source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  34 #include "rpc_client/cli_spoolss.h"
  35 #include "rpc_client/init_spoolss.h"
  36 #include "rpc_server/rpc_ncacn_np.h"
  37 #include "libcli/security/security.h"
  38 #include "libsmb/nmblib.h"
  39 #include "auth.h"
  40
  41 /****************************************************************************
  42  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  43  path or anything including wildcards.
  44  We're assuming here that '/' is not the second byte in any multibyte char
  45  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  46  set.
  47 ****************************************************************************/
  48
  49 /* Custom version for processing POSIX paths. */
  50 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  51
  52 static NTSTATUS check_path_syntax_internal(char *path,
  53                                            bool posix_path,
  54                                            bool *p_last_component_contains_wcard)
  55 {
  56         char *d = path;
  57         const char *s = path;
  58         NTSTATUS ret = NT_STATUS_OK;
  59         bool start_of_name_component = True;
  60         bool stream_started = false;
  61
  62         *p_last_component_contains_wcard = False;
  63
  64         while (*s) {
  65                 if (stream_started) {
  66                         switch (*s) {
  67                         case '/':
  68                         case '\\':
  69                                 return NT_STATUS_OBJECT_NAME_INVALID;
  70                         case ':':
  71                                 if (s[1] == '\0') {
  72                                         return NT_STATUS_OBJECT_NAME_INVALID;
  73                                 }
  74                                 if (strchr_m(&s[1], ':')) {
  75                                         return NT_STATUS_OBJECT_NAME_INVALID;
  76                                 }
  77                                 break;
  78                         }
  79                 }
  80
  81                 if ((*s == ':') && !posix_path && !stream_started) {
  82                         if (*p_last_component_contains_wcard) {
  83                                 return NT_STATUS_OBJECT_NAME_INVALID;
  84                         }
  85                         /* Stream names allow more characters than file names.
  86                            We're overloading posix_path here to allow a wider
  87                            range of characters. If stream_started is true this
  88                            is still a Windows path even if posix_path is true.
  89                            JRA.
  90                         */
  91                         stream_started = true;
  92                         start_of_name_component = false;
  93                         posix_path = true;
  94
  95                         if (s[1] == '\0') {
  96                                 return NT_STATUS_OBJECT_NAME_INVALID;
  97                         }
  98                 }
  99
 100                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 101                         /*
 102                          * Safe to assume is not the second part of a mb char
 103                          * as this is handled below.
 104                          */
 105                         /* Eat multiple '/' or '\\' */
 106                         while (IS_PATH_SEP(*s,posix_path)) {
 107                                 s++;
 108                         }
 109                         if ((d != path) && (*s != '\0')) {
 110                                 /* We only care about non-leading or trailing '/' or '\\' */
 111                                 *d++ = '/';
 112                         }
 113
 114                         start_of_name_component = True;
 115                         /* New component. */
 116                         *p_last_component_contains_wcard = False;
 117                         continue;
 118                 }
 119
 120                 if (start_of_name_component) {
 121                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 122                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 123
 124                                 /*
 125                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 126                                  */
 127
 128                                 /* If  we just added a '/' - delete it */
 129                                 if ((d > path) && (*(d-1) == '/')) {
 130                                         *(d-1) = '\0';
 131                                         d--;
 132                                 }
 133
 134                                 /* Are we at the start ? Can't go back further if so. */
 135                                 if (d <= path) {
 136                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 137                                         break;
 138                                 }
 139                                 /* Go back one level... */
 140                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 141                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 142                                 /* Decrement d first as d points to the *next* char to write into. */
 143                                 for (d--; d > path; d--) {
 144                                         if (*d == '/')
 145                                                 break;
 146                                 }
 147                                 s += 2; /* Else go past the .. */
 148                                 /* We're still at the start of a name component, just the previous one. */
 149                                 continue;
 150
 151                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 152                                 if (posix_path) {
 153                                         /* Eat the '.' */
 154                                         s++;
 155                                         continue;
 156                                 }
 157                         }
 158
 159                 }
 160
 161                 if (!(*s & 0x80)) {
 162                         if (!posix_path) {
 163                                 if (*s <= 0x1f || *s == '|') {
 164                                         return NT_STATUS_OBJECT_NAME_INVALID;
 165                                 }
 166                                 switch (*s) {
 167                                         case '*':
 168                                         case '?':
 169                                         case '<':
 170                                         case '>':
 171                                         case '"':
 172                                                 *p_last_component_contains_wcard = True;
 173                                                 break;
 174                                         default:
 175                                                 break;
 176                                 }
 177                         }
 178                         *d++ = *s++;
 179                 } else {
 180                         size_t siz;
 181                         /* Get the size of the next MB character. */
 182                         next_codepoint(s,&siz);
 183                         switch(siz) {
 184                                 case 5:
 185                                         *d++ = *s++;
 186                                         /*fall through*/
 187                                 case 4:
 188                                         *d++ = *s++;
 189                                         /*fall through*/
 190                                 case 3:
 191                                         *d++ = *s++;
 192                                         /*fall through*/
 193                                 case 2:
 194                                         *d++ = *s++;
 195                                         /*fall through*/
 196                                 case 1:
 197                                         *d++ = *s++;
 198                                         break;
 199                                 default:
 200                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 201                                         *d = '\0';
 202                                         return NT_STATUS_INVALID_PARAMETER;
 203                         }
 204                 }
 205                 start_of_name_component = False;
 206         }
 207
 208         *d = '\0';
 209
 210         return ret;
 211 }
 212
 213 /****************************************************************************
 214  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 215  No wildcards allowed.
 216 ****************************************************************************/
 217
 218 NTSTATUS check_path_syntax(char *path)
 219 {
 220         bool ignore;
 221         return check_path_syntax_internal(path, False, &ignore);
 222 }
 223
 224 /****************************************************************************
 225  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 226  Wildcards allowed - p_contains_wcard returns true if the last component contained
 227  a wildcard.
 228 ****************************************************************************/
 229
 230 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 231 {
 232         return check_path_syntax_internal(path, False, p_contains_wcard);
 233 }
 234
 235 /****************************************************************************
 236  Check the path for a POSIX client.
 237  We're assuming here that '/' is not the second byte in any multibyte char
 238  set (a safe assumption).
 239 ****************************************************************************/
 240
 241 NTSTATUS check_path_syntax_posix(char *path)
 242 {
 243         bool ignore;
 244         return check_path_syntax_internal(path, True, &ignore);
 245 }
 246
 247 /****************************************************************************
 248  Pull a string and check the path allowing a wilcard - provide for error return.
 249 ****************************************************************************/
 250
 251 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 252                         const char *base_ptr,
 253                         uint16 smb_flags2,
 254                         char **pp_dest,
 255                         const char *src,
 256                         size_t src_len,
 257                         int flags,
 258                         NTSTATUS *err,
 259                         bool *contains_wcard)
 260 {
 261         size_t ret;
 262
 263         *pp_dest = NULL;
 264
 265         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 266                                  src_len, flags);
 267
 268         if (!*pp_dest) {
 269                 *err = NT_STATUS_INVALID_PARAMETER;
 270                 return ret;
 271         }
 272
 273         *contains_wcard = False;
 274
 275         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 276                 /*
 277                  * For a DFS path the function parse_dfs_path()
 278                  * will do the path processing, just make a copy.
 279                  */
 280                 *err = NT_STATUS_OK;
 281                 return ret;
 282         }
 283
 284         if (lp_posix_pathnames()) {
 285                 *err = check_path_syntax_posix(*pp_dest);
 286         } else {
 287                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 288         }
 289
 290         return ret;
 291 }
 292
 293 /****************************************************************************
 294  Pull a string and check the path - provide for error return.
 295 ****************************************************************************/
 296
 297 size_t srvstr_get_path(TALLOC_CTX *ctx,
 298                         const char *base_ptr,
 299                         uint16 smb_flags2,
 300                         char **pp_dest,
 301                         const char *src,
 302                         size_t src_len,
 303                         int flags,
 304                         NTSTATUS *err)
 305 {
 306         bool ignore;
 307         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 308                                      src_len, flags, err, &ignore);
 309 }
 310
 311 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 312                                  char **pp_dest, const char *src, int flags,
 313                                  NTSTATUS *err, bool *contains_wcard)
 314 {
 315         return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
 316                                      pp_dest, src, smbreq_bufrem(req, src),
 317                                      flags, err, contains_wcard);
 318 }
 319
 320 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 321                            char **pp_dest, const char *src, int flags,
 322                            NTSTATUS *err)
 323 {
 324         bool ignore;
 325         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 326                                          flags, err, &ignore);
 327 }
 328
 329 /****************************************************************************
 330  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 331 ****************************************************************************/
 332
 333 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 334                     files_struct *fsp)
 335 {
 336         if ((fsp == NULL) || (conn == NULL)) {
 337                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 338                 return False;
 339         }
 340         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 341                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 342                 return False;
 343         }
 344         return True;
 345 }
 346
 347 /****************************************************************************
 348  Check if we have a correct fsp pointing to a file.
 349 ****************************************************************************/
 350
 351 bool check_fsp(connection_struct *conn, struct smb_request *req,
 352                files_struct *fsp)
 353 {
 354         if (!check_fsp_open(conn, req, fsp)) {
 355                 return False;
 356         }
 357         if (fsp->is_directory) {
 358                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 359                 return False;
 360         }
 361         if (fsp->fh->fd == -1) {
 362                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 363                 return False;
 364         }
 365         fsp->num_smb_operations++;
 366         return True;
 367 }
 368
 369 /****************************************************************************
 370  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 371  the CHECK_NTQUOTA_HANDLE_OK macro.
 372 ****************************************************************************/
 373
 374 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 375                               files_struct *fsp)
 376 {
 377         if (!check_fsp_open(conn, req, fsp)) {
 378                 return false;
 379         }
 380
 381         if (fsp->is_directory) {
 382                 return false;
 383         }
 384
 385         if (fsp->fake_file_handle == NULL) {
 386                 return false;
 387         }
 388
 389         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 390                 return false;
 391         }
 392
 393         if (fsp->fake_file_handle->private_data == NULL) {
 394                 return false;
 395         }
 396
 397         return true;
 398 }
 399
 400 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 401                                      const char *name, int name_type)
 402 {
 403         char *trim_name;
 404         char *trim_name_type;
 405         const char *retarget_parm;
 406         char *retarget;
 407         char *p;
 408         int retarget_type = 0x20;
 409         int retarget_port = 139;
 410         struct sockaddr_storage retarget_addr;
 411         struct sockaddr_in *in_addr;
 412         bool ret = false;
 413         uint8_t outbuf[10];
 414
 415         if (get_socket_port(sconn->sock) != 139) {
 416                 return false;
 417         }
 418
 419         trim_name = talloc_strdup(talloc_tos(), name);
 420         if (trim_name == NULL) {
 421                 goto fail;
 422         }
 423         trim_char(trim_name, ' ', ' ');
 424
 425         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 426                                          name_type);
 427         if (trim_name_type == NULL) {
 428                 goto fail;
 429         }
 430
 431         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 432                                              trim_name_type, NULL);
 433         if (retarget_parm == NULL) {
 434                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 435                                                      trim_name, NULL);
 436         }
 437         if (retarget_parm == NULL) {
 438                 goto fail;
 439         }
 440
 441         retarget = talloc_strdup(trim_name, retarget_parm);
 442         if (retarget == NULL) {
 443                 goto fail;
 444         }
 445
 446         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 447
 448         p = strchr(retarget, ':');
 449         if (p != NULL) {
 450                 *p++ = '\0';
 451                 retarget_port = atoi(p);
 452         }
 453
 454         p = strchr_m(retarget, '#');
 455         if (p != NULL) {
 456                 *p++ = '\0';
 457                 sscanf(p, "%x", &retarget_type);
 458         }
 459
 460         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 461         if (!ret) {
 462                 DEBUG(10, ("could not resolve %s\n", retarget));
 463                 goto fail;
 464         }
 465
 466         if (retarget_addr.ss_family != AF_INET) {
 467                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 468                 goto fail;
 469         }
 470
 471         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 472
 473         _smb_setlen(outbuf, 6);
 474         SCVAL(outbuf, 0, 0x84);
 475         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 476         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 477
 478         if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
 479                           NULL)) {
 480                 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
 481                                     "failed.");
 482         }
 483
 484         ret = true;
 485  fail:
 486         TALLOC_FREE(trim_name);
 487         return ret;
 488 }
 489
 490 /****************************************************************************
 491  Reply to a (netbios-level) special message.
 492 ****************************************************************************/
 493
 494 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
 495 {
 496         int msg_type = CVAL(inbuf,0);
 497         int msg_flags = CVAL(inbuf,1);
 498         /*
 499          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 500          * calculation & friends (srv_send_smb uses that) we need the full smb
 501          * header.
 502          */
 503         char outbuf[smb_size];
 504
 505         memset(outbuf, '\0', sizeof(outbuf));
 506
 507         smb_setlen(outbuf,0);
 508
 509         switch (msg_type) {
 510         case 0x81: /* session request */
 511         {
 512                 /* inbuf_size is guarenteed to be at least 4. */
 513                 fstring name1,name2;
 514                 int name_type1, name_type2;
 515                 int name_len1, name_len2;
 516
 517                 *name1 = *name2 = 0;
 518
 519                 if (sconn->nbt.got_session) {
 520                         exit_server_cleanly("multiple session request not permitted");
 521                 }
 522
 523                 SCVAL(outbuf,0,0x82);
 524                 SCVAL(outbuf,3,0);
 525
 526                 /* inbuf_size is guaranteed to be at least 4. */
 527                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 528                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 529                         DEBUG(0,("Invalid name length in session request\n"));
 530                         break;
 531                 }
 532                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 533                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 534                         DEBUG(0,("Invalid name length in session request\n"));
 535                         break;
 536                 }
 537
 538                 name_type1 = name_extract((unsigned char *)inbuf,
 539                                 inbuf_size,(unsigned int)4,name1);
 540                 name_type2 = name_extract((unsigned char *)inbuf,
 541                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 542
 543                 if (name_type1 == -1 || name_type2 == -1) {
 544                         DEBUG(0,("Invalid name type in session request\n"));
 545                         break;
 546                 }
 547
 548                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 549                          name1, name_type1, name2, name_type2));
 550
 551                 if (netbios_session_retarget(sconn, name1, name_type1)) {
 552                         exit_server_cleanly("retargeted client");
 553                 }
 554
 555                 /*
 556                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 557                  * "*SMBSERV" arrggg!!!
 558                  */
 559                 if (strequal(name1, "*SMBSERVER     ")
 560                     || strequal(name1, "*SMBSERV       "))  {
 561                         fstrcpy(name1, sconn->client_id.addr);
 562                 }
 563
 564                 set_local_machine_name(name1, True);
 565                 set_remote_machine_name(name2, True);
 566
 567                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 568                          get_local_machine_name(), get_remote_machine_name(),
 569                          name_type2));
 570
 571                 if (name_type2 == 'R') {
 572                         /* We are being asked for a pathworks session ---
 573                            no thanks! */
 574                         SCVAL(outbuf, 0,0x83);
 575                         break;
 576                 }
 577
 578                 /* only add the client's machine name to the list
 579                    of possibly valid usernames if we are operating
 580                    in share mode security */
 581                 if (lp_security() == SEC_SHARE) {
 582                         add_session_user(sconn, get_remote_machine_name());
 583                 }
 584
 585                 reload_services(sconn->msg_ctx, sconn->sock, True);
 586                 reopen_logs();
 587
 588                 sconn->nbt.got_session = true;
 589                 break;
 590         }
 591
 592         case 0x89: /* session keepalive request
 593                       (some old clients produce this?) */
 594                 SCVAL(outbuf,0,SMBkeepalive);
 595                 SCVAL(outbuf,3,0);
 596                 break;
 597
 598         case 0x82: /* positive session response */
 599         case 0x83: /* negative session response */
 600         case 0x84: /* retarget session response */
 601                 DEBUG(0,("Unexpected session response\n"));
 602                 break;
 603
 604         case SMBkeepalive: /* session keepalive */
 605         default:
 606                 return;
 607         }
 608
 609         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 610                     msg_type, msg_flags));
 611
 612         srv_send_smb(sconn, outbuf, false, 0, false, NULL);
 613         return;
 614 }
 615
 616 /****************************************************************************
 617  Reply to a tcon.
 618  conn POINTER CAN BE NULL HERE !
 619 ****************************************************************************/
 620
 621 void reply_tcon(struct smb_request *req)
 622 {
 623         connection_struct *conn = req->conn;
 624         const char *service;
 625         char *service_buf = NULL;
 626         char *password = NULL;
 627         char *dev = NULL;
 628         int pwlen=0;
 629         NTSTATUS nt_status;
 630         const char *p;
 631         DATA_BLOB password_blob;
 632         TALLOC_CTX *ctx = talloc_tos();
 633         struct smbd_server_connection *sconn = req->sconn;
 634
 635         START_PROFILE(SMBtcon);
 636
 637         if (req->buflen < 4) {
 638                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 639                 END_PROFILE(SMBtcon);
 640                 return;
 641         }
 642
 643         p = (const char *)req->buf + 1;
 644         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 645         p += 1;
 646         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 647         p += pwlen+1;
 648         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 649         p += 1;
 650
 651         if (service_buf == NULL || password == NULL || dev == NULL) {
 652                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 653                 END_PROFILE(SMBtcon);
 654                 return;
 655         }
 656         p = strrchr_m(service_buf,'\\');
 657         if (p) {
 658                 service = p+1;
 659         } else {
 660                 service = service_buf;
 661         }
 662
 663         password_blob = data_blob(password, pwlen+1);
 664
 665         conn = make_connection(sconn,service,password_blob,dev,
 666                                req->vuid,&nt_status);
 667         req->conn = conn;
 668
 669         data_blob_clear_free(&password_blob);
 670
 671         if (!conn) {
 672                 reply_nterror(req, nt_status);
 673                 END_PROFILE(SMBtcon);
 674                 return;
 675         }
 676
 677         reply_outbuf(req, 2, 0);
 678         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 679         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 680         SSVAL(req->outbuf,smb_tid,conn->cnum);
 681
 682         DEBUG(3,("tcon service=%s cnum=%d\n",
 683                  service, conn->cnum));
 684
 685         END_PROFILE(SMBtcon);
 686         return;
 687 }
 688
 689 /****************************************************************************
 690  Reply to a tcon and X.
 691  conn POINTER CAN BE NULL HERE !
 692 ****************************************************************************/
 693
 694 void reply_tcon_and_X(struct smb_request *req)
 695 {
 696         connection_struct *conn = req->conn;
 697         const char *service = NULL;
 698         DATA_BLOB password;
 699         TALLOC_CTX *ctx = talloc_tos();
 700         /* what the cleint thinks the device is */
 701         char *client_devicetype = NULL;
 702         /* what the server tells the client the share represents */
 703         const char *server_devicetype;
 704         NTSTATUS nt_status;
 705         int passlen;
 706         char *path = NULL;
 707         const char *p, *q;
 708         uint16 tcon_flags;
 709         struct smbd_server_connection *sconn = req->sconn;
 710
 711         START_PROFILE(SMBtconX);
 712
 713         if (req->wct < 4) {
 714                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 715                 END_PROFILE(SMBtconX);
 716                 return;
 717         }
 718
 719         passlen = SVAL(req->vwv+3, 0);
 720         tcon_flags = SVAL(req->vwv+2, 0);
 721
 722         /* we might have to close an old one */
 723         if ((tcon_flags & 0x1) && conn) {
 724                 close_cnum(conn,req->vuid);
 725                 req->conn = NULL;
 726                 conn = NULL;
 727         }
 728
 729         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 730                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 731                 END_PROFILE(SMBtconX);
 732                 return;
 733         }
 734
 735         if (sconn->smb1.negprot.encrypted_passwords) {
 736                 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
 737                 if (lp_security() == SEC_SHARE) {
 738                         /*
 739                          * Security = share always has a pad byte
 740                          * after the password.
 741                          */
 742                         p = (const char *)req->buf + passlen + 1;
 743                 } else {
 744                         p = (const char *)req->buf + passlen;
 745                 }
 746         } else {
 747                 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
 748                 /* Ensure correct termination */
 749                 password.data[passlen]=0;
 750                 p = (const char *)req->buf + passlen + 1;
 751         }
 752
 753         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 754
 755         if (path == NULL) {
 756                 data_blob_clear_free(&password);
 757                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 758                 END_PROFILE(SMBtconX);
 759                 return;
 760         }
 761
 762         /*
 763          * the service name can be either: \\server\share
 764          * or share directly like on the DELL PowerVault 705
 765          */
 766         if (*path=='\\') {
 767                 q = strchr_m(path+2,'\\');
 768                 if (!q) {
 769                         data_blob_clear_free(&password);
 770                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 771                         END_PROFILE(SMBtconX);
 772                         return;
 773                 }
 774                 service = q+1;
 775         } else {
 776                 service = path;
 777         }
 778
 779         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 780                                 &client_devicetype, p,
 781                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 782
 783         if (client_devicetype == NULL) {
 784                 data_blob_clear_free(&password);
 785                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 786                 END_PROFILE(SMBtconX);
 787                 return;
 788         }
 789
 790         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 791
 792         conn = make_connection(sconn, service, password, client_devicetype,
 793                                req->vuid, &nt_status);
 794         req->conn =conn;
 795
 796         data_blob_clear_free(&password);
 797
 798         if (!conn) {
 799                 reply_nterror(req, nt_status);
 800                 END_PROFILE(SMBtconX);
 801                 return;
 802         }
 803
 804         if ( IS_IPC(conn) )
 805                 server_devicetype = "IPC";
 806         else if ( IS_PRINT(conn) )
 807                 server_devicetype = "LPT1:";
 808         else
 809                 server_devicetype = "A:";
 810
 811         if (get_Protocol() < PROTOCOL_NT1) {
 812                 reply_outbuf(req, 2, 0);
 813                 if (message_push_string(&req->outbuf, server_devicetype,
 814                                         STR_TERMINATE|STR_ASCII) == -1) {
 815                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 816                         END_PROFILE(SMBtconX);
 817                         return;
 818                 }
 819         } else {
 820                 /* NT sets the fstype of IPC$ to the null string */
 821                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 822
 823                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 824                         /* Return permissions. */
 825                         uint32 perm1 = 0;
 826                         uint32 perm2 = 0;
 827
 828                         reply_outbuf(req, 7, 0);
 829
 830                         if (IS_IPC(conn)) {
 831                                 perm1 = FILE_ALL_ACCESS;
 832                                 perm2 = FILE_ALL_ACCESS;
 833                         } else {
 834                                 perm1 = CAN_WRITE(conn) ?
 835                                                 SHARE_ALL_ACCESS :
 836                                                 SHARE_READ_ONLY;
 837                         }
 838
 839                         SIVAL(req->outbuf, smb_vwv3, perm1);
 840                         SIVAL(req->outbuf, smb_vwv5, perm2);
 841                 } else {
 842                         reply_outbuf(req, 3, 0);
 843                 }
 844
 845                 if ((message_push_string(&req->outbuf, server_devicetype,
 846                                          STR_TERMINATE|STR_ASCII) == -1)
 847                     || (message_push_string(&req->outbuf, fstype,
 848                                             STR_TERMINATE) == -1)) {
 849                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 850                         END_PROFILE(SMBtconX);
 851                         return;
 852                 }
 853
 854                 /* what does setting this bit do? It is set by NT4 and
 855                    may affect the ability to autorun mounted cdroms */
 856                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 857                       (lp_csc_policy(SNUM(conn)) << 2));
 858
 859                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
 860                         DEBUG(2,("Serving %s as a Dfs root\n",
 861                                  lp_servicename(SNUM(conn)) ));
 862                         SSVAL(req->outbuf, smb_vwv2,
 863                               SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
 864                 }
 865         }
 866
 867
 868         DEBUG(3,("tconX service=%s \n",
 869                  service));
 870
 871         /* set the incoming and outgoing tid to the just created one */
 872         SSVAL(req->inbuf,smb_tid,conn->cnum);
 873         SSVAL(req->outbuf,smb_tid,conn->cnum);
 874
 875         END_PROFILE(SMBtconX);
 876
 877         req->tid = conn->cnum;
 878         chain_reply(req);
 879         return;
 880 }
 881
 882 /****************************************************************************
 883  Reply to an unknown type.
 884 ****************************************************************************/
 885
 886 void reply_unknown_new(struct smb_request *req, uint8 type)
 887 {
 888         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 889                   smb_fn_name(type), type, type));
 890         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
 891         return;
 892 }
 893
 894 /****************************************************************************
 895  Reply to an ioctl.
 896  conn POINTER CAN BE NULL HERE !
 897 ****************************************************************************/
 898
 899 void reply_ioctl(struct smb_request *req)
 900 {
 901         connection_struct *conn = req->conn;
 902         uint16 device;
 903         uint16 function;
 904         uint32 ioctl_code;
 905         int replysize;
 906         char *p;
 907
 908         START_PROFILE(SMBioctl);
 909
 910         if (req->wct < 3) {
 911                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 912                 END_PROFILE(SMBioctl);
 913                 return;
 914         }
 915
 916         device     = SVAL(req->vwv+1, 0);
 917         function   = SVAL(req->vwv+2, 0);
 918         ioctl_code = (device << 16) + function;
 919
 920         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 921
 922         switch (ioctl_code) {
 923             case IOCTL_QUERY_JOB_INFO:
 924                     replysize = 32;
 925                     break;
 926             default:
 927                     reply_force_doserror(req, ERRSRV, ERRnosupport);
 928                     END_PROFILE(SMBioctl);
 929                     return;
 930         }
 931
 932         reply_outbuf(req, 8, replysize+1);
 933         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 934         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 935         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 936         p = smb_buf(req->outbuf);
 937         memset(p, '\0', replysize+1); /* valgrind-safe. */
 938         p += 1;          /* Allow for alignment */
 939
 940         switch (ioctl_code) {
 941                 case IOCTL_QUERY_JOB_INFO:
 942                 {
 943                         files_struct *fsp = file_fsp(
 944                                 req, SVAL(req->vwv+0, 0));
 945                         if (!fsp) {
 946                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 947                                 END_PROFILE(SMBioctl);
 948                                 return;
 949                         }
 950                         /* Job number */
 951                         if (fsp->print_file) {
 952                                 SSVAL(p, 0, fsp->print_file->rap_jobid);
 953                         } else {
 954                                 SSVAL(p, 0, 0);
 955                         }
 956                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 957                                     global_myname(), 15,
 958                                     STR_TERMINATE|STR_ASCII);
 959                         if (conn) {
 960                                 srvstr_push((char *)req->outbuf, req->flags2,
 961                                             p+18, lp_servicename(SNUM(conn)),
 962                                             13, STR_TERMINATE|STR_ASCII);
 963                         } else {
 964                                 memset(p+18, 0, 13);
 965                         }
 966                         break;
 967                 }
 968         }
 969
 970         END_PROFILE(SMBioctl);
 971         return;
 972 }
 973
 974 /****************************************************************************
 975  Strange checkpath NTSTATUS mapping.
 976 ****************************************************************************/
 977
 978 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
 979 {
 980         /* Strange DOS error code semantics only for checkpath... */
 981         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 982                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 983                         /* We need to map to ERRbadpath */
 984                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 985                 }
 986         }
 987         return status;
 988 }
 989
 990 /****************************************************************************
 991  Reply to a checkpath.
 992 ****************************************************************************/
 993
 994 void reply_checkpath(struct smb_request *req)
 995 {
 996         connection_struct *conn = req->conn;
 997         struct smb_filename *smb_fname = NULL;
 998         char *name = NULL;
 999         NTSTATUS status;
1000         TALLOC_CTX *ctx = talloc_tos();
1001
1002         START_PROFILE(SMBcheckpath);
1003
1004         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1005                             STR_TERMINATE, &status);
1006
1007         if (!NT_STATUS_IS_OK(status)) {
1008                 status = map_checkpath_error(req->flags2, status);
1009                 reply_nterror(req, status);
1010                 END_PROFILE(SMBcheckpath);
1011                 return;
1012         }
1013
1014         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1015
1016         status = filename_convert(ctx,
1017                                 conn,
1018                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1019                                 name,
1020                                 0,
1021                                 NULL,
1022                                 &smb_fname);
1023
1024         if (!NT_STATUS_IS_OK(status)) {
1025                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1026                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1027                                         ERRSRV, ERRbadpath);
1028                         END_PROFILE(SMBcheckpath);
1029                         return;
1030                 }
1031                 goto path_err;
1032         }
1033
1034         if (!VALID_STAT(smb_fname->st) &&
1035             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1036                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1037                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1038                 status = map_nt_error_from_unix(errno);
1039                 goto path_err;
1040         }
1041
1042         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1043                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1044                                 ERRDOS, ERRbadpath);
1045                 goto out;
1046         }
1047
1048         reply_outbuf(req, 0, 0);
1049
1050  path_err:
1051         /* We special case this - as when a Windows machine
1052                 is parsing a path is steps through the components
1053                 one at a time - if a component fails it expects
1054                 ERRbadpath, not ERRbadfile.
1055         */
1056         status = map_checkpath_error(req->flags2, status);
1057         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1058                 /*
1059                  * Windows returns different error codes if
1060                  * the parent directory is valid but not the
1061                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1062                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1063                  * if the path is invalid.
