source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "printing.h"
  29 #include "smbd/globals.h"
  30 #include "fake_file.h"
  31 #include "../librpc/gen_ndr/cli_spoolss.h"
  32 #include "rpc_client/cli_spoolss.h"
  33 #include "rpc_client/init_spoolss.h"
  34
  35 /****************************************************************************
  36  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  37  path or anything including wildcards.
  38  We're assuming here that '/' is not the second byte in any multibyte char
  39  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  40  set.
  41 ****************************************************************************/
  42
  43 /* Custom version for processing POSIX paths. */
  44 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  45
  46 static NTSTATUS check_path_syntax_internal(char *path,
  47                                            bool posix_path,
  48                                            bool *p_last_component_contains_wcard)
  49 {
  50         char *d = path;
  51         const char *s = path;
  52         NTSTATUS ret = NT_STATUS_OK;
  53         bool start_of_name_component = True;
  54         bool stream_started = false;
  55
  56         *p_last_component_contains_wcard = False;
  57
  58         while (*s) {
  59                 if (stream_started) {
  60                         switch (*s) {
  61                         case '/':
  62                         case '\\':
  63                                 return NT_STATUS_OBJECT_NAME_INVALID;
  64                         case ':':
  65                                 if (s[1] == '\0') {
  66                                         return NT_STATUS_OBJECT_NAME_INVALID;
  67                                 }
  68                                 if (strchr_m(&s[1], ':')) {
  69                                         return NT_STATUS_OBJECT_NAME_INVALID;
  70                                 }
  71                                 break;
  72                         }
  73                 }
  74
  75                 if ((*s == ':') && !posix_path && !stream_started) {
  76                         if (*p_last_component_contains_wcard) {
  77                                 return NT_STATUS_OBJECT_NAME_INVALID;
  78                         }
  79                         /* Stream names allow more characters than file names.
  80                            We're overloading posix_path here to allow a wider
  81                            range of characters. If stream_started is true this
  82                            is still a Windows path even if posix_path is true.
  83                            JRA.
  84                         */
  85                         stream_started = true;
  86                         start_of_name_component = false;
  87                         posix_path = true;
  88
  89                         if (s[1] == '\0') {
  90                                 return NT_STATUS_OBJECT_NAME_INVALID;
  91                         }
  92                 }
  93
  94                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
  95                         /*
  96                          * Safe to assume is not the second part of a mb char
  97                          * as this is handled below.
  98                          */
  99                         /* Eat multiple '/' or '\\' */
 100                         while (IS_PATH_SEP(*s,posix_path)) {
 101                                 s++;
 102                         }
 103                         if ((d != path) && (*s != '\0')) {
 104                                 /* We only care about non-leading or trailing '/' or '\\' */
 105                                 *d++ = '/';
 106                         }
 107
 108                         start_of_name_component = True;
 109                         /* New component. */
 110                         *p_last_component_contains_wcard = False;
 111                         continue;
 112                 }
 113
 114                 if (start_of_name_component) {
 115                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 116                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 117
 118                                 /*
 119                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 120                                  */
 121
 122                                 /* If  we just added a '/' - delete it */
 123                                 if ((d > path) && (*(d-1) == '/')) {
 124                                         *(d-1) = '\0';
 125                                         d--;
 126                                 }
 127
 128                                 /* Are we at the start ? Can't go back further if so. */
 129                                 if (d <= path) {
 130                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 131                                         break;
 132                                 }
 133                                 /* Go back one level... */
 134                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 135                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 136                                 /* Decrement d first as d points to the *next* char to write into. */
 137                                 for (d--; d > path; d--) {
 138                                         if (*d == '/')
 139                                                 break;
 140                                 }
 141                                 s += 2; /* Else go past the .. */
 142                                 /* We're still at the start of a name component, just the previous one. */
 143                                 continue;
 144
 145                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 146                                 if (posix_path) {
 147                                         /* Eat the '.' */
 148                                         s++;
 149                                         continue;
 150                                 }
 151                         }
 152
 153                 }
 154
 155                 if (!(*s & 0x80)) {
 156                         if (!posix_path) {
 157                                 if (*s <= 0x1f || *s == '|') {
 158                                         return NT_STATUS_OBJECT_NAME_INVALID;
 159                                 }
 160                                 switch (*s) {
 161                                         case '*':
 162                                         case '?':
 163                                         case '<':
 164                                         case '>':
 165                                         case '"':
 166                                                 *p_last_component_contains_wcard = True;
 167                                                 break;
 168                                         default:
 169                                                 break;
 170                                 }
 171                         }
 172                         *d++ = *s++;
 173                 } else {
 174                         size_t siz;
 175                         /* Get the size of the next MB character. */
 176                         next_codepoint(s,&siz);
 177                         switch(siz) {
 178                                 case 5:
 179                                         *d++ = *s++;
 180                                         /*fall through*/
 181                                 case 4:
 182                                         *d++ = *s++;
 183                                         /*fall through*/
 184                                 case 3:
 185                                         *d++ = *s++;
 186                                         /*fall through*/
 187                                 case 2:
 188                                         *d++ = *s++;
 189                                         /*fall through*/
 190                                 case 1:
 191                                         *d++ = *s++;
 192                                         break;
 193                                 default:
 194                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 195                                         *d = '\0';
 196                                         return NT_STATUS_INVALID_PARAMETER;
 197                         }
 198                 }
 199                 start_of_name_component = False;
 200         }
 201
 202         *d = '\0';
 203
 204         return ret;
 205 }
 206
 207 /****************************************************************************
 208  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 209  No wildcards allowed.
 210 ****************************************************************************/
 211
 212 NTSTATUS check_path_syntax(char *path)
 213 {
 214         bool ignore;
 215         return check_path_syntax_internal(path, False, &ignore);
 216 }
 217
 218 /****************************************************************************
 219  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 220  Wildcards allowed - p_contains_wcard returns true if the last component contained
 221  a wildcard.
 222 ****************************************************************************/
 223
 224 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 225 {
 226         return check_path_syntax_internal(path, False, p_contains_wcard);
 227 }
 228
 229 /****************************************************************************
 230  Check the path for a POSIX client.
 231  We're assuming here that '/' is not the second byte in any multibyte char
 232  set (a safe assumption).
 233 ****************************************************************************/
 234
 235 NTSTATUS check_path_syntax_posix(char *path)
 236 {
 237         bool ignore;
 238         return check_path_syntax_internal(path, True, &ignore);
 239 }
 240
 241 /****************************************************************************
 242  Pull a string and check the path allowing a wilcard - provide for error return.
 243 ****************************************************************************/
 244
 245 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 246                         const char *base_ptr,
 247                         uint16 smb_flags2,
 248                         char **pp_dest,
 249                         const char *src,
 250                         size_t src_len,
 251                         int flags,
 252                         NTSTATUS *err,
 253                         bool *contains_wcard)
 254 {
 255         size_t ret;
 256
 257         *pp_dest = NULL;
 258
 259         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 260                                  src_len, flags);
 261
 262         if (!*pp_dest) {
 263                 *err = NT_STATUS_INVALID_PARAMETER;
 264                 return ret;
 265         }
 266
 267         *contains_wcard = False;
 268
 269         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 270                 /*
 271                  * For a DFS path the function parse_dfs_path()
 272                  * will do the path processing, just make a copy.
 273                  */
 274                 *err = NT_STATUS_OK;
 275                 return ret;
 276         }
 277
 278         if (lp_posix_pathnames()) {
 279                 *err = check_path_syntax_posix(*pp_dest);
 280         } else {
 281                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 282         }
 283
 284         return ret;
 285 }
 286
 287 /****************************************************************************
 288  Pull a string and check the path - provide for error return.
 289 ****************************************************************************/
 290
 291 size_t srvstr_get_path(TALLOC_CTX *ctx,
 292                         const char *base_ptr,
 293                         uint16 smb_flags2,
 294                         char **pp_dest,
 295                         const char *src,
 296                         size_t src_len,
 297                         int flags,
 298                         NTSTATUS *err)
 299 {
 300         bool ignore;
 301         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 302                                      src_len, flags, err, &ignore);
 303 }
 304
 305 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 306                                  char **pp_dest, const char *src, int flags,
 307                                  NTSTATUS *err, bool *contains_wcard)
 308 {
 309         return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
 310                                      pp_dest, src, smbreq_bufrem(req, src),
 311                                      flags, err, contains_wcard);
 312 }
 313
 314 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 315                            char **pp_dest, const char *src, int flags,
 316                            NTSTATUS *err)
 317 {
 318         bool ignore;
 319         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 320                                          flags, err, &ignore);
 321 }
 322
 323 /****************************************************************************
 324  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 325 ****************************************************************************/
 326
 327 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 328                     files_struct *fsp)
 329 {
 330         if ((fsp == NULL) || (conn == NULL)) {
 331                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 332                 return False;
 333         }
 334         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 335                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 336                 return False;
 337         }
 338         return True;
 339 }
 340
 341 /****************************************************************************
 342  Check if we have a correct fsp pointing to a file.
 343 ****************************************************************************/
 344
 345 bool check_fsp(connection_struct *conn, struct smb_request *req,
 346                files_struct *fsp)
 347 {
 348         if (!check_fsp_open(conn, req, fsp)) {
 349                 return False;
 350         }
 351         if (fsp->is_directory) {
 352                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 353                 return False;
 354         }
 355         if (fsp->fh->fd == -1) {
 356                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 357                 return False;
 358         }
 359         fsp->num_smb_operations++;
 360         return True;
 361 }
 362
 363 /****************************************************************************
 364  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 365  the CHECK_NTQUOTA_HANDLE_OK macro.
 366 ****************************************************************************/
 367
 368 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 369                               files_struct *fsp)
 370 {
 371         if (!check_fsp_open(conn, req, fsp)) {
 372                 return false;
 373         }
 374
 375         if (fsp->is_directory) {
 376                 return false;
 377         }
 378
 379         if (fsp->fake_file_handle == NULL) {
 380                 return false;
 381         }
 382
 383         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 384                 return false;
 385         }
 386
 387         if (fsp->fake_file_handle->private_data == NULL) {
 388                 return false;
 389         }
 390
 391         return true;
 392 }
 393
 394 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 395                                      const char *name, int name_type)
 396 {
 397         char *trim_name;
 398         char *trim_name_type;
 399         const char *retarget_parm;
 400         char *retarget;
 401         char *p;
 402         int retarget_type = 0x20;
 403         int retarget_port = 139;
 404         struct sockaddr_storage retarget_addr;
 405         struct sockaddr_in *in_addr;
 406         bool ret = false;
 407         uint8_t outbuf[10];
 408
 409         if (get_socket_port(sconn->sock) != 139) {
 410                 return false;
 411         }
 412
 413         trim_name = talloc_strdup(talloc_tos(), name);
 414         if (trim_name == NULL) {
 415                 goto fail;
 416         }
 417         trim_char(trim_name, ' ', ' ');
 418
 419         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 420                                          name_type);
 421         if (trim_name_type == NULL) {
 422                 goto fail;
 423         }
 424
 425         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 426                                              trim_name_type, NULL);
 427         if (retarget_parm == NULL) {
 428                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 429                                                      trim_name, NULL);
 430         }
 431         if (retarget_parm == NULL) {
 432                 goto fail;
 433         }
 434
 435         retarget = talloc_strdup(trim_name, retarget_parm);
 436         if (retarget == NULL) {
 437                 goto fail;
 438         }
 439
 440         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 441
 442         p = strchr(retarget, ':');
 443         if (p != NULL) {
 444                 *p++ = '\0';
 445                 retarget_port = atoi(p);
 446         }
 447
 448         p = strchr_m(retarget, '#');
 449         if (p != NULL) {
 450                 *p++ = '\0';
 451                 sscanf(p, "%x", &retarget_type);
 452         }
 453
 454         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 455         if (!ret) {
 456                 DEBUG(10, ("could not resolve %s\n", retarget));
 457                 goto fail;
 458         }
 459
 460         if (retarget_addr.ss_family != AF_INET) {
 461                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 462                 goto fail;
 463         }
 464
 465         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 466
 467         _smb_setlen(outbuf, 6);
 468         SCVAL(outbuf, 0, 0x84);
 469         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 470         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 471
 472         if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
 473                           NULL)) {
 474                 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
 475                                     "failed.");
 476         }
 477
 478         ret = true;
 479  fail:
 480         TALLOC_FREE(trim_name);
 481         return ret;
 482 }
 483
 484 /****************************************************************************
 485  Reply to a (netbios-level) special message.
 486 ****************************************************************************/
 487
 488 void reply_special(struct smbd_server_connection *sconn, char *inbuf)
 489 {
 490         int msg_type = CVAL(inbuf,0);
 491         int msg_flags = CVAL(inbuf,1);
 492         fstring name1,name2;
 493         char name_type1, name_type2;
 494
 495         /*
 496          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 497          * calculation & friends (srv_send_smb uses that) we need the full smb
 498          * header.
