7069                           (double)e->count,
7070                           (unsigned int)e->smbpid,
7071                           fsp_str_dbg(fsp)));
7072
7073                 if (e->brltype != UNLOCK_LOCK) {
7074                         /* this can only happen with SMB2 */
7075                         return NT_STATUS_INVALID_PARAMETER;
7076                 }
7077
7078                 status = do_unlock(smbd_messaging_context(),
7079                                 fsp,
7080                                 e->smbpid,
7081                                 e->count,
7082                                 e->offset,
7083                                 WINDOWS_LOCK);
7084
7085                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7086                     nt_errstr(status)));
7087
7088                 if (!NT_STATUS_IS_OK(status)) {
7089                         return status;
7090                 }
7091         }
7092
7093         /* Setup the timeout in seconds. */
7094
7095         if (!lp_blocking_locks(SNUM(conn))) {
7096                 timeout = 0;
7097         }
7098
7099         /* Data now points at the beginning of the list
7100            of smb_lkrng structs */
7101
7102         for(i = 0; i < (int)num_locks; i++) {
7103                 struct smbd_lock_element *e = &locks[i];
7104
7105                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for pid "
7106                           "%u, file %s timeout = %d\n",
7107                           (double)e->offset,
7108                           (double)e->count,
7109                           (unsigned int)e->smbpid,
7110                           fsp_str_dbg(fsp),
7111                           (int)timeout));
7112
7113                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7114                         struct blocking_lock_record *blr = NULL;
7115
7116                         if (num_locks > 1) {
7117                                 /*
7118                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7119                                  * if the lock vector contains one entry. When given mutliple cancel
7120                                  * requests in a single PDU we expect the server to return an
7121                                  * error. Windows servers seem to accept the request but only
7122                                  * cancel the first lock.
7123                                  * JRA - Do what Windows does (tm) :-).
7124                                  */
7125
7126 #if 0
7127                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7128                                 return NT_STATUS_DOS(ERRDOS,
7129                                                 ERRcancelviolation);
7130 #else
7131                                 /* Windows behavior. */
7132                                 if (i != 0) {
7133                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7134                                                 "cancel request\n"));
7135                                         continue;
7136                                 }
7137 #endif
7138                         }
7139
7140                         if (lp_blocking_locks(SNUM(conn))) {
7141
7142                                 /* Schedule a message to ourselves to
7143                                    remove the blocking lock record and
7144                                    return the right error. */
7145
7146                                 blr = blocking_lock_cancel(fsp,
7147                                                 e->smbpid,
7148                                                 e->offset,
7149                                                 e->count,
7150                                                 WINDOWS_LOCK,
7151                                                 type,
7152                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7153                                 if (blr == NULL) {
7154                                         return NT_STATUS_DOS(
7155                                                         ERRDOS,
7156                                                         ERRcancelviolation);
7157                                 }
7158                         }
7159                         /* Remove a matching pending lock. */
7160                         status = do_lock_cancel(fsp,
7161                                                 e->smbpid,
7162                                                 e->count,
7163                                                 e->offset,
7164                                                 WINDOWS_LOCK,
7165                                                 blr);
7166                 } else {
7167                         bool blocking_lock = timeout ? true : false;
7168                         bool defer_lock = false;
7169                         struct byte_range_lock *br_lck;
7170                         uint32_t block_smbpid;
7171
7172                         br_lck = do_lock(smbd_messaging_context(),
7173                                         fsp,
7174                                         e->smbpid,
7175                                         e->count,
7176                                         e->offset,
7177                                         e->brltype,
7178                                         WINDOWS_LOCK,
7179                                         blocking_lock,
7180                                         &status,
7181                                         &block_smbpid,
7182                                         NULL);
7183
7184                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7185                                 /* Windows internal resolution for blocking locks seems
7186                                    to be about 200ms... Don't wait for less than that. JRA. */
7187                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7188                                         timeout = lp_lock_spin_time();
7189                                 }
7190                                 defer_lock = true;
7191                         }
7192
7193                         /* If a lock sent with timeout of zero would fail, and
7194                          * this lock has been requested multiple times,
7195                          * according to brl_lock_failed() we convert this
7196                          * request to a blocking lock with a timeout of between
7197                          * 150 - 300 milliseconds.