1064                  */
1065                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1066                                 ERRDOS, ERRbadpath);
1067                 goto out;
1068         }
1069
1070         reply_nterror(req, status);
1071
1072  out:
1073         TALLOC_FREE(smb_fname);
1074         END_PROFILE(SMBcheckpath);
1075         return;
1076 }
1077
1078 /****************************************************************************
1079  Reply to a getatr.
1080 ****************************************************************************/
1081
1082 void reply_getatr(struct smb_request *req)
1083 {
1084         connection_struct *conn = req->conn;
1085         struct smb_filename *smb_fname = NULL;
1086         char *fname = NULL;
1087         int mode=0;
1088         SMB_OFF_T size=0;
1089         time_t mtime=0;
1090         const char *p;
1091         NTSTATUS status;
1092         TALLOC_CTX *ctx = talloc_tos();
1093         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1094
1095         START_PROFILE(SMBgetatr);
1096
1097         p = (const char *)req->buf + 1;
1098         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1099         if (!NT_STATUS_IS_OK(status)) {
1100                 reply_nterror(req, status);
1101                 goto out;
1102         }
1103
1104         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1105                 under WfWg - weird! */
1106         if (*fname == '\0') {
1107                 mode = aHIDDEN | aDIR;
1108                 if (!CAN_WRITE(conn)) {
1109                         mode |= aRONLY;
1110                 }
1111                 size = 0;
1112                 mtime = 0;
1113         } else {
1114                 status = filename_convert(ctx,
1115                                 conn,
1116                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1117                                 fname,
1118                                 0,
1119                                 NULL,
1120                                 &smb_fname);
1121                 if (!NT_STATUS_IS_OK(status)) {
1122                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1123                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1124                                                 ERRSRV, ERRbadpath);
1125                                 goto out;
1126                         }
1127                         reply_nterror(req, status);
1128                         goto out;
1129                 }
1130                 if (!VALID_STAT(smb_fname->st) &&
1131                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1132                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1133                                  smb_fname_str_dbg(smb_fname),
1134                                  strerror(errno)));
1135                         reply_nterror(req,  map_nt_error_from_unix(errno));
1136                         goto out;
1137                 }
1138
1139                 mode = dos_mode(conn, smb_fname);
1140                 size = smb_fname->st.st_ex_size;
1141
1142                 if (ask_sharemode) {
1143                         struct timespec write_time_ts;
1144                         struct file_id fileid;
1145
1146                         ZERO_STRUCT(write_time_ts);
1147                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1148                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1149                         if (!null_timespec(write_time_ts)) {
1150                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1151                         }
1152                 }
1153
1154                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1155                 if (mode & aDIR) {
1156                         size = 0;
1157                 }
1158         }
1159
1160         reply_outbuf(req, 10, 0);
1161
1162         SSVAL(req->outbuf,smb_vwv0,mode);
1163         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1164                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1165         } else {
1166                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1167         }
1168         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1169
1170         if (get_Protocol() >= PROTOCOL_NT1) {
1171                 SSVAL(req->outbuf, smb_flg2,
1172                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1173         }
1174
1175         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1176                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1177
1178  out:
1179         TALLOC_FREE(smb_fname);
1180         TALLOC_FREE(fname);
1181         END_PROFILE(SMBgetatr);
1182         return;
1183 }
1184
1185 /****************************************************************************
1186  Reply to a setatr.
1187 ****************************************************************************/
1188
1189 void reply_setatr(struct smb_request *req)
1190 {
1191         struct smb_file_time ft;
1192         connection_struct *conn = req->conn;
1193         struct smb_filename *smb_fname = NULL;
1194         char *fname = NULL;
1195         int mode;
1196         time_t mtime;
1197         const char *p;
1198         NTSTATUS status;
1199         TALLOC_CTX *ctx = talloc_tos();
1200
1201         START_PROFILE(SMBsetatr);
1202
1203         ZERO_STRUCT(ft);
1204
1205         if (req->wct < 2) {
1206                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1207                 goto out;
1208         }
1209
1210         p = (const char *)req->buf + 1;
1211         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1212         if (!NT_STATUS_IS_OK(status)) {
1213                 reply_nterror(req, status);
1214                 goto out;
1215         }
1216
1217         status = filename_convert(ctx,
1218                                 conn,
1219                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1220                                 fname,
1221                                 0,
1222                                 NULL,
1223                                 &smb_fname);
1224         if (!NT_STATUS_IS_OK(status)) {
1225                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1226                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1227                                         ERRSRV, ERRbadpath);
1228                         goto out;
1229                 }
1230                 reply_nterror(req, status);
1231                 goto out;
1232         }
1233
1234         if (smb_fname->base_name[0] == '.' &&
1235             smb_fname->base_name[1] == '\0') {
1236                 /*
1237                  * Not sure here is the right place to catch this
1238                  * condition. Might be moved to somewhere else later -- vl
1239                  */
1240                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1241                 goto out;
1242         }
1243
1244         mode = SVAL(req->vwv+0, 0);
1245         mtime = srv_make_unix_date3(req->vwv+1);
1246
1247         ft.mtime = convert_time_t_to_timespec(mtime);
1248         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1249         if (!NT_STATUS_IS_OK(status)) {
1250                 reply_nterror(req, status);
1251                 goto out;
1252         }
1253
1254         if (mode != FILE_ATTRIBUTE_NORMAL) {
1255                 if (VALID_STAT_OF_DIR(smb_fname->st))
1256                         mode |= aDIR;
1257                 else
1258                         mode &= ~aDIR;
1259
1260                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1261                                      false) != 0) {
1262                         reply_nterror(req, map_nt_error_from_unix(errno));
1263                         goto out;
1264                 }
1265         }
1266
1267         reply_outbuf(req, 0, 0);
1268
1269         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1270                  mode));
1271  out:
1272         TALLOC_FREE(smb_fname);
1273         END_PROFILE(SMBsetatr);
1274         return;
1275 }
1276
1277 /****************************************************************************
1278  Reply to a dskattr.
1279 ****************************************************************************/
1280
1281 void reply_dskattr(struct smb_request *req)
1282 {
1283         connection_struct *conn = req->conn;
1284         uint64_t dfree,dsize,bsize;
1285         START_PROFILE(SMBdskattr);
1286
1287         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1288                 reply_nterror(req, map_nt_error_from_unix(errno));
1289                 END_PROFILE(SMBdskattr);
1290                 return;
1291         }
1292
1293         reply_outbuf(req, 5, 0);
1294
1295         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1296                 double total_space, free_space;
1297                 /* we need to scale this to a number that DOS6 can handle. We
1298                    use floating point so we can handle large drives on systems
1299                    that don't have 64 bit integers
1300
1301                    we end up displaying a maximum of 2G to DOS systems
1302                 */
1303                 total_space = dsize * (double)bsize;
1304                 free_space = dfree * (double)bsize;
1305
1306                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1307                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1308
1309                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1310                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1311
1312                 SSVAL(req->outbuf,smb_vwv0,dsize);
1313                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1314                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1315                 SSVAL(req->outbuf,smb_vwv3,dfree);
1316         } else {
1317                 SSVAL(req->outbuf,smb_vwv0,dsize);
1318                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1319                 SSVAL(req->outbuf,smb_vwv2,512);
1320                 SSVAL(req->outbuf,smb_vwv3,dfree);
1321         }
1322
1323         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1324
1325         END_PROFILE(SMBdskattr);
1326         return;
1327 }
1328
1329 /*
1330  * Utility function to split the filename from the directory.
1331  */
1332 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1333                                      char **fname_dir_out,
1334                                      char **fname_mask_out)
1335 {
1336         const char *p = NULL;
1337         char *fname_dir = NULL;
1338         char *fname_mask = NULL;
1339
1340         p = strrchr_m(fname_in, '/');
1341         if (!p) {
1342                 fname_dir = talloc_strdup(ctx, ".");
1343                 fname_mask = talloc_strdup(ctx, fname_in);
1344         } else {
1345                 fname_dir = talloc_strndup(ctx, fname_in,
1346                     PTR_DIFF(p, fname_in));
1347                 fname_mask = talloc_strdup(ctx, p+1);
1348         }
1349
1350         if (!fname_dir || !fname_mask) {
1351                 TALLOC_FREE(fname_dir);
1352                 TALLOC_FREE(fname_mask);
1353                 return NT_STATUS_NO_MEMORY;
1354         }
1355
1356         *fname_dir_out = fname_dir;
1357         *fname_mask_out = fname_mask;
1358         return NT_STATUS_OK;
1359 }
1360
1361 /****************************************************************************
1362  Reply to a search.
1363  Can be called from SMBsearch, SMBffirst or SMBfunique.
1364 ****************************************************************************/
1365
1366 void reply_search(struct smb_request *req)
1367 {
1368         connection_struct *conn = req->conn;
1369         char *path = NULL;
1370         const char *mask = NULL;
1371         char *directory = NULL;
1372         struct smb_filename *smb_fname = NULL;
1373         char *fname = NULL;
1374         SMB_OFF_T size;
1375         uint32 mode;
1376         struct timespec date;
1377         uint32 dirtype;
1378         unsigned int numentries = 0;
1379         unsigned int maxentries = 0;
1380         bool finished = False;
1381         const char *p;
1382         int status_len;
1383         char status[21];
1384         int dptr_num= -1;
1385         bool check_descend = False;
1386         bool expect_close = False;
1387         NTSTATUS nt_status;
1388         bool mask_contains_wcard = False;
1389         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1390         TALLOC_CTX *ctx = talloc_tos();
1391         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1392         struct dptr_struct *dirptr = NULL;
1393         struct smbd_server_connection *sconn = req->sconn;
1394
1395         START_PROFILE(SMBsearch);
1396
1397         if (req->wct < 2) {
1398                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1399                 goto out;
1400         }
1401
1402         if (lp_posix_pathnames()) {
1403                 reply_unknown_new(req, req->cmd);
1404                 goto out;
1405         }
1406
1407         /* If we were called as SMBffirst then we must expect close. */
1408         if(req->cmd == SMBffirst) {
1409                 expect_close = True;
1410         }
1411
1412         reply_outbuf(req, 1, 3);
1413         maxentries = SVAL(req->vwv+0, 0);
1414         dirtype = SVAL(req->vwv+1, 0);
1415         p = (const char *)req->buf + 1;
1416         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1417                                        &nt_status, &mask_contains_wcard);
1418         if (!NT_STATUS_IS_OK(nt_status)) {
1419                 reply_nterror(req, nt_status);
1420                 goto out;
1421         }
1422
1423         p++;
1424         status_len = SVAL(p, 0);
1425         p += 2;
1426
1427         /* dirtype &= ~aDIR; */
1428
1429         if (status_len == 0) {
1430                 nt_status = filename_convert(ctx, conn,
1431                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1432                                              path,
1433                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1434                                              &mask_contains_wcard,
1435                                              &smb_fname);
1436                 if (!NT_STATUS_IS_OK(nt_status)) {
1437                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1438                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1439                                                 ERRSRV, ERRbadpath);
1440                                 goto out;
1441                         }
1442                         reply_nterror(req, nt_status);
1443                         goto out;
1444                 }
1445
1446                 directory = smb_fname->base_name;
1447
1448                 p = strrchr_m(directory,'/');
1449                 if ((p != NULL) && (*directory != '/')) {
1450                         mask = p + 1;
1451                         directory = talloc_strndup(ctx, directory,
1452                                                    PTR_DIFF(p, directory));
1453                 } else {
1454                         mask = directory;
1455                         directory = talloc_strdup(ctx,".");
1456                 }
1457
1458                 if (!directory) {
1459                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1460                         goto out;
1461                 }
1462
1463                 memset((char *)status,'\0',21);
1464                 SCVAL(status,0,(dirtype & 0x1F));
1465
1466                 nt_status = dptr_create(conn,
1467                                         NULL, /* fsp */
1468                                         directory,
1469                                         True,
1470                                         expect_close,
1471                                         req->smbpid,
1472                                         mask,
1473                                         mask_contains_wcard,
1474                                         dirtype,
1475                                         &dirptr);
1476                 if (!NT_STATUS_IS_OK(nt_status)) {
1477                         reply_nterror(req, nt_status);
1478                         goto out;
1479                 }
1480                 dptr_num = dptr_dnum(dirptr);
1481         } else {
1482                 int status_dirtype;
1483                 const char *dirpath;
1484
1485                 memcpy(status,p,21);
1486                 status_dirtype = CVAL(status,0) & 0x1F;
1487                 if (status_dirtype != (dirtype & 0x1F)) {
1488                         dirtype = status_dirtype;
1489                 }
1490
1491                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1492                 if (!dirptr) {
1493                         goto SearchEmpty;
1494                 }
1495                 dirpath = dptr_path(sconn, dptr_num);
1496                 directory = talloc_strdup(ctx, dirpath);
1497                 if (!directory) {
1498                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1499                         goto out;
1500                 }
1501
1502                 mask = dptr_wcard(sconn, dptr_num);
1503                 if (!mask) {
1504                         goto SearchEmpty;
1505                 }
1506                 /*
1507                  * For a 'continue' search we have no string. So
1508                  * check from the initial saved string.
1509                  */
1510                 mask_contains_wcard = ms_has_wild(mask);
1511                 dirtype = dptr_attr(sconn, dptr_num);
1512         }
1513
1514         DEBUG(4,("dptr_num is %d\n",dptr_num));
1515
1516         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1517         dptr_init_search_op(dirptr);
1518
1519         if ((dirtype&0x1F) == aVOLID) {
1520                 char buf[DIR_STRUCT_SIZE];
1521                 memcpy(buf,status,21);
1522                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1523                                 0,aVOLID,0,!allow_long_path_components)) {
1524                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1525                         goto out;
1526                 }
1527                 dptr_fill(sconn, buf+12,dptr_num);
1528                 if (dptr_zero(buf+12) && (status_len==0)) {
1529                         numentries = 1;
1530                 } else {
1531                         numentries = 0;
1532                 }
1533                 if (message_push_blob(&req->outbuf,
1534                                       data_blob_const(buf, sizeof(buf)))
1535                     == -1) {
1536                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1537                         goto out;
1538                 }
1539         } else {
1540                 unsigned int i;
1541                 maxentries = MIN(
1542                         maxentries,
1543                         ((BUFFER_SIZE -
1544                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1545                          /DIR_STRUCT_SIZE));
1546
1547                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1548                         directory,lp_dontdescend(SNUM(conn))));
1549                 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1550                         check_descend = True;
1551                 }
1552
1553                 for (i=numentries;(i<maxentries) && !finished;i++) {
1554                         finished = !get_dir_entry(ctx,
1555                                                   dirptr,
1556                                                   mask,
1557                                                   dirtype,
1558                                                   &fname,
1559                                                   &size,
1560                                                   &mode,
1561                                                   &date,
1562                                                   check_descend,
1563                                                   ask_sharemode);
1564                         if (!finished) {
1565                                 char buf[DIR_STRUCT_SIZE];
1566                                 memcpy(buf,status,21);
1567                                 if (!make_dir_struct(ctx,
1568                                                 buf,
1569                                                 mask,
1570                                                 fname,
1571                                                 size,
1572                                                 mode,
1573                                                 convert_timespec_to_time_t(date),
1574                                                 !allow_long_path_components)) {
1575                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1576                                         goto out;
1577                                 }
1578                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1579                                         break;
1580                                 }
1581                                 if (message_push_blob(&req->outbuf,
1582                                                       data_blob_const(buf, sizeof(buf)))
1583                                     == -1) {
1584                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1585                                         goto out;
1586                                 }
1587                                 numentries++;
1588                         }
1589                 }
1590         }
1591
1592   SearchEmpty:
1593
1594         /* If we were called as SMBffirst with smb_search_id == NULL
1595                 and no entries were found then return error and close dirptr
1596                 (X/Open spec) */
1597
1598         if (numentries == 0) {
1599                 dptr_close(sconn, &dptr_num);
1600         } else if(expect_close && status_len == 0) {
1601                 /* Close the dptr - we know it's gone */
1602                 dptr_close(sconn, &dptr_num);
1603         }
1604
1605         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1606         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1607                 dptr_close(sconn, &dptr_num);
1608         }
1609
1610         if ((numentries == 0) && !mask_contains_wcard) {
1611                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1612                 goto out;
1613         }
1614
1615         SSVAL(req->outbuf,smb_vwv0,numentries);
1616         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1617         SCVAL(smb_buf(req->outbuf),0,5);
1618         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1619
1620         /* The replies here are never long name. */
1621         SSVAL(req->outbuf, smb_flg2,
1622               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1623         if (!allow_long_path_components) {
1624                 SSVAL(req->outbuf, smb_flg2,
1625                       SVAL(req->outbuf, smb_flg2)
1626                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1627         }
1628
1629         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1630         SSVAL(req->outbuf, smb_flg2,
1631               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1632
1633         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1634                 smb_fn_name(req->cmd),
1635                 mask,
1636                 directory,
1637                 dirtype,
1638                 numentries,
1639                 maxentries ));
1640  out:
1641         TALLOC_FREE(directory);
1642         TALLOC_FREE(smb_fname);
1643         END_PROFILE(SMBsearch);
1644         return;
1645 }
1646
1647 /****************************************************************************
1648  Reply to a fclose (stop directory search).
1649 ****************************************************************************/
1650
1651 void reply_fclose(struct smb_request *req)
1652 {
1653         int status_len;
1654         char status[21];
1655         int dptr_num= -2;
1656         const char *p;
1657         char *path = NULL;
1658         NTSTATUS err;
1659         bool path_contains_wcard = False;
1660         TALLOC_CTX *ctx = talloc_tos();
1661         struct smbd_server_connection *sconn = req->sconn;
1662
1663         START_PROFILE(SMBfclose);
1664
1665         if (lp_posix_pathnames()) {
1666                 reply_unknown_new(req, req->cmd);
1667                 END_PROFILE(SMBfclose);
1668                 return;
1669         }
1670
1671         p = (const char *)req->buf + 1;
1672         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1673                                        &err, &path_contains_wcard);
1674         if (!NT_STATUS_IS_OK(err)) {
1675                 reply_nterror(req, err);
1676                 END_PROFILE(SMBfclose);
1677                 return;
1678         }
1679         p++;
1680         status_len = SVAL(p,0);
1681         p += 2;
1682
1683         if (status_len == 0) {
1684                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1685                 END_PROFILE(SMBfclose);
1686                 return;
1687         }
1688
1689         memcpy(status,p,21);
1690
1691         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1692                 /*  Close the dptr - we know it's gone */
1693                 dptr_close(sconn, &dptr_num);
1694         }
1695
1696         reply_outbuf(req, 1, 0);
1697         SSVAL(req->outbuf,smb_vwv0,0);
1698
1699         DEBUG(3,("search close\n"));
1700
1701         END_PROFILE(SMBfclose);
1702         return;
1703 }
1704
1705 /****************************************************************************
1706  Reply to an open.
1707 ****************************************************************************/
1708
1709 void reply_open(struct smb_request *req)
1710 {
1711         connection_struct *conn = req->conn;
1712         struct smb_filename *smb_fname = NULL;
1713         char *fname = NULL;
1714         uint32 fattr=0;
1715         SMB_OFF_T size = 0;
1716         time_t mtime=0;
1717         int info;
1718         files_struct *fsp;
1719         int oplock_request;
1720         int deny_mode;
1721         uint32 dos_attr;
1722         uint32 access_mask;
1723         uint32 share_mode;
1724         uint32 create_disposition;
1725         uint32 create_options = 0;
1726         uint32_t private_flags = 0;
1727         NTSTATUS status;
1728         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1729         TALLOC_CTX *ctx = talloc_tos();
1730
1731         START_PROFILE(SMBopen);
1732
1733         if (req->wct < 2) {
1734                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1735                 goto out;
1736         }
1737
1738         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1739         deny_mode = SVAL(req->vwv+0, 0);
1740         dos_attr = SVAL(req->vwv+1, 0);
1741
1742         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1743                             STR_TERMINATE, &status);
1744         if (!NT_STATUS_IS_OK(status)) {
1745                 reply_nterror(req, status);
1746                 goto out;
1747         }
1748
1749         status = filename_convert(ctx,
1750                                 conn,
1751                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1752                                 fname,
1753                                 0,
1754                                 NULL,
1755                                 &smb_fname);
1756         if (!NT_STATUS_IS_OK(status)) {
1757                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1758                         reply_botherror(req,
1759                                         NT_STATUS_PATH_NOT_COVERED,
1760                                         ERRSRV, ERRbadpath);
1761                         goto out;
1762                 }
1763                 reply_nterror(req, status);
1764                 goto out;
1765         }
1766
1767         if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1768                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1769                                          &share_mode, &create_disposition,
1770                                          &create_options, &private_flags)) {
1771                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1772                 goto out;
1773         }
1774
1775         status = SMB_VFS_CREATE_FILE(
1776                 conn,                                   /* conn */
1777                 req,                                    /* req */
1778                 0,                                      /* root_dir_fid */
1779                 smb_fname,                              /* fname */
1780                 access_mask,                            /* access_mask */
1781                 share_mode,                             /* share_access */
1782                 create_disposition,                     /* create_disposition*/
1783                 create_options,                         /* create_options */
1784                 dos_attr,                               /* file_attributes */
1785                 oplock_request,                         /* oplock_request */
1786                 0,                                      /* allocation_size */
1787                 private_flags,
1788                 NULL,                                   /* sd */
1789                 NULL,                                   /* ea_list */
1790                 &fsp,                                   /* result */
1791                 &info);                                 /* pinfo */
1792
1793         if (!NT_STATUS_IS_OK(status)) {
1794                 if (open_was_deferred(req->mid)) {
1795                         /* We have re-scheduled this call. */
1796                         goto out;
1797                 }
1798                 reply_openerror(req, status);
1799                 goto out;
1800         }
1801
1802         size = smb_fname->st.st_ex_size;
1803         fattr = dos_mode(conn, smb_fname);
1804
1805         /* Deal with other possible opens having a modified
1806            write time. JRA. */
1807         if (ask_sharemode) {
1808                 struct timespec write_time_ts;
1809
1810                 ZERO_STRUCT(write_time_ts);
1811                 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1812                 if (!null_timespec(write_time_ts)) {
1813                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1814                 }
1815         }
1816
1817         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1818
1819         if (fattr & aDIR) {
1820                 DEBUG(3,("attempt to open a directory %s\n",
1821                          fsp_str_dbg(fsp)));
1822                 close_file(req, fsp, ERROR_CLOSE);
1823                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1824                         ERRDOS, ERRnoaccess);
1825                 goto out;
1826         }
1827
1828         reply_outbuf(req, 7, 0);
1829         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1830         SSVAL(req->outbuf,smb_vwv1,fattr);
1831         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1832                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1833         } else {
1834                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1835         }
1836         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1837         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1838
1839         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1840                 SCVAL(req->outbuf,smb_flg,
1841                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1842         }
1843
1844         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1845                 SCVAL(req->outbuf,smb_flg,
1846                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1847         }
1848  out:
1849         TALLOC_FREE(smb_fname);
1850         END_PROFILE(SMBopen);
1851         return;
1852 }
1853
1854 /****************************************************************************
1855  Reply to an open and X.
1856 ****************************************************************************/
1857
1858 void reply_open_and_X(struct smb_request *req)
1859 {
1860         connection_struct *conn = req->conn;
1861         struct smb_filename *smb_fname = NULL;
1862         char *fname = NULL;
1863         uint16 open_flags;
1864         int deny_mode;
1865         uint32 smb_attr;
1866         /* Breakout the oplock request bits so we can set the
1867                 reply bits separately. */
1868         int ex_oplock_request;
1869         int core_oplock_request;
1870         int oplock_request;
1871 #if 0
1872         int smb_sattr = SVAL(req->vwv+4, 0);
1873         uint32 smb_time = make_unix_date3(req->vwv+6);
1874 #endif
1875         int smb_ofun;
1876         uint32 fattr=0;
1877         int mtime=0;
1878         int smb_action = 0;
1879         files_struct *fsp;
1880         NTSTATUS status;
1881         uint64_t allocation_size;
1882         ssize_t retval = -1;
1883         uint32 access_mask;
1884         uint32 share_mode;
1885         uint32 create_disposition;
1886         uint32 create_options = 0;
1887         uint32_t private_flags = 0;
1888         TALLOC_CTX *ctx = talloc_tos();
1889
1890         START_PROFILE(SMBopenX);
1891
1892         if (req->wct < 15) {
1893                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1894                 goto out;
1895         }
1896
1897         open_flags = SVAL(req->vwv+2, 0);
1898         deny_mode = SVAL(req->vwv+3, 0);
1899         smb_attr = SVAL(req->vwv+5, 0);
1900         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1901         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1902         oplock_request = ex_oplock_request | core_oplock_request;
1903         smb_ofun = SVAL(req->vwv+8, 0);
1904         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1905
1906         /* If it's an IPC, pass off the pipe handler. */
1907         if (IS_IPC(conn)) {
1908                 if (lp_nt_pipe_support()) {
1909                         reply_open_pipe_and_X(conn, req);
1910                 } else {
1911                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1912                 }
1913                 goto out;
1914         }
1915
1916         /* XXXX we need to handle passed times, sattr and flags */
1917         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1918                         STR_TERMINATE, &status);
1919         if (!NT_STATUS_IS_OK(status)) {
1920                 reply_nterror(req, status);
1921                 goto out;
1922         }
1923
1924         status = filename_convert(ctx,
1925                                 conn,
1926                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1927                                 fname,
1928                                 0,
1929                                 NULL,
1930                                 &smb_fname);
1931         if (!NT_STATUS_IS_OK(status)) {
1932                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1933                         reply_botherror(req,
1934                                         NT_STATUS_PATH_NOT_COVERED,
1935                                         ERRSRV, ERRbadpath);
1936                         goto out;
1937                 }
1938                 reply_nterror(req, status);
1939                 goto out;
1940         }
1941
1942         if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1943                                          &access_mask, &share_mode,
1944                                          &create_disposition,
1945                                          &create_options,
1946                                          &private_flags)) {
1947                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1948                 goto out;
1949         }
1950
1951         status = SMB_VFS_CREATE_FILE(
1952                 conn,                                   /* conn */
1953                 req,                                    /* req */
1954                 0,                                      /* root_dir_fid */
1955                 smb_fname,                              /* fname */
1956                 access_mask,                            /* access_mask */
1957                 share_mode,                             /* share_access */
1958                 create_disposition,                     /* create_disposition*/
1959                 create_options,                         /* create_options */
1960                 smb_attr,                               /* file_attributes */
1961                 oplock_request,                         /* oplock_request */
1962                 0,                                      /* allocation_size */
1963                 private_flags,
1964                 NULL,                                   /* sd */
1965                 NULL,                                   /* ea_list */
1966                 &fsp,                                   /* result */
1967                 &smb_action);                           /* pinfo */
1968
1969         if (!NT_STATUS_IS_OK(status)) {
1970                 if (open_was_deferred(req->mid)) {
1971                         /* We have re-scheduled this call. */
1972                         goto out;
1973                 }
1974                 reply_openerror(req, status);
1975                 goto out;
1976         }
1977
1978         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1979            if the file is truncated or created. */
1980         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1981                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1982                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1983                         close_file(req, fsp, ERROR_CLOSE);
1984                         reply_nterror(req, NT_STATUS_DISK_FULL);
1985                         goto out;
1986                 }
1987                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1988                 if (retval < 0) {
1989                         close_file(req, fsp, ERROR_CLOSE);
1990                         reply_nterror(req, NT_STATUS_DISK_FULL);
1991                         goto out;
1992                 }
1993                 status = vfs_stat_fsp(fsp);
1994                 if (!NT_STATUS_IS_OK(status)) {
1995                         close_file(req, fsp, ERROR_CLOSE);
1996                         reply_nterror(req, status);
1997                         goto out;
1998                 }
1999         }
2000
2001         fattr = dos_mode(conn, fsp->fsp_name);
2002         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2003         if (fattr & aDIR) {
2004                 close_file(req, fsp, ERROR_CLOSE);
2005                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2006                 goto out;
2007         }
2008
2009         /* If the caller set the extended oplock request bit
2010                 and we granted one (by whatever means) - set the
2011                 correct bit for extended oplock reply.
2012         */
2013
2014         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2015                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2016         }
2017
2018         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2019                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2020         }
2021
2022         /* If the caller set the core oplock request bit
2023                 and we granted one (by whatever means) - set the
2024                 correct bit for core oplock reply.