 499          */
 500         char outbuf[smb_size];
 501
 502         *name1 = *name2 = 0;
 503
 504         memset(outbuf, '\0', sizeof(outbuf));
 505
 506         smb_setlen(outbuf,0);
 507
 508         switch (msg_type) {
 509         case 0x81: /* session request */
 510
 511                 if (sconn->nbt.got_session) {
 512                         exit_server_cleanly("multiple session request not permitted");
 513                 }
 514
 515                 SCVAL(outbuf,0,0x82);
 516                 SCVAL(outbuf,3,0);
 517                 if (name_len(inbuf+4) > 50 ||
 518                     name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
 519                         DEBUG(0,("Invalid name length in session request\n"));
 520                         return;
 521                 }
 522                 name_type1 = name_extract(inbuf,4,name1);
 523                 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
 524                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 525                          name1, name_type1, name2, name_type2));
 526
 527                 if (netbios_session_retarget(sconn, name1, name_type1)) {
 528                         exit_server_cleanly("retargeted client");
 529                 }
 530
 531                 /*
 532                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 533                  * "*SMBSERV" arrggg!!!
 534                  */
 535                 if (strequal(name1, "*SMBSERVER     ")
 536                     || strequal(name1, "*SMBSERV       "))  {
 537                         fstrcpy(name1, sconn->client_id.addr);
 538                 }
 539
 540                 set_local_machine_name(name1, True);
 541                 set_remote_machine_name(name2, True);
 542
 543                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 544                          get_local_machine_name(), get_remote_machine_name(),
 545                          name_type2));
 546
 547                 if (name_type2 == 'R') {
 548                         /* We are being asked for a pathworks session ---
 549                            no thanks! */
 550                         SCVAL(outbuf, 0,0x83);
 551                         break;
 552                 }
 553
 554                 /* only add the client's machine name to the list
 555                    of possibly valid usernames if we are operating
 556                    in share mode security */
 557                 if (lp_security() == SEC_SHARE) {
 558                         add_session_user(sconn, get_remote_machine_name());
 559                 }
 560
 561                 reload_services(sconn->msg_ctx, sconn->sock, True);
 562                 reopen_logs();
 563
 564                 sconn->nbt.got_session = true;
 565                 break;
 566
 567         case 0x89: /* session keepalive request
 568                       (some old clients produce this?) */
 569                 SCVAL(outbuf,0,SMBkeepalive);
 570                 SCVAL(outbuf,3,0);
 571                 break;
 572
 573         case 0x82: /* positive session response */
 574         case 0x83: /* negative session response */
 575         case 0x84: /* retarget session response */
 576                 DEBUG(0,("Unexpected session response\n"));
 577                 break;
 578
 579         case SMBkeepalive: /* session keepalive */
 580         default:
 581                 return;
 582         }
 583
 584         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 585                     msg_type, msg_flags));
 586
 587         srv_send_smb(sconn, outbuf, false, 0, false, NULL);
 588         return;
 589 }
 590
 591 /****************************************************************************
 592  Reply to a tcon.
 593  conn POINTER CAN BE NULL HERE !
 594 ****************************************************************************/
 595
 596 void reply_tcon(struct smb_request *req)
 597 {
 598         connection_struct *conn = req->conn;
 599         const char *service;
 600         char *service_buf = NULL;
 601         char *password = NULL;
 602         char *dev = NULL;
 603         int pwlen=0;
 604         NTSTATUS nt_status;
 605         const char *p;
 606         DATA_BLOB password_blob;
 607         TALLOC_CTX *ctx = talloc_tos();
 608         struct smbd_server_connection *sconn = req->sconn;
 609
 610         START_PROFILE(SMBtcon);
 611
 612         if (req->buflen < 4) {
 613                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 614                 END_PROFILE(SMBtcon);
 615                 return;
 616         }
 617
 618         p = (const char *)req->buf + 1;
 619         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 620         p += 1;
 621         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 622         p += pwlen+1;
 623         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 624         p += 1;
 625
 626         if (service_buf == NULL || password == NULL || dev == NULL) {
 627                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 628                 END_PROFILE(SMBtcon);
 629                 return;
 630         }
 631         p = strrchr_m(service_buf,'\\');
 632         if (p) {
 633                 service = p+1;
 634         } else {
 635                 service = service_buf;
 636         }
 637
 638         password_blob = data_blob(password, pwlen+1);
 639
 640         conn = make_connection(sconn,service,password_blob,dev,
 641                                req->vuid,&nt_status);
 642         req->conn = conn;
 643
 644         data_blob_clear_free(&password_blob);
 645
 646         if (!conn) {
 647                 reply_nterror(req, nt_status);
 648                 END_PROFILE(SMBtcon);
 649                 return;
 650         }
 651
 652         reply_outbuf(req, 2, 0);
 653         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 654         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 655         SSVAL(req->outbuf,smb_tid,conn->cnum);
 656
 657         DEBUG(3,("tcon service=%s cnum=%d\n",
 658                  service, conn->cnum));
 659
 660         END_PROFILE(SMBtcon);
 661         return;
 662 }
 663
 664 /****************************************************************************
 665  Reply to a tcon and X.
 666  conn POINTER CAN BE NULL HERE !
 667 ****************************************************************************/
 668
 669 void reply_tcon_and_X(struct smb_request *req)
 670 {
 671         connection_struct *conn = req->conn;
 672         const char *service = NULL;
 673         DATA_BLOB password;
 674         TALLOC_CTX *ctx = talloc_tos();
 675         /* what the cleint thinks the device is */
 676         char *client_devicetype = NULL;
 677         /* what the server tells the client the share represents */
 678         const char *server_devicetype;
 679         NTSTATUS nt_status;
 680         int passlen;
 681         char *path = NULL;
 682         const char *p, *q;
 683         uint16 tcon_flags;
 684         struct smbd_server_connection *sconn = req->sconn;
 685
 686         START_PROFILE(SMBtconX);
 687
 688         if (req->wct < 4) {
 689                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 690                 END_PROFILE(SMBtconX);
 691                 return;
 692         }
 693
 694         passlen = SVAL(req->vwv+3, 0);
 695         tcon_flags = SVAL(req->vwv+2, 0);
 696
 697         /* we might have to close an old one */
 698         if ((tcon_flags & 0x1) && conn) {
 699                 close_cnum(conn,req->vuid);
 700                 req->conn = NULL;
 701                 conn = NULL;
 702         }
 703
 704         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 705                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 706                 END_PROFILE(SMBtconX);
 707                 return;
 708         }
 709
 710         if (sconn->smb1.negprot.encrypted_passwords) {
 711                 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
 712                 if (lp_security() == SEC_SHARE) {
 713                         /*
 714                          * Security = share always has a pad byte
 715                          * after the password.
 716                          */
 717                         p = (const char *)req->buf + passlen + 1;
 718                 } else {
 719                         p = (const char *)req->buf + passlen;
 720                 }
 721         } else {
 722                 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
 723                 /* Ensure correct termination */
 724                 password.data[passlen]=0;
 725                 p = (const char *)req->buf + passlen + 1;
 726         }
 727
 728         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 729
 730         if (path == NULL) {
 731                 data_blob_clear_free(&password);
 732                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 733                 END_PROFILE(SMBtconX);
 734                 return;
 735         }
 736
 737         /*
 738          * the service name can be either: \\server\share
 739          * or share directly like on the DELL PowerVault 705
 740          */
 741         if (*path=='\\') {
 742                 q = strchr_m(path+2,'\\');
 743                 if (!q) {
 744                         data_blob_clear_free(&password);
 745                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 746                         END_PROFILE(SMBtconX);
 747                         return;
 748                 }
 749                 service = q+1;
 750         } else {
 751                 service = path;
 752         }
 753
 754         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 755                                 &client_devicetype, p,
 756                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 757
 758         if (client_devicetype == NULL) {
 759                 data_blob_clear_free(&password);
 760                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 761                 END_PROFILE(SMBtconX);
 762                 return;
 763         }
 764
 765         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 766
 767         conn = make_connection(sconn, service, password, client_devicetype,
 768                                req->vuid, &nt_status);
 769         req->conn =conn;
 770
 771         data_blob_clear_free(&password);
 772
 773         if (!conn) {
 774                 reply_nterror(req, nt_status);
 775                 END_PROFILE(SMBtconX);
 776                 return;
 777         }
 778
 779         if ( IS_IPC(conn) )
 780                 server_devicetype = "IPC";
 781         else if ( IS_PRINT(conn) )
 782                 server_devicetype = "LPT1:";
 783         else
 784                 server_devicetype = "A:";
 785
 786         if (get_Protocol() < PROTOCOL_NT1) {
 787                 reply_outbuf(req, 2, 0);
 788                 if (message_push_string(&req->outbuf, server_devicetype,
 789                                         STR_TERMINATE|STR_ASCII) == -1) {
 790                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 791                         END_PROFILE(SMBtconX);
 792                         return;
 793                 }
 794         } else {
 795                 /* NT sets the fstype of IPC$ to the null string */
 796                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 797
 798                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 799                         /* Return permissions. */
 800                         uint32 perm1 = 0;
 801                         uint32 perm2 = 0;
 802
 803                         reply_outbuf(req, 7, 0);
 804
 805                         if (IS_IPC(conn)) {
 806                                 perm1 = FILE_ALL_ACCESS;
 807                                 perm2 = FILE_ALL_ACCESS;
 808                         } else {
 809                                 perm1 = CAN_WRITE(conn) ?
 810                                                 SHARE_ALL_ACCESS :
 811                                                 SHARE_READ_ONLY;
 812                         }
 813
 814                         SIVAL(req->outbuf, smb_vwv3, perm1);
 815                         SIVAL(req->outbuf, smb_vwv5, perm2);
 816                 } else {
 817                         reply_outbuf(req, 3, 0);
 818                 }
 819
 820                 if ((message_push_string(&req->outbuf, server_devicetype,
 821                                          STR_TERMINATE|STR_ASCII) == -1)
 822                     || (message_push_string(&req->outbuf, fstype,
 823                                             STR_TERMINATE) == -1)) {
 824                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 825                         END_PROFILE(SMBtconX);
 826                         return;
 827                 }
 828
 829                 /* what does setting this bit do? It is set by NT4 and
 830                    may affect the ability to autorun mounted cdroms */
 831                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 832                       (lp_csc_policy(SNUM(conn)) << 2));
 833
 834                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
 835                         DEBUG(2,("Serving %s as a Dfs root\n",
 836                                  lp_servicename(SNUM(conn)) ));
 837                         SSVAL(req->outbuf, smb_vwv2,
 838                               SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
 839                 }
 840         }
 841
 842
 843         DEBUG(3,("tconX service=%s \n",
 844                  service));
 845
 846         /* set the incoming and outgoing tid to the just created one */
 847         SSVAL(req->inbuf,smb_tid,conn->cnum);
 848         SSVAL(req->outbuf,smb_tid,conn->cnum);
 849
 850         END_PROFILE(SMBtconX);
 851
 852         req->tid = conn->cnum;
 853         chain_reply(req);
 854         return;
 855 }
 856
 857 /****************************************************************************
 858  Reply to an unknown type.
 859 ****************************************************************************/
 860
 861 void reply_unknown_new(struct smb_request *req, uint8 type)
 862 {
 863         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 864                   smb_fn_name(type), type, type));
 865         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
 866         return;
 867 }
 868
 869 /****************************************************************************
 870  Reply to an ioctl.
 871  conn POINTER CAN BE NULL HERE !