7198                          *
7199                          * If lp_lock_spin_time() has been set to 0, we skip
7200                          * this blocking retry and fail immediately.
7201                          *
7202                          * Replacement for do_lock_spin(). JRA. */
7203
7204                         if (br_lck && lp_blocking_locks(SNUM(conn)) &&
7205                             lp_lock_spin_time() && !blocking_lock &&
7206                             NT_STATUS_EQUAL((status),
7207                                 NT_STATUS_FILE_LOCK_CONFLICT))
7208                         {
7209                                 defer_lock = true;
7210                                 timeout = lp_lock_spin_time();
7211                         }
7212
7213                         if (br_lck && defer_lock) {
7214                                 /*
7215                                  * A blocking lock was requested. Package up
7216                                  * this smb into a queued request and push it
7217                                  * onto the blocking lock queue.
7218                                  */
7219                                 if(push_blocking_lock_request(br_lck,
7220                                                         req,
7221                                                         fsp,
7222                                                         timeout,
7223                                                         i,
7224                                                         e->smbpid,
7225                                                         e->brltype,
7226                                                         WINDOWS_LOCK,
7227                                                         e->offset,
7228                                                         e->count,
7229                                                         block_smbpid)) {
7230                                         TALLOC_FREE(br_lck);
7231                                         *async = true;
7232                                         return NT_STATUS_OK;
7233                                 }
7234                         }
7235
7236                         TALLOC_FREE(br_lck);
7237                 }
7238
7239                 if (!NT_STATUS_IS_OK(status)) {
7240                         break;
7241                 }
7242         }
7243
7244         /* If any of the above locks failed, then we must unlock
7245            all of the previous locks (X/Open spec). */
7246
7247         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7248
7249                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7250                         i = -1; /* we want to skip the for loop */
7251                 }
7252
7253                 /*
7254                  * Ensure we don't do a remove on the lock that just failed,
7255                  * as under POSIX rules, if we have a lock already there, we
7256                  * will delete it (and we shouldn't) .....
7257                  */
7258                 for(i--; i >= 0; i--) {
7259                         struct smbd_lock_element *e = &locks[i];
7260
7261                         do_unlock(smbd_messaging_context(),
7262                                 fsp,
7263                                 e->smbpid,
7264                                 e->count,
7265                                 e->offset,
7266                                 WINDOWS_LOCK);
7267                 }
7268                 return status;
7269         }
7270
7271         DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7272                   fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7273
7274         return NT_STATUS_OK;
7275 }
7276
7277 /****************************************************************************
7278  Reply to a lockingX request.
7279 ****************************************************************************/
7280
7281 void reply_lockingX(struct smb_request *req)
7282 {
7283         connection_struct *conn = req->conn;
7284         files_struct *fsp;
7285         unsigned char locktype;
7286         unsigned char oplocklevel;
7287         uint16 num_ulocks;
7288         uint16 num_locks;
7289         int32 lock_timeout;
7290         int i;
7291         const uint8_t *data;
7292         bool large_file_format;
7293         bool err;
7294         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7295         struct smbd_lock_element *ulocks;
7296         struct smbd_lock_element *locks;
7297         bool async = false;
7298
7299         START_PROFILE(SMBlockingX);
7300
7301         if (req->wct < 8) {
7302                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7303                 END_PROFILE(SMBlockingX);
7304                 return;
7305         }
7306
7307         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7308         locktype = CVAL(req->vwv+3, 0);
7309         oplocklevel = CVAL(req->vwv+3, 1);
7310         num_ulocks = SVAL(req->vwv+6, 0);
7311         num_locks = SVAL(req->vwv+7, 0);
7312         lock_timeout = IVAL(req->vwv+4, 0);
7313         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7314
7315         if (!check_fsp(conn, req, fsp)) {
7316                 END_PROFILE(SMBlockingX);
7317                 return;
7318         }
7319
7320         data = req->buf;
7321
7322         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7323                 /* we don't support these - and CANCEL_LOCK makes w2k
7324                    and XP reboot so I don't really want to be
7325                    compatible! (tridge) */
7326                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7327                 END_PROFILE(SMBlockingX);
7328                 return;
7329         }
7330
7331         /* Check if this is an oplock break on a file
7332            we have granted an oplock on.