2025         */
2026
2027         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2028                 reply_outbuf(req, 19, 0);
2029         } else {
2030                 reply_outbuf(req, 15, 0);
2031         }
2032
2033         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2034                 SCVAL(req->outbuf, smb_flg,
2035                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2036         }
2037
2038         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2039                 SCVAL(req->outbuf, smb_flg,
2040                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2041         }
2042
2043         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2044         SSVAL(req->outbuf,smb_vwv3,fattr);
2045         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2046                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2047         } else {
2048                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2049         }
2050         SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2051         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2052         SSVAL(req->outbuf,smb_vwv11,smb_action);
2053
2054         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2055                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2056         }
2057
2058         chain_reply(req);
2059  out:
2060         TALLOC_FREE(smb_fname);
2061         END_PROFILE(SMBopenX);
2062         return;
2063 }
2064
2065 /****************************************************************************
2066  Reply to a SMBulogoffX.
2067 ****************************************************************************/
2068
2069 void reply_ulogoffX(struct smb_request *req)
2070 {
2071         struct smbd_server_connection *sconn = req->sconn;
2072         user_struct *vuser;
2073
2074         START_PROFILE(SMBulogoffX);
2075
2076         vuser = get_valid_user_struct(sconn, req->vuid);
2077
2078         if(vuser == NULL) {
2079                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2080                          req->vuid));
2081         }
2082
2083         /* in user level security we are supposed to close any files
2084                 open by this user */
2085         if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2086                 file_close_user(sconn, req->vuid);
2087         }
2088
2089         invalidate_vuid(sconn, req->vuid);
2090
2091         reply_outbuf(req, 2, 0);
2092
2093         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2094
2095         END_PROFILE(SMBulogoffX);
2096         req->vuid = UID_FIELD_INVALID;
2097         chain_reply(req);
2098 }
2099
2100 /****************************************************************************
2101  Reply to a mknew or a create.
2102 ****************************************************************************/
2103
2104 void reply_mknew(struct smb_request *req)
2105 {
2106         connection_struct *conn = req->conn;
2107         struct smb_filename *smb_fname = NULL;
2108         char *fname = NULL;
2109         uint32 fattr = 0;
2110         struct smb_file_time ft;
2111         files_struct *fsp;
2112         int oplock_request = 0;
2113         NTSTATUS status;
2114         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2115         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2116         uint32 create_disposition;
2117         uint32 create_options = 0;
2118         TALLOC_CTX *ctx = talloc_tos();
2119
2120         START_PROFILE(SMBcreate);
2121         ZERO_STRUCT(ft);
2122
2123         if (req->wct < 3) {
2124                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2125                 goto out;
2126         }
2127
2128         fattr = SVAL(req->vwv+0, 0);
2129         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2130
2131         /* mtime. */
2132         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2133
2134         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2135                             STR_TERMINATE, &status);
2136         if (!NT_STATUS_IS_OK(status)) {
2137                 reply_nterror(req, status);
2138                 goto out;
2139         }
2140
2141         status = filename_convert(ctx,
2142                                 conn,
2143                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2144                                 fname,
2145                                 0,
2146                                 NULL,
2147                                 &smb_fname);
2148         if (!NT_STATUS_IS_OK(status)) {
2149                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2150                         reply_botherror(req,
2151                                         NT_STATUS_PATH_NOT_COVERED,
2152                                         ERRSRV, ERRbadpath);
2153                         goto out;
2154                 }
2155                 reply_nterror(req, status);
2156                 goto out;
2157         }
2158
2159         if (fattr & aVOLID) {
2160                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2161                          "please report this\n",
2162                          smb_fname_str_dbg(smb_fname)));
2163         }
2164
2165         if(req->cmd == SMBmknew) {
2166                 /* We should fail if file exists. */
2167                 create_disposition = FILE_CREATE;
2168         } else {
2169                 /* Create if file doesn't exist, truncate if it does. */
2170                 create_disposition = FILE_OVERWRITE_IF;
2171         }
2172
2173         status = SMB_VFS_CREATE_FILE(
2174                 conn,                                   /* conn */
2175                 req,                                    /* req */
2176                 0,                                      /* root_dir_fid */
2177                 smb_fname,                              /* fname */
2178                 access_mask,                            /* access_mask */
2179                 share_mode,                             /* share_access */
2180                 create_disposition,                     /* create_disposition*/
2181                 create_options,                         /* create_options */
2182                 fattr,                                  /* file_attributes */
2183                 oplock_request,                         /* oplock_request */
2184                 0,                                      /* allocation_size */
2185                 0,                                      /* private_flags */
2186                 NULL,                                   /* sd */
2187                 NULL,                                   /* ea_list */
2188                 &fsp,                                   /* result */
2189                 NULL);                                  /* pinfo */
2190
2191         if (!NT_STATUS_IS_OK(status)) {
2192                 if (open_was_deferred(req->mid)) {
2193                         /* We have re-scheduled this call. */
2194                         goto out;
2195                 }
2196                 reply_openerror(req, status);
2197                 goto out;
2198         }
2199
2200         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2201         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2202         if (!NT_STATUS_IS_OK(status)) {
2203                 END_PROFILE(SMBcreate);
2204                 goto out;
2205         }
2206
2207         reply_outbuf(req, 1, 0);
2208         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2209
2210         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2211                 SCVAL(req->outbuf,smb_flg,
2212                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2213         }
2214
2215         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2216                 SCVAL(req->outbuf,smb_flg,
2217                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2218         }
2219
2220         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2221         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2222                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2223                   (unsigned int)fattr));
2224
2225  out:
2226         TALLOC_FREE(smb_fname);
2227         END_PROFILE(SMBcreate);
2228         return;
2229 }
2230
2231 /****************************************************************************
2232  Reply to a create temporary file.
2233 ****************************************************************************/
2234
2235 void reply_ctemp(struct smb_request *req)
2236 {
2237         connection_struct *conn = req->conn;
2238         struct smb_filename *smb_fname = NULL;
2239         char *fname = NULL;
2240         uint32 fattr;
2241         files_struct *fsp;
2242         int oplock_request;
2243         int tmpfd;
2244         char *s;
2245         NTSTATUS status;
2246         TALLOC_CTX *ctx = talloc_tos();
2247
2248         START_PROFILE(SMBctemp);
2249
2250         if (req->wct < 3) {
2251                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2252                 goto out;
2253         }
2254
2255         fattr = SVAL(req->vwv+0, 0);
2256         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2257
2258         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2259                             STR_TERMINATE, &status);
2260         if (!NT_STATUS_IS_OK(status)) {
2261                 reply_nterror(req, status);
2262                 goto out;
2263         }
2264         if (*fname) {
2265                 fname = talloc_asprintf(ctx,
2266                                 "%s/TMXXXXXX",
2267                                 fname);
2268         } else {
2269                 fname = talloc_strdup(ctx, "TMXXXXXX");
2270         }
2271
2272         if (!fname) {
2273                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2274                 goto out;
2275         }
2276
2277         status = filename_convert(ctx, conn,
2278                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2279                                 fname,
2280                                 0,
2281                                 NULL,
2282                                 &smb_fname);
2283         if (!NT_STATUS_IS_OK(status)) {
2284                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2285                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2286                                         ERRSRV, ERRbadpath);
2287                         goto out;
2288                 }
2289                 reply_nterror(req, status);
2290                 goto out;
2291         }
2292
2293         tmpfd = mkstemp(smb_fname->base_name);
2294         if (tmpfd == -1) {
2295                 reply_nterror(req, map_nt_error_from_unix(errno));
2296                 goto out;
2297         }
2298
2299         SMB_VFS_STAT(conn, smb_fname);
2300
2301         /* We should fail if file does not exist. */
2302         status = SMB_VFS_CREATE_FILE(
2303                 conn,                                   /* conn */
2304                 req,                                    /* req */
2305                 0,                                      /* root_dir_fid */
2306                 smb_fname,                              /* fname */
2307                 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2308                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2309                 FILE_OPEN,                              /* create_disposition*/
2310                 0,                                      /* create_options */
2311                 fattr,                                  /* file_attributes */
2312                 oplock_request,                         /* oplock_request */
2313                 0,                                      /* allocation_size */
2314                 0,                                      /* private_flags */
2315                 NULL,                                   /* sd */
2316                 NULL,                                   /* ea_list */
2317                 &fsp,                                   /* result */
2318                 NULL);                                  /* pinfo */
2319
2320         /* close fd from mkstemp() */
2321         close(tmpfd);
2322
2323         if (!NT_STATUS_IS_OK(status)) {
2324                 if (open_was_deferred(req->mid)) {
2325                         /* We have re-scheduled this call. */
2326                         goto out;
2327                 }
2328                 reply_openerror(req, status);
2329                 goto out;
2330         }
2331
2332         reply_outbuf(req, 1, 0);
2333         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2334
2335         /* the returned filename is relative to the directory */
2336         s = strrchr_m(fsp->fsp_name->base_name, '/');
2337         if (!s) {
2338                 s = fsp->fsp_name->base_name;
2339         } else {
2340                 s++;
2341         }
2342
2343 #if 0
2344         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2345            thing in the byte section. JRA */
2346         SSVALS(p, 0, -1); /* what is this? not in spec */
2347 #endif
2348         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2349             == -1) {
2350                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2351                 goto out;
2352         }
2353
2354         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2355                 SCVAL(req->outbuf, smb_flg,
2356                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2357         }
2358
2359         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2360                 SCVAL(req->outbuf, smb_flg,
2361                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2362         }
2363
2364         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2365         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2366                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2367  out:
2368         TALLOC_FREE(smb_fname);
2369         END_PROFILE(SMBctemp);
2370         return;
2371 }
2372
2373 /*******************************************************************
2374  Check if a user is allowed to rename a file.
2375 ********************************************************************/
2376
2377 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2378                         uint16 dirtype)
2379 {
2380         uint32 fmode;
2381
2382         if (!CAN_WRITE(conn)) {
2383                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2384         }
2385
2386         fmode = dos_mode(conn, fsp->fsp_name);
2387         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2388                 return NT_STATUS_NO_SUCH_FILE;
2389         }
2390
2391         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2392                 if (fsp->posix_open) {
2393                         return NT_STATUS_OK;
2394                 }
2395
2396                 /* If no pathnames are open below this
2397                    directory, allow the rename. */
2398
2399                 if (file_find_subpath(fsp)) {
2400                         return NT_STATUS_ACCESS_DENIED;
2401                 }
2402                 return NT_STATUS_OK;
2403         }
2404
2405         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2406                 return NT_STATUS_OK;
2407         }
2408
2409         return NT_STATUS_ACCESS_DENIED;
2410 }
2411
2412 /*******************************************************************
2413  * unlink a file with all relevant access checks
2414  *******************************************************************/
2415
2416 static NTSTATUS do_unlink(connection_struct *conn,
2417                         struct smb_request *req,
2418                         struct smb_filename *smb_fname,
2419                         uint32 dirtype)
2420 {
2421         uint32 fattr;
2422         files_struct *fsp;
2423         uint32 dirtype_orig = dirtype;
2424         NTSTATUS status;
2425         int ret;
2426         bool posix_paths = lp_posix_pathnames();
2427
2428         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2429                   smb_fname_str_dbg(smb_fname),
2430                   dirtype));
2431
2432         if (!CAN_WRITE(conn)) {
2433                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2434         }
2435
2436         if (posix_paths) {
2437                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2438         } else {
2439                 ret = SMB_VFS_STAT(conn, smb_fname);
2440         }
2441         if (ret != 0) {
2442                 return map_nt_error_from_unix(errno);
2443         }
2444
2445         fattr = dos_mode(conn, smb_fname);
2446
2447         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2448                 dirtype = aDIR|aARCH|aRONLY;
2449         }
2450
2451         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2452         if (!dirtype) {
2453                 return NT_STATUS_NO_SUCH_FILE;
2454         }
2455
2456         if (!dir_check_ftype(conn, fattr, dirtype)) {
2457                 if (fattr & aDIR) {
2458                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2459                 }
2460                 return NT_STATUS_NO_SUCH_FILE;
2461         }
2462
2463         if (dirtype_orig & 0x8000) {
2464                 /* These will never be set for POSIX. */
2465                 return NT_STATUS_NO_SUCH_FILE;
2466         }
2467
2468 #if 0
2469         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2470                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2471         }
2472
2473         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2474                 return NT_STATUS_NO_SUCH_FILE;
2475         }
2476
2477         if (dirtype & 0xFF00) {
2478                 /* These will never be set for POSIX. */
2479                 return NT_STATUS_NO_SUCH_FILE;
2480         }
2481
2482         dirtype &= 0xFF;
2483         if (!dirtype) {
2484                 return NT_STATUS_NO_SUCH_FILE;
2485         }
2486
2487         /* Can't delete a directory. */
2488         if (fattr & aDIR) {
2489                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2490         }
2491 #endif
2492
2493 #if 0 /* JRATEST */
2494         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2495                 return NT_STATUS_OBJECT_NAME_INVALID;
2496 #endif /* JRATEST */
2497
2498         /* On open checks the open itself will check the share mode, so
2499            don't do it here as we'll get it wrong. */
2500
2501         status = SMB_VFS_CREATE_FILE
2502                 (conn,                  /* conn */
2503                  req,                   /* req */
2504                  0,                     /* root_dir_fid */
2505                  smb_fname,             /* fname */
2506                  DELETE_ACCESS,         /* access_mask */
2507                  FILE_SHARE_NONE,       /* share_access */
2508                  FILE_OPEN,             /* create_disposition*/
2509                  FILE_NON_DIRECTORY_FILE, /* create_options */
2510                                         /* file_attributes */
2511                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2512                                 FILE_ATTRIBUTE_NORMAL,
2513                  0,                     /* oplock_request */
2514                  0,                     /* allocation_size */
2515                  0,                     /* private_flags */
2516                  NULL,                  /* sd */
2517                  NULL,                  /* ea_list */
2518                  &fsp,                  /* result */
2519                  NULL);                 /* pinfo */
2520
2521         if (!NT_STATUS_IS_OK(status)) {
2522                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2523                            nt_errstr(status)));
2524                 return status;
2525         }
2526
2527         status = can_set_delete_on_close(fsp, fattr);
2528         if (!NT_STATUS_IS_OK(status)) {
2529                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2530                         "(%s)\n",
2531                         smb_fname_str_dbg(smb_fname),
2532                         nt_errstr(status)));
2533                 close_file(req, fsp, NORMAL_CLOSE);
2534                 return status;
2535         }
2536
2537         /* The set is across all open files on this dev/inode pair. */
2538         if (!set_delete_on_close(fsp, True, &conn->session_info->utok)) {
2539                 close_file(req, fsp, NORMAL_CLOSE);
2540                 return NT_STATUS_ACCESS_DENIED;
2541         }
2542
2543         return close_file(req, fsp, NORMAL_CLOSE);
2544 }
2545
2546 /****************************************************************************
2547  The guts of the unlink command, split out so it may be called by the NT SMB
2548  code.
2549 ****************************************************************************/
2550
2551 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2552                           uint32 dirtype, struct smb_filename *smb_fname,
2553                           bool has_wild)
2554 {
2555         char *fname_dir = NULL;
2556         char *fname_mask = NULL;
2557         int count=0;
2558         NTSTATUS status = NT_STATUS_OK;
2559         TALLOC_CTX *ctx = talloc_tos();
2560
2561         /* Split up the directory from the filename/mask. */
2562         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2563                                       &fname_dir, &fname_mask);
2564         if (!NT_STATUS_IS_OK(status)) {
2565                 goto out;
2566         }
2567
2568         /*
2569          * We should only check the mangled cache
2570          * here if unix_convert failed. This means
2571          * that the path in 'mask' doesn't exist
2572          * on the file system and so we need to look
2573          * for a possible mangle. This patch from
2574          * Tine Smukavec <valentin.smukavec@hermes.si>.
2575          */
2576
2577         if (!VALID_STAT(smb_fname->st) &&
2578             mangle_is_mangled(fname_mask, conn->params)) {
2579                 char *new_mask = NULL;
2580                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2581                                             &new_mask, conn->params);
2582                 if (new_mask) {
2583                         TALLOC_FREE(fname_mask);
2584                         fname_mask = new_mask;
2585                 }
2586         }
2587
2588         if (!has_wild) {
2589
2590                 /*
2591                  * Only one file needs to be unlinked. Append the mask back
2592                  * onto the directory.
2593                  */
2594                 TALLOC_FREE(smb_fname->base_name);
2595                 if (ISDOT(fname_dir)) {
2596                         /* Ensure we use canonical names on open. */
2597                         smb_fname->base_name = talloc_asprintf(smb_fname,
2598                                                         "%s",
2599                                                         fname_mask);
2600                 } else {
2601                         smb_fname->base_name = talloc_asprintf(smb_fname,
2602                                                         "%s/%s",
2603                                                         fname_dir,
2604                                                         fname_mask);
2605                 }
2606                 if (!smb_fname->base_name) {
2607                         status = NT_STATUS_NO_MEMORY;
2608                         goto out;
2609                 }
2610                 if (dirtype == 0) {
2611                         dirtype = FILE_ATTRIBUTE_NORMAL;
2612                 }
2613
2614                 status = check_name(conn, smb_fname->base_name);
2615                 if (!NT_STATUS_IS_OK(status)) {
2616                         goto out;
2617                 }
2618
2619                 status = do_unlink(conn, req, smb_fname, dirtype);
2620                 if (!NT_STATUS_IS_OK(status)) {
2621                         goto out;
2622                 }
2623
2624                 count++;
2625         } else {
2626                 struct smb_Dir *dir_hnd = NULL;
2627                 long offset = 0;
2628                 const char *dname = NULL;
2629                 char *talloced = NULL;
2630
2631                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2632                         status = NT_STATUS_OBJECT_NAME_INVALID;
2633                         goto out;
2634                 }
2635
2636                 if (strequal(fname_mask,"????????.???")) {
2637                         TALLOC_FREE(fname_mask);
2638                         fname_mask = talloc_strdup(ctx, "*");
2639                         if (!fname_mask) {
2640                                 status = NT_STATUS_NO_MEMORY;
2641                                 goto out;
2642                         }
2643                 }
2644
2645                 status = check_name(conn, fname_dir);
2646                 if (!NT_STATUS_IS_OK(status)) {
2647                         goto out;
2648                 }
2649
2650                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2651                                   dirtype);
2652                 if (dir_hnd == NULL) {
2653                         status = map_nt_error_from_unix(errno);
2654                         goto out;
2655                 }
2656
2657                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2658                    the pattern matches against the long name, otherwise the short name
2659                    We don't implement this yet XXXX
2660                 */
2661
2662                 status = NT_STATUS_NO_SUCH_FILE;
2663
2664                 while ((dname = ReadDirName(dir_hnd, &offset,
2665                                             &smb_fname->st, &talloced))) {
2666                         TALLOC_CTX *frame = talloc_stackframe();
2667
2668                         if (!is_visible_file(conn, fname_dir, dname,
2669                                              &smb_fname->st, true)) {
2670                                 TALLOC_FREE(frame);
2671                                 TALLOC_FREE(talloced);
2672                                 continue;
2673                         }
2674
2675                         /* Quick check for "." and ".." */
2676                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2677                                 TALLOC_FREE(frame);
2678                                 TALLOC_FREE(talloced);
2679                                 continue;
2680                         }
2681
2682                         if(!mask_match(dname, fname_mask,
2683                                        conn->case_sensitive)) {
2684                                 TALLOC_FREE(frame);
2685                                 TALLOC_FREE(talloced);
2686                                 continue;
2687                         }
2688
2689                         TALLOC_FREE(smb_fname->base_name);
2690                         if (ISDOT(fname_dir)) {
2691                                 /* Ensure we use canonical names on open. */
2692                                 smb_fname->base_name =
2693                                         talloc_asprintf(smb_fname, "%s",
2694                                                 dname);
2695                         } else {
2696                                 smb_fname->base_name =
2697                                         talloc_asprintf(smb_fname, "%s/%s",
2698                                                 fname_dir, dname);
2699                         }
2700
2701                         if (!smb_fname->base_name) {
2702                                 TALLOC_FREE(dir_hnd);
2703                                 status = NT_STATUS_NO_MEMORY;
2704                                 TALLOC_FREE(frame);
2705                                 TALLOC_FREE(talloced);
2706                                 goto out;
2707                         }
2708
2709                         status = check_name(conn, smb_fname->base_name);
2710                         if (!NT_STATUS_IS_OK(status)) {
2711                                 TALLOC_FREE(dir_hnd);
2712                                 TALLOC_FREE(frame);
2713                                 TALLOC_FREE(talloced);
2714                                 goto out;
2715                         }
2716
2717                         status = do_unlink(conn, req, smb_fname, dirtype);
2718                         if (!NT_STATUS_IS_OK(status)) {
2719                                 TALLOC_FREE(frame);
2720                                 TALLOC_FREE(talloced);
2721                                 continue;
2722                         }
2723
2724                         count++;
2725                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2726                                  smb_fname->base_name));
2727
2728                         TALLOC_FREE(frame);
2729                         TALLOC_FREE(talloced);
2730                 }
2731                 TALLOC_FREE(dir_hnd);
2732         }
2733
2734         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2735                 status = map_nt_error_from_unix(errno);
2736         }
2737
2738  out:
2739         TALLOC_FREE(fname_dir);
2740         TALLOC_FREE(fname_mask);
2741         return status;
2742 }
2743
2744 /****************************************************************************
2745  Reply to a unlink
2746 ****************************************************************************/
2747
2748 void reply_unlink(struct smb_request *req)
2749 {
2750         connection_struct *conn = req->conn;
2751         char *name = NULL;
2752         struct smb_filename *smb_fname = NULL;
2753         uint32 dirtype;
2754         NTSTATUS status;
2755         bool path_contains_wcard = False;
2756         TALLOC_CTX *ctx = talloc_tos();
2757
2758         START_PROFILE(SMBunlink);
2759
2760         if (req->wct < 1) {
2761                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2762                 goto out;
2763         }
2764
2765         dirtype = SVAL(req->vwv+0, 0);
2766
2767         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2768                                   STR_TERMINATE, &status,
2769                                   &path_contains_wcard);
2770         if (!NT_STATUS_IS_OK(status)) {
2771                 reply_nterror(req, status);
2772                 goto out;
2773         }
2774
2775         status = filename_convert(ctx, conn,
2776                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2777                                   name,
2778                                   UCF_COND_ALLOW_WCARD_LCOMP,
2779                                   &path_contains_wcard,
2780                                   &smb_fname);
2781         if (!NT_STATUS_IS_OK(status)) {
2782                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2783                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2784                                         ERRSRV, ERRbadpath);
2785                         goto out;
2786                 }
2787                 reply_nterror(req, status);
2788                 goto out;
2789         }
2790
2791         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2792
2793         status = unlink_internals(conn, req, dirtype, smb_fname,
2794                                   path_contains_wcard);
2795         if (!NT_STATUS_IS_OK(status)) {
2796                 if (open_was_deferred(req->mid)) {
2797                         /* We have re-scheduled this call. */
2798                         goto out;
2799                 }
2800                 reply_nterror(req, status);
2801                 goto out;
2802         }
2803
2804         reply_outbuf(req, 0, 0);
2805  out:
2806         TALLOC_FREE(smb_fname);
2807         END_PROFILE(SMBunlink);
2808         return;
2809 }
2810
2811 /****************************************************************************
2812  Fail for readbraw.
2813 ****************************************************************************/
2814
2815 static void fail_readraw(void)
2816 {
2817         const char *errstr = talloc_asprintf(talloc_tos(),
2818                         "FAIL ! reply_readbraw: socket write fail (%s)",
2819                         strerror(errno));
2820         if (!errstr) {
2821                 errstr = "";
2822         }
2823         exit_server_cleanly(errstr);
2824 }
2825
2826 /****************************************************************************
2827  Fake (read/write) sendfile. Returns -1 on read or write fail.
2828 ****************************************************************************/
2829
2830 ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
2831 {
2832         size_t bufsize;
2833         size_t tosend = nread;
2834         char *buf;
2835
2836         if (nread == 0) {
2837                 return 0;
2838         }
2839
2840         bufsize = MIN(nread, 65536);
2841
2842         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2843                 return -1;
2844         }
2845
2846         while (tosend > 0) {
2847                 ssize_t ret;
2848                 size_t cur_read;
2849
2850                 if (tosend > bufsize) {
2851                         cur_read = bufsize;
2852                 } else {
2853                         cur_read = tosend;
2854                 }
2855                 ret = read_file(fsp,buf,startpos,cur_read);
2856                 if (ret == -1) {
2857                         SAFE_FREE(buf);
2858                         return -1;
2859                 }
2860
2861                 /* If we had a short read, fill with zeros. */
2862                 if (ret < cur_read) {
2863                         memset(buf + ret, '\0', cur_read - ret);
2864                 }
2865
2866                 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2867                     != cur_read) {
2868                         char addr[INET6_ADDRSTRLEN];
2869                         /*
2870                          * Try and give an error message saying what
2871                          * client failed.
2872                          */
2873                         DEBUG(0, ("write_data failed for client %s. "
2874                                   "Error %s\n",
2875                                   get_peer_addr(fsp->conn->sconn->sock, addr,
2876                                                 sizeof(addr)),
2877                                   strerror(errno)));
2878                         SAFE_FREE(buf);
2879                         return -1;
2880                 }
2881                 tosend -= cur_read;
2882                 startpos += cur_read;
2883         }
2884
2885         SAFE_FREE(buf);
2886         return (ssize_t)nread;
2887 }
2888
2889 /****************************************************************************
2890  Deal with the case of sendfile reading less bytes from the file than
2891  requested. Fill with zeros (all we can do).
2892 ****************************************************************************/
2893
2894 void sendfile_short_send(files_struct *fsp,
2895                                 ssize_t nread,
2896                                 size_t headersize,
2897                                 size_t smb_maxcnt)
2898 {
2899 #define SHORT_SEND_BUFSIZE 1024
2900         if (nread < headersize) {
2901                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2902                         "header for file %s (%s). Terminating\n",
2903                         fsp_str_dbg(fsp), strerror(errno)));
2904                 exit_server_cleanly("sendfile_short_send failed");
2905         }
2906
2907         nread -= headersize;
2908
2909         if (nread < smb_maxcnt) {
2910                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2911                 if (!buf) {
2912                         exit_server_cleanly("sendfile_short_send: "
2913                                 "malloc failed");
2914                 }
2915
2916                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2917                         "with zeros !\n", fsp_str_dbg(fsp)));
2918
2919                 while (nread < smb_maxcnt) {
2920                         /*
2921                          * We asked for the real file size and told sendfile
2922                          * to not go beyond the end of the file. But it can
2923                          * happen that in between our fstat call and the
2924                          * sendfile call the file was truncated. This is very
2925                          * bad because we have already announced the larger
2926                          * number of bytes to the client.
2927                          *
2928                          * The best we can do now is to send 0-bytes, just as
2929                          * a read from a hole in a sparse file would do.
2930                          *
2931                          * This should happen rarely enough that I don't care
2932                          * about efficiency here :-)
2933                          */
2934                         size_t to_write;
2935
2936                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2937                         if (write_data(fsp->conn->sconn->sock, buf, to_write)
2938                             != to_write) {
2939                                 char addr[INET6_ADDRSTRLEN];
2940                                 /*
2941                                  * Try and give an error message saying what
2942                                  * client failed.
2943                                  */
2944                                 DEBUG(0, ("write_data failed for client %s. "
2945                                           "Error %s\n",
2946                                           get_peer_addr(
2947                                                   fsp->conn->sconn->sock, addr,
2948                                                   sizeof(addr)),
2949                                           strerror(errno)));
2950                                 exit_server_cleanly("sendfile_short_send: "
2951                                                     "write_data failed");
2952                         }
2953                         nread += to_write;
2954                 }
2955                 SAFE_FREE(buf);
2956         }
2957 }
2958
2959 /****************************************************************************
2960  Return a readbraw error (4 bytes of zero).
2961 ****************************************************************************/
2962
2963 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2964 {
2965         char header[4];
2966
2967         SIVAL(header,0,0);
2968
2969         smbd_lock_socket(sconn);
2970         if (write_data(sconn->sock,header,4) != 4) {
2971                 char addr[INET6_ADDRSTRLEN];
2972                 /*
2973                  * Try and give an error message saying what
2974                  * client failed.
2975                  */
2976                 DEBUG(0, ("write_data failed for client %s. "
2977                           "Error %s\n",
2978                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2979                           strerror(errno)));
2980
2981                 fail_readraw();
2982         }
2983         smbd_unlock_socket(sconn);
2984 }
2985
2986 /****************************************************************************
2987  Use sendfile in readbraw.
2988 ****************************************************************************/
2989
2990 static void send_file_readbraw(connection_struct *conn,
2991                                struct smb_request *req,
2992                                files_struct *fsp,
2993                                SMB_OFF_T startpos,
2994                                size_t nread,
2995                                ssize_t mincount)
2996 {
2997         struct smbd_server_connection *sconn = req->sconn;
2998         char *outbuf = NULL;
2999         ssize_t ret=0;
3000
3001         /*
3002          * We can only use sendfile on a non-chained packet
3003          * but we can use on a non-oplocked file. tridge proved this
3004          * on a train in Germany :-). JRA.
3005          * reply_readbraw has already checked the length.
3006          */
3007
3008         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3009             (fsp->wcp == NULL) &&
3010             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3011                 ssize_t sendfile_read = -1;
3012                 char header[4];
3013                 DATA_BLOB header_blob;
3014
3015                 _smb_setlen(header,nread);
3016                 header_blob = data_blob_const(header, 4);
3017
3018                 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3019                                                  &header_blob, startpos,
3020                                                  nread);
3021                 if (sendfile_read == -1) {
3022                         /* Returning ENOSYS means no data at all was sent.
3023                          * Do this as a normal read. */
3024                         if (errno == ENOSYS) {
3025                                 goto normal_readbraw;
3026                         }
3027
3028                         /*
3029                          * Special hack for broken Linux with no working sendfile. If we
3030                          * return EINTR we sent the header but not the rest of the data.