 872 ****************************************************************************/
 873
 874 void reply_ioctl(struct smb_request *req)
 875 {
 876         connection_struct *conn = req->conn;
 877         uint16 device;
 878         uint16 function;
 879         uint32 ioctl_code;
 880         int replysize;
 881         char *p;
 882
 883         START_PROFILE(SMBioctl);
 884
 885         if (req->wct < 3) {
 886                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 887                 END_PROFILE(SMBioctl);
 888                 return;
 889         }
 890
 891         device     = SVAL(req->vwv+1, 0);
 892         function   = SVAL(req->vwv+2, 0);
 893         ioctl_code = (device << 16) + function;
 894
 895         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 896
 897         switch (ioctl_code) {
 898             case IOCTL_QUERY_JOB_INFO:
 899                     replysize = 32;
 900                     break;
 901             default:
 902                     reply_force_doserror(req, ERRSRV, ERRnosupport);
 903                     END_PROFILE(SMBioctl);
 904                     return;
 905         }
 906
 907         reply_outbuf(req, 8, replysize+1);
 908         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 909         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 910         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 911         p = smb_buf(req->outbuf);
 912         memset(p, '\0', replysize+1); /* valgrind-safe. */
 913         p += 1;          /* Allow for alignment */
 914
 915         switch (ioctl_code) {
 916                 case IOCTL_QUERY_JOB_INFO:
 917                 {
 918                         files_struct *fsp = file_fsp(
 919                                 req, SVAL(req->vwv+0, 0));
 920                         if (!fsp) {
 921                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 922                                 END_PROFILE(SMBioctl);
 923                                 return;
 924                         }
 925                         /* Job number */
 926                         if (fsp->print_file) {
 927                                 SSVAL(p, 0, fsp->print_file->rap_jobid);
 928                         } else {
 929                                 SSVAL(p, 0, 0);
 930                         }
 931                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 932                                     global_myname(), 15,
 933                                     STR_TERMINATE|STR_ASCII);
 934                         if (conn) {
 935                                 srvstr_push((char *)req->outbuf, req->flags2,
 936                                             p+18, lp_servicename(SNUM(conn)),
 937                                             13, STR_TERMINATE|STR_ASCII);
 938                         } else {
 939                                 memset(p+18, 0, 13);
 940                         }
 941                         break;
 942                 }
 943         }
 944
 945         END_PROFILE(SMBioctl);
 946         return;
 947 }
 948
 949 /****************************************************************************
 950  Strange checkpath NTSTATUS mapping.
 951 ****************************************************************************/
 952
 953 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
 954 {
 955         /* Strange DOS error code semantics only for checkpath... */
 956         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 957                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 958                         /* We need to map to ERRbadpath */
 959                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 960                 }
 961         }
 962         return status;
 963 }
 964
 965 /****************************************************************************
 966  Reply to a checkpath.
 967 ****************************************************************************/
 968
 969 void reply_checkpath(struct smb_request *req)
 970 {
 971         connection_struct *conn = req->conn;
 972         struct smb_filename *smb_fname = NULL;
 973         char *name = NULL;
 974         NTSTATUS status;
 975         TALLOC_CTX *ctx = talloc_tos();
 976
 977         START_PROFILE(SMBcheckpath);
 978
 979         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
 980                             STR_TERMINATE, &status);
 981
 982         if (!NT_STATUS_IS_OK(status)) {
 983                 status = map_checkpath_error(req->flags2, status);
 984                 reply_nterror(req, status);
 985                 END_PROFILE(SMBcheckpath);
 986                 return;
 987         }
 988
 989         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
 990
 991         status = filename_convert(ctx,
 992                                 conn,
 993                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
 994                                 name,
 995                                 0,
 996                                 NULL,
 997                                 &smb_fname);
 998
 999         if (!NT_STATUS_IS_OK(status)) {
1000                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1001                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1002                                         ERRSRV, ERRbadpath);
1003                         END_PROFILE(SMBcheckpath);
1004                         return;
1005                 }
1006                 goto path_err;
1007         }
1008
1009         if (!VALID_STAT(smb_fname->st) &&
1010             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1011                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1012                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1013                 status = map_nt_error_from_unix(errno);
1014                 goto path_err;
1015         }
1016
1017         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1018                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1019                                 ERRDOS, ERRbadpath);
1020                 goto out;
1021         }
1022
1023         reply_outbuf(req, 0, 0);
1024
1025  path_err:
1026         /* We special case this - as when a Windows machine
1027                 is parsing a path is steps through the components
1028                 one at a time - if a component fails it expects
1029                 ERRbadpath, not ERRbadfile.
1030         */
1031         status = map_checkpath_error(req->flags2, status);
1032         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1033                 /*
1034                  * Windows returns different error codes if
1035                  * the parent directory is valid but not the
1036                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1037                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1038                  * if the path is invalid.
1039                  */
1040                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1041                                 ERRDOS, ERRbadpath);
1042                 goto out;
1043         }
1044
1045         reply_nterror(req, status);
1046
1047  out:
1048         TALLOC_FREE(smb_fname);
1049         END_PROFILE(SMBcheckpath);
1050         return;
1051 }
1052
1053 /****************************************************************************
1054  Reply to a getatr.
1055 ****************************************************************************/
1056
1057 void reply_getatr(struct smb_request *req)
1058 {
1059         connection_struct *conn = req->conn;
1060         struct smb_filename *smb_fname = NULL;
1061         char *fname = NULL;
1062         int mode=0;
1063         SMB_OFF_T size=0;
1064         time_t mtime=0;
1065         const char *p;
1066         NTSTATUS status;
1067         TALLOC_CTX *ctx = talloc_tos();
1068         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1069
1070         START_PROFILE(SMBgetatr);
1071
1072         p = (const char *)req->buf + 1;
1073         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1074         if (!NT_STATUS_IS_OK(status)) {
1075                 reply_nterror(req, status);
1076                 goto out;
1077         }
1078
1079         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1080                 under WfWg - weird! */
1081         if (*fname == '\0') {
1082                 mode = aHIDDEN | aDIR;
1083                 if (!CAN_WRITE(conn)) {
1084                         mode |= aRONLY;
1085                 }
1086                 size = 0;
1087                 mtime = 0;
1088         } else {
1089                 status = filename_convert(ctx,
1090                                 conn,
1091                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1092                                 fname,
1093                                 0,
1094                                 NULL,
1095                                 &smb_fname);
1096                 if (!NT_STATUS_IS_OK(status)) {
1097                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1098                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1099                                                 ERRSRV, ERRbadpath);
1100                                 goto out;
1101                         }
1102                         reply_nterror(req, status);
1103                         goto out;
1104                 }
1105                 if (!VALID_STAT(smb_fname->st) &&
1106                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1107                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1108                                  smb_fname_str_dbg(smb_fname),
1109                                  strerror(errno)));
1110                         reply_nterror(req,  map_nt_error_from_unix(errno));
1111                         goto out;
1112                 }
1113
1114                 mode = dos_mode(conn, smb_fname);
1115                 size = smb_fname->st.st_ex_size;
1116
1117                 if (ask_sharemode) {
1118                         struct timespec write_time_ts;
1119                         struct file_id fileid;
1120
1121                         ZERO_STRUCT(write_time_ts);
1122                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1123                         get_file_infos(fileid, NULL, &write_time_ts);
1124                         if (!null_timespec(write_time_ts)) {
1125                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1126                         }
1127                 }
1128
1129                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1130                 if (mode & aDIR) {
1131                         size = 0;
1132                 }
1133         }
1134
1135         reply_outbuf(req, 10, 0);
1136
1137         SSVAL(req->outbuf,smb_vwv0,mode);
1138         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1139                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1140         } else {
1141                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1142         }
1143         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1144
1145         if (get_Protocol() >= PROTOCOL_NT1) {
1146                 SSVAL(req->outbuf, smb_flg2,
1147                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1148         }
1149
1150         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1151                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1152
1153  out:
1154         TALLOC_FREE(smb_fname);
1155         TALLOC_FREE(fname);
1156         END_PROFILE(SMBgetatr);
1157         return;
1158 }
1159
1160 /****************************************************************************
1161  Reply to a setatr.
1162 ****************************************************************************/
1163
1164 void reply_setatr(struct smb_request *req)
1165 {
1166         struct smb_file_time ft;
1167         connection_struct *conn = req->conn;
1168         struct smb_filename *smb_fname = NULL;
1169         char *fname = NULL;
1170         int mode;
1171         time_t mtime;
1172         const char *p;
1173         NTSTATUS status;
1174         TALLOC_CTX *ctx = talloc_tos();
1175
1176         START_PROFILE(SMBsetatr);
1177
1178         ZERO_STRUCT(ft);
1179
1180         if (req->wct < 2) {
1181                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1182                 goto out;
1183         }
1184
1185         p = (const char *)req->buf + 1;
1186         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1187         if (!NT_STATUS_IS_OK(status)) {
1188                 reply_nterror(req, status);
1189                 goto out;
1190         }
1191
1192         status = filename_convert(ctx,
1193                                 conn,
1194                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1195                                 fname,
1196                                 0,
1197                                 NULL,
1198                                 &smb_fname);
1199         if (!NT_STATUS_IS_OK(status)) {
1200                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1201                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1202                                         ERRSRV, ERRbadpath);
1203                         goto out;
1204                 }
1205                 reply_nterror(req, status);
1206                 goto out;
1207         }
1208
1209         if (smb_fname->base_name[0] == '.' &&
1210             smb_fname->base_name[1] == '\0') {
1211                 /*
1212                  * Not sure here is the right place to catch this
1213                  * condition. Might be moved to somewhere else later -- vl
1214                  */
1215                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1216                 goto out;
1217         }
1218
1219         mode = SVAL(req->vwv+0, 0);
1220         mtime = srv_make_unix_date3(req->vwv+1);
1221
1222         ft.mtime = convert_time_t_to_timespec(mtime);
1223         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1224         if (!NT_STATUS_IS_OK(status)) {
1225                 reply_nterror(req, status);
1226                 goto out;
1227         }
1228
1229         if (mode != FILE_ATTRIBUTE_NORMAL) {
1230                 if (VALID_STAT_OF_DIR(smb_fname->st))
1231                         mode |= aDIR;
1232                 else
1233                         mode &= ~aDIR;
1234
1235                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1236                                      false) != 0) {
1237                         reply_nterror(req, map_nt_error_from_unix(errno));
1238                         goto out;
1239                 }
1240         }
1241
1242         reply_outbuf(req, 0, 0);
1243
1244         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1245                  mode));
1246  out:
1247         TALLOC_FREE(smb_fname);
1248         END_PROFILE(SMBsetatr);
1249         return;
1250 }
1251
1252 /****************************************************************************
1253  Reply to a dskattr.
1254 ****************************************************************************/
1255
1256 void reply_dskattr(struct smb_request *req)
1257 {
1258         connection_struct *conn = req->conn;
1259         uint64_t dfree,dsize,bsize;
1260         START_PROFILE(SMBdskattr);
1261
1262         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1263                 reply_nterror(req, map_nt_error_from_unix(errno));
1264                 END_PROFILE(SMBdskattr);
1265                 return;
1266         }
1267
1268         reply_outbuf(req, 5, 0);
1269
1270         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1271                 double total_space, free_space;
1272                 /* we need to scale this to a number that DOS6 can handle. We
1273                    use floating point so we can handle large drives on systems
1274                    that don't have 64 bit integers
1275
1276                    we end up displaying a maximum of 2G to DOS systems
1277                 */
1278                 total_space = dsize * (double)bsize;
1279                 free_space = dfree * (double)bsize;
1280
1281                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1282                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1283
1284                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1285                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1286
1287                 SSVAL(req->outbuf,smb_vwv0,dsize);
1288                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1289                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1290                 SSVAL(req->outbuf,smb_vwv3,dfree);
1291         } else {
1292                 SSVAL(req->outbuf,smb_vwv0,dsize);
1293                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1294                 SSVAL(req->outbuf,smb_vwv2,512);
1295                 SSVAL(req->outbuf,smb_vwv3,dfree);
1296         }
1297
1298         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1299
1300         END_PROFILE(SMBdskattr);
1301         return;
1302 }
1303
1304 /*
1305  * Utility function to split the filename from the directory.