7333         */
7334         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7335                 /* Client can insist on breaking to none. */
7336                 bool break_to_none = (oplocklevel == 0);
7337                 bool result;
7338
7339                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7340                          "for fnum = %d\n", (unsigned int)oplocklevel,
7341                          fsp->fnum ));
7342
7343                 /*
7344                  * Make sure we have granted an exclusive or batch oplock on
7345                  * this file.
7346                  */
7347
7348                 if (fsp->oplock_type == 0) {
7349
7350                         /* The Samba4 nbench simulator doesn't understand
7351                            the difference between break to level2 and break
7352                            to none from level2 - it sends oplock break
7353                            replies in both cases. Don't keep logging an error
7354                            message here - just ignore it. JRA. */
7355
7356                         DEBUG(5,("reply_lockingX: Error : oplock break from "
7357                                  "client for fnum = %d (oplock=%d) and no "
7358                                  "oplock granted on this file (%s).\n",
7359                                  fsp->fnum, fsp->oplock_type,
7360                                  fsp_str_dbg(fsp)));
7361
7362                         /* if this is a pure oplock break request then don't
7363                          * send a reply */
7364                         if (num_locks == 0 && num_ulocks == 0) {
7365                                 END_PROFILE(SMBlockingX);
7366                                 return;
7367                         } else {
7368                                 END_PROFILE(SMBlockingX);
7369                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7370                                 return;
7371                         }
7372                 }
7373
7374                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7375                     (break_to_none)) {
7376                         result = remove_oplock(fsp);
7377                 } else {
7378                         result = downgrade_oplock(fsp);
7379                 }
7380
7381                 if (!result) {
7382                         DEBUG(0, ("reply_lockingX: error in removing "
7383                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
7384                         /* Hmmm. Is this panic justified? */
7385                         smb_panic("internal tdb error");
7386                 }
7387
7388                 reply_to_oplock_break_requests(fsp);
7389
7390                 /* if this is a pure oplock break request then don't send a
7391                  * reply */
7392                 if (num_locks == 0 && num_ulocks == 0) {
7393                         /* Sanity check - ensure a pure oplock break is not a
7394                            chained request. */
7395                         if(CVAL(req->vwv+0, 0) != 0xff)
7396                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
7397                                          "break is a chained %d request !\n",
7398                                          (unsigned int)CVAL(req->vwv+0, 0)));
7399                         END_PROFILE(SMBlockingX);
7400                         return;
7401                 }
7402         }
7403
7404         if (req->buflen <
7405             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7406                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7407                 END_PROFILE(SMBlockingX);
7408                 return;
7409         }
7410
7411         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7412         if (ulocks == NULL) {
7413                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7414                 END_PROFILE(SMBlockingX);
7415                 return;
7416         }
7417
7418         locks = talloc_array(req, struct smbd_lock_element, num_locks);
7419         if (locks == NULL) {
7420                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7421                 END_PROFILE(SMBlockingX);
7422                 return;
7423         }
7424
7425         /* Data now points at the beginning of the list
7426            of smb_unlkrng structs */
7427         for(i = 0; i < (int)num_ulocks; i++) {
7428                 ulocks[i].smbpid = get_lock_pid(data, i, large_file_format);
7429                 ulocks[i].count = get_lock_count(data, i, large_file_format);
7430                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7431                 ulocks[i].brltype = UNLOCK_LOCK;
7432
7433                 /*
7434                  * There is no error code marked "stupid client bug".... :-).