3031                          * Fake this up by doing read/write calls.
3032                          */
3033                         if (errno == EINTR) {
3034                                 /* Ensure we don't do this again. */
3035                                 set_use_sendfile(SNUM(conn), False);
3036                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3037
3038                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
3039                                         DEBUG(0,("send_file_readbraw: "
3040                                                  "fake_sendfile failed for "
3041                                                  "file %s (%s).\n",
3042                                                  fsp_str_dbg(fsp),
3043                                                  strerror(errno)));
3044                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3045                                 }
3046                                 return;
3047                         }
3048
3049                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3050                                  "file %s (%s). Terminating\n",
3051                                  fsp_str_dbg(fsp), strerror(errno)));
3052                         exit_server_cleanly("send_file_readbraw sendfile failed");
3053                 } else if (sendfile_read == 0) {
3054                         /*
3055                          * Some sendfile implementations return 0 to indicate
3056                          * that there was a short read, but nothing was
3057                          * actually written to the socket.  In this case,
3058                          * fallback to the normal read path so the header gets
3059                          * the correct byte count.
3060                          */
3061                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3062                                   "bytes falling back to the normal read: "
3063                                   "%s\n", fsp_str_dbg(fsp)));
3064                         goto normal_readbraw;
3065                 }
3066
3067                 /* Deal with possible short send. */
3068                 if (sendfile_read != 4+nread) {
3069                         sendfile_short_send(fsp, sendfile_read, 4, nread);
3070                 }
3071                 return;
3072         }
3073
3074 normal_readbraw:
3075
3076         outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3077         if (!outbuf) {
3078                 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3079                         (unsigned)(nread+4)));
3080                 reply_readbraw_error(sconn);
3081                 return;
3082         }
3083
3084         if (nread > 0) {
3085                 ret = read_file(fsp,outbuf+4,startpos,nread);
3086 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3087                 if (ret < mincount)
3088                         ret = 0;
3089 #else
3090                 if (ret < nread)
3091                         ret = 0;
3092 #endif
3093         }
3094
3095         _smb_setlen(outbuf,ret);
3096         if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3097                 char addr[INET6_ADDRSTRLEN];
3098                 /*
3099                  * Try and give an error message saying what
3100                  * client failed.
3101                  */
3102                 DEBUG(0, ("write_data failed for client %s. "
3103                           "Error %s\n",
3104                           get_peer_addr(fsp->conn->sconn->sock, addr,
3105                                         sizeof(addr)),
3106                           strerror(errno)));
3107
3108                 fail_readraw();
3109         }
3110
3111         TALLOC_FREE(outbuf);
3112 }
3113
3114 /****************************************************************************
3115  Reply to a readbraw (core+ protocol).
3116 ****************************************************************************/
3117
3118 void reply_readbraw(struct smb_request *req)
3119 {
3120         connection_struct *conn = req->conn;
3121         struct smbd_server_connection *sconn = req->sconn;
3122         ssize_t maxcount,mincount;
3123         size_t nread = 0;
3124         SMB_OFF_T startpos;
3125         files_struct *fsp;
3126         struct lock_struct lock;
3127         SMB_OFF_T size = 0;
3128
3129         START_PROFILE(SMBreadbraw);
3130
3131         if (srv_is_signing_active(sconn) ||
3132             is_encrypted_packet(req->inbuf)) {
3133                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3134                         "raw reads/writes are disallowed.");
3135         }
3136
3137         if (req->wct < 8) {
3138                 reply_readbraw_error(sconn);
3139                 END_PROFILE(SMBreadbraw);
3140                 return;
3141         }
3142
3143         if (sconn->smb1.echo_handler.trusted_fde) {
3144                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3145                          "'async smb echo handler = yes'\n"));
3146                 reply_readbraw_error(sconn);
3147                 END_PROFILE(SMBreadbraw);
3148                 return;
3149         }
3150
3151         /*
3152          * Special check if an oplock break has been issued
3153          * and the readraw request croses on the wire, we must
3154          * return a zero length response here.
3155          */
3156
3157         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3158
3159         /*
3160          * We have to do a check_fsp by hand here, as
3161          * we must always return 4 zero bytes on error,
3162          * not a NTSTATUS.
3163          */
3164
3165         if (!fsp || !conn || conn != fsp->conn ||
3166                         req->vuid != fsp->vuid ||
3167                         fsp->is_directory || fsp->fh->fd == -1) {
3168                 /*
3169                  * fsp could be NULL here so use the value from the packet. JRA.
3170                  */
3171                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3172                         "- cache prime?\n",
3173                         (int)SVAL(req->vwv+0, 0)));
3174                 reply_readbraw_error(sconn);
3175                 END_PROFILE(SMBreadbraw);
3176                 return;
3177         }
3178
3179         /* Do a "by hand" version of CHECK_READ. */
3180         if (!(fsp->can_read ||
3181                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3182                                 (fsp->access_mask & FILE_EXECUTE)))) {
3183                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3184                                 (int)SVAL(req->vwv+0, 0)));
3185                 reply_readbraw_error(sconn);
3186                 END_PROFILE(SMBreadbraw);
3187                 return;
3188         }
3189
3190         flush_write_cache(fsp, READRAW_FLUSH);
3191
3192         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3193         if(req->wct == 10) {
3194                 /*
3195                  * This is a large offset (64 bit) read.
3196                  */
3197 #ifdef LARGE_SMB_OFF_T
3198
3199                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3200
3201 #else /* !LARGE_SMB_OFF_T */
3202
3203                 /*
3204                  * Ensure we haven't been sent a >32 bit offset.
3205                  */
3206
3207                 if(IVAL(req->vwv+8, 0) != 0) {
3208                         DEBUG(0,("reply_readbraw: large offset "
3209                                 "(%x << 32) used and we don't support "
3210                                 "64 bit offsets.\n",
3211                         (unsigned int)IVAL(req->vwv+8, 0) ));
3212                         reply_readbraw_error();
3213                         END_PROFILE(SMBreadbraw);
3214                         return;
3215                 }
3216
3217 #endif /* LARGE_SMB_OFF_T */
3218
3219                 if(startpos < 0) {
3220                         DEBUG(0,("reply_readbraw: negative 64 bit "
3221                                 "readraw offset (%.0f) !\n",
3222                                 (double)startpos ));
3223                         reply_readbraw_error(sconn);
3224                         END_PROFILE(SMBreadbraw);
3225                         return;
3226                 }
3227         }
3228
3229         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3230         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3231
3232         /* ensure we don't overrun the packet size */
3233         maxcount = MIN(65535,maxcount);
3234
3235         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3236             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3237             &lock);
3238
3239         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3240                 reply_readbraw_error(sconn);
3241                 END_PROFILE(SMBreadbraw);
3242                 return;
3243         }
3244
3245         if (fsp_stat(fsp) == 0) {
3246                 size = fsp->fsp_name->st.st_ex_size;
3247         }
3248
3249         if (startpos >= size) {
3250                 nread = 0;
3251         } else {
3252                 nread = MIN(maxcount,(size - startpos));
3253         }
3254
3255 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3256         if (nread < mincount)
3257                 nread = 0;
3258 #endif
3259
3260         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3261                 "min=%lu nread=%lu\n",
3262                 fsp->fnum, (double)startpos,
3263                 (unsigned long)maxcount,
3264                 (unsigned long)mincount,
3265                 (unsigned long)nread ) );
3266
3267         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3268
3269         DEBUG(5,("reply_readbraw finished\n"));
3270
3271         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3272
3273         END_PROFILE(SMBreadbraw);
3274         return;
3275 }
3276
3277 #undef DBGC_CLASS
3278 #define DBGC_CLASS DBGC_LOCKING
3279
3280 /****************************************************************************
3281  Reply to a lockread (core+ protocol).
3282 ****************************************************************************/
3283
3284 void reply_lockread(struct smb_request *req)
3285 {
3286         connection_struct *conn = req->conn;
3287         ssize_t nread = -1;
3288         char *data;
3289         SMB_OFF_T startpos;
3290         size_t numtoread;
3291         NTSTATUS status;
3292         files_struct *fsp;
3293         struct byte_range_lock *br_lck = NULL;
3294         char *p = NULL;
3295         struct smbd_server_connection *sconn = req->sconn;
3296
3297         START_PROFILE(SMBlockread);
3298
3299         if (req->wct < 5) {
3300                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3301                 END_PROFILE(SMBlockread);
3302                 return;
3303         }
3304
3305         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3306
3307         if (!check_fsp(conn, req, fsp)) {
3308                 END_PROFILE(SMBlockread);
3309                 return;
3310         }
3311
3312         if (!CHECK_READ(fsp,req)) {
3313                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3314                 END_PROFILE(SMBlockread);
3315                 return;
3316         }
3317
3318         numtoread = SVAL(req->vwv+1, 0);
3319         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3320
3321         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3322
3323         reply_outbuf(req, 5, numtoread + 3);
3324
3325         data = smb_buf(req->outbuf) + 3;
3326
3327         /*
3328          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3329          * protocol request that predates the read/write lock concept.
3330          * Thus instead of asking for a read lock here we need to ask
3331          * for a write lock. JRA.
3332          * Note that the requested lock size is unaffected by max_recv.
3333          */
3334
3335         br_lck = do_lock(req->sconn->msg_ctx,
3336                         fsp,
3337                         (uint64_t)req->smbpid,
3338                         (uint64_t)numtoread,
3339                         (uint64_t)startpos,
3340                         WRITE_LOCK,
3341                         WINDOWS_LOCK,
3342                         False, /* Non-blocking lock. */
3343                         &status,
3344                         NULL,
3345                         NULL);
3346         TALLOC_FREE(br_lck);
3347
3348         if (NT_STATUS_V(status)) {
3349                 reply_nterror(req, status);
3350                 END_PROFILE(SMBlockread);
3351                 return;
3352         }
3353
3354         /*
3355          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3356          */
3357
3358         if (numtoread > sconn->smb1.negprot.max_recv) {
3359                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3360 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3361                         (unsigned int)numtoread,
3362                         (unsigned int)sconn->smb1.negprot.max_recv));
3363                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3364         }
3365         nread = read_file(fsp,data,startpos,numtoread);
3366
3367         if (nread < 0) {
3368                 reply_nterror(req, map_nt_error_from_unix(errno));
3369                 END_PROFILE(SMBlockread);
3370                 return;
3371         }
3372
3373         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3374
3375         SSVAL(req->outbuf,smb_vwv0,nread);
3376         SSVAL(req->outbuf,smb_vwv5,nread+3);
3377         p = smb_buf(req->outbuf);
3378         SCVAL(p,0,0); /* pad byte. */
3379         SSVAL(p,1,nread);
3380
3381         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3382                  fsp->fnum, (int)numtoread, (int)nread));
3383
3384         END_PROFILE(SMBlockread);
3385         return;
3386 }
3387
3388 #undef DBGC_CLASS
3389 #define DBGC_CLASS DBGC_ALL
3390
3391 /****************************************************************************
3392  Reply to a read.
3393 ****************************************************************************/
3394
3395 void reply_read(struct smb_request *req)
3396 {
3397         connection_struct *conn = req->conn;
3398         size_t numtoread;
3399         ssize_t nread = 0;
3400         char *data;
3401         SMB_OFF_T startpos;
3402         int outsize = 0;
3403         files_struct *fsp;
3404         struct lock_struct lock;
3405         struct smbd_server_connection *sconn = req->sconn;
3406
3407         START_PROFILE(SMBread);
3408
3409         if (req->wct < 3) {
3410                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3411                 END_PROFILE(SMBread);
3412                 return;
3413         }
3414
3415         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3416
3417         if (!check_fsp(conn, req, fsp)) {
3418                 END_PROFILE(SMBread);
3419                 return;
3420         }
3421
3422         if (!CHECK_READ(fsp,req)) {
3423                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3424                 END_PROFILE(SMBread);
3425                 return;
3426         }
3427
3428         numtoread = SVAL(req->vwv+1, 0);
3429         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3430
3431         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3432
3433         /*
3434          * The requested read size cannot be greater than max_recv. JRA.
3435          */
3436         if (numtoread > sconn->smb1.negprot.max_recv) {
3437                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3438 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3439                         (unsigned int)numtoread,
3440                         (unsigned int)sconn->smb1.negprot.max_recv));
3441                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3442         }
3443
3444         reply_outbuf(req, 5, numtoread+3);
3445
3446         data = smb_buf(req->outbuf) + 3;
3447
3448         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3449             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3450             &lock);
3451
3452         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3453                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3454                 END_PROFILE(SMBread);
3455                 return;
3456         }
3457
3458         if (numtoread > 0)
3459                 nread = read_file(fsp,data,startpos,numtoread);
3460
3461         if (nread < 0) {
3462                 reply_nterror(req, map_nt_error_from_unix(errno));
3463                 goto strict_unlock;
3464         }
3465
3466         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3467
3468         SSVAL(req->outbuf,smb_vwv0,nread);
3469         SSVAL(req->outbuf,smb_vwv5,nread+3);
3470         SCVAL(smb_buf(req->outbuf),0,1);
3471         SSVAL(smb_buf(req->outbuf),1,nread);
3472
3473         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3474                 fsp->fnum, (int)numtoread, (int)nread ) );
3475
3476 strict_unlock:
3477         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3478
3479         END_PROFILE(SMBread);
3480         return;
3481 }
3482
3483 /****************************************************************************
3484  Setup readX header.
3485 ****************************************************************************/
3486
3487 static int setup_readX_header(struct smb_request *req, char *outbuf,
3488                               size_t smb_maxcnt)
3489 {
3490         int outsize;
3491         char *data;
3492
3493         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3494         data = smb_buf(outbuf);
3495
3496         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3497
3498         SCVAL(outbuf,smb_vwv0,0xFF);
3499         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3500         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3501         SSVAL(outbuf,smb_vwv6,
3502               req_wct_ofs(req)
3503               + 1               /* the wct field */
3504               + 12 * sizeof(uint16_t) /* vwv */
3505               + 2);             /* the buflen field */
3506         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3507         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3508         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3509         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3510         return outsize;
3511 }
3512
3513 /****************************************************************************
3514  Reply to a read and X - possibly using sendfile.
3515 ****************************************************************************/
3516
3517 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3518                             files_struct *fsp, SMB_OFF_T startpos,
3519                             size_t smb_maxcnt)
3520 {
3521         ssize_t nread = -1;
3522         struct lock_struct lock;
3523         int saved_errno = 0;
3524
3525         if(fsp_stat(fsp) == -1) {
3526                 reply_nterror(req, map_nt_error_from_unix(errno));
3527                 return;
3528         }
3529
3530         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3531             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3532             &lock);
3533
3534         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3535                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3536                 return;
3537         }
3538
3539         if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3540                         (startpos > fsp->fsp_name->st.st_ex_size)
3541                         || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3542                 /*
3543                  * We already know that we would do a short read, so don't
3544                  * try the sendfile() path.
3545                  */
3546                 goto nosendfile_read;
3547         }
3548
3549         /*
3550          * We can only use sendfile on a non-chained packet
3551          * but we can use on a non-oplocked file. tridge proved this
3552          * on a train in Germany :-). JRA.
3553          */
3554
3555         if (!req_is_in_chain(req) &&
3556             !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3557             (fsp->wcp == NULL) &&
3558             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3559                 uint8 headerbuf[smb_size + 12 * 2];
3560                 DATA_BLOB header;
3561
3562                 /*
3563                  * Set up the packet header before send. We
3564                  * assume here the sendfile will work (get the
3565                  * correct amount of data).
3566                  */
3567
3568                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3569
3570                 construct_reply_common_req(req, (char *)headerbuf);
3571                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3572
3573                 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3574                                          startpos, smb_maxcnt);
3575                 if (nread == -1) {
3576                         /* Returning ENOSYS means no data at all was sent.
3577                            Do this as a normal read. */
3578                         if (errno == ENOSYS) {
3579                                 goto normal_read;
3580                         }
3581
3582                         /*
3583                          * Special hack for broken Linux with no working sendfile. If we
3584                          * return EINTR we sent the header but not the rest of the data.
3585                          * Fake this up by doing read/write calls.
3586                          */
3587
3588                         if (errno == EINTR) {
3589                                 /* Ensure we don't do this again. */
3590                                 set_use_sendfile(SNUM(conn), False);
3591                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3592                                 nread = fake_sendfile(fsp, startpos,
3593                                                       smb_maxcnt);
3594                                 if (nread == -1) {
3595                                         DEBUG(0,("send_file_readX: "
3596                                                  "fake_sendfile failed for "
3597                                                  "file %s (%s).\n",
3598                                                  fsp_str_dbg(fsp),
3599                                                  strerror(errno)));
3600                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3601                                 }
3602                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3603                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3604                                 /* No outbuf here means successful sendfile. */
3605                                 goto strict_unlock;
3606                         }
3607
3608                         DEBUG(0,("send_file_readX: sendfile failed for file "
3609                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3610                                  strerror(errno)));
3611                         exit_server_cleanly("send_file_readX sendfile failed");
3612                 } else if (nread == 0) {
3613                         /*
3614                          * Some sendfile implementations return 0 to indicate
3615                          * that there was a short read, but nothing was
3616                          * actually written to the socket.  In this case,
3617                          * fallback to the normal read path so the header gets
3618                          * the correct byte count.
3619                          */
3620                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3621                                   "falling back to the normal read: %s\n",
3622                                   fsp_str_dbg(fsp)));
3623                         goto normal_read;
3624                 }
3625
3626                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3627                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3628
3629                 /* Deal with possible short send. */
3630                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3631                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3632                 }
3633                 /* No outbuf here means successful sendfile. */
3634                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3635                 SMB_PERFCOUNT_END(&req->pcd);
3636                 goto strict_unlock;
3637         }
3638
3639 normal_read:
3640
3641         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3642                 uint8 headerbuf[smb_size + 2*12];
3643
3644                 construct_reply_common_req(req, (char *)headerbuf);
3645                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3646
3647                 /* Send out the header. */
3648                 if (write_data(req->sconn->sock, (char *)headerbuf,
3649                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3650
3651                         char addr[INET6_ADDRSTRLEN];
3652                         /*
3653                          * Try and give an error message saying what
3654                          * client failed.
3655                          */
3656                         DEBUG(0, ("write_data failed for client %s. "
3657                                   "Error %s\n",
3658                                   get_peer_addr(req->sconn->sock, addr,
3659                                                 sizeof(addr)),
3660                                   strerror(errno)));
3661
3662                         DEBUG(0,("send_file_readX: write_data failed for file "
3663                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3664                                  strerror(errno)));
3665                         exit_server_cleanly("send_file_readX sendfile failed");
3666                 }
3667                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3668                 if (nread == -1) {
3669                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3670                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3671                                  strerror(errno)));
3672                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3673                 }
3674                 goto strict_unlock;
3675         }
3676
3677 nosendfile_read:
3678
3679         reply_outbuf(req, 12, smb_maxcnt);
3680
3681         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3682         saved_errno = errno;
3683
3684         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3685
3686         if (nread < 0) {
3687                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3688                 return;
3689         }
3690
3691         setup_readX_header(req, (char *)req->outbuf, nread);
3692
3693         DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3694                     fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3695
3696         chain_reply(req);
3697         return;
3698
3699  strict_unlock:
3700         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3701         TALLOC_FREE(req->outbuf);
3702         return;
3703 }
3704
3705 /****************************************************************************
3706  Reply to a read and X.
3707 ****************************************************************************/
3708
3709 void reply_read_and_X(struct smb_request *req)
3710 {
3711         connection_struct *conn = req->conn;
3712         files_struct *fsp;
3713         SMB_OFF_T startpos;
3714         size_t smb_maxcnt;
3715         bool big_readX = False;
3716 #if 0
3717         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3718 #endif
3719
3720         START_PROFILE(SMBreadX);
3721
3722         if ((req->wct != 10) && (req->wct != 12)) {
3723                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3724                 return;
3725         }
3726
3727         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3728         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3729         smb_maxcnt = SVAL(req->vwv+5, 0);
3730
3731         /* If it's an IPC, pass off the pipe handler. */
3732         if (IS_IPC(conn)) {
3733                 reply_pipe_read_and_X(req);
3734                 END_PROFILE(SMBreadX);
3735                 return;
3736         }
3737
3738         if (!check_fsp(conn, req, fsp)) {
3739                 END_PROFILE(SMBreadX);
3740                 return;
3741         }
3742
3743         if (!CHECK_READ(fsp,req)) {
3744                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3745                 END_PROFILE(SMBreadX);
3746                 return;
3747         }
3748
3749         if (global_client_caps & CAP_LARGE_READX) {
3750                 size_t upper_size = SVAL(req->vwv+7, 0);
3751                 smb_maxcnt |= (upper_size<<16);
3752                 if (upper_size > 1) {
3753                         /* Can't do this on a chained packet. */
3754                         if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3755                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3756                                 END_PROFILE(SMBreadX);
3757                                 return;
3758                         }
3759                         /* We currently don't do this on signed or sealed data. */
3760                         if (srv_is_signing_active(req->sconn) ||
3761                             is_encrypted_packet(req->inbuf)) {
3762                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3763                                 END_PROFILE(SMBreadX);
3764                                 return;
3765                         }
3766                         /* Is there room in the reply for this data ? */
3767                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3768                                 reply_nterror(req,
3769                                               NT_STATUS_INVALID_PARAMETER);
3770                                 END_PROFILE(SMBreadX);
3771                                 return;
3772                         }
3773                         big_readX = True;
3774                 }
3775         }
3776
3777         if (req->wct == 12) {
3778 #ifdef LARGE_SMB_OFF_T
3779                 /*
3780                  * This is a large offset (64 bit) read.
3781                  */
3782                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3783
3784 #else /* !LARGE_SMB_OFF_T */
3785
3786                 /*
3787                  * Ensure we haven't been sent a >32 bit offset.
3788                  */
3789
3790                 if(IVAL(req->vwv+10, 0) != 0) {
3791                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3792                                  "used and we don't support 64 bit offsets.\n",
3793                                  (unsigned int)IVAL(req->vwv+10, 0) ));
3794                         END_PROFILE(SMBreadX);
3795                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3796                         return;
3797                 }
3798
3799 #endif /* LARGE_SMB_OFF_T */
3800
3801         }
3802
3803         if (!big_readX) {
3804                 NTSTATUS status = schedule_aio_read_and_X(conn,
3805                                         req,
3806                                         fsp,
3807                                         startpos,
3808                                         smb_maxcnt);
3809                 if (NT_STATUS_IS_OK(status)) {
3810                         /* Read scheduled - we're done. */
3811                         goto out;
3812                 }
3813                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3814                         /* Real error - report to client. */
3815                         END_PROFILE(SMBreadX);
3816                         reply_nterror(req, status);
3817                         return;
3818                 }
3819                 /* NT_STATUS_RETRY - fall back to sync read. */
3820         }
3821
3822         smbd_lock_socket(req->sconn);
3823         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3824         smbd_unlock_socket(req->sconn);
3825
3826  out:
3827         END_PROFILE(SMBreadX);
3828         return;
3829 }
3830
3831 /****************************************************************************
3832  Error replies to writebraw must have smb_wct == 1. Fix this up.
3833 ****************************************************************************/
3834
3835 void error_to_writebrawerr(struct smb_request *req)
3836 {
3837         uint8 *old_outbuf = req->outbuf;
3838
3839         reply_outbuf(req, 1, 0);
3840
3841         memcpy(req->outbuf, old_outbuf, smb_size);
3842         TALLOC_FREE(old_outbuf);
3843 }
3844
3845 /****************************************************************************
3846  Read 4 bytes of a smb packet and return the smb length of the packet.
3847  Store the result in the buffer. This version of the function will
3848  never return a session keepalive (length of zero).
3849  Timeout is in milliseconds.
3850 ****************************************************************************/
3851
3852 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3853                                 size_t *len)
3854 {
3855         uint8_t msgtype = SMBkeepalive;
3856
3857         while (msgtype == SMBkeepalive) {
3858                 NTSTATUS status;
3859
3860                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3861                                                           len);
3862                 if (!NT_STATUS_IS_OK(status)) {
3863                         char addr[INET6_ADDRSTRLEN];
3864                         /* Try and give an error message
3865                          * saying what client failed. */
3866                         DEBUG(0, ("read_fd_with_timeout failed for "
3867                                   "client %s read error = %s.\n",
3868                                   get_peer_addr(fd,addr,sizeof(addr)),
3869                                   nt_errstr(status)));
3870                         return status;
3871                 }
3872
3873                 msgtype = CVAL(inbuf, 0);
3874         }
3875
3876         DEBUG(10,("read_smb_length: got smb length of %lu\n",
3877                   (unsigned long)len));
3878
3879         return NT_STATUS_OK;
3880 }
3881
3882 /****************************************************************************
3883  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3884 ****************************************************************************/
3885
3886 void reply_writebraw(struct smb_request *req)
3887 {
3888         connection_struct *conn = req->conn;
3889         char *buf = NULL;
3890         ssize_t nwritten=0;
3891         ssize_t total_written=0;
3892         size_t numtowrite=0;
3893         size_t tcount;
3894         SMB_OFF_T startpos;
3895         char *data=NULL;
3896         bool write_through;
3897         files_struct *fsp;
3898         struct lock_struct lock;
3899         NTSTATUS status;
3900
3901         START_PROFILE(SMBwritebraw);
3902
3903         /*
3904          * If we ever reply with an error, it must have the SMB command
3905          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3906          * we're finished.
3907          */
3908         SCVAL(req->inbuf,smb_com,SMBwritec);
3909
3910         if (srv_is_signing_active(req->sconn)) {
3911                 END_PROFILE(SMBwritebraw);
3912                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3913                                 "raw reads/writes are disallowed.");
3914         }
3915
3916         if (req->wct < 12) {
3917                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3918                 error_to_writebrawerr(req);
3919                 END_PROFILE(SMBwritebraw);
3920                 return;
3921         }
3922
3923         if (req->sconn->smb1.echo_handler.trusted_fde) {
3924                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3925                          "'async smb echo handler = yes'\n"));
3926                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3927                 error_to_writebrawerr(req);
3928                 END_PROFILE(SMBwritebraw);
3929                 return;
3930         }
3931
3932         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3933         if (!check_fsp(conn, req, fsp)) {
3934                 error_to_writebrawerr(req);
3935                 END_PROFILE(SMBwritebraw);
3936                 return;
3937         }
3938
3939         if (!CHECK_WRITE(fsp)) {
3940                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3941                 error_to_writebrawerr(req);
3942                 END_PROFILE(SMBwritebraw);
3943                 return;
3944         }
3945
3946         tcount = IVAL(req->vwv+1, 0);
3947         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3948         write_through = BITSETW(req->vwv+7,0);
3949
3950         /* We have to deal with slightly different formats depending
3951                 on whether we are using the core+ or lanman1.0 protocol */
3952
3953         if(get_Protocol() <= PROTOCOL_COREPLUS) {
3954                 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3955                 data = smb_buf(req->inbuf);
3956         } else {
3957                 numtowrite = SVAL(req->vwv+10, 0);
3958                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3959         }
3960
3961         /* Ensure we don't write bytes past the end of this packet. */
3962         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3963                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3964                 error_to_writebrawerr(req);
3965                 END_PROFILE(SMBwritebraw);
3966                 return;
3967         }
3968
3969         if (!fsp->print_file) {
3970                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3971                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3972                     &lock);
3973
3974                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3975                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3976                         error_to_writebrawerr(req);
3977                         END_PROFILE(SMBwritebraw);
3978                         return;
3979                 }
3980         }
3981
3982         if (numtowrite>0) {
3983                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3984         }
3985
3986         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3987                         "wrote=%d sync=%d\n",
3988                 fsp->fnum, (double)startpos, (int)numtowrite,
3989                 (int)nwritten, (int)write_through));
3990
3991         if (nwritten < (ssize_t)numtowrite)  {
3992                 reply_nterror(req, NT_STATUS_DISK_FULL);
3993                 error_to_writebrawerr(req);
3994                 goto strict_unlock;
3995         }
3996
3997         total_written = nwritten;
3998
3999         /* Allocate a buffer of 64k + length. */
4000         buf = TALLOC_ARRAY(NULL, char, 65540);
4001         if (!buf) {
4002                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4003                 error_to_writebrawerr(req);
4004                 goto strict_unlock;
4005         }
4006
4007         /* Return a SMBwritebraw message to the redirector to tell
4008          * it to send more bytes */
4009
4010         memcpy(buf, req->inbuf, smb_size);
4011         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4012         SCVAL(buf,smb_com,SMBwritebraw);
4013         SSVALS(buf,smb_vwv0,0xFFFF);
4014         show_msg(buf);
4015         if (!srv_send_smb(req->sconn,
4016                           buf,
4017                           false, 0, /* no signing */
4018                           IS_CONN_ENCRYPTED(conn),
4019                           &req->pcd)) {
4020                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4021                         "failed.");
4022         }
4023
4024         /* Now read the raw data into the buffer and write it */
4025         status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4026                                  &numtowrite);
4027         if (!NT_STATUS_IS_OK(status)) {
4028                 exit_server_cleanly("secondary writebraw failed");
4029         }
4030
4031         /* Set up outbuf to return the correct size */
4032         reply_outbuf(req, 1, 0);
4033
4034         if (numtowrite != 0) {
4035
4036                 if (numtowrite > 0xFFFF) {
4037                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4038                                 "raw requested (%u). Terminating\n",
4039                                 (unsigned int)numtowrite ));
4040                         exit_server_cleanly("secondary writebraw failed");
4041                 }
4042
4043                 if (tcount > nwritten+numtowrite) {
4044                         DEBUG(3,("reply_writebraw: Client overestimated the "
4045                                 "write %d %d %d\n",
4046                                 (int)tcount,(int)nwritten,(int)numtowrite));
4047                 }
4048
4049                 status = read_data(req->sconn->sock, buf+4, numtowrite);
4050
4051                 if (!NT_STATUS_IS_OK(status)) {
4052                         char addr[INET6_ADDRSTRLEN];
4053                         /* Try and give an error message
4054                          * saying what client failed. */
4055                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4056                                   "raw read failed (%s) for client %s. "
4057                                   "Terminating\n", nt_errstr(status),
4058                                   get_peer_addr(req->sconn->sock, addr,
4059                                                 sizeof(addr))));
4060                         exit_server_cleanly("secondary writebraw failed");
4061                 }
4062
4063                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4064                 if (nwritten == -1) {
4065                         TALLOC_FREE(buf);
4066                         reply_nterror(req, map_nt_error_from_unix(errno));
4067                         error_to_writebrawerr(req);
4068                         goto strict_unlock;
4069                 }
4070
4071                 if (nwritten < (ssize_t)numtowrite) {
4072                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4073                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4074                 }
4075
4076                 if (nwritten > 0) {
4077                         total_written += nwritten;
4078                 }
4079         }
4080
4081         TALLOC_FREE(buf);
4082         SSVAL(req->outbuf,smb_vwv0,total_written);
4083
4084         status = sync_file(conn, fsp, write_through);
4085         if (!NT_STATUS_IS_OK(status)) {
4086                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4087                          fsp_str_dbg(fsp), nt_errstr(status)));
4088                 reply_nterror(req, status);
4089                 error_to_writebrawerr(req);
4090                 goto strict_unlock;
4091         }
4092
4093         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4094                 "wrote=%d\n",
4095                 fsp->fnum, (double)startpos, (int)numtowrite,
4096                 (int)total_written));
4097
4098         if (!fsp->print_file) {
4099                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4100         }
4101
4102         /* We won't return a status if write through is not selected - this
4103          * follows what WfWg does */
4104         END_PROFILE(SMBwritebraw);
4105
4106         if (!write_through && total_written==tcount) {
4107
4108 #if RABBIT_PELLET_FIX
4109                 /*
4110                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4111                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
4112                  * JRA.