1306  */
1307 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1308                                      char **fname_dir_out,
1309                                      char **fname_mask_out)
1310 {
1311         const char *p = NULL;
1312         char *fname_dir = NULL;
1313         char *fname_mask = NULL;
1314
1315         p = strrchr_m(fname_in, '/');
1316         if (!p) {
1317                 fname_dir = talloc_strdup(ctx, ".");
1318                 fname_mask = talloc_strdup(ctx, fname_in);
1319         } else {
1320                 fname_dir = talloc_strndup(ctx, fname_in,
1321                     PTR_DIFF(p, fname_in));
1322                 fname_mask = talloc_strdup(ctx, p+1);
1323         }
1324
1325         if (!fname_dir || !fname_mask) {
1326                 TALLOC_FREE(fname_dir);
1327                 TALLOC_FREE(fname_mask);
1328                 return NT_STATUS_NO_MEMORY;
1329         }
1330
1331         *fname_dir_out = fname_dir;
1332         *fname_mask_out = fname_mask;
1333         return NT_STATUS_OK;
1334 }
1335
1336 /****************************************************************************
1337  Reply to a search.
1338  Can be called from SMBsearch, SMBffirst or SMBfunique.
1339 ****************************************************************************/
1340
1341 void reply_search(struct smb_request *req)
1342 {
1343         connection_struct *conn = req->conn;
1344         char *path = NULL;
1345         const char *mask = NULL;
1346         char *directory = NULL;
1347         struct smb_filename *smb_fname = NULL;
1348         char *fname = NULL;
1349         SMB_OFF_T size;
1350         uint32 mode;
1351         struct timespec date;
1352         uint32 dirtype;
1353         unsigned int numentries = 0;
1354         unsigned int maxentries = 0;
1355         bool finished = False;
1356         const char *p;
1357         int status_len;
1358         char status[21];
1359         int dptr_num= -1;
1360         bool check_descend = False;
1361         bool expect_close = False;
1362         NTSTATUS nt_status;
1363         bool mask_contains_wcard = False;
1364         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1365         TALLOC_CTX *ctx = talloc_tos();
1366         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1367         struct dptr_struct *dirptr = NULL;
1368         struct smbd_server_connection *sconn = req->sconn;
1369
1370         START_PROFILE(SMBsearch);
1371
1372         if (req->wct < 2) {
1373                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1374                 goto out;
1375         }
1376
1377         if (lp_posix_pathnames()) {
1378                 reply_unknown_new(req, req->cmd);
1379                 goto out;
1380         }
1381
1382         /* If we were called as SMBffirst then we must expect close. */
1383         if(req->cmd == SMBffirst) {
1384                 expect_close = True;
1385         }
1386
1387         reply_outbuf(req, 1, 3);
1388         maxentries = SVAL(req->vwv+0, 0);
1389         dirtype = SVAL(req->vwv+1, 0);
1390         p = (const char *)req->buf + 1;
1391         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1392                                        &nt_status, &mask_contains_wcard);
1393         if (!NT_STATUS_IS_OK(nt_status)) {
1394                 reply_nterror(req, nt_status);
1395                 goto out;
1396         }
1397
1398         p++;
1399         status_len = SVAL(p, 0);
1400         p += 2;
1401
1402         /* dirtype &= ~aDIR; */
1403
1404         if (status_len == 0) {
1405                 nt_status = filename_convert(ctx, conn,
1406                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1407                                              path,
1408                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1409                                              &mask_contains_wcard,
1410                                              &smb_fname);
1411                 if (!NT_STATUS_IS_OK(nt_status)) {
1412                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1413                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1414                                                 ERRSRV, ERRbadpath);
1415                                 goto out;
1416                         }
1417                         reply_nterror(req, nt_status);
1418                         goto out;
1419                 }
1420
1421                 directory = smb_fname->base_name;
1422
1423                 p = strrchr_m(directory,'/');
1424                 if ((p != NULL) && (*directory != '/')) {
1425                         mask = p + 1;
1426                         directory = talloc_strndup(ctx, directory,
1427                                                    PTR_DIFF(p, directory));
1428                 } else {
1429                         mask = directory;
1430                         directory = talloc_strdup(ctx,".");
1431                 }
1432
1433                 if (!directory) {
1434                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1435                         goto out;
1436                 }
1437
1438                 memset((char *)status,'\0',21);
1439                 SCVAL(status,0,(dirtype & 0x1F));
1440
1441                 nt_status = dptr_create(conn,
1442                                         directory,
1443                                         True,
1444                                         expect_close,
1445                                         req->smbpid,
1446                                         mask,
1447                                         mask_contains_wcard,
1448                                         dirtype,
1449                                         &dirptr);
1450                 if (!NT_STATUS_IS_OK(nt_status)) {
1451                         reply_nterror(req, nt_status);
1452                         goto out;
1453                 }
1454                 dptr_num = dptr_dnum(dirptr);
1455         } else {
1456                 int status_dirtype;
1457                 const char *dirpath;
1458
1459                 memcpy(status,p,21);
1460                 status_dirtype = CVAL(status,0) & 0x1F;
1461                 if (status_dirtype != (dirtype & 0x1F)) {
1462                         dirtype = status_dirtype;
1463                 }
1464
1465                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1466                 if (!dirptr) {
1467                         goto SearchEmpty;
1468                 }
1469                 dirpath = dptr_path(sconn, dptr_num);
1470                 directory = talloc_strdup(ctx, dirpath);
1471                 if (!directory) {
1472                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1473                         goto out;
1474                 }
1475
1476                 mask = dptr_wcard(sconn, dptr_num);
1477                 if (!mask) {
1478                         goto SearchEmpty;
1479                 }
1480                 /*
1481                  * For a 'continue' search we have no string. So
1482                  * check from the initial saved string.
1483                  */
1484                 mask_contains_wcard = ms_has_wild(mask);
1485                 dirtype = dptr_attr(sconn, dptr_num);
1486         }
1487
1488         DEBUG(4,("dptr_num is %d\n",dptr_num));
1489
1490         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1491         dptr_init_search_op(dirptr);
1492
1493         if ((dirtype&0x1F) == aVOLID) {
1494                 char buf[DIR_STRUCT_SIZE];
1495                 memcpy(buf,status,21);
1496                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1497                                 0,aVOLID,0,!allow_long_path_components)) {
1498                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1499                         goto out;
1500                 }
1501                 dptr_fill(sconn, buf+12,dptr_num);
1502                 if (dptr_zero(buf+12) && (status_len==0)) {
1503                         numentries = 1;
1504                 } else {
1505                         numentries = 0;
1506                 }
1507                 if (message_push_blob(&req->outbuf,
1508                                       data_blob_const(buf, sizeof(buf)))
1509                     == -1) {
1510                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1511                         goto out;
1512                 }
1513         } else {
1514                 unsigned int i;
1515                 maxentries = MIN(
1516                         maxentries,
1517                         ((BUFFER_SIZE -
1518                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1519                          /DIR_STRUCT_SIZE));
1520
1521                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1522                         directory,lp_dontdescend(SNUM(conn))));
1523                 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1524                         check_descend = True;
1525                 }
1526
1527                 for (i=numentries;(i<maxentries) && !finished;i++) {
1528                         finished = !get_dir_entry(ctx,
1529                                                   dirptr,
1530                                                   mask,
1531                                                   dirtype,
1532                                                   &fname,
1533                                                   &size,
1534                                                   &mode,
1535                                                   &date,
1536                                                   check_descend,
1537                                                   ask_sharemode);
1538                         if (!finished) {
1539                                 char buf[DIR_STRUCT_SIZE];
1540                                 memcpy(buf,status,21);
1541                                 if (!make_dir_struct(ctx,
1542                                                 buf,
1543                                                 mask,
1544                                                 fname,
1545                                                 size,
1546                                                 mode,
1547                                                 convert_timespec_to_time_t(date),
1548                                                 !allow_long_path_components)) {
1549                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1550                                         goto out;
1551                                 }
1552                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1553                                         break;
1554                                 }
1555                                 if (message_push_blob(&req->outbuf,
1556                                                       data_blob_const(buf, sizeof(buf)))
1557                                     == -1) {
1558                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1559                                         goto out;
1560                                 }
1561                                 numentries++;
1562                         }
1563                 }
1564         }
1565
1566   SearchEmpty:
1567
1568         /* If we were called as SMBffirst with smb_search_id == NULL
1569                 and no entries were found then return error and close dirptr
1570                 (X/Open spec) */
1571
1572         if (numentries == 0) {
1573                 dptr_close(sconn, &dptr_num);
1574         } else if(expect_close && status_len == 0) {
1575                 /* Close the dptr - we know it's gone */
1576                 dptr_close(sconn, &dptr_num);
1577         }
1578
1579         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1580         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1581                 dptr_close(sconn, &dptr_num);
1582         }
1583
1584         if ((numentries == 0) && !mask_contains_wcard) {
1585                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1586                 goto out;
1587         }
1588
1589         SSVAL(req->outbuf,smb_vwv0,numentries);
1590         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1591         SCVAL(smb_buf(req->outbuf),0,5);
1592         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1593
1594         /* The replies here are never long name. */
1595         SSVAL(req->outbuf, smb_flg2,
1596               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1597         if (!allow_long_path_components) {
1598                 SSVAL(req->outbuf, smb_flg2,
1599                       SVAL(req->outbuf, smb_flg2)
1600                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1601         }
1602
1603         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1604         SSVAL(req->outbuf, smb_flg2,
1605               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1606
1607         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1608                 smb_fn_name(req->cmd),
1609                 mask,
1610                 directory,
1611                 dirtype,
1612                 numentries,
1613                 maxentries ));
1614  out:
1615         TALLOC_FREE(directory);
1616         TALLOC_FREE(smb_fname);
1617         END_PROFILE(SMBsearch);
1618         return;
1619 }
1620
1621 /****************************************************************************
1622  Reply to a fclose (stop directory search).
1623 ****************************************************************************/
1624
1625 void reply_fclose(struct smb_request *req)
1626 {
1627         int status_len;
1628         char status[21];
1629         int dptr_num= -2;
1630         const char *p;
1631         char *path = NULL;
1632         NTSTATUS err;
1633         bool path_contains_wcard = False;
1634         TALLOC_CTX *ctx = talloc_tos();
1635         struct smbd_server_connection *sconn = req->sconn;
1636
1637         START_PROFILE(SMBfclose);
1638
1639         if (lp_posix_pathnames()) {
1640                 reply_unknown_new(req, req->cmd);
1641                 END_PROFILE(SMBfclose);
1642                 return;
1643         }
1644
1645         p = (const char *)req->buf + 1;
1646         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1647                                        &err, &path_contains_wcard);
1648         if (!NT_STATUS_IS_OK(err)) {
1649                 reply_nterror(req, err);
1650                 END_PROFILE(SMBfclose);
1651                 return;
1652         }
1653         p++;
1654         status_len = SVAL(p,0);
1655         p += 2;
1656
1657         if (status_len == 0) {
1658                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1659                 END_PROFILE(SMBfclose);
1660                 return;
1661         }
1662
1663         memcpy(status,p,21);
1664
1665         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1666                 /*  Close the dptr - we know it's gone */
1667                 dptr_close(sconn, &dptr_num);
1668         }
1669
1670         reply_outbuf(req, 1, 0);
1671         SSVAL(req->outbuf,smb_vwv0,0);
1672
1673         DEBUG(3,("search close\n"));
1674
1675         END_PROFILE(SMBfclose);
1676         return;
1677 }
1678
1679 /****************************************************************************
1680  Reply to an open.
1681 ****************************************************************************/
1682
1683 void reply_open(struct smb_request *req)
1684 {
1685         connection_struct *conn = req->conn;
1686         struct smb_filename *smb_fname = NULL;
1687         char *fname = NULL;
1688         uint32 fattr=0;
1689         SMB_OFF_T size = 0;
1690         time_t mtime=0;
1691         int info;
1692         files_struct *fsp;
1693         int oplock_request;
1694         int deny_mode;
1695         uint32 dos_attr;
1696         uint32 access_mask;
1697         uint32 share_mode;
1698         uint32 create_disposition;
1699         uint32 create_options = 0;
1700         uint32_t private_flags = 0;
1701         NTSTATUS status;
1702         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1703         TALLOC_CTX *ctx = talloc_tos();
1704
1705         START_PROFILE(SMBopen);
1706
1707         if (req->wct < 2) {
1708                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1709                 goto out;
1710         }
1711
1712         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1713         deny_mode = SVAL(req->vwv+0, 0);
1714         dos_attr = SVAL(req->vwv+1, 0);
1715
1716         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1717                             STR_TERMINATE, &status);
1718         if (!NT_STATUS_IS_OK(status)) {
1719                 reply_nterror(req, status);
1720                 goto out;
1721         }
1722
1723         status = filename_convert(ctx,
1724                                 conn,
1725                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1726                                 fname,
1727                                 0,
1728                                 NULL,
1729                                 &smb_fname);
1730         if (!NT_STATUS_IS_OK(status)) {
1731                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1732                         reply_botherror(req,
1733                                         NT_STATUS_PATH_NOT_COVERED,
1734                                         ERRSRV, ERRbadpath);
1735                         goto out;
1736                 }
1737                 reply_nterror(req, status);
1738                 goto out;
1739         }
1740
1741         if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1742                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1743                                          &share_mode, &create_disposition,
1744                                          &create_options, &private_flags)) {
1745                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1746                 goto out;
1747         }
1748
1749         status = SMB_VFS_CREATE_FILE(
1750                 conn,                                   /* conn */
1751                 req,                                    /* req */
1752                 0,                                      /* root_dir_fid */
1753                 smb_fname,                              /* fname */
1754                 access_mask,                            /* access_mask */
1755                 share_mode,                             /* share_access */
1756                 create_disposition,                     /* create_disposition*/
1757                 create_options,                         /* create_options */
1758                 dos_attr,                               /* file_attributes */
1759                 oplock_request,                         /* oplock_request */
1760                 0,                                      /* allocation_size */
1761                 private_flags,
1762                 NULL,                                   /* sd */
1763                 NULL,                                   /* ea_list */
1764                 &fsp,                                   /* result */
1765                 &info);                                 /* pinfo */
1766
1767         if (!NT_STATUS_IS_OK(status)) {
1768                 if (open_was_deferred(req->mid)) {
1769                         /* We have re-scheduled this call. */
1770                         goto out;
1771                 }
1772                 reply_openerror(req, status);
1773                 goto out;
1774         }
1775
1776         size = smb_fname->st.st_ex_size;
1777         fattr = dos_mode(conn, smb_fname);
1778
1779         /* Deal with other possible opens having a modified
1780            write time. JRA. */
1781         if (ask_sharemode) {
1782                 struct timespec write_time_ts;
1783
1784                 ZERO_STRUCT(write_time_ts);
1785                 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1786                 if (!null_timespec(write_time_ts)) {
1787                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1788                 }
1789         }
1790
1791         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1792
1793         if (fattr & aDIR) {
1794                 DEBUG(3,("attempt to open a directory %s\n",
1795                          fsp_str_dbg(fsp)));
1796                 close_file(req, fsp, ERROR_CLOSE);
1797                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1798                         ERRDOS, ERRnoaccess);
1799                 goto out;
1800         }
1801
1802         reply_outbuf(req, 7, 0);
1803         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1804         SSVAL(req->outbuf,smb_vwv1,fattr);
1805         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1806                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1807         } else {
1808                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1809         }
1810         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1811         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1812
1813         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1814                 SCVAL(req->outbuf,smb_flg,
1815                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1816         }
1817
1818         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1819                 SCVAL(req->outbuf,smb_flg,
1820                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1821         }
1822  out:
1823         TALLOC_FREE(smb_fname);
1824         END_PROFILE(SMBopen);
1825         return;
1826 }
1827
1828 /****************************************************************************