7435                  */
7436                 if(err) {
7437                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7438                         END_PROFILE(SMBlockingX);
7439                         return;
7440                 }
7441         }
7442
7443         /* Now do any requested locks */
7444         data += ((large_file_format ? 20 : 10)*num_ulocks);
7445
7446         /* Data now points at the beginning of the list
7447            of smb_lkrng structs */
7448
7449         for(i = 0; i < (int)num_locks; i++) {
7450                 locks[i].smbpid = get_lock_pid(data, i, large_file_format);
7451                 locks[i].count = get_lock_count(data, i, large_file_format);
7452                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7453
7454                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7455                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7456                                 locks[i].brltype = PENDING_READ_LOCK;
7457                         } else {
7458                                 locks[i].brltype = READ_LOCK;
7459                         }
7460                 } else {
7461                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7462                                 locks[i].brltype = PENDING_WRITE_LOCK;
7463                         } else {
7464                                 locks[i].brltype = WRITE_LOCK;
7465                         }
7466                 }
7467
7468                 /*
7469                  * There is no error code marked "stupid client bug".... :-).
7470                  */
7471                 if(err) {
7472                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7473                         END_PROFILE(SMBlockingX);
7474                         return;
7475                 }
7476         }
7477
7478         status = smbd_do_locking(req, fsp,
7479                                  locktype, lock_timeout,
7480                                  num_ulocks, ulocks,
7481                                  num_locks, locks,
7482                                  &async);
7483         if (!NT_STATUS_IS_OK(status)) {
7484                 END_PROFILE(SMBlockingX);
7485                 reply_nterror(req, status);
7486                 return;
7487         }
7488         if (async) {
7489                 END_PROFILE(SMBlockingX);
7490                 return;
7491         }
7492
7493         reply_outbuf(req, 2, 0);
7494
7495         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7496                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7497
7498         END_PROFILE(SMBlockingX);
7499         chain_reply(req);
7500 }
7501
7502 #undef DBGC_CLASS
7503 #define DBGC_CLASS DBGC_ALL
7504
7505 /****************************************************************************
7506  Reply to a SMBreadbmpx (read block multiplex) request.
7507  Always reply with an error, if someone has a platform really needs this,
7508  please contact vl@samba.org
7509 ****************************************************************************/
7510
7511 void reply_readbmpx(struct smb_request *req)
7512 {
7513         START_PROFILE(SMBreadBmpx);
7514         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7515         END_PROFILE(SMBreadBmpx);
7516         return;
7517 }
7518
7519 /****************************************************************************
7520  Reply to a SMBreadbs (read block multiplex secondary) request.
7521  Always reply with an error, if someone has a platform really needs this,
7522  please contact vl@samba.org
7523 ****************************************************************************/
7524
7525 void reply_readbs(struct smb_request *req)
7526 {
7527         START_PROFILE(SMBreadBs);
7528         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7529         END_PROFILE(SMBreadBs);
7530         return;
7531 }
7532
7533 /****************************************************************************
7534  Reply to a SMBsetattrE.
7535 ****************************************************************************/
7536
7537 void reply_setattrE(struct smb_request *req)
7538 {
7539         connection_struct *conn = req->conn;
7540         struct smb_file_time ft;
7541         files_struct *fsp;
7542         NTSTATUS status;
7543
7544         START_PROFILE(SMBsetattrE);
7545         ZERO_STRUCT(ft);
7546
7547         if (req->wct < 7) {
7548                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7549                 goto out;
7550         }
7551
7552         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7553
7554         if(!fsp || (fsp->conn != conn)) {
7555                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7556                 goto out;
7557         }
7558
7559         /*
7560          * Convert the DOS times into unix times.