4113                  */
4114                 if (!send_keepalive(req->sconn->sock)) {
4115                         exit_server_cleanly("reply_writebraw: send of "
4116                                 "keepalive failed");
4117                 }
4118 #endif
4119                 TALLOC_FREE(req->outbuf);
4120         }
4121         return;
4122
4123 strict_unlock:
4124         if (!fsp->print_file) {
4125                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4126         }
4127
4128         END_PROFILE(SMBwritebraw);
4129         return;
4130 }
4131
4132 #undef DBGC_CLASS
4133 #define DBGC_CLASS DBGC_LOCKING
4134
4135 /****************************************************************************
4136  Reply to a writeunlock (core+).
4137 ****************************************************************************/
4138
4139 void reply_writeunlock(struct smb_request *req)
4140 {
4141         connection_struct *conn = req->conn;
4142         ssize_t nwritten = -1;
4143         size_t numtowrite;
4144         SMB_OFF_T startpos;
4145         const char *data;
4146         NTSTATUS status = NT_STATUS_OK;
4147         files_struct *fsp;
4148         struct lock_struct lock;
4149         int saved_errno = 0;
4150
4151         START_PROFILE(SMBwriteunlock);
4152
4153         if (req->wct < 5) {
4154                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4155                 END_PROFILE(SMBwriteunlock);
4156                 return;
4157         }
4158
4159         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4160
4161         if (!check_fsp(conn, req, fsp)) {
4162                 END_PROFILE(SMBwriteunlock);
4163                 return;
4164         }
4165
4166         if (!CHECK_WRITE(fsp)) {
4167                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4168                 END_PROFILE(SMBwriteunlock);
4169                 return;
4170         }
4171
4172         numtowrite = SVAL(req->vwv+1, 0);
4173         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4174         data = (const char *)req->buf + 3;
4175
4176         if (!fsp->print_file && numtowrite > 0) {
4177                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4178                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4179                     &lock);
4180
4181                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4182                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4183                         END_PROFILE(SMBwriteunlock);
4184                         return;
4185                 }
4186         }
4187
4188         /* The special X/Open SMB protocol handling of
4189            zero length writes is *NOT* done for
4190            this call */
4191         if(numtowrite == 0) {
4192                 nwritten = 0;
4193         } else {
4194                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4195                 saved_errno = errno;
4196         }
4197
4198         status = sync_file(conn, fsp, False /* write through */);
4199         if (!NT_STATUS_IS_OK(status)) {
4200                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4201                          fsp_str_dbg(fsp), nt_errstr(status)));
4202                 reply_nterror(req, status);
4203                 goto strict_unlock;
4204         }
4205
4206         if(nwritten < 0) {
4207                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4208                 goto strict_unlock;
4209         }
4210
4211         if((nwritten < numtowrite) && (numtowrite != 0)) {
4212                 reply_nterror(req, NT_STATUS_DISK_FULL);
4213                 goto strict_unlock;
4214         }
4215
4216         if (numtowrite && !fsp->print_file) {
4217                 status = do_unlock(req->sconn->msg_ctx,
4218                                 fsp,
4219                                 (uint64_t)req->smbpid,
4220                                 (uint64_t)numtowrite,
4221                                 (uint64_t)startpos,
4222                                 WINDOWS_LOCK);
4223
4224                 if (NT_STATUS_V(status)) {
4225                         reply_nterror(req, status);
4226                         goto strict_unlock;
4227                 }
4228         }
4229
4230         reply_outbuf(req, 1, 0);
4231
4232         SSVAL(req->outbuf,smb_vwv0,nwritten);
4233
4234         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4235                  fsp->fnum, (int)numtowrite, (int)nwritten));
4236
4237 strict_unlock:
4238         if (numtowrite && !fsp->print_file) {
4239                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4240         }
4241
4242         END_PROFILE(SMBwriteunlock);
4243         return;
4244 }
4245
4246 #undef DBGC_CLASS
4247 #define DBGC_CLASS DBGC_ALL
4248
4249 /****************************************************************************
4250  Reply to a write.
4251 ****************************************************************************/
4252
4253 void reply_write(struct smb_request *req)
4254 {
4255         connection_struct *conn = req->conn;
4256         size_t numtowrite;
4257         ssize_t nwritten = -1;
4258         SMB_OFF_T startpos;
4259         const char *data;
4260         files_struct *fsp;
4261         struct lock_struct lock;
4262         NTSTATUS status;
4263         int saved_errno = 0;
4264
4265         START_PROFILE(SMBwrite);
4266
4267         if (req->wct < 5) {
4268                 END_PROFILE(SMBwrite);
4269                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4270                 return;
4271         }
4272
4273         /* If it's an IPC, pass off the pipe handler. */
4274         if (IS_IPC(conn)) {
4275                 reply_pipe_write(req);
4276                 END_PROFILE(SMBwrite);
4277                 return;
4278         }
4279
4280         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4281
4282         if (!check_fsp(conn, req, fsp)) {
4283                 END_PROFILE(SMBwrite);
4284                 return;
4285         }
4286
4287         if (!CHECK_WRITE(fsp)) {
4288                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4289                 END_PROFILE(SMBwrite);
4290                 return;
4291         }
4292
4293         numtowrite = SVAL(req->vwv+1, 0);
4294         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4295         data = (const char *)req->buf + 3;
4296
4297         if (!fsp->print_file) {
4298                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4299                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4300                         &lock);
4301
4302                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4303                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4304                         END_PROFILE(SMBwrite);
4305                         return;
4306                 }
4307         }
4308
4309         /*
4310          * X/Open SMB protocol says that if smb_vwv1 is
4311          * zero then the file size should be extended or
4312          * truncated to the size given in smb_vwv[2-3].
4313          */
4314
4315         if(numtowrite == 0) {
4316                 /*
4317                  * This is actually an allocate call, and set EOF. JRA.
4318                  */
4319                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4320                 if (nwritten < 0) {
4321                         reply_nterror(req, NT_STATUS_DISK_FULL);
4322                         goto strict_unlock;
4323                 }
4324                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4325                 if (nwritten < 0) {
4326                         reply_nterror(req, NT_STATUS_DISK_FULL);
4327                         goto strict_unlock;
4328                 }
4329                 trigger_write_time_update_immediate(fsp);
4330         } else {
4331                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4332         }
4333
4334         status = sync_file(conn, fsp, False);
4335         if (!NT_STATUS_IS_OK(status)) {
4336                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4337                          fsp_str_dbg(fsp), nt_errstr(status)));
4338                 reply_nterror(req, status);
4339                 goto strict_unlock;
4340         }
4341
4342         if(nwritten < 0) {
4343                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4344                 goto strict_unlock;
4345         }
4346
4347         if((nwritten == 0) && (numtowrite != 0)) {
4348                 reply_nterror(req, NT_STATUS_DISK_FULL);
4349                 goto strict_unlock;
4350         }
4351
4352         reply_outbuf(req, 1, 0);
4353
4354         SSVAL(req->outbuf,smb_vwv0,nwritten);
4355
4356         if (nwritten < (ssize_t)numtowrite) {
4357                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4358                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4359         }
4360
4361         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4362
4363 strict_unlock:
4364         if (!fsp->print_file) {
4365                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4366         }
4367
4368         END_PROFILE(SMBwrite);
4369         return;
4370 }
4371
4372 /****************************************************************************
4373  Ensure a buffer is a valid writeX for recvfile purposes.
4374 ****************************************************************************/
4375
4376 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4377                                                 (2*14) + /* word count (including bcc) */ \
4378                                                 1 /* pad byte */)
4379
4380 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4381                             const uint8_t *inbuf)
4382 {
4383         size_t numtowrite;
4384         connection_struct *conn = NULL;
4385         unsigned int doff = 0;
4386         size_t len = smb_len_large(inbuf);
4387
4388         if (is_encrypted_packet(inbuf)) {
4389                 /* Can't do this on encrypted
4390                  * connections. */
4391                 return false;
4392         }
4393
4394         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4395                 return false;
4396         }
4397
4398         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4399                         CVAL(inbuf,smb_wct) != 14) {
4400                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4401                         "invalid word length.\n"));
4402                 return false;
4403         }
4404
4405         conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4406         if (conn == NULL) {
4407                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4408                 return false;
4409         }
4410         if (IS_IPC(conn)) {
4411                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4412                 return false;
4413         }
4414         if (IS_PRINT(conn)) {
4415                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4416                 return false;
4417         }
4418         doff = SVAL(inbuf,smb_vwv11);
4419
4420         numtowrite = SVAL(inbuf,smb_vwv10);
4421
4422         if (len > doff && len - doff > 0xFFFF) {
4423                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4424         }
4425
4426         if (numtowrite == 0) {
4427                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4428                 return false;
4429         }
4430
4431         /* Ensure the sizes match up. */
4432         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4433                 /* no pad byte...old smbclient :-( */
4434                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4435                         (unsigned int)doff,
4436                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4437                 return false;
4438         }
4439
4440         if (len - doff != numtowrite) {
4441                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4442                         "len = %u, doff = %u, numtowrite = %u\n",
4443                         (unsigned int)len,
4444                         (unsigned int)doff,
4445                         (unsigned int)numtowrite ));
4446                 return false;
4447         }
4448
4449         DEBUG(10,("is_valid_writeX_buffer: true "
4450                 "len = %u, doff = %u, numtowrite = %u\n",
4451                 (unsigned int)len,
4452                 (unsigned int)doff,
4453                 (unsigned int)numtowrite ));
4454
4455         return true;
4456 }
4457
4458 /****************************************************************************
4459  Reply to a write and X.
4460 ****************************************************************************/
4461
4462 void reply_write_and_X(struct smb_request *req)
4463 {
4464         connection_struct *conn = req->conn;
4465         files_struct *fsp;
4466         struct lock_struct lock;
4467         SMB_OFF_T startpos;
4468         size_t numtowrite;
4469         bool write_through;
4470         ssize_t nwritten;
4471         unsigned int smb_doff;
4472         unsigned int smblen;
4473         char *data;
4474         NTSTATUS status;
4475         int saved_errno = 0;
4476
4477         START_PROFILE(SMBwriteX);
4478
4479         if ((req->wct != 12) && (req->wct != 14)) {
4480                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4481                 END_PROFILE(SMBwriteX);
4482                 return;
4483         }
4484
4485         numtowrite = SVAL(req->vwv+10, 0);
4486         smb_doff = SVAL(req->vwv+11, 0);
4487         smblen = smb_len(req->inbuf);
4488
4489         if (req->unread_bytes > 0xFFFF ||
4490                         (smblen > smb_doff &&
4491                                 smblen - smb_doff > 0xFFFF)) {
4492                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4493         }
4494
4495         if (req->unread_bytes) {
4496                 /* Can't do a recvfile write on IPC$ */
4497                 if (IS_IPC(conn)) {
4498                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4499                         END_PROFILE(SMBwriteX);
4500                         return;
4501                 }
4502                 if (numtowrite != req->unread_bytes) {
4503                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4504                         END_PROFILE(SMBwriteX);
4505                         return;
4506                 }
4507         } else {
4508                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4509                                 smb_doff + numtowrite > smblen) {
4510                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4511                         END_PROFILE(SMBwriteX);
4512                         return;
4513                 }
4514         }
4515
4516         /* If it's an IPC, pass off the pipe handler. */
4517         if (IS_IPC(conn)) {
4518                 if (req->unread_bytes) {
4519                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4520                         END_PROFILE(SMBwriteX);
4521                         return;
4522                 }
4523                 reply_pipe_write_and_X(req);
4524                 END_PROFILE(SMBwriteX);
4525                 return;
4526         }
4527
4528         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4529         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4530         write_through = BITSETW(req->vwv+7,0);
4531
4532         if (!check_fsp(conn, req, fsp)) {
4533                 END_PROFILE(SMBwriteX);
4534                 return;
4535         }
4536
4537         if (!CHECK_WRITE(fsp)) {
4538                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4539                 END_PROFILE(SMBwriteX);
4540                 return;
4541         }
4542
4543         data = smb_base(req->inbuf) + smb_doff;
4544
4545         if(req->wct == 14) {
4546 #ifdef LARGE_SMB_OFF_T
4547                 /*
4548                  * This is a large offset (64 bit) write.
4549                  */
4550                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4551
4552 #else /* !LARGE_SMB_OFF_T */
4553
4554                 /*
4555                  * Ensure we haven't been sent a >32 bit offset.
4556                  */
4557
4558                 if(IVAL(req->vwv+12, 0) != 0) {
4559                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4560                                  "used and we don't support 64 bit offsets.\n",
4561                                  (unsigned int)IVAL(req->vwv+12, 0) ));
4562                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4563                         END_PROFILE(SMBwriteX);
4564                         return;
4565                 }
4566
4567 #endif /* LARGE_SMB_OFF_T */
4568         }
4569
4570         /* X/Open SMB protocol says that, unlike SMBwrite
4571         if the length is zero then NO truncation is
4572         done, just a write of zero. To truncate a file,
4573         use SMBwrite. */
4574
4575         if(numtowrite == 0) {
4576                 nwritten = 0;
4577         } else {
4578                 if (req->unread_bytes == 0) {
4579                         status = schedule_aio_write_and_X(conn,
4580                                                 req,
4581                                                 fsp,
4582                                                 data,
4583                                                 startpos,
4584                                                 numtowrite);
4585
4586                         if (NT_STATUS_IS_OK(status)) {
4587                                 /* write scheduled - we're done. */
4588                                 goto out;
4589                         }
4590                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4591                                 /* Real error - report to client. */
4592                                 reply_nterror(req, status);
4593                                 goto out;
4594                         }
4595                         /* NT_STATUS_RETRY - fall through to sync write. */
4596                 }
4597
4598                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4599                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4600                     &lock);
4601
4602                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4603                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4604                         goto out;
4605                 }
4606
4607                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4608                 saved_errno = errno;
4609
4610                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4611         }
4612
4613         if(nwritten < 0) {
4614                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4615                 goto out;
4616         }
4617
4618         if((nwritten == 0) && (numtowrite != 0)) {
4619                 reply_nterror(req, NT_STATUS_DISK_FULL);
4620                 goto out;
4621         }
4622
4623         reply_outbuf(req, 6, 0);
4624         SSVAL(req->outbuf,smb_vwv2,nwritten);
4625         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4626
4627         if (nwritten < (ssize_t)numtowrite) {
4628                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4629                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4630         }
4631
4632         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4633                 fsp->fnum, (int)numtowrite, (int)nwritten));
4634
4635         status = sync_file(conn, fsp, write_through);
4636         if (!NT_STATUS_IS_OK(status)) {
4637                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4638                          fsp_str_dbg(fsp), nt_errstr(status)));
4639                 reply_nterror(req, status);
4640                 goto out;
4641         }
4642
4643         END_PROFILE(SMBwriteX);
4644         chain_reply(req);
4645         return;
4646
4647 out:
4648         END_PROFILE(SMBwriteX);
4649         return;
4650 }
4651
4652 /****************************************************************************
4653  Reply to a lseek.
4654 ****************************************************************************/
4655
4656 void reply_lseek(struct smb_request *req)
4657 {
4658         connection_struct *conn = req->conn;
4659         SMB_OFF_T startpos;
4660         SMB_OFF_T res= -1;
4661         int mode,umode;
4662         files_struct *fsp;
4663
4664         START_PROFILE(SMBlseek);
4665
4666         if (req->wct < 4) {
4667                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4668                 END_PROFILE(SMBlseek);
4669                 return;
4670         }
4671
4672         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4673
4674         if (!check_fsp(conn, req, fsp)) {
4675                 return;
4676         }
4677
4678         flush_write_cache(fsp, SEEK_FLUSH);
4679
4680         mode = SVAL(req->vwv+1, 0) & 3;
4681         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4682         startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4683
4684         switch (mode) {
4685                 case 0:
4686                         umode = SEEK_SET;
4687                         res = startpos;
4688                         break;
4689                 case 1:
4690                         umode = SEEK_CUR;
4691                         res = fsp->fh->pos + startpos;
4692                         break;
4693                 case 2:
4694                         umode = SEEK_END;
4695                         break;
4696                 default:
4697                         umode = SEEK_SET;
4698                         res = startpos;
4699                         break;
4700         }
4701
4702         if (umode == SEEK_END) {
4703                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4704                         if(errno == EINVAL) {
4705                                 SMB_OFF_T current_pos = startpos;
4706
4707                                 if(fsp_stat(fsp) == -1) {
4708                                         reply_nterror(req,
4709                                                 map_nt_error_from_unix(errno));
4710                                         END_PROFILE(SMBlseek);
4711                                         return;
4712                                 }
4713
4714                                 current_pos += fsp->fsp_name->st.st_ex_size;
4715                                 if(current_pos < 0)
4716                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4717                         }
4718                 }
4719
4720                 if(res == -1) {
4721                         reply_nterror(req, map_nt_error_from_unix(errno));
4722                         END_PROFILE(SMBlseek);
4723                         return;
4724                 }
4725         }
4726
4727         fsp->fh->pos = res;
4728
4729         reply_outbuf(req, 2, 0);
4730         SIVAL(req->outbuf,smb_vwv0,res);
4731
4732         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4733                 fsp->fnum, (double)startpos, (double)res, mode));
4734
4735         END_PROFILE(SMBlseek);
4736         return;
4737 }
4738
4739 /****************************************************************************
4740  Reply to a flush.
4741 ****************************************************************************/
4742
4743 void reply_flush(struct smb_request *req)
4744 {
4745         connection_struct *conn = req->conn;
4746         uint16 fnum;
4747         files_struct *fsp;
4748
4749         START_PROFILE(SMBflush);
4750
4751         if (req->wct < 1) {
4752                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4753                 return;
4754         }
4755
4756         fnum = SVAL(req->vwv+0, 0);
4757         fsp = file_fsp(req, fnum);
4758
4759         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4760                 return;
4761         }
4762
4763         if (!fsp) {
4764                 file_sync_all(conn);
4765         } else {
4766                 NTSTATUS status = sync_file(conn, fsp, True);
4767                 if (!NT_STATUS_IS_OK(status)) {
4768                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4769                                 fsp_str_dbg(fsp), nt_errstr(status)));
4770                         reply_nterror(req, status);
4771                         END_PROFILE(SMBflush);
4772                         return;
4773                 }
4774         }
4775
4776         reply_outbuf(req, 0, 0);
4777
4778         DEBUG(3,("flush\n"));
4779         END_PROFILE(SMBflush);
4780         return;
4781 }
4782
4783 /****************************************************************************
4784  Reply to a exit.
4785  conn POINTER CAN BE NULL HERE !
4786 ****************************************************************************/
4787
4788 void reply_exit(struct smb_request *req)
4789 {
4790         START_PROFILE(SMBexit);
4791
4792         file_close_pid(req->sconn, req->smbpid, req->vuid);
4793
4794         reply_outbuf(req, 0, 0);
4795
4796         DEBUG(3,("exit\n"));
4797
4798         END_PROFILE(SMBexit);
4799         return;
4800 }
4801
4802 /****************************************************************************
4803  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4804 ****************************************************************************/
4805
4806 void reply_close(struct smb_request *req)
4807 {
4808         connection_struct *conn = req->conn;
4809         NTSTATUS status = NT_STATUS_OK;
4810         files_struct *fsp = NULL;
4811         START_PROFILE(SMBclose);
4812
4813         if (req->wct < 3) {
4814                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4815                 END_PROFILE(SMBclose);
4816                 return;
4817         }
4818
4819         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4820
4821         /*
4822          * We can only use check_fsp if we know it's not a directory.
4823          */
4824
4825         if (!check_fsp_open(conn, req, fsp)) {
4826                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4827                 END_PROFILE(SMBclose);
4828                 return;
4829         }
4830
4831         if(fsp->is_directory) {
4832                 /*
4833                  * Special case - close NT SMB directory handle.
4834                  */
4835                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4836                 status = close_file(req, fsp, NORMAL_CLOSE);
4837         } else {
4838                 time_t t;
4839                 /*
4840                  * Close ordinary file.
4841                  */
4842
4843                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4844                          fsp->fh->fd, fsp->fnum,
4845                          conn->num_files_open));
4846
4847                 /*
4848                  * Take care of any time sent in the close.
4849                  */
4850
4851                 t = srv_make_unix_date3(req->vwv+1);
4852                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4853
4854                 /*
4855                  * close_file() returns the unix errno if an error
4856                  * was detected on close - normally this is due to
4857                  * a disk full error. If not then it was probably an I/O error.
4858                  */
4859
4860                 status = close_file(req, fsp, NORMAL_CLOSE);
4861         }
4862
4863         if (!NT_STATUS_IS_OK(status)) {
4864                 reply_nterror(req, status);
4865                 END_PROFILE(SMBclose);
4866                 return;
4867         }
4868
4869         reply_outbuf(req, 0, 0);
4870         END_PROFILE(SMBclose);
4871         return;
4872 }
4873
4874 /****************************************************************************
4875  Reply to a writeclose (Core+ protocol).
4876 ****************************************************************************/
4877
4878 void reply_writeclose(struct smb_request *req)
4879 {
4880         connection_struct *conn = req->conn;
4881         size_t numtowrite;
4882         ssize_t nwritten = -1;
4883         NTSTATUS close_status = NT_STATUS_OK;
4884         SMB_OFF_T startpos;
4885         const char *data;
4886         struct timespec mtime;
4887         files_struct *fsp;
4888         struct lock_struct lock;
4889
4890         START_PROFILE(SMBwriteclose);
4891
4892         if (req->wct < 6) {
4893                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4894                 END_PROFILE(SMBwriteclose);
4895                 return;
4896         }
4897
4898         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4899
4900         if (!check_fsp(conn, req, fsp)) {
4901                 END_PROFILE(SMBwriteclose);
4902                 return;
4903         }
4904         if (!CHECK_WRITE(fsp)) {
4905                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4906                 END_PROFILE(SMBwriteclose);
4907                 return;
4908         }
4909
4910         numtowrite = SVAL(req->vwv+1, 0);
4911         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4912         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4913         data = (const char *)req->buf + 1;
4914
4915         if (!fsp->print_file) {
4916                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4917                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4918                     &lock);
4919
4920                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4921                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4922                         END_PROFILE(SMBwriteclose);
4923                         return;
4924                 }
4925         }
4926
4927         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4928
4929         set_close_write_time(fsp, mtime);
4930
4931         /*
4932          * More insanity. W2K only closes the file if writelen > 0.
4933          * JRA.
4934          */
4935
4936         if (numtowrite) {
4937                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4938                          "file %s\n", fsp_str_dbg(fsp)));
4939                 close_status = close_file(req, fsp, NORMAL_CLOSE);
4940         }
4941
4942         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4943                  fsp->fnum, (int)numtowrite, (int)nwritten,
4944                  conn->num_files_open));
4945
4946         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4947                 reply_nterror(req, NT_STATUS_DISK_FULL);
4948                 goto strict_unlock;
4949         }
4950
4951         if(!NT_STATUS_IS_OK(close_status)) {
4952                 reply_nterror(req, close_status);
4953                 goto strict_unlock;
4954         }
4955
4956         reply_outbuf(req, 1, 0);
4957
4958         SSVAL(req->outbuf,smb_vwv0,nwritten);
4959
4960 strict_unlock:
4961         if (numtowrite && !fsp->print_file) {
4962                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4963         }
4964
4965         END_PROFILE(SMBwriteclose);
4966         return;
4967 }
4968
4969 #undef DBGC_CLASS
4970 #define DBGC_CLASS DBGC_LOCKING
4971
4972 /****************************************************************************
4973  Reply to a lock.
4974 ****************************************************************************/
4975
4976 void reply_lock(struct smb_request *req)
4977 {
4978         connection_struct *conn = req->conn;
4979         uint64_t count,offset;
4980         NTSTATUS status;
4981         files_struct *fsp;
4982         struct byte_range_lock *br_lck = NULL;
4983
4984         START_PROFILE(SMBlock);
4985
4986         if (req->wct < 5) {
4987                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4988                 END_PROFILE(SMBlock);
4989                 return;
4990         }
4991
4992         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4993
4994         if (!check_fsp(conn, req, fsp)) {
4995                 END_PROFILE(SMBlock);
4996                 return;
4997         }
4998
4999         count = (uint64_t)IVAL(req->vwv+1, 0);
5000         offset = (uint64_t)IVAL(req->vwv+3, 0);
5001
5002         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5003                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
5004
5005         br_lck = do_lock(req->sconn->msg_ctx,
5006                         fsp,
5007                         (uint64_t)req->smbpid,
5008                         count,
5009                         offset,
5010                         WRITE_LOCK,
5011                         WINDOWS_LOCK,
5012                         False, /* Non-blocking lock. */
5013                         &status,
5014                         NULL,
5015                         NULL);
5016
5017         TALLOC_FREE(br_lck);
5018
5019         if (NT_STATUS_V(status)) {
5020                 reply_nterror(req, status);
5021                 END_PROFILE(SMBlock);
5022                 return;
5023         }
5024
5025         reply_outbuf(req, 0, 0);
5026
5027         END_PROFILE(SMBlock);
5028         return;
5029 }
5030
5031 /****************************************************************************
5032  Reply to a unlock.
5033 ****************************************************************************/
5034
5035 void reply_unlock(struct smb_request *req)
5036 {
5037         connection_struct *conn = req->conn;
5038         uint64_t count,offset;
5039         NTSTATUS status;
5040         files_struct *fsp;
5041
5042         START_PROFILE(SMBunlock);
5043
5044         if (req->wct < 5) {
5045                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5046                 END_PROFILE(SMBunlock);
5047                 return;
5048         }
5049
5050         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5051
5052         if (!check_fsp(conn, req, fsp)) {
5053                 END_PROFILE(SMBunlock);
5054                 return;
5055         }
5056
5057         count = (uint64_t)IVAL(req->vwv+1, 0);
5058         offset = (uint64_t)IVAL(req->vwv+3, 0);
5059
5060         status = do_unlock(req->sconn->msg_ctx,
5061                         fsp,
5062                         (uint64_t)req->smbpid,
5063                         count,
5064                         offset,
5065                         WINDOWS_LOCK);
5066
5067         if (NT_STATUS_V(status)) {
5068                 reply_nterror(req, status);
5069                 END_PROFILE(SMBunlock);
5070                 return;
5071         }
5072
5073         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5074                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5075
5076         reply_outbuf(req, 0, 0);
5077
5078         END_PROFILE(SMBunlock);
5079         return;
5080 }
5081
5082 #undef DBGC_CLASS
5083 #define DBGC_CLASS DBGC_ALL
5084
5085 /****************************************************************************
5086  Reply to a tdis.
5087  conn POINTER CAN BE NULL HERE !