1829  Reply to an open and X.
1830 ****************************************************************************/
1831
1832 void reply_open_and_X(struct smb_request *req)
1833 {
1834         connection_struct *conn = req->conn;
1835         struct smb_filename *smb_fname = NULL;
1836         char *fname = NULL;
1837         uint16 open_flags;
1838         int deny_mode;
1839         uint32 smb_attr;
1840         /* Breakout the oplock request bits so we can set the
1841                 reply bits separately. */
1842         int ex_oplock_request;
1843         int core_oplock_request;
1844         int oplock_request;
1845 #if 0
1846         int smb_sattr = SVAL(req->vwv+4, 0);
1847         uint32 smb_time = make_unix_date3(req->vwv+6);
1848 #endif
1849         int smb_ofun;
1850         uint32 fattr=0;
1851         int mtime=0;
1852         int smb_action = 0;
1853         files_struct *fsp;
1854         NTSTATUS status;
1855         uint64_t allocation_size;
1856         ssize_t retval = -1;
1857         uint32 access_mask;
1858         uint32 share_mode;
1859         uint32 create_disposition;
1860         uint32 create_options = 0;
1861         uint32_t private_flags = 0;
1862         TALLOC_CTX *ctx = talloc_tos();
1863
1864         START_PROFILE(SMBopenX);
1865
1866         if (req->wct < 15) {
1867                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1868                 goto out;
1869         }
1870
1871         open_flags = SVAL(req->vwv+2, 0);
1872         deny_mode = SVAL(req->vwv+3, 0);
1873         smb_attr = SVAL(req->vwv+5, 0);
1874         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1875         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1876         oplock_request = ex_oplock_request | core_oplock_request;
1877         smb_ofun = SVAL(req->vwv+8, 0);
1878         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1879
1880         /* If it's an IPC, pass off the pipe handler. */
1881         if (IS_IPC(conn)) {
1882                 if (lp_nt_pipe_support()) {
1883                         reply_open_pipe_and_X(conn, req);
1884                 } else {
1885                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1886                 }
1887                 goto out;
1888         }
1889
1890         /* XXXX we need to handle passed times, sattr and flags */
1891         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1892                         STR_TERMINATE, &status);
1893         if (!NT_STATUS_IS_OK(status)) {
1894                 reply_nterror(req, status);
1895                 goto out;
1896         }
1897
1898         status = filename_convert(ctx,
1899                                 conn,
1900                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1901                                 fname,
1902                                 0,
1903                                 NULL,
1904                                 &smb_fname);
1905         if (!NT_STATUS_IS_OK(status)) {
1906                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1907                         reply_botherror(req,
1908                                         NT_STATUS_PATH_NOT_COVERED,
1909                                         ERRSRV, ERRbadpath);
1910                         goto out;
1911                 }
1912                 reply_nterror(req, status);
1913                 goto out;
1914         }
1915
1916         if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1917                                          &access_mask, &share_mode,
1918                                          &create_disposition,
1919                                          &create_options,
1920                                          &private_flags)) {
1921                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1922                 goto out;
1923         }
1924
1925         status = SMB_VFS_CREATE_FILE(
1926                 conn,                                   /* conn */
1927                 req,                                    /* req */
1928                 0,                                      /* root_dir_fid */
1929                 smb_fname,                              /* fname */
1930                 access_mask,                            /* access_mask */
1931                 share_mode,                             /* share_access */
1932                 create_disposition,                     /* create_disposition*/
1933                 create_options,                         /* create_options */
1934                 smb_attr,                               /* file_attributes */
1935                 oplock_request,                         /* oplock_request */
1936                 0,                                      /* allocation_size */
1937                 private_flags,
1938                 NULL,                                   /* sd */
1939                 NULL,                                   /* ea_list */
1940                 &fsp,                                   /* result */
1941                 &smb_action);                           /* pinfo */
1942
1943         if (!NT_STATUS_IS_OK(status)) {
1944                 if (open_was_deferred(req->mid)) {
1945                         /* We have re-scheduled this call. */
1946                         goto out;
1947                 }
1948                 reply_openerror(req, status);
1949                 goto out;
1950         }
1951
1952         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1953            if the file is truncated or created. */
1954         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1955                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1956                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1957                         close_file(req, fsp, ERROR_CLOSE);
1958                         reply_nterror(req, NT_STATUS_DISK_FULL);
1959                         goto out;
1960                 }
1961                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1962                 if (retval < 0) {
1963                         close_file(req, fsp, ERROR_CLOSE);
1964                         reply_nterror(req, NT_STATUS_DISK_FULL);
1965                         goto out;
1966                 }
1967                 smb_fname->st.st_ex_size =
1968                     SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1969         }
1970
1971         fattr = dos_mode(conn, smb_fname);
1972         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1973         if (fattr & aDIR) {
1974                 close_file(req, fsp, ERROR_CLOSE);
1975                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1976                 goto out;
1977         }
1978
1979         /* If the caller set the extended oplock request bit
1980                 and we granted one (by whatever means) - set the
1981                 correct bit for extended oplock reply.
1982         */
1983
1984         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1985                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1986         }
1987
1988         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1989                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1990         }
1991
1992         /* If the caller set the core oplock request bit
1993                 and we granted one (by whatever means) - set the
1994                 correct bit for core oplock reply.
1995         */
1996
1997         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1998                 reply_outbuf(req, 19, 0);
1999         } else {
2000                 reply_outbuf(req, 15, 0);
2001         }
2002
2003         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2004                 SCVAL(req->outbuf, smb_flg,
2005                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2006         }
2007
2008         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2009                 SCVAL(req->outbuf, smb_flg,
2010                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2011         }
2012
2013         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2014         SSVAL(req->outbuf,smb_vwv3,fattr);
2015         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2016                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2017         } else {
2018                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2019         }
2020         SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2021         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2022         SSVAL(req->outbuf,smb_vwv11,smb_action);
2023
2024         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2025                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2026         }
2027
2028         chain_reply(req);
2029  out:
2030         TALLOC_FREE(smb_fname);
2031         END_PROFILE(SMBopenX);
2032         return;
2033 }
2034
2035 /****************************************************************************
2036  Reply to a SMBulogoffX.
2037 ****************************************************************************/
2038
2039 void reply_ulogoffX(struct smb_request *req)
2040 {
2041         struct smbd_server_connection *sconn = req->sconn;
2042         user_struct *vuser;
2043
2044         START_PROFILE(SMBulogoffX);
2045
2046         vuser = get_valid_user_struct(sconn, req->vuid);
2047
2048         if(vuser == NULL) {
2049                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2050                          req->vuid));
2051         }
2052
2053         /* in user level security we are supposed to close any files
2054                 open by this user */
2055         if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2056                 file_close_user(req->vuid);
2057         }
2058
2059         invalidate_vuid(sconn, req->vuid);
2060
2061         reply_outbuf(req, 2, 0);
2062
2063         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2064
2065         END_PROFILE(SMBulogoffX);
2066         req->vuid = UID_FIELD_INVALID;
2067         chain_reply(req);
2068 }
2069
2070 /****************************************************************************
2071  Reply to a mknew or a create.
2072 ****************************************************************************/
2073
2074 void reply_mknew(struct smb_request *req)
2075 {
2076         connection_struct *conn = req->conn;
2077         struct smb_filename *smb_fname = NULL;
2078         char *fname = NULL;
2079         uint32 fattr = 0;
2080         struct smb_file_time ft;
2081         files_struct *fsp;
2082         int oplock_request = 0;
2083         NTSTATUS status;
2084         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2085         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2086         uint32 create_disposition;
2087         uint32 create_options = 0;
2088         TALLOC_CTX *ctx = talloc_tos();
2089
2090         START_PROFILE(SMBcreate);
2091         ZERO_STRUCT(ft);
2092
2093         if (req->wct < 3) {
2094                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2095                 goto out;
2096         }
2097
2098         fattr = SVAL(req->vwv+0, 0);
2099         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2100
2101         /* mtime. */
2102         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2103
2104         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2105                             STR_TERMINATE, &status);
2106         if (!NT_STATUS_IS_OK(status)) {
2107                 reply_nterror(req, status);
2108                 goto out;
2109         }
2110
2111         status = filename_convert(ctx,
2112                                 conn,
2113                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2114                                 fname,
2115                                 0,
2116                                 NULL,
2117                                 &smb_fname);
2118         if (!NT_STATUS_IS_OK(status)) {
2119                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2120                         reply_botherror(req,
2121                                         NT_STATUS_PATH_NOT_COVERED,
2122                                         ERRSRV, ERRbadpath);
2123                         goto out;
2124                 }
2125                 reply_nterror(req, status);
2126                 goto out;
2127         }
2128
2129         if (fattr & aVOLID) {
2130                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2131                          "please report this\n",
2132                          smb_fname_str_dbg(smb_fname)));
2133         }
2134
2135         if(req->cmd == SMBmknew) {
2136                 /* We should fail if file exists. */
2137                 create_disposition = FILE_CREATE;
2138         } else {
2139                 /* Create if file doesn't exist, truncate if it does. */
2140                 create_disposition = FILE_OVERWRITE_IF;
2141         }
2142
2143         status = SMB_VFS_CREATE_FILE(
2144                 conn,                                   /* conn */
2145                 req,                                    /* req */
2146                 0,                                      /* root_dir_fid */
2147                 smb_fname,                              /* fname */
2148                 access_mask,                            /* access_mask */
2149                 share_mode,                             /* share_access */
2150                 create_disposition,                     /* create_disposition*/
2151                 create_options,                         /* create_options */
2152                 fattr,                                  /* file_attributes */
2153                 oplock_request,                         /* oplock_request */
2154                 0,                                      /* allocation_size */
2155                 0,                                      /* private_flags */
2156                 NULL,                                   /* sd */
2157                 NULL,                                   /* ea_list */
2158                 &fsp,                                   /* result */
2159                 NULL);                                  /* pinfo */
2160
2161         if (!NT_STATUS_IS_OK(status)) {
2162                 if (open_was_deferred(req->mid)) {
2163                         /* We have re-scheduled this call. */
2164                         goto out;
2165                 }
2166                 reply_openerror(req, status);
2167                 goto out;
2168         }
2169
2170         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2171         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2172         if (!NT_STATUS_IS_OK(status)) {
2173                 END_PROFILE(SMBcreate);
2174                 goto out;
2175         }
2176
2177         reply_outbuf(req, 1, 0);
2178         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2179
2180         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2181                 SCVAL(req->outbuf,smb_flg,
2182                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2183         }
2184
2185         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2186                 SCVAL(req->outbuf,smb_flg,
2187                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2188         }
2189
2190         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2191         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2192                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2193                   (unsigned int)fattr));
2194
2195  out:
2196         TALLOC_FREE(smb_fname);
2197         END_PROFILE(SMBcreate);
2198         return;
2199 }
2200
2201 /****************************************************************************