7561          */
7562
7563         ft.atime = convert_time_t_to_timespec(
7564             srv_make_unix_date2(req->vwv+3));
7565         ft.mtime = convert_time_t_to_timespec(
7566             srv_make_unix_date2(req->vwv+5));
7567         ft.create_time = convert_time_t_to_timespec(
7568             srv_make_unix_date2(req->vwv+1));
7569
7570         reply_outbuf(req, 0, 0);
7571
7572         /*
7573          * Patch from Ray Frush <frush@engr.colostate.edu>
7574          * Sometimes times are sent as zero - ignore them.
7575          */
7576
7577         /* Ensure we have a valid stat struct for the source. */
7578         status = vfs_stat_fsp(fsp);
7579         if (!NT_STATUS_IS_OK(status)) {
7580                 reply_nterror(req, status);
7581                 goto out;
7582         }
7583
7584         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7585         if (!NT_STATUS_IS_OK(status)) {
7586                 reply_nterror(req, status);
7587                 goto out;
7588         }
7589
7590         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7591                " createtime=%u\n",
7592                 fsp->fnum,
7593                 (unsigned int)ft.atime.tv_sec,
7594                 (unsigned int)ft.mtime.tv_sec,
7595                 (unsigned int)ft.create_time.tv_sec
7596                 ));
7597  out:
7598         END_PROFILE(SMBsetattrE);
7599         return;
7600 }
7601
7602
7603 /* Back from the dead for OS/2..... JRA. */
7604
7605 /****************************************************************************
7606  Reply to a SMBwritebmpx (write block multiplex primary) request.
7607  Always reply with an error, if someone has a platform really needs this,
7608  please contact vl@samba.org
7609 ****************************************************************************/
7610
7611 void reply_writebmpx(struct smb_request *req)
7612 {
7613         START_PROFILE(SMBwriteBmpx);
7614         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7615         END_PROFILE(SMBwriteBmpx);
7616         return;
7617 }
7618
7619 /****************************************************************************
7620  Reply to a SMBwritebs (write block multiplex secondary) request.
7621  Always reply with an error, if someone has a platform really needs this,
7622  please contact vl@samba.org
7623 ****************************************************************************/
7624
7625 void reply_writebs(struct smb_request *req)
7626 {
7627         START_PROFILE(SMBwriteBs);
7628         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7629         END_PROFILE(SMBwriteBs);
7630         return;
7631 }
7632
7633 /****************************************************************************
7634  Reply to a SMBgetattrE.
7635 ****************************************************************************/
7636
7637 void reply_getattrE(struct smb_request *req)
7638 {
7639         connection_struct *conn = req->conn;
7640         int mode;
7641         files_struct *fsp;
7642         struct timespec create_ts;
7643
7644         START_PROFILE(SMBgetattrE);
7645
7646         if (req->wct < 1) {
7647                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7648                 END_PROFILE(SMBgetattrE);
7649                 return;
7650         }
7651
7652         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7653
7654         if(!fsp || (fsp->conn != conn)) {
7655                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7656                 END_PROFILE(SMBgetattrE);
7657                 return;
7658         }
7659
7660         /* Do an fstat on this file */
7661         if(fsp_stat(fsp)) {
7662                 reply_nterror(req, map_nt_error_from_unix(errno));
7663                 END_PROFILE(SMBgetattrE);
7664                 return;
7665         }
7666
7667         mode = dos_mode(conn, fsp->fsp_name);
7668
7669         /*
7670          * Convert the times into dos times. Set create
7671          * date to be last modify date as UNIX doesn't save
7672          * this.
7673          */
7674
7675         reply_outbuf(req, 11, 0);
7676
7677         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7678         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7679         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7680                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7681         /* Should we check pending modtime here ? JRA */
7682         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7683                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7684
7685         if (mode & aDIR) {
7686                 SIVAL(req->outbuf, smb_vwv6, 0);
7687                 SIVAL(req->outbuf, smb_vwv8, 0);
7688         } else {
7689                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7690                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7691                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7692         }
7693         SSVAL(req->outbuf,smb_vwv10, mode);
7694
7695         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7696
7697         END_PROFILE(SMBgetattrE);
7698         return;
7699 }