5088 ****************************************************************************/
5089
5090 void reply_tdis(struct smb_request *req)
5091 {
5092         connection_struct *conn = req->conn;
5093         START_PROFILE(SMBtdis);
5094
5095         if (!conn) {
5096                 DEBUG(4,("Invalid connection in tdis\n"));
5097                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5098                 END_PROFILE(SMBtdis);
5099                 return;
5100         }
5101
5102         conn->used = False;
5103
5104         close_cnum(conn,req->vuid);
5105         req->conn = NULL;
5106
5107         reply_outbuf(req, 0, 0);
5108         END_PROFILE(SMBtdis);
5109         return;
5110 }
5111
5112 /****************************************************************************
5113  Reply to a echo.
5114  conn POINTER CAN BE NULL HERE !
5115 ****************************************************************************/
5116
5117 void reply_echo(struct smb_request *req)
5118 {
5119         connection_struct *conn = req->conn;
5120         struct smb_perfcount_data local_pcd;
5121         struct smb_perfcount_data *cur_pcd;
5122         int smb_reverb;
5123         int seq_num;
5124
5125         START_PROFILE(SMBecho);
5126
5127         smb_init_perfcount_data(&local_pcd);
5128
5129         if (req->wct < 1) {
5130                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5131                 END_PROFILE(SMBecho);
5132                 return;
5133         }
5134
5135         smb_reverb = SVAL(req->vwv+0, 0);
5136
5137         reply_outbuf(req, 1, req->buflen);
5138
5139         /* copy any incoming data back out */
5140         if (req->buflen > 0) {
5141                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5142         }
5143
5144         if (smb_reverb > 100) {
5145                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5146                 smb_reverb = 100;
5147         }
5148
5149         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5150
5151                 /* this makes sure we catch the request pcd */
5152                 if (seq_num == smb_reverb) {
5153                         cur_pcd = &req->pcd;
5154                 } else {
5155                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5156                         cur_pcd = &local_pcd;
5157                 }
5158
5159                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5160
5161                 show_msg((char *)req->outbuf);
5162                 if (!srv_send_smb(req->sconn,
5163                                 (char *)req->outbuf,
5164                                 true, req->seqnum+1,
5165                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5166                                 cur_pcd))
5167                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5168         }
5169
5170         DEBUG(3,("echo %d times\n", smb_reverb));
5171
5172         TALLOC_FREE(req->outbuf);
5173
5174         END_PROFILE(SMBecho);
5175         return;
5176 }
5177
5178 /****************************************************************************
5179  Reply to a printopen.
5180 ****************************************************************************/
5181
5182 void reply_printopen(struct smb_request *req)
5183 {
5184         connection_struct *conn = req->conn;
5185         files_struct *fsp;
5186         NTSTATUS status;
5187
5188         START_PROFILE(SMBsplopen);
5189
5190         if (req->wct < 2) {
5191                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5192                 END_PROFILE(SMBsplopen);
5193                 return;
5194         }
5195
5196         if (!CAN_PRINT(conn)) {
5197                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5198                 END_PROFILE(SMBsplopen);
5199                 return;
5200         }
5201
5202         status = file_new(req, conn, &fsp);
5203         if(!NT_STATUS_IS_OK(status)) {
5204                 reply_nterror(req, status);
5205                 END_PROFILE(SMBsplopen);
5206                 return;
5207         }
5208
5209         /* Open for exclusive use, write only. */
5210         status = print_spool_open(fsp, NULL, req->vuid);
5211
5212         if (!NT_STATUS_IS_OK(status)) {
5213                 file_free(req, fsp);
5214                 reply_nterror(req, status);
5215                 END_PROFILE(SMBsplopen);
5216                 return;
5217         }
5218
5219         reply_outbuf(req, 1, 0);
5220         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5221
5222         DEBUG(3,("openprint fd=%d fnum=%d\n",
5223                  fsp->fh->fd, fsp->fnum));
5224
5225         END_PROFILE(SMBsplopen);
5226         return;
5227 }
5228
5229 /****************************************************************************
5230  Reply to a printclose.
5231 ****************************************************************************/
5232
5233 void reply_printclose(struct smb_request *req)
5234 {
5235         connection_struct *conn = req->conn;
5236         files_struct *fsp;
5237         NTSTATUS status;
5238
5239         START_PROFILE(SMBsplclose);
5240
5241         if (req->wct < 1) {
5242                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5243                 END_PROFILE(SMBsplclose);
5244                 return;
5245         }
5246
5247         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5248
5249         if (!check_fsp(conn, req, fsp)) {
5250                 END_PROFILE(SMBsplclose);
5251                 return;
5252         }
5253
5254         if (!CAN_PRINT(conn)) {
5255                 reply_force_doserror(req, ERRSRV, ERRerror);
5256                 END_PROFILE(SMBsplclose);
5257                 return;
5258         }
5259
5260         DEBUG(3,("printclose fd=%d fnum=%d\n",
5261                  fsp->fh->fd,fsp->fnum));
5262
5263         status = close_file(req, fsp, NORMAL_CLOSE);
5264
5265         if(!NT_STATUS_IS_OK(status)) {
5266                 reply_nterror(req, status);
5267                 END_PROFILE(SMBsplclose);
5268                 return;
5269         }
5270
5271         reply_outbuf(req, 0, 0);
5272
5273         END_PROFILE(SMBsplclose);
5274         return;
5275 }
5276
5277 /****************************************************************************
5278  Reply to a printqueue.
5279 ****************************************************************************/
5280
5281 void reply_printqueue(struct smb_request *req)
5282 {
5283         connection_struct *conn = req->conn;
5284         int max_count;
5285         int start_index;
5286
5287         START_PROFILE(SMBsplretq);
5288
5289         if (req->wct < 2) {
5290                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5291                 END_PROFILE(SMBsplretq);
5292                 return;
5293         }
5294
5295         max_count = SVAL(req->vwv+0, 0);
5296         start_index = SVAL(req->vwv+1, 0);
5297
5298         /* we used to allow the client to get the cnum wrong, but that
5299            is really quite gross and only worked when there was only
5300            one printer - I think we should now only accept it if they
5301            get it right (tridge) */
5302         if (!CAN_PRINT(conn)) {
5303                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5304                 END_PROFILE(SMBsplretq);
5305                 return;
5306         }
5307
5308         reply_outbuf(req, 2, 3);
5309         SSVAL(req->outbuf,smb_vwv0,0);
5310         SSVAL(req->outbuf,smb_vwv1,0);
5311         SCVAL(smb_buf(req->outbuf),0,1);
5312         SSVAL(smb_buf(req->outbuf),1,0);
5313
5314         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5315                  start_index, max_count));
5316
5317         {
5318                 TALLOC_CTX *mem_ctx = talloc_tos();
5319                 NTSTATUS status;
5320                 WERROR werr;
5321                 const char *sharename = lp_servicename(SNUM(conn));
5322                 struct rpc_pipe_client *cli = NULL;
5323                 struct dcerpc_binding_handle *b = NULL;
5324                 struct policy_handle handle;
5325                 struct spoolss_DevmodeContainer devmode_ctr;
5326                 union spoolss_JobInfo *info;
5327                 uint32_t count;
5328                 uint32_t num_to_get;
5329                 uint32_t first;
5330                 uint32_t i;
5331
5332                 ZERO_STRUCT(handle);
5333
5334                 status = rpc_pipe_open_interface(conn,
5335                                                  &ndr_table_spoolss.syntax_id,
5336                                                  conn->session_info,
5337                                                  &conn->sconn->client_id,
5338                                                  conn->sconn->msg_ctx,
5339                                                  &cli);
5340                 if (!NT_STATUS_IS_OK(status)) {
5341                         DEBUG(0, ("reply_printqueue: "
5342                                   "could not connect to spoolss: %s\n",
5343                                   nt_errstr(status)));
5344                         reply_nterror(req, status);
5345                         goto out;
5346                 }
5347                 b = cli->binding_handle;
5348
5349                 ZERO_STRUCT(devmode_ctr);
5350
5351                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5352                                                 sharename,
5353                                                 NULL, devmode_ctr,
5354                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5355                                                 &handle,
5356                                                 &werr);
5357                 if (!NT_STATUS_IS_OK(status)) {
5358                         reply_nterror(req, status);
5359                         goto out;
5360                 }
5361                 if (!W_ERROR_IS_OK(werr)) {
5362                         reply_nterror(req, werror_to_ntstatus(werr));
5363                         goto out;
5364                 }
5365
5366                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5367                                                &handle,
5368                                                0, /* firstjob */
5369                                                0xff, /* numjobs */
5370                                                2, /* level */
5371                                                0, /* offered */
5372                                                &count,
5373                                                &info);
5374                 if (!W_ERROR_IS_OK(werr)) {
5375                         reply_nterror(req, werror_to_ntstatus(werr));
5376                         goto out;
5377                 }
5378
5379                 if (max_count > 0) {
5380                         first = start_index;
5381                 } else {
5382                         first = start_index + max_count + 1;
5383                 }
5384
5385                 if (first >= count) {
5386                         num_to_get = first;
5387                 } else {
5388                         num_to_get = first + MIN(ABS(max_count), count - first);
5389                 }
5390
5391                 for (i = first; i < num_to_get; i++) {
5392                         char blob[28];
5393                         char *p = blob;
5394                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5395                         int qstatus;
5396                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5397                                                         info[i].info2.job_id);
5398
5399                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5400                                 qstatus = 2;
5401                         } else {
5402                                 qstatus = 3;
5403                         }
5404
5405                         srv_put_dos_date2(p, 0, qtime);
5406                         SCVAL(p, 4, qstatus);
5407                         SSVAL(p, 5, qrapjobid);
5408                         SIVAL(p, 7, info[i].info2.size);
5409                         SCVAL(p, 11, 0);
5410                         srvstr_push(blob, req->flags2, p+12,
5411                                     info[i].info2.notify_name, 16, STR_ASCII);
5412
5413                         if (message_push_blob(
5414                                     &req->outbuf,
5415                                     data_blob_const(
5416                                             blob, sizeof(blob))) == -1) {
5417                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5418                                 goto out;
5419                         }
5420                 }
5421
5422                 if (count > 0) {
5423                         SSVAL(req->outbuf,smb_vwv0,count);
5424                         SSVAL(req->outbuf,smb_vwv1,
5425                               (max_count>0?first+count:first-1));
5426                         SCVAL(smb_buf(req->outbuf),0,1);
5427                         SSVAL(smb_buf(req->outbuf),1,28*count);
5428                 }
5429
5430
5431                 DEBUG(3, ("%u entries returned in queue\n",
5432                           (unsigned)count));
5433
5434 out:
5435                 if (b && is_valid_policy_hnd(&handle)) {
5436                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5437                 }
5438
5439         }
5440
5441         END_PROFILE(SMBsplretq);
5442         return;
5443 }
5444
5445 /****************************************************************************
5446  Reply to a printwrite.
5447 ****************************************************************************/
5448
5449 void reply_printwrite(struct smb_request *req)
5450 {
5451         connection_struct *conn = req->conn;
5452         int numtowrite;
5453         const char *data;
5454         files_struct *fsp;
5455
5456         START_PROFILE(SMBsplwr);
5457
5458         if (req->wct < 1) {
5459                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5460                 END_PROFILE(SMBsplwr);
5461                 return;
5462         }
5463
5464         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5465
5466         if (!check_fsp(conn, req, fsp)) {
5467                 END_PROFILE(SMBsplwr);
5468                 return;
5469         }
5470
5471         if (!fsp->print_file) {
5472                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5473                 END_PROFILE(SMBsplwr);
5474                 return;
5475         }
5476
5477         if (!CHECK_WRITE(fsp)) {
5478                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5479                 END_PROFILE(SMBsplwr);
5480                 return;
5481         }
5482
5483         numtowrite = SVAL(req->buf, 1);
5484
5485         if (req->buflen < numtowrite + 3) {
5486                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5487                 END_PROFILE(SMBsplwr);
5488                 return;
5489         }
5490
5491         data = (const char *)req->buf + 3;
5492
5493         if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5494                 reply_nterror(req, map_nt_error_from_unix(errno));
5495                 END_PROFILE(SMBsplwr);
5496                 return;
5497         }
5498
5499         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5500
5501         END_PROFILE(SMBsplwr);
5502         return;
5503 }
5504
5505 /****************************************************************************
5506  Reply to a mkdir.
5507 ****************************************************************************/
5508
5509 void reply_mkdir(struct smb_request *req)
5510 {
5511         connection_struct *conn = req->conn;
5512         struct smb_filename *smb_dname = NULL;
5513         char *directory = NULL;
5514         NTSTATUS status;
5515         TALLOC_CTX *ctx = talloc_tos();
5516
5517         START_PROFILE(SMBmkdir);
5518
5519         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5520                             STR_TERMINATE, &status);
5521         if (!NT_STATUS_IS_OK(status)) {
5522                 reply_nterror(req, status);
5523                 goto out;
5524         }
5525
5526         status = filename_convert(ctx, conn,
5527                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5528                                  directory,
5529                                  0,
5530                                  NULL,
5531                                  &smb_dname);
5532         if (!NT_STATUS_IS_OK(status)) {
5533                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5534                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5535                                         ERRSRV, ERRbadpath);
5536                         goto out;
5537                 }
5538                 reply_nterror(req, status);
5539                 goto out;
5540         }
5541
5542         status = create_directory(conn, req, smb_dname);
5543
5544         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5545
5546         if (!NT_STATUS_IS_OK(status)) {
5547
5548                 if (!use_nt_status()
5549                     && NT_STATUS_EQUAL(status,
5550                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5551                         /*
5552                          * Yes, in the DOS error code case we get a
5553                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5554                          * samba4 torture test.
5555                          */
5556                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5557                 }
5558
5559                 reply_nterror(req, status);
5560                 goto out;
5561         }
5562
5563         reply_outbuf(req, 0, 0);
5564
5565         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5566  out:
5567         TALLOC_FREE(smb_dname);
5568         END_PROFILE(SMBmkdir);
5569         return;
5570 }
5571
5572 /****************************************************************************
5573  Reply to a rmdir.
5574 ****************************************************************************/
5575
5576 void reply_rmdir(struct smb_request *req)
5577 {
5578         connection_struct *conn = req->conn;
5579         struct smb_filename *smb_dname = NULL;
5580         char *directory = NULL;
5581         NTSTATUS status;
5582         TALLOC_CTX *ctx = talloc_tos();
5583         files_struct *fsp = NULL;
5584         int info = 0;
5585         struct smbd_server_connection *sconn = req->sconn;
5586
5587         START_PROFILE(SMBrmdir);
5588
5589         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5590                             STR_TERMINATE, &status);
5591         if (!NT_STATUS_IS_OK(status)) {
5592                 reply_nterror(req, status);
5593                 goto out;
5594         }
5595
5596         status = filename_convert(ctx, conn,
5597                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5598                                  directory,
5599                                  0,
5600                                  NULL,
5601                                  &smb_dname);
5602         if (!NT_STATUS_IS_OK(status)) {
5603                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5604                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5605                                         ERRSRV, ERRbadpath);
5606                         goto out;
5607                 }
5608                 reply_nterror(req, status);
5609                 goto out;
5610         }
5611
5612         if (is_ntfs_stream_smb_fname(smb_dname)) {
5613                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5614                 goto out;
5615         }
5616
5617         status = SMB_VFS_CREATE_FILE(
5618                 conn,                                   /* conn */
5619                 req,                                    /* req */
5620                 0,                                      /* root_dir_fid */
5621                 smb_dname,                              /* fname */
5622                 DELETE_ACCESS,                          /* access_mask */
5623                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5624                         FILE_SHARE_DELETE),
5625                 FILE_OPEN,                              /* create_disposition*/
5626                 FILE_DIRECTORY_FILE,                    /* create_options */
5627                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5628                 0,                                      /* oplock_request */
5629                 0,                                      /* allocation_size */
5630                 0,                                      /* private_flags */
5631                 NULL,                                   /* sd */
5632                 NULL,                                   /* ea_list */
5633                 &fsp,                                   /* result */
5634                 &info);                                 /* pinfo */
5635
5636         if (!NT_STATUS_IS_OK(status)) {
5637                 if (open_was_deferred(req->mid)) {
5638                         /* We have re-scheduled this call. */
5639                         goto out;
5640                 }
5641                 reply_nterror(req, status);
5642                 goto out;
5643         }
5644
5645         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5646         if (!NT_STATUS_IS_OK(status)) {
5647                 close_file(req, fsp, ERROR_CLOSE);
5648                 reply_nterror(req, status);
5649                 goto out;
5650         }
5651
5652         if (!set_delete_on_close(fsp, true, &conn->session_info->utok)) {
5653                 close_file(req, fsp, ERROR_CLOSE);
5654                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5655                 goto out;
5656         }
5657
5658         status = close_file(req, fsp, NORMAL_CLOSE);
5659         if (!NT_STATUS_IS_OK(status)) {
5660                 reply_nterror(req, status);
5661         } else {
5662                 reply_outbuf(req, 0, 0);
5663         }
5664
5665         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5666
5667         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5668  out:
5669         TALLOC_FREE(smb_dname);
5670         END_PROFILE(SMBrmdir);
5671         return;
5672 }
5673
5674 /*******************************************************************
5675  Resolve wildcards in a filename rename.
5676 ********************************************************************/
5677
5678 static bool resolve_wildcards(TALLOC_CTX *ctx,
5679                                 const char *name1,
5680                                 const char *name2,
5681                                 char **pp_newname)
5682 {
5683         char *name2_copy = NULL;
5684         char *root1 = NULL;
5685         char *root2 = NULL;
5686         char *ext1 = NULL;
5687         char *ext2 = NULL;
5688         char *p,*p2, *pname1, *pname2;
5689
5690         name2_copy = talloc_strdup(ctx, name2);
5691         if (!name2_copy) {
5692                 return False;
5693         }
5694
5695         pname1 = strrchr_m(name1,'/');
5696         pname2 = strrchr_m(name2_copy,'/');
5697
5698         if (!pname1 || !pname2) {
5699                 return False;
5700         }
5701
5702         /* Truncate the copy of name2 at the last '/' */
5703         *pname2 = '\0';
5704
5705         /* Now go past the '/' */
5706         pname1++;
5707         pname2++;
5708
5709         root1 = talloc_strdup(ctx, pname1);
5710         root2 = talloc_strdup(ctx, pname2);
5711
5712         if (!root1 || !root2) {
5713                 return False;
5714         }
5715
5716         p = strrchr_m(root1,'.');
5717         if (p) {
5718                 *p = 0;
5719                 ext1 = talloc_strdup(ctx, p+1);
5720         } else {
5721                 ext1 = talloc_strdup(ctx, "");
5722         }
5723         p = strrchr_m(root2,'.');
5724         if (p) {
5725                 *p = 0;
5726                 ext2 = talloc_strdup(ctx, p+1);
5727         } else {
5728                 ext2 = talloc_strdup(ctx, "");
5729         }
5730
5731         if (!ext1 || !ext2) {
5732                 return False;
5733         }
5734
5735         p = root1;
5736         p2 = root2;
5737         while (*p2) {
5738                 if (*p2 == '?') {
5739                         /* Hmmm. Should this be mb-aware ? */
5740                         *p2 = *p;
5741                         p2++;
5742                 } else if (*p2 == '*') {
5743                         *p2 = '\0';
5744                         root2 = talloc_asprintf(ctx, "%s%s",
5745                                                 root2,
5746                                                 p);
5747                         if (!root2) {
5748                                 return False;
5749                         }
5750                         break;
5751                 } else {
5752                         p2++;
5753                 }
5754                 if (*p) {
5755                         p++;
5756                 }
5757         }
5758
5759         p = ext1;
5760         p2 = ext2;
5761         while (*p2) {
5762                 if (*p2 == '?') {
5763                         /* Hmmm. Should this be mb-aware ? */
5764                         *p2 = *p;
5765                         p2++;
5766                 } else if (*p2 == '*') {
5767                         *p2 = '\0';
5768                         ext2 = talloc_asprintf(ctx, "%s%s",
5769                                                 ext2,
5770                                                 p);
5771                         if (!ext2) {
5772                                 return False;
5773                         }
5774                         break;
5775                 } else {
5776                         p2++;
5777                 }
5778                 if (*p) {
5779                         p++;
5780                 }
5781         }
5782
5783         if (*ext2) {
5784                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5785                                 name2_copy,
5786                                 root2,
5787                                 ext2);
5788         } else {
5789                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5790                                 name2_copy,
5791                                 root2);
5792         }
5793
5794         if (!*pp_newname) {
5795                 return False;
5796         }
5797
5798         return True;
5799 }
5800
5801 /****************************************************************************
5802  Ensure open files have their names updated. Updated to notify other smbd's
5803  asynchronously.
5804 ****************************************************************************/
5805
5806 static void rename_open_files(connection_struct *conn,
5807                               struct share_mode_lock *lck,
5808                               uint32_t orig_name_hash,
5809                               const struct smb_filename *smb_fname_dst)
5810 {
5811         files_struct *fsp;
5812         bool did_rename = False;
5813         NTSTATUS status;
5814         uint32_t new_name_hash;
5815
5816         for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
5817             fsp = file_find_di_next(fsp)) {
5818                 /* fsp_name is a relative path under the fsp. To change this for other
5819                    sharepaths we need to manipulate relative paths. */
5820                 /* TODO - create the absolute path and manipulate the newname
5821                    relative to the sharepath. */
5822                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5823                         continue;
5824                 }
5825                 if (fsp->name_hash != orig_name_hash) {
5826                         continue;
5827                 }
5828                 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5829                            "(file_id %s) from %s -> %s\n", fsp->fnum,
5830                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5831                            smb_fname_str_dbg(smb_fname_dst)));
5832
5833                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5834                 if (NT_STATUS_IS_OK(status)) {
5835                         did_rename = True;
5836                         new_name_hash = fsp->name_hash;
5837                 }
5838         }
5839
5840         if (!did_rename) {
5841                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5842                            "for %s\n", file_id_string_tos(&lck->id),
5843                            smb_fname_str_dbg(smb_fname_dst)));
5844         }
5845
5846         /* Send messages to all smbd's (not ourself) that the name has changed. */
5847         rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5848                               orig_name_hash, new_name_hash,
5849                               smb_fname_dst);
5850
5851 }
5852
5853 /****************************************************************************
5854  We need to check if the source path is a parent directory of the destination
5855  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5856  refuse the rename with a sharing violation. Under UNIX the above call can
5857  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5858  probably need to check that the client is a Windows one before disallowing
5859  this as a UNIX client (one with UNIX extensions) can know the source is a
5860  symlink and make this decision intelligently. Found by an excellent bug
5861  report from <AndyLiebman@aol.com>.
5862 ****************************************************************************/
5863
5864 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5865                                      const struct smb_filename *smb_fname_dst)
5866 {
5867         const char *psrc = smb_fname_src->base_name;
5868         const char *pdst = smb_fname_dst->base_name;
5869         size_t slen;
5870
5871         if (psrc[0] == '.' && psrc[1] == '/') {
5872                 psrc += 2;
5873         }
5874         if (pdst[0] == '.' && pdst[1] == '/') {
5875                 pdst += 2;
5876         }
5877         if ((slen = strlen(psrc)) > strlen(pdst)) {
5878                 return False;
5879         }
5880         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5881 }
5882
5883 /*
5884  * Do the notify calls from a rename
5885  */
5886
5887 static void notify_rename(connection_struct *conn, bool is_dir,
5888                           const struct smb_filename *smb_fname_src,
5889                           const struct smb_filename *smb_fname_dst)
5890 {
5891         char *parent_dir_src = NULL;
5892         char *parent_dir_dst = NULL;
5893         uint32 mask;
5894
5895         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5896                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5897
5898         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5899                             &parent_dir_src, NULL) ||
5900             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5901                             &parent_dir_dst, NULL)) {
5902                 goto out;
5903         }
5904
5905         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5906                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5907                              smb_fname_src->base_name);
5908                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5909                              smb_fname_dst->base_name);
5910         }
5911         else {
5912                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5913                              smb_fname_src->base_name);
5914                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5915                              smb_fname_dst->base_name);
5916         }
5917
5918         /* this is a strange one. w2k3 gives an additional event for
5919            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5920            files, but not directories */
5921         if (!is_dir) {
5922                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5923                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5924                              |FILE_NOTIFY_CHANGE_CREATION,
5925                              smb_fname_dst->base_name);
5926         }
5927  out:
5928         TALLOC_FREE(parent_dir_src);
5929         TALLOC_FREE(parent_dir_dst);
5930 }
5931
5932 /****************************************************************************
5933  Rename an open file - given an fsp.
5934 ****************************************************************************/
5935
5936 NTSTATUS rename_internals_fsp(connection_struct *conn,
5937                         files_struct *fsp,
5938                         const struct smb_filename *smb_fname_dst_in,
5939                         uint32 attrs,
5940                         bool replace_if_exists)
5941 {
5942         TALLOC_CTX *ctx = talloc_tos();
5943         struct smb_filename *smb_fname_dst = NULL;
5944         NTSTATUS status = NT_STATUS_OK;
5945         struct share_mode_lock *lck = NULL;
5946         bool dst_exists, old_is_stream, new_is_stream;
5947
5948         status = check_name(conn, smb_fname_dst_in->base_name);
5949         if (!NT_STATUS_IS_OK(status)) {
5950                 return status;
5951         }
5952
5953         /* Make a copy of the dst smb_fname structs */
5954
5955         status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5956         if (!NT_STATUS_IS_OK(status)) {
5957                 goto out;
5958         }
5959
5960         /*
5961          * Check for special case with case preserving and not
5962          * case sensitive. If the old last component differs from the original
5963          * last component only by case, then we should allow
5964          * the rename (user is trying to change the case of the
5965          * filename).
5966          */
5967         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5968             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5969             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5970                 char *last_slash;
5971                 char *fname_dst_lcomp_base_mod = NULL;
5972                 struct smb_filename *smb_fname_orig_lcomp = NULL;
5973
5974                 /*
5975                  * Get the last component of the destination name.
5976                  */
5977                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5978                 if (last_slash) {
5979                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5980                 } else {
5981                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
5982                 }
5983                 if (!fname_dst_lcomp_base_mod) {
5984                         status = NT_STATUS_NO_MEMORY;
5985                         goto out;
5986                 }
5987
5988                 /*
5989                  * Create an smb_filename struct using the original last
5990                  * component of the destination.
5991                  */
5992                 status = create_synthetic_smb_fname_split(ctx,
5993                     smb_fname_dst->original_lcomp, NULL,
5994                     &smb_fname_orig_lcomp);
5995                 if (!NT_STATUS_IS_OK(status)) {
5996                         TALLOC_FREE(fname_dst_lcomp_base_mod);
5997                         goto out;
5998                 }
5999
6000                 /* If the base names only differ by case, use original. */
6001                 if(!strcsequal(fname_dst_lcomp_base_mod,
6002                                smb_fname_orig_lcomp->base_name)) {
6003                         char *tmp;
6004                         /*
6005                          * Replace the modified last component with the
6006                          * original.
6007                          */
6008                         if (last_slash) {
6009                                 *last_slash = '\0'; /* Truncate at the '/' */
6010                                 tmp = talloc_asprintf(smb_fname_dst,
6011                                         "%s/%s",
6012                                         smb_fname_dst->base_name,
6013                                         smb_fname_orig_lcomp->base_name);
6014                         } else {
6015                                 tmp = talloc_asprintf(smb_fname_dst,
6016                                         "%s",
6017                                         smb_fname_orig_lcomp->base_name);
6018                         }
6019                         if (tmp == NULL) {
6020                                 status = NT_STATUS_NO_MEMORY;
6021                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6022                                 TALLOC_FREE(smb_fname_orig_lcomp);
6023                                 goto out;
6024                         }
6025                         TALLOC_FREE(smb_fname_dst->base_name);
6026                         smb_fname_dst->base_name = tmp;
6027                 }
6028
6029                 /* If the stream_names only differ by case, use original. */
6030                 if(!strcsequal(smb_fname_dst->stream_name,
6031                                smb_fname_orig_lcomp->stream_name)) {
6032                         char *tmp = NULL;
6033                         /* Use the original stream. */
6034                         tmp = talloc_strdup(smb_fname_dst,
6035                                             smb_fname_orig_lcomp->stream_name);
6036                         if (tmp == NULL) {
6037                                 status = NT_STATUS_NO_MEMORY;
6038                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6039                                 TALLOC_FREE(smb_fname_orig_lcomp);
6040                                 goto out;
6041                         }
6042                         TALLOC_FREE(smb_fname_dst->stream_name);
6043                         smb_fname_dst->stream_name = tmp;
6044                 }
6045                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6046                 TALLOC_FREE(smb_fname_orig_lcomp);
6047         }
6048
6049         /*
6050          * If the src and dest names are identical - including case,
6051          * don't do the rename, just return success.