2202  Reply to a create temporary file.
2203 ****************************************************************************/
2204
2205 void reply_ctemp(struct smb_request *req)
2206 {
2207         connection_struct *conn = req->conn;
2208         struct smb_filename *smb_fname = NULL;
2209         char *fname = NULL;
2210         uint32 fattr;
2211         files_struct *fsp;
2212         int oplock_request;
2213         int tmpfd;
2214         char *s;
2215         NTSTATUS status;
2216         TALLOC_CTX *ctx = talloc_tos();
2217
2218         START_PROFILE(SMBctemp);
2219
2220         if (req->wct < 3) {
2221                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2222                 goto out;
2223         }
2224
2225         fattr = SVAL(req->vwv+0, 0);
2226         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2227
2228         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2229                             STR_TERMINATE, &status);
2230         if (!NT_STATUS_IS_OK(status)) {
2231                 reply_nterror(req, status);
2232                 goto out;
2233         }
2234         if (*fname) {
2235                 fname = talloc_asprintf(ctx,
2236                                 "%s/TMXXXXXX",
2237                                 fname);
2238         } else {
2239                 fname = talloc_strdup(ctx, "TMXXXXXX");
2240         }
2241
2242         if (!fname) {
2243                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2244                 goto out;
2245         }
2246
2247         status = filename_convert(ctx, conn,
2248                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2249                                 fname,
2250                                 0,
2251                                 NULL,
2252                                 &smb_fname);
2253         if (!NT_STATUS_IS_OK(status)) {
2254                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2255                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2256                                         ERRSRV, ERRbadpath);
2257                         goto out;
2258                 }
2259                 reply_nterror(req, status);
2260                 goto out;
2261         }
2262
2263         tmpfd = mkstemp(smb_fname->base_name);
2264         if (tmpfd == -1) {
2265                 reply_nterror(req, map_nt_error_from_unix(errno));
2266                 goto out;
2267         }
2268
2269         SMB_VFS_STAT(conn, smb_fname);
2270
2271         /* We should fail if file does not exist. */
2272         status = SMB_VFS_CREATE_FILE(
2273                 conn,                                   /* conn */
2274                 req,                                    /* req */
2275                 0,                                      /* root_dir_fid */
2276                 smb_fname,                              /* fname */
2277                 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2278                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2279                 FILE_OPEN,                              /* create_disposition*/
2280                 0,                                      /* create_options */
2281                 fattr,                                  /* file_attributes */
2282                 oplock_request,                         /* oplock_request */
2283                 0,                                      /* allocation_size */
2284                 0,                                      /* private_flags */
2285                 NULL,                                   /* sd */
2286                 NULL,                                   /* ea_list */
2287                 &fsp,                                   /* result */
2288                 NULL);                                  /* pinfo */
2289
2290         /* close fd from mkstemp() */
2291         close(tmpfd);
2292
2293         if (!NT_STATUS_IS_OK(status)) {
2294                 if (open_was_deferred(req->mid)) {
2295                         /* We have re-scheduled this call. */
2296                         goto out;
2297                 }
2298                 reply_openerror(req, status);
2299                 goto out;
2300         }
2301
2302         reply_outbuf(req, 1, 0);
2303         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2304
2305         /* the returned filename is relative to the directory */
2306         s = strrchr_m(fsp->fsp_name->base_name, '/');
2307         if (!s) {
2308                 s = fsp->fsp_name->base_name;
2309         } else {
2310                 s++;
2311         }
2312
2313 #if 0
2314         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2315            thing in the byte section. JRA */
2316         SSVALS(p, 0, -1); /* what is this? not in spec */
2317 #endif
2318         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2319             == -1) {
2320                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2321                 goto out;
2322         }
2323
2324         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2325                 SCVAL(req->outbuf, smb_flg,
2326                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2327         }
2328
2329         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2330                 SCVAL(req->outbuf, smb_flg,
2331                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2332         }
2333
2334         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2335         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2336                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2337  out:
2338         TALLOC_FREE(smb_fname);
2339         END_PROFILE(SMBctemp);
2340         return;
2341 }
2342
2343 /*******************************************************************
2344  Check if a user is allowed to rename a file.
2345 ********************************************************************/
2346
2347 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2348                         uint16 dirtype)
2349 {
2350         uint32 fmode;
2351
2352         if (!CAN_WRITE(conn)) {
2353                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2354         }
2355
2356         fmode = dos_mode(conn, fsp->fsp_name);
2357         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2358                 return NT_STATUS_NO_SUCH_FILE;
2359         }
2360
2361         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2362                 if (fsp->posix_open) {
2363                         return NT_STATUS_OK;
2364                 }
2365
2366                 /* If no pathnames are open below this
2367                    directory, allow the rename. */
2368
2369                 if (file_find_subpath(fsp)) {
2370                         return NT_STATUS_ACCESS_DENIED;
2371                 }
2372                 return NT_STATUS_OK;
2373         }
2374
2375         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2376                 return NT_STATUS_OK;
2377         }
2378
2379         return NT_STATUS_ACCESS_DENIED;
2380 }
2381
2382 /*******************************************************************
2383  * unlink a file with all relevant access checks
2384  *******************************************************************/
2385
2386 static NTSTATUS do_unlink(connection_struct *conn,
2387                         struct smb_request *req,
2388                         struct smb_filename *smb_fname,
2389                         uint32 dirtype)
2390 {
2391         uint32 fattr;
2392         files_struct *fsp;
2393         uint32 dirtype_orig = dirtype;
2394         NTSTATUS status;
2395         int ret;
2396         bool posix_paths = lp_posix_pathnames();
2397
2398         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2399                   smb_fname_str_dbg(smb_fname),
2400                   dirtype));
2401
2402         if (!CAN_WRITE(conn)) {
2403                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2404         }
2405
2406         if (posix_paths) {
2407                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2408         } else {
2409                 ret = SMB_VFS_STAT(conn, smb_fname);
2410         }
2411         if (ret != 0) {
2412                 return map_nt_error_from_unix(errno);
2413         }
2414
2415         fattr = dos_mode(conn, smb_fname);
2416
2417         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2418                 dirtype = aDIR|aARCH|aRONLY;
2419         }
2420
2421         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2422         if (!dirtype) {
2423                 return NT_STATUS_NO_SUCH_FILE;
2424         }
2425
2426         if (!dir_check_ftype(conn, fattr, dirtype)) {
2427                 if (fattr & aDIR) {
2428                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2429                 }
2430                 return NT_STATUS_NO_SUCH_FILE;
2431         }
2432
2433         if (dirtype_orig & 0x8000) {
2434                 /* These will never be set for POSIX. */
2435                 return NT_STATUS_NO_SUCH_FILE;
2436         }
2437
2438 #if 0
2439         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2440                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2441         }
2442
2443         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2444                 return NT_STATUS_NO_SUCH_FILE;
2445         }
2446
2447         if (dirtype & 0xFF00) {
2448                 /* These will never be set for POSIX. */
2449                 return NT_STATUS_NO_SUCH_FILE;
2450         }
2451
2452         dirtype &= 0xFF;
2453         if (!dirtype) {
2454                 return NT_STATUS_NO_SUCH_FILE;
2455         }
2456
2457         /* Can't delete a directory. */
2458         if (fattr & aDIR) {
2459                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2460         }
2461 #endif
2462
2463 #if 0 /* JRATEST */
2464         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2465                 return NT_STATUS_OBJECT_NAME_INVALID;
2466 #endif /* JRATEST */
2467
2468         /* On open checks the open itself will check the share mode, so
2469            don't do it here as we'll get it wrong. */
2470
2471         status = SMB_VFS_CREATE_FILE
2472                 (conn,                  /* conn */
2473                  req,                   /* req */
2474                  0,                     /* root_dir_fid */
2475                  smb_fname,             /* fname */
2476                  DELETE_ACCESS,         /* access_mask */
2477                  FILE_SHARE_NONE,       /* share_access */
2478                  FILE_OPEN,             /* create_disposition*/
2479                  FILE_NON_DIRECTORY_FILE, /* create_options */
2480                                         /* file_attributes */
2481                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2482                                 FILE_ATTRIBUTE_NORMAL,
2483                  0,                     /* oplock_request */
2484                  0,                     /* allocation_size */
2485                  0,                     /* private_flags */
2486                  NULL,                  /* sd */
2487                  NULL,                  /* ea_list */
2488                  &fsp,                  /* result */
2489                  NULL);                 /* pinfo */
2490
2491         if (!NT_STATUS_IS_OK(status)) {
2492                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2493                            nt_errstr(status)));
2494                 return status;
2495         }
2496
2497         status = can_set_delete_on_close(fsp, fattr);
2498         if (!NT_STATUS_IS_OK(status)) {
2499                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2500                         "(%s)\n",
2501                         smb_fname_str_dbg(smb_fname),
2502                         nt_errstr(status)));
2503                 close_file(req, fsp, NORMAL_CLOSE);
2504                 return status;
2505         }
2506
2507         /* The set is across all open files on this dev/inode pair. */
2508         if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2509                 close_file(req, fsp, NORMAL_CLOSE);
2510                 return NT_STATUS_ACCESS_DENIED;
2511         }
2512
2513         return close_file(req, fsp, NORMAL_CLOSE);
2514 }
2515
2516 /****************************************************************************
2517  The guts of the unlink command, split out so it may be called by the NT SMB
2518  code.
2519 ****************************************************************************/
2520
2521 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2522                           uint32 dirtype, struct smb_filename *smb_fname,
2523                           bool has_wild)
2524 {
2525         char *fname_dir = NULL;
2526         char *fname_mask = NULL;
2527         int count=0;
2528         NTSTATUS status = NT_STATUS_OK;
2529         TALLOC_CTX *ctx = talloc_tos();
2530
2531         /* Split up the directory from the filename/mask. */
2532         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2533                                       &fname_dir, &fname_mask);
2534         if (!NT_STATUS_IS_OK(status)) {
2535                 goto out;
2536         }
2537
2538         /*
2539          * We should only check the mangled cache
2540          * here if unix_convert failed. This means
2541          * that the path in 'mask' doesn't exist
2542          * on the file system and so we need to look
2543          * for a possible mangle. This patch from
2544          * Tine Smukavec <valentin.smukavec@hermes.si>.
2545          */
2546
2547         if (!VALID_STAT(smb_fname->st) &&
2548             mangle_is_mangled(fname_mask, conn->params)) {
2549                 char *new_mask = NULL;
2550                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2551                                             &new_mask, conn->params);
2552                 if (new_mask) {
2553                         TALLOC_FREE(fname_mask);
2554                         fname_mask = new_mask;
2555                 }
2556         }
2557
2558         if (!has_wild) {
2559
2560                 /*
2561                  * Only one file needs to be unlinked. Append the mask back
2562                  * onto the directory.
2563                  */
2564                 TALLOC_FREE(smb_fname->base_name);
2565                 smb_fname->base_name = talloc_asprintf(smb_fname,
2566                                                        "%s/%s",
2567                                                        fname_dir,
2568                                                        fname_mask);
2569                 if (!smb_fname->base_name) {
2570                         status = NT_STATUS_NO_MEMORY;
2571                         goto out;
2572                 }
2573                 if (dirtype == 0) {
2574                         dirtype = FILE_ATTRIBUTE_NORMAL;
2575                 }
2576
2577                 status = check_name(conn, smb_fname->base_name);
2578                 if (!NT_STATUS_IS_OK(status)) {
2579                         goto out;
2580                 }
2581
2582                 status = do_unlink(conn, req, smb_fname, dirtype);
2583                 if (!NT_STATUS_IS_OK(status)) {
2584                         goto out;
2585                 }
2586
2587                 count++;
2588         } else {
2589                 struct smb_Dir *dir_hnd = NULL;
2590                 long offset = 0;
2591                 const char *dname = NULL;
2592                 char *talloced = NULL;
2593
2594                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2595                         status = NT_STATUS_OBJECT_NAME_INVALID;
2596                         goto out;
2597                 }
2598
2599                 if (strequal(fname_mask,"????????.???")) {
2600                         TALLOC_FREE(fname_mask);
2601                         fname_mask = talloc_strdup(ctx, "*");
2602                         if (!fname_mask) {
2603                                 status = NT_STATUS_NO_MEMORY;
2604                                 goto out;
2605                         }
2606                 }
2607
2608                 status = check_name(conn, fname_dir);
2609                 if (!NT_STATUS_IS_OK(status)) {
2610                         goto out;
2611                 }
2612
2613                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2614                                   dirtype);
2615                 if (dir_hnd == NULL) {
2616                         status = map_nt_error_from_unix(errno);
2617                         goto out;
2618                 }
2619
2620                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2621                    the pattern matches against the long name, otherwise the short name
2622                    We don't implement this yet XXXX
2623                 */
2624
2625                 status = NT_STATUS_NO_SUCH_FILE;
2626
2627                 while ((dname = ReadDirName(dir_hnd, &offset,
2628                                             &smb_fname->st, &talloced))) {
2629                         TALLOC_CTX *frame = talloc_stackframe();
2630
2631                         if (!is_visible_file(conn, fname_dir, dname,
2632                                              &smb_fname->st, true)) {
2633                                 TALLOC_FREE(frame);
2634                                 TALLOC_FREE(talloced);
2635                                 continue;
2636                         }
2637
2638                         /* Quick check for "." and ".." */
2639                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2640                                 TALLOC_FREE(frame);
2641                                 TALLOC_FREE(talloced);
2642                                 continue;
2643                         }
2644
2645                         if(!mask_match(dname, fname_mask,
2646                                        conn->case_sensitive)) {
2647                                 TALLOC_FREE(frame);
2648                                 TALLOC_FREE(talloced);
2649                                 continue;
2650                         }
2651
2652                         TALLOC_FREE(smb_fname->base_name);
2653                         smb_fname->base_name =
2654                             talloc_asprintf(smb_fname, "%s/%s",
2655                                             fname_dir, dname);
2656
2657                         if (!smb_fname->base_name) {
2658                                 TALLOC_FREE(dir_hnd);
2659                                 status = NT_STATUS_NO_MEMORY;
2660                                 TALLOC_FREE(frame);
2661                                 TALLOC_FREE(talloced);
2662                                 goto out;
2663                         }
2664
2665                         status = check_name(conn, smb_fname->base_name);
2666                         if (!NT_STATUS_IS_OK(status)) {
2667                                 TALLOC_FREE(dir_hnd);
2668                                 TALLOC_FREE(frame);
2669                                 TALLOC_FREE(talloced);
2670                                 goto out;
2671                         }
2672
2673                         status = do_unlink(conn, req, smb_fname, dirtype);
2674                         if (!NT_STATUS_IS_OK(status)) {
2675                                 TALLOC_FREE(frame);
2676                                 TALLOC_FREE(talloced);
2677                                 continue;
2678                         }
2679
2680                         count++;
2681                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2682                                  smb_fname->base_name));
2683
2684                         TALLOC_FREE(frame);
2685                         TALLOC_FREE(talloced);
2686                 }
2687                 TALLOC_FREE(dir_hnd);
2688         }
2689
2690         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2691                 status = map_nt_error_from_unix(errno);
2692         }
2693
2694  out:
2695         TALLOC_FREE(fname_dir);
2696         TALLOC_FREE(fname_mask);
2697         return status;
2698 }
2699
2700 /****************************************************************************
2701  Reply to a unlink
2702 ****************************************************************************/
2703
2704 void reply_unlink(struct smb_request *req)
2705 {
2706         connection_struct *conn = req->conn;
2707         char *name = NULL;
2708         struct smb_filename *smb_fname = NULL;
2709         uint32 dirtype;
2710         NTSTATUS status;
2711         bool path_contains_wcard = False;
2712         TALLOC_CTX *ctx = talloc_tos();
2713
2714         START_PROFILE(SMBunlink);
2715
2716         if (req->wct < 1) {
2717                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2718                 goto out;
2719         }
2720
2721         dirtype = SVAL(req->vwv+0, 0);
2722
2723         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2724                                   STR_TERMINATE, &status,
2725                                   &path_contains_wcard);
2726         if (!NT_STATUS_IS_OK(status)) {
2727                 reply_nterror(req, status);
2728                 goto out;
2729         }
2730
2731         status = filename_convert(ctx, conn,
2732                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2733                                   name,
2734                                   UCF_COND_ALLOW_WCARD_LCOMP,
2735                                   &path_contains_wcard,
2736                                   &smb_fname);
2737         if (!NT_STATUS_IS_OK(status)) {
2738                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2739                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2740                                         ERRSRV, ERRbadpath);
2741                         goto out;
2742                 }
2743                 reply_nterror(req, status);
2744                 goto out;
2745         }
2746
2747         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2748
2749         status = unlink_internals(conn, req, dirtype, smb_fname,
2750                                   path_contains_wcard);
2751         if (!NT_STATUS_IS_OK(status)) {
2752                 if (open_was_deferred(req->mid)) {
2753                         /* We have re-scheduled this call. */
2754                         goto out;
2755                 }
2756                 reply_nterror(req, status);
2757                 goto out;
2758         }
2759
2760         reply_outbuf(req, 0, 0);
2761  out:
2762         TALLOC_FREE(smb_fname);
2763         END_PROFILE(SMBunlink);
2764         return;
2765 }
2766
2767 /****************************************************************************
2768  Fail for readbraw.
2769 ****************************************************************************/
2770
2771 static void fail_readraw(void)
2772 {
2773         const char *errstr = talloc_asprintf(talloc_tos(),
2774                         "FAIL ! reply_readbraw: socket write fail (%s)",
2775                         strerror(errno));
2776         if (!errstr) {
2777                 errstr = "";
2778         }
2779         exit_server_cleanly(errstr);
2780 }
2781
2782 /****************************************************************************
2783  Fake (read/write) sendfile. Returns -1 on read or write fail.
2784 ****************************************************************************/
2785
2786 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2787                              size_t nread)
2788 {
2789         size_t bufsize;
2790         size_t tosend = nread;
2791         char *buf;
2792
2793         if (nread == 0) {
2794                 return 0;
2795         }
2796
2797         bufsize = MIN(nread, 65536);
2798
2799         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2800                 return -1;
2801         }
2802
2803         while (tosend > 0) {
2804                 ssize_t ret;
2805                 size_t cur_read;
2806
2807                 if (tosend > bufsize) {
2808                         cur_read = bufsize;
2809                 } else {
2810                         cur_read = tosend;
2811                 }
2812                 ret = read_file(fsp,buf,startpos,cur_read);
2813                 if (ret == -1) {
2814                         SAFE_FREE(buf);
2815                         return -1;
2816                 }
2817
2818                 /* If we had a short read, fill with zeros. */
2819                 if (ret < cur_read) {
2820                         memset(buf + ret, '\0', cur_read - ret);
2821                 }
2822
2823                 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2824                     != cur_read) {
2825                         char addr[INET6_ADDRSTRLEN];
2826                         /*
2827                          * Try and give an error message saying what
2828                          * client failed.
2829                          */
2830                         DEBUG(0, ("write_data failed for client %s. "
2831                                   "Error %s\n",
2832                                   get_peer_addr(fsp->conn->sconn->sock, addr,
2833                                                 sizeof(addr)),
2834                                   strerror(errno)));
2835                         SAFE_FREE(buf);
2836                         return -1;
2837                 }
2838                 tosend -= cur_read;
2839                 startpos += cur_read;
2840         }
2841
2842         SAFE_FREE(buf);
2843         return (ssize_t)nread;
2844 }
2845
2846 #if defined(WITH_SENDFILE)
2847 /****************************************************************************
2848  Deal with the case of sendfile reading less bytes from the file than
2849  requested. Fill with zeros (all we can do).
2850 ****************************************************************************/
2851
2852 static void sendfile_short_send(files_struct *fsp,
2853                                 ssize_t nread,
2854                                 size_t headersize,
2855                                 size_t smb_maxcnt)
2856 {
2857 #define SHORT_SEND_BUFSIZE 1024
2858         if (nread < headersize) {
2859                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2860                         "header for file %s (%s). Terminating\n",
2861                         fsp_str_dbg(fsp), strerror(errno)));
2862                 exit_server_cleanly("sendfile_short_send failed");
2863         }
2864
2865         nread -= headersize;
2866
2867         if (nread < smb_maxcnt) {
2868                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2869                 if (!buf) {
2870                         exit_server_cleanly("sendfile_short_send: "
2871                                 "malloc failed");
2872                 }
2873
2874                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2875                         "with zeros !\n", fsp_str_dbg(fsp)));
2876
2877                 while (nread < smb_maxcnt) {
2878                         /*
2879                          * We asked for the real file size and told sendfile
2880                          * to not go beyond the end of the file. But it can
2881                          * happen that in between our fstat call and the
2882                          * sendfile call the file was truncated. This is very
2883                          * bad because we have already announced the larger
2884                          * number of bytes to the client.
2885                          *
2886                          * The best we can do now is to send 0-bytes, just as
2887                          * a read from a hole in a sparse file would do.
2888                          *
2889                          * This should happen rarely enough that I don't care
2890                          * about efficiency here :-)
2891                          */
2892                         size_t to_write;
2893
2894                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2895                         if (write_data(fsp->conn->sconn->sock, buf, to_write)
2896                             != to_write) {
2897                                 char addr[INET6_ADDRSTRLEN];
2898                                 /*
2899                                  * Try and give an error message saying what
2900                                  * client failed.
2901                                  */
2902                                 DEBUG(0, ("write_data failed for client %s. "
2903                                           "Error %s\n",
2904                                           get_peer_addr(
2905                                                   fsp->conn->sconn->sock, addr,
2906                                                   sizeof(addr)),
2907                                           strerror(errno)));
2908                                 exit_server_cleanly("sendfile_short_send: "
2909                                                     "write_data failed");
2910                         }
2911                         nread += to_write;
2912                 }
2913                 SAFE_FREE(buf);
2914         }
2915 }
2916 #endif /* defined WITH_SENDFILE */
2917
2918 /****************************************************************************
2919  Return a readbraw error (4 bytes of zero).
2920 ****************************************************************************/
2921
2922 static void reply_readbraw_error(struct smbd_server_connection *sconn)
2923 {
2924         char header[4];
2925
2926         SIVAL(header,0,0);
2927
2928         smbd_lock_socket(sconn);
2929         if (write_data(sconn->sock,header,4) != 4) {
2930                 char addr[INET6_ADDRSTRLEN];
2931                 /*
2932                  * Try and give an error message saying what
2933                  * client failed.
2934                  */
2935                 DEBUG(0, ("write_data failed for client %s. "
2936                           "Error %s\n",
2937                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2938                           strerror(errno)));
2939
2940                 fail_readraw();
2941         }
2942         smbd_unlock_socket(sconn);
2943 }
2944
2945 /****************************************************************************
2946  Use sendfile in readbraw.
2947 ****************************************************************************/
2948
2949 static void send_file_readbraw(connection_struct *conn,
2950                                struct smb_request *req,
2951                                files_struct *fsp,
2952                                SMB_OFF_T startpos,
2953                                size_t nread,
2954                                ssize_t mincount)
2955 {
2956         struct smbd_server_connection *sconn = req->sconn;
2957         char *outbuf = NULL;
2958         ssize_t ret=0;
2959
2960 #if defined(WITH_SENDFILE)
2961         /*
2962          * We can only use sendfile on a non-chained packet
2963          * but we can use on a non-oplocked file. tridge proved this
2964          * on a train in Germany :-). JRA.
2965          * reply_readbraw has already checked the length.
2966          */
2967
2968         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2969             (fsp->wcp == NULL) &&
2970             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
2971                 ssize_t sendfile_read = -1;
2972                 char header[4];
2973                 DATA_BLOB header_blob;
2974
2975                 _smb_setlen(header,nread);
2976                 header_blob = data_blob_const(header, 4);
2977
2978                 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
2979                                                  &header_blob, startpos,
2980                                                  nread);
2981                 if (sendfile_read == -1) {
2982                         /* Returning ENOSYS means no data at all was sent.
2983                          * Do this as a normal read. */
2984                         if (errno == ENOSYS) {
2985                                 goto normal_readbraw;
2986                         }
2987
2988                         /*
2989                          * Special hack for broken Linux with no working sendfile. If we
2990                          * return EINTR we sent the header but not the rest of the data.
2991                          * Fake this up by doing read/write calls.
2992                          */
2993                         if (errno == EINTR) {
2994                                 /* Ensure we don't do this again. */
2995                                 set_use_sendfile(SNUM(conn), False);
2996                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2997
2998                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
2999                                         DEBUG(0,("send_file_readbraw: "
3000                                                  "fake_sendfile failed for "
3001                                                  "file %s (%s).\n",
3002                                                  fsp_str_dbg(fsp),
3003                                                  strerror(errno)));
3004                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3005                                 }
3006                                 return;
3007                         }
3008
3009                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3010                                  "file %s (%s). Terminating\n",
3011                                  fsp_str_dbg(fsp), strerror(errno)));
3012                         exit_server_cleanly("send_file_readbraw sendfile failed");
3013                 } else if (sendfile_read == 0) {
3014                         /*
3015                          * Some sendfile implementations return 0 to indicate
3016                          * that there was a short read, but nothing was
3017                          * actually written to the socket.  In this case,
3018                          * fallback to the normal read path so the header gets
3019                          * the correct byte count.