6052          */
6053
6054         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6055             strcsequal(fsp->fsp_name->stream_name,
6056                        smb_fname_dst->stream_name)) {
6057                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6058                           "- returning success\n",
6059                           smb_fname_str_dbg(smb_fname_dst)));
6060                 status = NT_STATUS_OK;
6061                 goto out;
6062         }
6063
6064         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6065         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6066
6067         /* Return the correct error code if both names aren't streams. */
6068         if (!old_is_stream && new_is_stream) {
6069                 status = NT_STATUS_OBJECT_NAME_INVALID;
6070                 goto out;
6071         }
6072
6073         if (old_is_stream && !new_is_stream) {
6074                 status = NT_STATUS_INVALID_PARAMETER;
6075                 goto out;
6076         }
6077
6078         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6079
6080         if(!replace_if_exists && dst_exists) {
6081                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6082                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6083                           smb_fname_str_dbg(smb_fname_dst)));
6084                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6085                 goto out;
6086         }
6087
6088         if (dst_exists) {
6089                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6090                     &smb_fname_dst->st);
6091                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6092                                                            fileid);
6093                 /* The file can be open when renaming a stream */
6094                 if (dst_fsp && !new_is_stream) {
6095                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6096                         status = NT_STATUS_ACCESS_DENIED;
6097                         goto out;
6098                 }
6099         }
6100
6101         /* Ensure we have a valid stat struct for the source. */
6102         status = vfs_stat_fsp(fsp);
6103         if (!NT_STATUS_IS_OK(status)) {
6104                 goto out;
6105         }
6106
6107         status = can_rename(conn, fsp, attrs);
6108
6109         if (!NT_STATUS_IS_OK(status)) {
6110                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6111                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6112                           smb_fname_str_dbg(smb_fname_dst)));
6113                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6114                         status = NT_STATUS_ACCESS_DENIED;
6115                 goto out;
6116         }
6117
6118         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6119                 status = NT_STATUS_ACCESS_DENIED;
6120         }
6121
6122         lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6123                                   NULL);
6124
6125         /*
6126          * We have the file open ourselves, so not being able to get the
6127          * corresponding share mode lock is a fatal error.
6128          */
6129
6130         SMB_ASSERT(lck != NULL);
6131
6132         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6133                 uint32 create_options = fsp->fh->private_options;
6134
6135                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6136                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6137                           smb_fname_str_dbg(smb_fname_dst)));
6138
6139                 if (!lp_posix_pathnames() &&
6140                     (lp_map_archive(SNUM(conn)) ||
6141                     lp_store_dos_attributes(SNUM(conn)))) {
6142                         /* We must set the archive bit on the newly
6143                            renamed file. */
6144                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6145                                 uint32_t old_dosmode = dos_mode(conn,
6146                                                         smb_fname_dst);
6147                                 file_set_dosmode(conn,
6148                                         smb_fname_dst,
6149                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6150                                         NULL,
6151                                         true);
6152                         }
6153                 }
6154
6155                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6156                               smb_fname_dst);
6157
6158                 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6159
6160                 /*
6161                  * A rename acts as a new file create w.r.t. allowing an initial delete
6162                  * on close, probably because in Windows there is a new handle to the
6163                  * new file. If initial delete on close was requested but not
6164                  * originally set, we need to set it here. This is probably not 100% correct,
6165                  * but will work for the CIFSFS client which in non-posix mode
6166                  * depends on these semantics. JRA.
6167                  */
6168
6169                 if (create_options & FILE_DELETE_ON_CLOSE) {
6170                         status = can_set_delete_on_close(fsp, 0);
6171
6172                         if (NT_STATUS_IS_OK(status)) {
6173                                 /* Note that here we set the *inital* delete on close flag,
6174                                  * not the regular one. The magic gets handled in close. */
6175                                 fsp->initial_delete_on_close = True;
6176                         }
6177                 }
6178                 TALLOC_FREE(lck);
6179                 status = NT_STATUS_OK;
6180                 goto out;
6181         }
6182
6183         TALLOC_FREE(lck);
6184
6185         if (errno == ENOTDIR || errno == EISDIR) {
6186                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6187         } else {
6188                 status = map_nt_error_from_unix(errno);
6189         }
6190
6191         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6192                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6193                   smb_fname_str_dbg(smb_fname_dst)));
6194
6195  out:
6196         TALLOC_FREE(smb_fname_dst);
6197
6198         return status;
6199 }
6200
6201 /****************************************************************************
6202  The guts of the rename command, split out so it may be called by the NT SMB
6203  code.
6204 ****************************************************************************/
6205
6206 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6207                         connection_struct *conn,
6208                         struct smb_request *req,
6209                         struct smb_filename *smb_fname_src,
6210                         struct smb_filename *smb_fname_dst,
6211                         uint32 attrs,
6212                         bool replace_if_exists,
6213                         bool src_has_wild,
6214                         bool dest_has_wild,
6215                         uint32_t access_mask)
6216 {
6217         char *fname_src_dir = NULL;
6218         char *fname_src_mask = NULL;
6219         int count=0;
6220         NTSTATUS status = NT_STATUS_OK;
6221         struct smb_Dir *dir_hnd = NULL;
6222         const char *dname = NULL;
6223         char *talloced = NULL;
6224         long offset = 0;
6225         int create_options = 0;
6226         bool posix_pathnames = lp_posix_pathnames();
6227
6228         /*
6229          * Split the old name into directory and last component
6230          * strings. Note that unix_convert may have stripped off a
6231          * leading ./ from both name and newname if the rename is
6232          * at the root of the share. We need to make sure either both
6233          * name and newname contain a / character or neither of them do
6234          * as this is checked in resolve_wildcards().
6235          */
6236
6237         /* Split up the directory from the filename/mask. */
6238         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6239                                       &fname_src_dir, &fname_src_mask);
6240         if (!NT_STATUS_IS_OK(status)) {
6241                 status = NT_STATUS_NO_MEMORY;
6242                 goto out;
6243         }
6244
6245         /*
6246          * We should only check the mangled cache
6247          * here if unix_convert failed. This means
6248          * that the path in 'mask' doesn't exist
6249          * on the file system and so we need to look
6250          * for a possible mangle. This patch from
6251          * Tine Smukavec <valentin.smukavec@hermes.si>.
6252          */
6253
6254         if (!VALID_STAT(smb_fname_src->st) &&
6255             mangle_is_mangled(fname_src_mask, conn->params)) {
6256                 char *new_mask = NULL;
6257                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6258                                             conn->params);
6259                 if (new_mask) {
6260                         TALLOC_FREE(fname_src_mask);
6261                         fname_src_mask = new_mask;
6262                 }
6263         }
6264
6265         if (!src_has_wild) {
6266                 files_struct *fsp;
6267
6268                 /*
6269                  * Only one file needs to be renamed. Append the mask back
6270                  * onto the directory.
6271                  */
6272                 TALLOC_FREE(smb_fname_src->base_name);
6273                 if (ISDOT(fname_src_dir)) {
6274                         /* Ensure we use canonical names on open. */
6275                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6276                                                         "%s",
6277                                                         fname_src_mask);
6278                 } else {
6279                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6280                                                         "%s/%s",
6281                                                         fname_src_dir,
6282                                                         fname_src_mask);
6283                 }
6284                 if (!smb_fname_src->base_name) {
6285                         status = NT_STATUS_NO_MEMORY;
6286                         goto out;
6287                 }
6288
6289                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6290                           "case_preserve = %d, short case preserve = %d, "
6291                           "directory = %s, newname = %s, "
6292                           "last_component_dest = %s\n",
6293                           conn->case_sensitive, conn->case_preserve,
6294                           conn->short_case_preserve,
6295                           smb_fname_str_dbg(smb_fname_src),
6296                           smb_fname_str_dbg(smb_fname_dst),
6297                           smb_fname_dst->original_lcomp));
6298
6299                 /* The dest name still may have wildcards. */
6300                 if (dest_has_wild) {
6301                         char *fname_dst_mod = NULL;
6302                         if (!resolve_wildcards(smb_fname_dst,
6303                                                smb_fname_src->base_name,
6304                                                smb_fname_dst->base_name,
6305                                                &fname_dst_mod)) {
6306                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6307                                           "%s %s failed\n",
6308                                           smb_fname_src->base_name,
6309                                           smb_fname_dst->base_name));
6310                                 status = NT_STATUS_NO_MEMORY;
6311                                 goto out;
6312                         }
6313                         TALLOC_FREE(smb_fname_dst->base_name);
6314                         smb_fname_dst->base_name = fname_dst_mod;
6315                 }
6316
6317                 ZERO_STRUCT(smb_fname_src->st);
6318                 if (posix_pathnames) {
6319                         SMB_VFS_LSTAT(conn, smb_fname_src);
6320                 } else {
6321                         SMB_VFS_STAT(conn, smb_fname_src);
6322                 }
6323
6324                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6325                         create_options |= FILE_DIRECTORY_FILE;
6326                 }
6327
6328                 status = SMB_VFS_CREATE_FILE(
6329                         conn,                           /* conn */
6330                         req,                            /* req */
6331                         0,                              /* root_dir_fid */
6332                         smb_fname_src,                  /* fname */
6333                         access_mask,                    /* access_mask */
6334                         (FILE_SHARE_READ |              /* share_access */
6335                             FILE_SHARE_WRITE),
6336                         FILE_OPEN,                      /* create_disposition*/
6337                         create_options,                 /* create_options */
6338                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6339                         0,                              /* oplock_request */
6340                         0,                              /* allocation_size */
6341                         0,                              /* private_flags */
6342                         NULL,                           /* sd */
6343                         NULL,                           /* ea_list */
6344                         &fsp,                           /* result */
6345                         NULL);                          /* pinfo */
6346
6347                 if (!NT_STATUS_IS_OK(status)) {
6348                         DEBUG(3, ("Could not open rename source %s: %s\n",
6349                                   smb_fname_str_dbg(smb_fname_src),
6350                                   nt_errstr(status)));
6351                         goto out;
6352                 }
6353
6354                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6355                                               attrs, replace_if_exists);
6356
6357                 close_file(req, fsp, NORMAL_CLOSE);
6358
6359                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6360                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6361                           smb_fname_str_dbg(smb_fname_dst)));
6362
6363                 goto out;
6364         }
6365
6366         /*
6367          * Wildcards - process each file that matches.
6368          */
6369         if (strequal(fname_src_mask, "????????.???")) {
6370                 TALLOC_FREE(fname_src_mask);
6371                 fname_src_mask = talloc_strdup(ctx, "*");
6372                 if (!fname_src_mask) {
6373                         status = NT_STATUS_NO_MEMORY;
6374                         goto out;
6375                 }
6376         }
6377
6378         status = check_name(conn, fname_src_dir);
6379         if (!NT_STATUS_IS_OK(status)) {
6380                 goto out;
6381         }
6382
6383         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6384                           attrs);
6385         if (dir_hnd == NULL) {
6386                 status = map_nt_error_from_unix(errno);
6387                 goto out;
6388         }
6389
6390         status = NT_STATUS_NO_SUCH_FILE;
6391         /*
6392          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6393          * - gentest fix. JRA
6394          */
6395
6396         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6397                                     &talloced))) {
6398                 files_struct *fsp = NULL;
6399                 char *destname = NULL;
6400                 bool sysdir_entry = False;
6401
6402                 /* Quick check for "." and ".." */
6403                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6404                         if (attrs & aDIR) {
6405                                 sysdir_entry = True;
6406                         } else {
6407                                 TALLOC_FREE(talloced);
6408                                 continue;
6409                         }
6410                 }
6411
6412                 if (!is_visible_file(conn, fname_src_dir, dname,
6413                                      &smb_fname_src->st, false)) {
6414                         TALLOC_FREE(talloced);
6415                         continue;
6416                 }
6417
6418                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6419                         TALLOC_FREE(talloced);
6420                         continue;
6421                 }
6422
6423                 if (sysdir_entry) {
6424                         status = NT_STATUS_OBJECT_NAME_INVALID;
6425                         break;
6426                 }
6427
6428                 TALLOC_FREE(smb_fname_src->base_name);
6429                 if (ISDOT(fname_src_dir)) {
6430                         /* Ensure we use canonical names on open. */
6431                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6432                                                         "%s",
6433                                                         dname);
6434                 } else {
6435                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6436                                                         "%s/%s",
6437                                                         fname_src_dir,
6438                                                         dname);
6439                 }
6440                 if (!smb_fname_src->base_name) {
6441                         status = NT_STATUS_NO_MEMORY;
6442                         goto out;
6443                 }
6444
6445                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6446                                        smb_fname_dst->base_name,
6447                                        &destname)) {
6448                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6449                                   smb_fname_src->base_name, destname));
6450                         TALLOC_FREE(talloced);
6451                         continue;
6452                 }
6453                 if (!destname) {
6454                         status = NT_STATUS_NO_MEMORY;
6455                         goto out;
6456                 }
6457
6458                 TALLOC_FREE(smb_fname_dst->base_name);
6459                 smb_fname_dst->base_name = destname;
6460
6461                 ZERO_STRUCT(smb_fname_src->st);
6462                 if (posix_pathnames) {
6463                         SMB_VFS_LSTAT(conn, smb_fname_src);
6464                 } else {
6465                         SMB_VFS_STAT(conn, smb_fname_src);
6466                 }
6467
6468                 create_options = 0;
6469
6470                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6471                         create_options |= FILE_DIRECTORY_FILE;
6472                 }
6473
6474                 status = SMB_VFS_CREATE_FILE(
6475                         conn,                           /* conn */
6476                         req,                            /* req */
6477                         0,                              /* root_dir_fid */
6478                         smb_fname_src,                  /* fname */
6479                         access_mask,                    /* access_mask */
6480                         (FILE_SHARE_READ |              /* share_access */
6481                             FILE_SHARE_WRITE),
6482                         FILE_OPEN,                      /* create_disposition*/
6483                         create_options,                 /* create_options */
6484                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6485                         0,                              /* oplock_request */
6486                         0,                              /* allocation_size */
6487                         0,                              /* private_flags */
6488                         NULL,                           /* sd */
6489                         NULL,                           /* ea_list */
6490                         &fsp,                           /* result */
6491                         NULL);                          /* pinfo */
6492
6493                 if (!NT_STATUS_IS_OK(status)) {
6494                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6495                                  "returned %s rename %s -> %s\n",
6496                                  nt_errstr(status),
6497                                  smb_fname_str_dbg(smb_fname_src),
6498                                  smb_fname_str_dbg(smb_fname_dst)));
6499                         break;
6500                 }
6501
6502                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6503                                                               dname);
6504                 if (!smb_fname_dst->original_lcomp) {
6505                         status = NT_STATUS_NO_MEMORY;
6506                         goto out;
6507                 }
6508
6509                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6510                                               attrs, replace_if_exists);
6511
6512                 close_file(req, fsp, NORMAL_CLOSE);
6513
6514                 if (!NT_STATUS_IS_OK(status)) {
6515                         DEBUG(3, ("rename_internals_fsp returned %s for "
6516                                   "rename %s -> %s\n", nt_errstr(status),
6517                                   smb_fname_str_dbg(smb_fname_src),
6518                                   smb_fname_str_dbg(smb_fname_dst)));
6519                         break;
6520                 }
6521
6522                 count++;
6523
6524                 DEBUG(3,("rename_internals: doing rename on %s -> "
6525                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6526                          smb_fname_str_dbg(smb_fname_src)));
6527                 TALLOC_FREE(talloced);
6528         }
6529         TALLOC_FREE(dir_hnd);
6530
6531         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6532                 status = map_nt_error_from_unix(errno);
6533         }
6534
6535  out:
6536         TALLOC_FREE(talloced);
6537         TALLOC_FREE(fname_src_dir);
6538         TALLOC_FREE(fname_src_mask);
6539         return status;
6540 }
6541
6542 /****************************************************************************
6543  Reply to a mv.
6544 ****************************************************************************/
6545
6546 void reply_mv(struct smb_request *req)
6547 {
6548         connection_struct *conn = req->conn;
6549         char *name = NULL;
6550         char *newname = NULL;
6551         const char *p;
6552         uint32 attrs;
6553         NTSTATUS status;
6554         bool src_has_wcard = False;
6555         bool dest_has_wcard = False;
6556         TALLOC_CTX *ctx = talloc_tos();
6557         struct smb_filename *smb_fname_src = NULL;
6558         struct smb_filename *smb_fname_dst = NULL;
6559         bool stream_rename = false;
6560
6561         START_PROFILE(SMBmv);
6562
6563         if (req->wct < 1) {
6564                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6565                 goto out;
6566         }
6567
6568         attrs = SVAL(req->vwv+0, 0);
6569
6570         p = (const char *)req->buf + 1;
6571         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6572                                        &status, &src_has_wcard);
6573         if (!NT_STATUS_IS_OK(status)) {
6574                 reply_nterror(req, status);
6575                 goto out;
6576         }
6577         p++;
6578         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6579                                        &status, &dest_has_wcard);
6580         if (!NT_STATUS_IS_OK(status)) {
6581                 reply_nterror(req, status);
6582                 goto out;
6583         }
6584
6585         if (!lp_posix_pathnames()) {
6586                 /* The newname must begin with a ':' if the
6587                    name contains a ':'. */
6588                 if (strchr_m(name, ':')) {
6589                         if (newname[0] != ':') {
6590                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6591                                 goto out;
6592                         }
6593                         stream_rename = true;
6594                 }
6595         }
6596
6597         status = filename_convert(ctx,
6598                                   conn,
6599                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6600                                   name,
6601                                   UCF_COND_ALLOW_WCARD_LCOMP,
6602                                   &src_has_wcard,
6603                                   &smb_fname_src);
6604
6605         if (!NT_STATUS_IS_OK(status)) {
6606                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6607                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6608                                         ERRSRV, ERRbadpath);
6609                         goto out;
6610                 }
6611                 reply_nterror(req, status);
6612                 goto out;
6613         }
6614
6615         status = filename_convert(ctx,
6616                                   conn,
6617                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6618                                   newname,
6619                                   UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6620                                   &dest_has_wcard,
6621                                   &smb_fname_dst);
6622
6623         if (!NT_STATUS_IS_OK(status)) {
6624                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6625                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6626                                         ERRSRV, ERRbadpath);
6627                         goto out;
6628                 }
6629                 reply_nterror(req, status);
6630                 goto out;
6631         }
6632
6633         if (stream_rename) {
6634                 /* smb_fname_dst->base_name must be the same as
6635                    smb_fname_src->base_name. */
6636                 TALLOC_FREE(smb_fname_dst->base_name);
6637                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6638                                                 smb_fname_src->base_name);
6639                 if (!smb_fname_dst->base_name) {
6640                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6641                         goto out;
6642                 }
6643         }
6644
6645         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6646                  smb_fname_str_dbg(smb_fname_dst)));
6647
6648         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6649                                   attrs, False, src_has_wcard, dest_has_wcard,
6650                                   DELETE_ACCESS);
6651         if (!NT_STATUS_IS_OK(status)) {
6652                 if (open_was_deferred(req->mid)) {
6653                         /* We have re-scheduled this call. */
6654                         goto out;
6655                 }
6656                 reply_nterror(req, status);
6657                 goto out;
6658         }
6659
6660         reply_outbuf(req, 0, 0);
6661  out:
6662         TALLOC_FREE(smb_fname_src);
6663         TALLOC_FREE(smb_fname_dst);
6664         END_PROFILE(SMBmv);
6665         return;
6666 }
6667
6668 /*******************************************************************
6669  Copy a file as part of a reply_copy.
6670 ******************************************************************/
6671
6672 /*
6673  * TODO: check error codes on all callers
6674  */
6675
6676 NTSTATUS copy_file(TALLOC_CTX *ctx,
6677                         connection_struct *conn,
6678                         struct smb_filename *smb_fname_src,
6679                         struct smb_filename *smb_fname_dst,
6680                         int ofun,
6681                         int count,
6682                         bool target_is_directory)
6683 {
6684         struct smb_filename *smb_fname_dst_tmp = NULL;
6685         SMB_OFF_T ret=-1;
6686         files_struct *fsp1,*fsp2;
6687         uint32 dosattrs;
6688         uint32 new_create_disposition;
6689         NTSTATUS status;
6690
6691
6692         status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6693         if (!NT_STATUS_IS_OK(status)) {
6694                 return status;
6695         }
6696
6697         /*
6698          * If the target is a directory, extract the last component from the
6699          * src filename and append it to the dst filename
6700          */
6701         if (target_is_directory) {
6702                 const char *p;
6703
6704                 /* dest/target can't be a stream if it's a directory. */
6705                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6706
6707                 p = strrchr_m(smb_fname_src->base_name,'/');
6708                 if (p) {
6709                         p++;
6710                 } else {
6711                         p = smb_fname_src->base_name;
6712                 }
6713                 smb_fname_dst_tmp->base_name =
6714                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6715                                            p);
6716                 if (!smb_fname_dst_tmp->base_name) {
6717                         status = NT_STATUS_NO_MEMORY;
6718                         goto out;
6719                 }
6720         }
6721
6722         status = vfs_file_exist(conn, smb_fname_src);
6723         if (!NT_STATUS_IS_OK(status)) {
6724                 goto out;
6725         }
6726
6727         if (!target_is_directory && count) {
6728                 new_create_disposition = FILE_OPEN;
6729         } else {
6730                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6731                                                  NULL, NULL,
6732                                                  &new_create_disposition,
6733                                                  NULL,
6734                                                  NULL)) {
6735                         status = NT_STATUS_INVALID_PARAMETER;
6736                         goto out;
6737                 }
6738         }
6739
6740         /* Open the src file for reading. */
6741         status = SMB_VFS_CREATE_FILE(
6742                 conn,                                   /* conn */
6743                 NULL,                                   /* req */
6744                 0,                                      /* root_dir_fid */
6745                 smb_fname_src,                          /* fname */
6746                 FILE_GENERIC_READ,                      /* access_mask */
6747                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6748                 FILE_OPEN,                              /* create_disposition*/
6749                 0,                                      /* create_options */
6750                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
6751                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6752                 0,                                      /* allocation_size */
6753                 0,                                      /* private_flags */
6754                 NULL,                                   /* sd */
6755                 NULL,                                   /* ea_list */
6756                 &fsp1,                                  /* result */
6757                 NULL);                                  /* psbuf */
6758
6759         if (!NT_STATUS_IS_OK(status)) {
6760                 goto out;
6761         }
6762
6763         dosattrs = dos_mode(conn, smb_fname_src);
6764
6765         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6766                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6767         }
6768
6769         /* Open the dst file for writing. */
6770         status = SMB_VFS_CREATE_FILE(
6771                 conn,                                   /* conn */
6772                 NULL,                                   /* req */
6773                 0,                                      /* root_dir_fid */
6774                 smb_fname_dst,                          /* fname */
6775                 FILE_GENERIC_WRITE,                     /* access_mask */
6776                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6777                 new_create_disposition,                 /* create_disposition*/
6778                 0,                                      /* create_options */
6779                 dosattrs,                               /* file_attributes */
6780                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6781                 0,                                      /* allocation_size */
6782                 0,                                      /* private_flags */
6783                 NULL,                                   /* sd */
6784                 NULL,                                   /* ea_list */
6785                 &fsp2,                                  /* result */
6786                 NULL);                                  /* psbuf */
6787
6788         if (!NT_STATUS_IS_OK(status)) {
6789                 close_file(NULL, fsp1, ERROR_CLOSE);
6790                 goto out;
6791         }
6792
6793         if (ofun & OPENX_FILE_EXISTS_OPEN) {
6794                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6795                 if (ret == -1) {
6796                         DEBUG(0, ("error - vfs lseek returned error %s\n",
6797                                 strerror(errno)));
6798                         status = map_nt_error_from_unix(errno);
6799                         close_file(NULL, fsp1, ERROR_CLOSE);
6800                         close_file(NULL, fsp2, ERROR_CLOSE);
6801                         goto out;
6802                 }
6803         }
6804
6805         /* Do the actual copy. */
6806         if (smb_fname_src->st.st_ex_size) {
6807                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6808         } else {
6809                 ret = 0;
6810         }
6811
6812         close_file(NULL, fsp1, NORMAL_CLOSE);
6813
6814         /* Ensure the modtime is set correctly on the destination file. */
6815         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6816
6817         /*
6818          * As we are opening fsp1 read-only we only expect
6819          * an error on close on fsp2 if we are out of space.
6820          * Thus we don't look at the error return from the
6821          * close of fsp1.
6822          */
6823         status = close_file(NULL, fsp2, NORMAL_CLOSE);
6824
6825         if (!NT_STATUS_IS_OK(status)) {
6826                 goto out;
6827         }
6828
6829         if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6830                 status = NT_STATUS_DISK_FULL;
6831                 goto out;
6832         }
6833
6834         status = NT_STATUS_OK;
6835
6836  out:
6837         TALLOC_FREE(smb_fname_dst_tmp);
6838         return status;
6839 }
6840
6841 /****************************************************************************
6842  Reply to a file copy.
6843 ****************************************************************************/
6844
6845 void reply_copy(struct smb_request *req)
6846 {
6847         connection_struct *conn = req->conn;
6848         struct smb_filename *smb_fname_src = NULL;
6849         struct smb_filename *smb_fname_dst = NULL;
6850         char *fname_src = NULL;
6851         char *fname_dst = NULL;
6852         char *fname_src_mask = NULL;
6853         char *fname_src_dir = NULL;
6854         const char *p;
6855         int count=0;
6856         int error = ERRnoaccess;
6857         int tid2;
6858         int ofun;
6859         int flags;
6860         bool target_is_directory=False;
6861         bool source_has_wild = False;
6862         bool dest_has_wild = False;
6863         NTSTATUS status;
6864         TALLOC_CTX *ctx = talloc_tos();
6865
6866         START_PROFILE(SMBcopy);
6867
6868         if (req->wct < 3) {
6869                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6870                 goto out;
6871         }
6872
6873         tid2 = SVAL(req->vwv+0, 0);
6874         ofun = SVAL(req->vwv+1, 0);
6875         flags = SVAL(req->vwv+2, 0);
6876
6877         p = (const char *)req->buf;
6878         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6879                                        &status, &source_has_wild);
6880         if (!NT_STATUS_IS_OK(status)) {
6881                 reply_nterror(req, status);
6882                 goto out;
6883         }
6884         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6885                                        &status, &dest_has_wild);
6886         if (!NT_STATUS_IS_OK(status)) {
6887                 reply_nterror(req, status);
6888                 goto out;
6889         }
6890
6891         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6892
6893         if (tid2 != conn->cnum) {
6894                 /* can't currently handle inter share copies XXXX */
6895                 DEBUG(3,("Rejecting inter-share copy\n"));
6896                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6897                 goto out;
6898         }
6899
6900         status = filename_convert(ctx, conn,
6901                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6902                                   fname_src,
6903                                   UCF_COND_ALLOW_WCARD_LCOMP,
6904                                   &source_has_wild,
6905                                   &smb_fname_src);
6906         if (!NT_STATUS_IS_OK(status)) {
6907                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6908                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6909                                         ERRSRV, ERRbadpath);
6910                         goto out;
6911                 }
6912                 reply_nterror(req, status);
6913                 goto out;
6914         }
6915
6916         status = filename_convert(ctx, conn,
6917                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6918                                   fname_dst,
6919                                   UCF_COND_ALLOW_WCARD_LCOMP,
6920                                   &dest_has_wild,
6921                                   &smb_fname_dst);
6922         if (!NT_STATUS_IS_OK(status)) {
6923                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6924                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6925                                         ERRSRV, ERRbadpath);
6926                         goto out;
6927                 }
6928                 reply_nterror(req, status);
6929                 goto out;
6930         }
6931
6932         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6933
6934         if ((flags&1) && target_is_directory) {
6935                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6936                 goto out;
6937         }
6938
6939         if ((flags&2) && !target_is_directory) {
6940                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6941                 goto out;
6942         }
6943
6944         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6945                 /* wants a tree copy! XXXX */
6946                 DEBUG(3,("Rejecting tree copy\n"));
6947                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6948                 goto out;
6949         }
6950
6951         /* Split up the directory from the filename/mask. */
6952         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6953                                       &fname_src_dir, &fname_src_mask);
6954         if (!NT_STATUS_IS_OK(status)) {
6955                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6956                 goto out;
6957         }
6958
6959         /*
6960          * We should only check the mangled cache
6961          * here if unix_convert failed. This means
6962          * that the path in 'mask' doesn't exist
6963          * on the file system and so we need to look
6964          * for a possible mangle. This patch from
6965          * Tine Smukavec <valentin.smukavec@hermes.si>.
6966          */
6967         if (!VALID_STAT(smb_fname_src->st) &&
6968             mangle_is_mangled(fname_src_mask, conn->params)) {
6969                 char *new_mask = NULL;
6970                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6971                                             &new_mask, conn->params);
6972
6973                 /* Use demangled name if one was successfully found. */
6974                 if (new_mask) {
6975                         TALLOC_FREE(fname_src_mask);
6976                         fname_src_mask = new_mask;
6977                 }
6978         }
6979
6980         if (!source_has_wild) {
6981
6982                 /*
6983                  * Only one file needs to be copied. Append the mask back onto
6984                  * the directory.
6985                  */
6986                 TALLOC_FREE(smb_fname_src->base_name);
6987                 if (ISDOT(fname_src_dir)) {
6988                         /* Ensure we use canonical names on open. */
6989                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6990                                                         "%s",
6991                                                         fname_src_mask);
6992                 } else {
6993                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6994                                                         "%s/%s",
6995                                                         fname_src_dir,
6996                                                         fname_src_mask);
6997                 }
6998                 if (!smb_fname_src->base_name) {
6999                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7000                         goto out;
7001                 }
7002
7003                 if (dest_has_wild) {
7004                         char *fname_dst_mod = NULL;
7005                         if (!resolve_wildcards(smb_fname_dst,
7006                                                smb_fname_src->base_name,
7007                                                smb_fname_dst->base_name,
7008                                                &fname_dst_mod)) {
7009                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7010                                 goto out;
7011                         }
7012                         TALLOC_FREE(smb_fname_dst->base_name);
7013                         smb_fname_dst->base_name = fname_dst_mod;
7014                 }
7015
7016                 status = check_name(conn, smb_fname_src->base_name);
7017                 if (!NT_STATUS_IS_OK(status)) {
7018                         reply_nterror(req, status);
7019                         goto out;
7020                 }
7021
7022                 status = check_name(conn, smb_fname_dst->base_name);
7023                 if (!NT_STATUS_IS_OK(status)) {
7024                         reply_nterror(req, status);
7025                         goto out;
7026                 }
7027
7028                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7029                                    ofun, count, target_is_directory);
7030
7031                 if(!NT_STATUS_IS_OK(status)) {
7032                         reply_nterror(req, status);
7033                         goto out;
7034                 } else {
7035                         count++;
7036                 }
7037         } else {
7038                 struct smb_Dir *dir_hnd = NULL;
7039                 const char *dname = NULL;
7040                 char *talloced = NULL;
7041                 long offset = 0;
7042
7043                 /*
7044                  * There is a wildcard that requires us to actually read the
7045                  * src dir and copy each file matching the mask to the dst.
7046                  * Right now streams won't be copied, but this could
7047                  * presumably be added with a nested loop for reach dir entry.
7048                  */
7049                 SMB_ASSERT(!smb_fname_src->stream_name);
7050                 SMB_ASSERT(!smb_fname_dst->stream_name);
7051
7052                 smb_fname_src->stream_name = NULL;
7053                 smb_fname_dst->stream_name = NULL;
7054
7055                 if (strequal(fname_src_mask,"????????.???")) {
7056                         TALLOC_FREE(fname_src_mask);
7057                         fname_src_mask = talloc_strdup(ctx, "*");
7058                         if (!fname_src_mask) {
7059                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7060                                 goto out;
7061                         }
7062                 }
7063
7064                 status = check_name(conn, fname_src_dir);
7065                 if (!NT_STATUS_IS_OK(status)) {
7066                         reply_nterror(req, status);
7067                         goto out;
7068                 }
7069
7070                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7071                 if (dir_hnd == NULL) {
7072                         status = map_nt_error_from_unix(errno);
7073                         reply_nterror(req, status);
7074                         goto out;
7075                 }
7076
7077                 error = ERRbadfile;
7078
7079                 /* Iterate over the src dir copying each entry to the dst. */
7080                 while ((dname = ReadDirName(dir_hnd, &offset,
7081                                             &smb_fname_src->st, &talloced))) {
7082                         char *destname = NULL;
7083
7084                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7085                                 TALLOC_FREE(talloced);
7086                                 continue;
7087                         }
7088
7089                         if (!is_visible_file(conn, fname_src_dir, dname,
7090                                              &smb_fname_src->st, false)) {
7091                                 TALLOC_FREE(talloced);
7092                                 continue;
7093                         }
7094
7095                         if(!mask_match(dname, fname_src_mask,
7096                                        conn->case_sensitive)) {
7097                                 TALLOC_FREE(talloced);
7098                                 continue;
7099                         }
7100
7101                         error = ERRnoaccess;
7102
7103                         /* Get the src smb_fname struct setup. */
7104                         TALLOC_FREE(smb_fname_src->base_name);
7105                         if (ISDOT(fname_src_dir)) {
7106                                 /* Ensure we use canonical names on open. */
7107                                 smb_fname_src->base_name =
7108                                         talloc_asprintf(smb_fname_src, "%s",
7109                                                 dname);
7110                         } else {
7111                                 smb_fname_src->base_name =
7112                                         talloc_asprintf(smb_fname_src, "%s/%s",
7113                                                 fname_src_dir, dname);
7114                         }
7115
7116                         if (!smb_fname_src->base_name) {
7117                                 TALLOC_FREE(dir_hnd);
7118                                 TALLOC_FREE(talloced);
7119                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7120                                 goto out;
7121                         }
7122
7123                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7124                                                smb_fname_dst->base_name,
7125                                                &destname)) {
7126                                 TALLOC_FREE(talloced);
7127                                 continue;
7128                         }
7129                         if (!destname) {
7130                                 TALLOC_FREE(dir_hnd);
7131                                 TALLOC_FREE(talloced);
7132                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7133                                 goto out;
7134                         }
7135
7136                         TALLOC_FREE(smb_fname_dst->base_name);
7137                         smb_fname_dst->base_name = destname;
7138
7139                         status = check_name(conn, smb_fname_src->base_name);
7140                         if (!NT_STATUS_IS_OK(status)) {
7141                                 TALLOC_FREE(dir_hnd);
7142                                 TALLOC_FREE(talloced);
7143                                 reply_nterror(req, status);
7144                                 goto out;
7145                         }
7146
7147                         status = check_name(conn, smb_fname_dst->base_name);
7148                         if (!NT_STATUS_IS_OK(status)) {
7149                                 TALLOC_FREE(dir_hnd);
7150                                 TALLOC_FREE(talloced);
7151                                 reply_nterror(req, status);
7152                                 goto out;
7153                         }
7154
7155                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7156                                 smb_fname_src->base_name,
7157                                 smb_fname_dst->base_name));
7158
7159                         status = copy_file(ctx, conn, smb_fname_src,
7160                                            smb_fname_dst, ofun, count,
7161                                            target_is_directory);
7162                         if (NT_STATUS_IS_OK(status)) {
7163                                 count++;
7164                         }
7165
7166                         TALLOC_FREE(talloced);
7167                 }
7168                 TALLOC_FREE(dir_hnd);
7169         }
7170
7171         if (count == 0) {
7172                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7173                 goto out;
7174         }
7175
7176         reply_outbuf(req, 1, 0);
7177         SSVAL(req->outbuf,smb_vwv0,count);
7178  out:
7179         TALLOC_FREE(smb_fname_src);
7180         TALLOC_FREE(smb_fname_dst);
7181         TALLOC_FREE(fname_src);
7182         TALLOC_FREE(fname_dst);
7183         TALLOC_FREE(fname_src_mask);
7184         TALLOC_FREE(fname_src_dir);
7185
7186         END_PROFILE(SMBcopy);
7187         return;
7188 }
7189
7190 #undef DBGC_CLASS
7191 #define DBGC_CLASS DBGC_LOCKING
7192
7193 /****************************************************************************
7194  Get a lock pid, dealing with large count requests.
7195 ****************************************************************************/
7196
7197 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7198                     bool large_file_format)
7199 {
7200         if(!large_file_format)
7201                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7202         else
7203                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7204 }
7205
7206 /****************************************************************************
7207  Get a lock count, dealing with large count requests.
7208 ****************************************************************************/
7209
7210 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7211                         bool large_file_format)
7212 {
7213         uint64_t count = 0;
7214
7215         if(!large_file_format) {
7216                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7217         } else {
7218
7219 #if defined(HAVE_LONGLONG)
7220                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7221                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7222 #else /* HAVE_LONGLONG */
7223
7224                 /*
7225                  * NT4.x seems to be broken in that it sends large file (64 bit)
7226                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7227                  * negotiated. For boxes without large unsigned ints truncate the
7228                  * lock count by dropping the top 32 bits.
7229                  */
7230
7231                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7232                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7233                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7234                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7235                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7236                 }
7237
7238                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7239 #endif /* HAVE_LONGLONG */
7240         }
7241
7242         return count;
7243 }
7244
7245 #if !defined(HAVE_LONGLONG)
7246 /****************************************************************************
7247  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7248 ****************************************************************************/
7249
7250 static uint32 map_lock_offset(uint32 high, uint32 low)
7251 {
7252         unsigned int i;
7253         uint32 mask = 0;
7254         uint32 highcopy = high;
7255
7256         /*
7257          * Try and find out how many significant bits there are in high.
7258          */
7259
7260         for(i = 0; highcopy; i++)
7261                 highcopy >>= 1;
7262
7263         /*
7264          * We use 31 bits not 32 here as POSIX
7265          * lock offsets may not be negative.
7266          */
7267
7268         mask = (~0) << (31 - i);
7269
7270         if(low & mask)
7271                 return 0; /* Fail. */
7272
7273         high <<= (31 - i);
7274
7275         return (high|low);
7276 }
7277 #endif /* !defined(HAVE_LONGLONG) */
7278
7279 /****************************************************************************
7280  Get a lock offset, dealing with large offset requests.
7281 ****************************************************************************/
7282
7283 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7284                          bool large_file_format, bool *err)
7285 {
7286         uint64_t offset = 0;
7287
7288         *err = False;
7289
7290         if(!large_file_format) {
7291                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7292         } else {
7293
7294 #if defined(HAVE_LONGLONG)
7295                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7296                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7297 #else /* HAVE_LONGLONG */
7298
7299                 /*
7300                  * NT4.x seems to be broken in that it sends large file (64 bit)
7301                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7302                  * negotiated. For boxes without large unsigned ints mangle the
7303                  * lock offset by mapping the top 32 bits onto the lower 32.
7304                  */
7305
7306                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7307                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7308                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7309                         uint32 new_low = 0;
7310
7311                         if((new_low = map_lock_offset(high, low)) == 0) {
7312                                 *err = True;
7313                                 return (uint64_t)-1;
7314                         }
7315
7316                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7317                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7318                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7319                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7320                 }
7321
7322                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7323 #endif /* HAVE_LONGLONG */
7324         }
7325
7326         return offset;
7327 }
7328
7329 NTSTATUS smbd_do_locking(struct smb_request *req,
7330                          files_struct *fsp,
7331                          uint8_t type,
7332                          int32_t timeout,
7333                          uint16_t num_ulocks,
7334                          struct smbd_lock_element *ulocks,
7335                          uint16_t num_locks,
7336                          struct smbd_lock_element *locks,
7337                          bool *async)
7338 {
7339         connection_struct *conn = req->conn;
7340         int i;
7341         NTSTATUS status = NT_STATUS_OK;
7342
7343         *async = false;
7344
7345         /* Data now points at the beginning of the list
7346            of smb_unlkrng structs */
7347         for(i = 0; i < (int)num_ulocks; i++) {
7348                 struct smbd_lock_element *e = &ulocks[i];
7349
7350                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7351                           "pid %u, file %s\n",
7352                           (double)e->offset,
7353                           (double)e->count,
7354                           (unsigned int)e->smblctx,
7355                           fsp_str_dbg(fsp)));
7356
7357                 if (e->brltype != UNLOCK_LOCK) {
7358                         /* this can only happen with SMB2 */
7359                         return NT_STATUS_INVALID_PARAMETER;
7360                 }
7361
7362                 status = do_unlock(req->sconn->msg_ctx,
7363                                 fsp,
7364                                 e->smblctx,
7365                                 e->count,
7366                                 e->offset,
7367                                 WINDOWS_LOCK);
7368
7369                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7370                     nt_errstr(status)));
7371
7372                 if (!NT_STATUS_IS_OK(status)) {
7373                         return status;
7374                 }
7375         }
7376
7377         /* Setup the timeout in seconds. */
7378
7379         if (!lp_blocking_locks(SNUM(conn))) {
7380                 timeout = 0;
7381         }
7382
7383         /* Data now points at the beginning of the list
7384            of smb_lkrng structs */
7385
7386         for(i = 0; i < (int)num_locks; i++) {
7387                 struct smbd_lock_element *e = &locks[i];
7388
7389                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7390                           "%llu, file %s timeout = %d\n",
7391                           (double)e->offset,
7392                           (double)e->count,
7393                           (unsigned long long)e->smblctx,
7394                           fsp_str_dbg(fsp),
7395                           (int)timeout));
7396
7397                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7398                         struct blocking_lock_record *blr = NULL;
7399
7400                         if (num_locks > 1) {
7401                                 /*
7402                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7403                                  * if the lock vector contains one entry. When given mutliple cancel
7404                                  * requests in a single PDU we expect the server to return an
7405                                  * error. Windows servers seem to accept the request but only
7406                                  * cancel the first lock.
7407                                  * JRA - Do what Windows does (tm) :-).
7408                                  */
7409
7410 #if 0
7411                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7412                                 return NT_STATUS_DOS(ERRDOS,
7413                                                 ERRcancelviolation);
7414 #else
7415                                 /* Windows behavior. */
7416                                 if (i != 0) {
7417                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7418                                                 "cancel request\n"));
7419                                         continue;
7420                                 }
7421 #endif
7422                         }
7423
7424                         if (lp_blocking_locks(SNUM(conn))) {
7425
7426                                 /* Schedule a message to ourselves to
7427                                    remove the blocking lock record and
7428                                    return the right error. */
7429
7430                                 blr = blocking_lock_cancel_smb1(fsp,
7431                                                 e->smblctx,
7432                                                 e->offset,
7433                                                 e->count,
7434                                                 WINDOWS_LOCK,
7435                                                 type,
7436                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7437                                 if (blr == NULL) {
7438                                         return NT_STATUS_DOS(
7439                                                         ERRDOS,
7440                                                         ERRcancelviolation);
7441                                 }
7442                         }
7443                         /* Remove a matching pending lock. */
7444                         status = do_lock_cancel(fsp,
7445                                                 e->smblctx,
7446                                                 e->count,
7447                                                 e->offset,
7448                                                 WINDOWS_LOCK,
7449                                                 blr);
7450                 } else {
7451                         bool blocking_lock = timeout ? true : false;
7452                         bool defer_lock = false;
7453                         struct byte_range_lock *br_lck;
7454                         uint64_t block_smblctx;
7455
7456                         br_lck = do_lock(req->sconn->msg_ctx,
7457                                         fsp,
7458                                         e->smblctx,
7459                                         e->count,
7460                                         e->offset,
7461                                         e->brltype,
7462                                         WINDOWS_LOCK,
7463                                         blocking_lock,
7464                                         &status,
7465                                         &block_smblctx,
7466                                         NULL);
7467
7468                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7469                                 /* Windows internal resolution for blocking locks seems
7470                                    to be about 200ms... Don't wait for less than that. JRA. */
7471                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7472                                         timeout = lp_lock_spin_time();
7473                                 }
7474                                 defer_lock = true;
7475                         }
7476
7477                         /* If a lock sent with timeout of zero would fail, and
7478                          * this lock has been requested multiple times,
7479                          * according to brl_lock_failed() we convert this
7480                          * request to a blocking lock with a timeout of between
7481                          * 150 - 300 milliseconds.
7482                          *
7483                          * If lp_lock_spin_time() has been set to 0, we skip
7484                          * this blocking retry and fail immediately.
7485                          *
7486                          * Replacement for do_lock_spin(). JRA. */
7487
7488                         if (!req->sconn->using_smb2 &&
7489                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7490                             lp_lock_spin_time() && !blocking_lock &&
7491                             NT_STATUS_EQUAL((status),
7492                                 NT_STATUS_FILE_LOCK_CONFLICT))
7493                         {
7494                                 defer_lock = true;
7495                                 timeout = lp_lock_spin_time();
7496                         }
7497
7498                         if (br_lck && defer_lock) {
7499                                 /*
7500                                  * A blocking lock was requested. Package up
7501                                  * this smb into a queued request and push it
7502                                  * onto the blocking lock queue.
7503                                  */
7504                                 if(push_blocking_lock_request(br_lck,
7505                                                         req,
7506                                                         fsp,
7507                                                         timeout,
7508                                                         i,
7509                                                         e->smblctx,
7510                                                         e->brltype,
7511                                                         WINDOWS_LOCK,
7512                                                         e->offset,
7513                                                         e->count,
7514                                                         block_smblctx)) {
7515                                         TALLOC_FREE(br_lck);
7516                                         *async = true;
7517                                         return NT_STATUS_OK;
7518                                 }
7519                         }
7520
7521                         TALLOC_FREE(br_lck);
7522                 }
7523
7524                 if (!NT_STATUS_IS_OK(status)) {
7525                         break;
7526                 }
7527         }
7528
7529         /* If any of the above locks failed, then we must unlock
7530            all of the previous locks (X/Open spec). */
7531
7532         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7533
7534                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7535                         i = -1; /* we want to skip the for loop */
7536                 }
7537
7538                 /*
7539                  * Ensure we don't do a remove on the lock that just failed,
7540                  * as under POSIX rules, if we have a lock already there, we
7541                  * will delete it (and we shouldn't) .....
7542                  */
7543                 for(i--; i >= 0; i--) {
7544                         struct smbd_lock_element *e = &locks[i];
7545
7546                         do_unlock(req->sconn->msg_ctx,
7547                                 fsp,
7548                                 e->smblctx,
7549                                 e->count,
7550                                 e->offset,
7551                                 WINDOWS_LOCK);
7552                 }
7553                 return status;
7554         }
7555
7556         DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7557                   fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7558
7559         return NT_STATUS_OK;
7560 }
7561
7562 /****************************************************************************
7563  Reply to a lockingX request.
7564 ****************************************************************************/
7565
7566 void reply_lockingX(struct smb_request *req)
7567 {
7568         connection_struct *conn = req->conn;
7569         files_struct *fsp;
7570         unsigned char locktype;
7571         unsigned char oplocklevel;
7572         uint16 num_ulocks;
7573         uint16 num_locks;
7574         int32 lock_timeout;
7575         int i;
7576         const uint8_t *data;
7577         bool large_file_format;
7578         bool err;
7579         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7580         struct smbd_lock_element *ulocks;
7581         struct smbd_lock_element *locks;
7582         bool async = false;
7583
7584         START_PROFILE(SMBlockingX);
7585
7586         if (req->wct < 8) {
7587                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7588                 END_PROFILE(SMBlockingX);
7589                 return;
7590         }
7591
7592         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7593         locktype = CVAL(req->vwv+3, 0);
7594         oplocklevel = CVAL(req->vwv+3, 1);
7595         num_ulocks = SVAL(req->vwv+6, 0);
7596         num_locks = SVAL(req->vwv+7, 0);
7597         lock_timeout = IVAL(req->vwv+4, 0);
7598         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7599
7600         if (!check_fsp(conn, req, fsp)) {
7601                 END_PROFILE(SMBlockingX);
7602                 return;
7603         }
7604
7605         data = req->buf;
7606
7607         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7608                 /* we don't support these - and CANCEL_LOCK makes w2k
7609                    and XP reboot so I don't really want to be
7610                    compatible! (tridge) */
7611                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7612                 END_PROFILE(SMBlockingX);
7613                 return;
7614         }
7615
7616         /* Check if this is an oplock break on a file
7617            we have granted an oplock on.
7618         */
7619         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7620                 /* Client can insist on breaking to none. */
7621                 bool break_to_none = (oplocklevel == 0);
7622                 bool result;
7623
7624                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7625                          "for fnum = %d\n", (unsigned int)oplocklevel,
7626                          fsp->fnum ));
7627
7628                 /*
7629                  * Make sure we have granted an exclusive or batch oplock on
7630                  * this file.
7631                  */
7632
7633                 if (fsp->oplock_type == 0) {
7634
7635                         /* The Samba4 nbench simulator doesn't understand
7636                            the difference between break to level2 and break
7637                            to none from level2 - it sends oplock break
7638                            replies in both cases. Don't keep logging an error
7639                            message here - just ignore it. JRA. */
7640
7641                         DEBUG(5,("reply_lockingX: Error : oplock break from "
7642                                  "client for fnum = %d (oplock=%d) and no "
7643                                  "oplock granted on this file (%s).\n",
7644                                  fsp->fnum, fsp->oplock_type,
7645                                  fsp_str_dbg(fsp)));
7646
7647                         /* if this is a pure oplock break request then don't
7648                          * send a reply */
7649                         if (num_locks == 0 && num_ulocks == 0) {
7650                                 END_PROFILE(SMBlockingX);
7651                                 return;
7652                         } else {
7653                                 END_PROFILE(SMBlockingX);
7654                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7655                                 return;
7656                         }
7657                 }
7658
7659                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7660                     (break_to_none)) {
7661                         result = remove_oplock(fsp);
7662                 } else {
7663                         result = downgrade_oplock(fsp);
7664                 }
7665
7666                 if (!result) {
7667                         DEBUG(0, ("reply_lockingX: error in removing "
7668                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
7669                         /* Hmmm. Is this panic justified? */
7670                         smb_panic("internal tdb error");
7671                 }
7672
7673                 reply_to_oplock_break_requests(fsp);
7674
7675                 /* if this is a pure oplock break request then don't send a
7676                  * reply */
7677                 if (num_locks == 0 && num_ulocks == 0) {
7678                         /* Sanity check - ensure a pure oplock break is not a
7679                            chained request. */
7680                         if(CVAL(req->vwv+0, 0) != 0xff)
7681                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
7682                                          "break is a chained %d request !\n",
7683                                          (unsigned int)CVAL(req->vwv+0, 0)));
7684                         END_PROFILE(SMBlockingX);
7685                         return;
7686                 }
7687         }
7688
7689         if (req->buflen <
7690             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7691                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7692                 END_PROFILE(SMBlockingX);
7693                 return;
7694         }
7695
7696         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7697         if (ulocks == NULL) {
7698                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7699                 END_PROFILE(SMBlockingX);
7700                 return;
7701         }
7702
7703         locks = talloc_array(req, struct smbd_lock_element, num_locks);
7704         if (locks == NULL) {
7705                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7706                 END_PROFILE(SMBlockingX);
7707                 return;
7708         }
7709
7710         /* Data now points at the beginning of the list
7711            of smb_unlkrng structs */
7712         for(i = 0; i < (int)num_ulocks; i++) {
7713                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7714                 ulocks[i].count = get_lock_count(data, i, large_file_format);
7715                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7716                 ulocks[i].brltype = UNLOCK_LOCK;
7717
7718                 /*
7719                  * There is no error code marked "stupid client bug".... :-).
7720                  */
7721                 if(err) {
7722                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7723                         END_PROFILE(SMBlockingX);
7724                         return;
7725                 }
7726         }
7727
7728         /* Now do any requested locks */
7729         data += ((large_file_format ? 20 : 10)*num_ulocks);
7730
7731         /* Data now points at the beginning of the list
7732            of smb_lkrng structs */
7733
7734         for(i = 0; i < (int)num_locks; i++) {
7735                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7736                 locks[i].count = get_lock_count(data, i, large_file_format);
7737                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7738
7739                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7740                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7741                                 locks[i].brltype = PENDING_READ_LOCK;
7742                         } else {
7743                                 locks[i].brltype = READ_LOCK;
7744                         }
7745                 } else {
7746                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7747                                 locks[i].brltype = PENDING_WRITE_LOCK;
7748                         } else {
7749                                 locks[i].brltype = WRITE_LOCK;
7750                         }
7751                 }
7752
7753                 /*
7754                  * There is no error code marked "stupid client bug".... :-).
7755                  */
7756                 if(err) {
7757                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7758                         END_PROFILE(SMBlockingX);
7759                         return;
7760                 }
7761         }
7762
7763         status = smbd_do_locking(req, fsp,
7764                                  locktype, lock_timeout,
7765                                  num_ulocks, ulocks,
7766                                  num_locks, locks,
7767                                  &async);
7768         if (!NT_STATUS_IS_OK(status)) {
7769                 END_PROFILE(SMBlockingX);
7770                 reply_nterror(req, status);
7771                 return;
7772         }
7773         if (async) {
7774                 END_PROFILE(SMBlockingX);
7775                 return;
7776         }
7777
7778         reply_outbuf(req, 2, 0);
7779
7780         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7781                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7782
7783         END_PROFILE(SMBlockingX);
7784         chain_reply(req);
7785 }
7786
7787 #undef DBGC_CLASS
7788 #define DBGC_CLASS DBGC_ALL
7789
7790 /****************************************************************************
7791  Reply to a SMBreadbmpx (read block multiplex) request.
7792  Always reply with an error, if someone has a platform really needs this,
7793  please contact vl@samba.org
7794 ****************************************************************************/
7795
7796 void reply_readbmpx(struct smb_request *req)
7797 {
7798         START_PROFILE(SMBreadBmpx);
7799         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7800         END_PROFILE(SMBreadBmpx);
7801         return;
7802 }
7803
7804 /****************************************************************************
7805  Reply to a SMBreadbs (read block multiplex secondary) request.
7806  Always reply with an error, if someone has a platform really needs this,
7807  please contact vl@samba.org
7808 ****************************************************************************/
7809
7810 void reply_readbs(struct smb_request *req)
7811 {
7812         START_PROFILE(SMBreadBs);
7813         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7814         END_PROFILE(SMBreadBs);
7815         return;
7816 }
7817
7818 /****************************************************************************
7819  Reply to a SMBsetattrE.
7820 ****************************************************************************/
7821
7822 void reply_setattrE(struct smb_request *req)
7823 {
7824         connection_struct *conn = req->conn;
7825         struct smb_file_time ft;
7826         files_struct *fsp;
7827         NTSTATUS status;
7828
7829         START_PROFILE(SMBsetattrE);
7830         ZERO_STRUCT(ft);
7831
7832         if (req->wct < 7) {
7833                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7834                 goto out;
7835         }
7836
7837         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7838
7839         if(!fsp || (fsp->conn != conn)) {
7840                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7841                 goto out;
7842         }
7843
7844         /*
7845          * Convert the DOS times into unix times.
7846          */
7847
7848         ft.atime = convert_time_t_to_timespec(
7849             srv_make_unix_date2(req->vwv+3));
7850         ft.mtime = convert_time_t_to_timespec(
7851             srv_make_unix_date2(req->vwv+5));
7852         ft.create_time = convert_time_t_to_timespec(
7853             srv_make_unix_date2(req->vwv+1));
7854
7855         reply_outbuf(req, 0, 0);
7856
7857         /*
7858          * Patch from Ray Frush <frush@engr.colostate.edu>
7859          * Sometimes times are sent as zero - ignore them.
7860          */
7861
7862         /* Ensure we have a valid stat struct for the source. */
7863         status = vfs_stat_fsp(fsp);
7864         if (!NT_STATUS_IS_OK(status)) {
7865                 reply_nterror(req, status);
7866                 goto out;
7867         }
7868
7869         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7870         if (!NT_STATUS_IS_OK(status)) {
7871                 reply_nterror(req, status);
7872                 goto out;
7873         }
7874
7875         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7876                " createtime=%u\n",
7877                 fsp->fnum,
7878                 (unsigned int)ft.atime.tv_sec,
7879                 (unsigned int)ft.mtime.tv_sec,
7880                 (unsigned int)ft.create_time.tv_sec
7881                 ));
7882  out:
7883         END_PROFILE(SMBsetattrE);
7884         return;
7885 }
7886
7887
7888 /* Back from the dead for OS/2..... JRA. */
7889
7890 /****************************************************************************
7891  Reply to a SMBwritebmpx (write block multiplex primary) request.
7892  Always reply with an error, if someone has a platform really needs this,
7893  please contact vl@samba.org
7894 ****************************************************************************/
7895
7896 void reply_writebmpx(struct smb_request *req)
7897 {
7898         START_PROFILE(SMBwriteBmpx);
7899         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7900         END_PROFILE(SMBwriteBmpx);
7901         return;
7902 }
7903
7904 /****************************************************************************
7905  Reply to a SMBwritebs (write block multiplex secondary) request.
7906  Always reply with an error, if someone has a platform really needs this,
7907  please contact vl@samba.org
7908 ****************************************************************************/
7909
7910 void reply_writebs(struct smb_request *req)
7911 {
7912         START_PROFILE(SMBwriteBs);
7913         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7914         END_PROFILE(SMBwriteBs);
7915         return;
7916 }
7917
7918 /****************************************************************************
7919  Reply to a SMBgetattrE.
7920 ****************************************************************************/
7921
7922 void reply_getattrE(struct smb_request *req)
7923 {
7924         connection_struct *conn = req->conn;
7925         int mode;
7926         files_struct *fsp;
7927         struct timespec create_ts;
7928
7929         START_PROFILE(SMBgetattrE);
7930
7931         if (req->wct < 1) {
7932                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7933                 END_PROFILE(SMBgetattrE);
7934                 return;
7935         }
7936
7937         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7938
7939         if(!fsp || (fsp->conn != conn)) {
7940                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7941                 END_PROFILE(SMBgetattrE);
7942                 return;
7943         }
7944
7945         /* Do an fstat on this file */
7946         if(fsp_stat(fsp)) {
7947                 reply_nterror(req, map_nt_error_from_unix(errno));
7948                 END_PROFILE(SMBgetattrE);
7949                 return;
7950         }
7951
7952         mode = dos_mode(conn, fsp->fsp_name);
7953
7954         /*
7955          * Convert the times into dos times. Set create
7956          * date to be last modify date as UNIX doesn't save
7957          * this.
7958          */
7959
7960         reply_outbuf(req, 11, 0);
7961
7962         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7963         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7964         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7965                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7966         /* Should we check pending modtime here ? JRA */
7967         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7968                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7969
7970         if (mode & aDIR) {
7971                 SIVAL(req->outbuf, smb_vwv6, 0);
7972                 SIVAL(req->outbuf, smb_vwv8, 0);
7973         } else {
7974                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7975                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7976                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7977         }
7978         SSVAL(req->outbuf,smb_vwv10, mode);
7979
7980         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7981
7982         END_PROFILE(SMBgetattrE);
7983         return;
7984 }