3020                          */
3021                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3022                                   "bytes falling back to the normal read: "
3023                                   "%s\n", fsp_str_dbg(fsp)));
3024                         goto normal_readbraw;
3025                 }
3026
3027                 /* Deal with possible short send. */
3028                 if (sendfile_read != 4+nread) {
3029                         sendfile_short_send(fsp, sendfile_read, 4, nread);
3030                 }
3031                 return;
3032         }
3033
3034 normal_readbraw:
3035 #endif
3036
3037         outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3038         if (!outbuf) {
3039                 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3040                         (unsigned)(nread+4)));
3041                 reply_readbraw_error(sconn);
3042                 return;
3043         }
3044
3045         if (nread > 0) {
3046                 ret = read_file(fsp,outbuf+4,startpos,nread);
3047 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3048                 if (ret < mincount)
3049                         ret = 0;
3050 #else
3051                 if (ret < nread)
3052                         ret = 0;
3053 #endif
3054         }
3055
3056         _smb_setlen(outbuf,ret);
3057         if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3058                 char addr[INET6_ADDRSTRLEN];
3059                 /*
3060                  * Try and give an error message saying what
3061                  * client failed.
3062                  */
3063                 DEBUG(0, ("write_data failed for client %s. "
3064                           "Error %s\n",
3065                           get_peer_addr(fsp->conn->sconn->sock, addr,
3066                                         sizeof(addr)),
3067                           strerror(errno)));
3068
3069                 fail_readraw();
3070         }
3071
3072         TALLOC_FREE(outbuf);
3073 }
3074
3075 /****************************************************************************
3076  Reply to a readbraw (core+ protocol).
3077 ****************************************************************************/
3078
3079 void reply_readbraw(struct smb_request *req)
3080 {
3081         connection_struct *conn = req->conn;
3082         struct smbd_server_connection *sconn = req->sconn;
3083         ssize_t maxcount,mincount;
3084         size_t nread = 0;
3085         SMB_OFF_T startpos;
3086         files_struct *fsp;
3087         struct lock_struct lock;
3088         SMB_OFF_T size = 0;
3089
3090         START_PROFILE(SMBreadbraw);
3091
3092         if (srv_is_signing_active(sconn) ||
3093             is_encrypted_packet(req->inbuf)) {
3094                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3095                         "raw reads/writes are disallowed.");
3096         }
3097
3098         if (req->wct < 8) {
3099                 reply_readbraw_error(sconn);
3100                 END_PROFILE(SMBreadbraw);
3101                 return;
3102         }
3103
3104         if (sconn->smb1.echo_handler.trusted_fde) {
3105                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3106                          "'async smb echo handler = yes'\n"));
3107                 reply_readbraw_error(sconn);
3108                 END_PROFILE(SMBreadbraw);
3109                 return;
3110         }
3111
3112         /*
3113          * Special check if an oplock break has been issued
3114          * and the readraw request croses on the wire, we must
3115          * return a zero length response here.
3116          */
3117
3118         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3119
3120         /*
3121          * We have to do a check_fsp by hand here, as
3122          * we must always return 4 zero bytes on error,
3123          * not a NTSTATUS.
3124          */
3125
3126         if (!fsp || !conn || conn != fsp->conn ||
3127                         req->vuid != fsp->vuid ||
3128                         fsp->is_directory || fsp->fh->fd == -1) {
3129                 /*
3130                  * fsp could be NULL here so use the value from the packet. JRA.
3131                  */
3132                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3133                         "- cache prime?\n",
3134                         (int)SVAL(req->vwv+0, 0)));
3135                 reply_readbraw_error(sconn);
3136                 END_PROFILE(SMBreadbraw);
3137                 return;
3138         }
3139
3140         /* Do a "by hand" version of CHECK_READ. */
3141         if (!(fsp->can_read ||
3142                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3143                                 (fsp->access_mask & FILE_EXECUTE)))) {
3144                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3145                                 (int)SVAL(req->vwv+0, 0)));
3146                 reply_readbraw_error(sconn);
3147                 END_PROFILE(SMBreadbraw);
3148                 return;
3149         }
3150
3151         flush_write_cache(fsp, READRAW_FLUSH);
3152
3153         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3154         if(req->wct == 10) {
3155                 /*
3156                  * This is a large offset (64 bit) read.
3157                  */
3158 #ifdef LARGE_SMB_OFF_T
3159
3160                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3161
3162 #else /* !LARGE_SMB_OFF_T */
3163
3164                 /*
3165                  * Ensure we haven't been sent a >32 bit offset.
3166                  */
3167
3168                 if(IVAL(req->vwv+8, 0) != 0) {
3169                         DEBUG(0,("reply_readbraw: large offset "
3170                                 "(%x << 32) used and we don't support "
3171                                 "64 bit offsets.\n",
3172                         (unsigned int)IVAL(req->vwv+8, 0) ));
3173                         reply_readbraw_error();
3174                         END_PROFILE(SMBreadbraw);
3175                         return;
3176                 }
3177
3178 #endif /* LARGE_SMB_OFF_T */
3179
3180                 if(startpos < 0) {
3181                         DEBUG(0,("reply_readbraw: negative 64 bit "
3182                                 "readraw offset (%.0f) !\n",
3183                                 (double)startpos ));
3184                         reply_readbraw_error(sconn);
3185                         END_PROFILE(SMBreadbraw);
3186                         return;
3187                 }
3188         }
3189
3190         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3191         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3192
3193         /* ensure we don't overrun the packet size */
3194         maxcount = MIN(65535,maxcount);
3195
3196         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3197             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3198             &lock);
3199
3200         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3201                 reply_readbraw_error(sconn);
3202                 END_PROFILE(SMBreadbraw);
3203                 return;
3204         }
3205
3206         if (fsp_stat(fsp) == 0) {
3207                 size = fsp->fsp_name->st.st_ex_size;
3208         }
3209
3210         if (startpos >= size) {
3211                 nread = 0;
3212         } else {
3213                 nread = MIN(maxcount,(size - startpos));
3214         }
3215
3216 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3217         if (nread < mincount)
3218                 nread = 0;
3219 #endif
3220
3221         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3222                 "min=%lu nread=%lu\n",
3223                 fsp->fnum, (double)startpos,
3224                 (unsigned long)maxcount,
3225                 (unsigned long)mincount,
3226                 (unsigned long)nread ) );
3227
3228         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3229
3230         DEBUG(5,("reply_readbraw finished\n"));
3231
3232         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3233
3234         END_PROFILE(SMBreadbraw);
3235         return;
3236 }
3237
3238 #undef DBGC_CLASS
3239 #define DBGC_CLASS DBGC_LOCKING
3240
3241 /****************************************************************************
3242  Reply to a lockread (core+ protocol).
3243 ****************************************************************************/
3244
3245 void reply_lockread(struct smb_request *req)
3246 {
3247         connection_struct *conn = req->conn;
3248         ssize_t nread = -1;
3249         char *data;
3250         SMB_OFF_T startpos;
3251         size_t numtoread;
3252         NTSTATUS status;
3253         files_struct *fsp;
3254         struct byte_range_lock *br_lck = NULL;
3255         char *p = NULL;
3256         struct smbd_server_connection *sconn = req->sconn;
3257
3258         START_PROFILE(SMBlockread);
3259
3260         if (req->wct < 5) {
3261                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3262                 END_PROFILE(SMBlockread);
3263                 return;
3264         }
3265
3266         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3267
3268         if (!check_fsp(conn, req, fsp)) {
3269                 END_PROFILE(SMBlockread);
3270                 return;
3271         }
3272
3273         if (!CHECK_READ(fsp,req)) {
3274                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3275                 END_PROFILE(SMBlockread);
3276                 return;
3277         }
3278
3279         numtoread = SVAL(req->vwv+1, 0);
3280         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3281
3282         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3283
3284         reply_outbuf(req, 5, numtoread + 3);
3285
3286         data = smb_buf(req->outbuf) + 3;
3287
3288         /*
3289          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3290          * protocol request that predates the read/write lock concept.
3291          * Thus instead of asking for a read lock here we need to ask
3292          * for a write lock. JRA.
3293          * Note that the requested lock size is unaffected by max_recv.
3294          */
3295
3296         br_lck = do_lock(req->sconn->msg_ctx,
3297                         fsp,
3298                         (uint64_t)req->smbpid,
3299                         (uint64_t)numtoread,
3300                         (uint64_t)startpos,
3301                         WRITE_LOCK,
3302                         WINDOWS_LOCK,
3303                         False, /* Non-blocking lock. */
3304                         &status,
3305                         NULL,
3306                         NULL);
3307         TALLOC_FREE(br_lck);
3308
3309         if (NT_STATUS_V(status)) {
3310                 reply_nterror(req, status);
3311                 END_PROFILE(SMBlockread);
3312                 return;
3313         }
3314
3315         /*
3316          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3317          */
3318
3319         if (numtoread > sconn->smb1.negprot.max_recv) {
3320                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3321 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3322                         (unsigned int)numtoread,
3323                         (unsigned int)sconn->smb1.negprot.max_recv));
3324                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3325         }
3326         nread = read_file(fsp,data,startpos,numtoread);
3327
3328         if (nread < 0) {
3329                 reply_nterror(req, map_nt_error_from_unix(errno));
3330                 END_PROFILE(SMBlockread);
3331                 return;
3332         }
3333
3334         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3335
3336         SSVAL(req->outbuf,smb_vwv0,nread);
3337         SSVAL(req->outbuf,smb_vwv5,nread+3);
3338         p = smb_buf(req->outbuf);
3339         SCVAL(p,0,0); /* pad byte. */
3340         SSVAL(p,1,nread);
3341
3342         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3343                  fsp->fnum, (int)numtoread, (int)nread));
3344
3345         END_PROFILE(SMBlockread);
3346         return;
3347 }
3348
3349 #undef DBGC_CLASS
3350 #define DBGC_CLASS DBGC_ALL
3351
3352 /****************************************************************************
3353  Reply to a read.
3354 ****************************************************************************/
3355
3356 void reply_read(struct smb_request *req)
3357 {
3358         connection_struct *conn = req->conn;
3359         size_t numtoread;
3360         ssize_t nread = 0;
3361         char *data;
3362         SMB_OFF_T startpos;
3363         int outsize = 0;
3364         files_struct *fsp;
3365         struct lock_struct lock;
3366         struct smbd_server_connection *sconn = req->sconn;
3367
3368         START_PROFILE(SMBread);
3369
3370         if (req->wct < 3) {
3371                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3372                 END_PROFILE(SMBread);
3373                 return;
3374         }
3375
3376         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3377
3378         if (!check_fsp(conn, req, fsp)) {
3379                 END_PROFILE(SMBread);
3380                 return;
3381         }
3382
3383         if (!CHECK_READ(fsp,req)) {
3384                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3385                 END_PROFILE(SMBread);
3386                 return;
3387         }
3388
3389         numtoread = SVAL(req->vwv+1, 0);
3390         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3391
3392         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3393
3394         /*
3395          * The requested read size cannot be greater than max_recv. JRA.
3396          */
3397         if (numtoread > sconn->smb1.negprot.max_recv) {
3398                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3399 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3400                         (unsigned int)numtoread,
3401                         (unsigned int)sconn->smb1.negprot.max_recv));
3402                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3403         }
3404
3405         reply_outbuf(req, 5, numtoread+3);
3406
3407         data = smb_buf(req->outbuf) + 3;
3408
3409         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3410             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3411             &lock);
3412
3413         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3414                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3415                 END_PROFILE(SMBread);
3416                 return;
3417         }
3418
3419         if (numtoread > 0)
3420                 nread = read_file(fsp,data,startpos,numtoread);
3421
3422         if (nread < 0) {
3423                 reply_nterror(req, map_nt_error_from_unix(errno));
3424                 goto strict_unlock;
3425         }
3426
3427         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3428
3429         SSVAL(req->outbuf,smb_vwv0,nread);
3430         SSVAL(req->outbuf,smb_vwv5,nread+3);
3431         SCVAL(smb_buf(req->outbuf),0,1);
3432         SSVAL(smb_buf(req->outbuf),1,nread);
3433
3434         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3435                 fsp->fnum, (int)numtoread, (int)nread ) );
3436
3437 strict_unlock:
3438         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3439
3440         END_PROFILE(SMBread);
3441         return;
3442 }
3443
3444 /****************************************************************************
3445  Setup readX header.
3446 ****************************************************************************/
3447
3448 static int setup_readX_header(struct smb_request *req, char *outbuf,
3449                               size_t smb_maxcnt)
3450 {
3451         int outsize;
3452         char *data;
3453
3454         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3455         data = smb_buf(outbuf);
3456
3457         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3458
3459         SCVAL(outbuf,smb_vwv0,0xFF);
3460         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3461         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3462         SSVAL(outbuf,smb_vwv6,
3463               req_wct_ofs(req)
3464               + 1               /* the wct field */
3465               + 12 * sizeof(uint16_t) /* vwv */
3466               + 2);             /* the buflen field */
3467         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3468         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3469         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3470         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3471         return outsize;
3472 }
3473
3474 /****************************************************************************
3475  Reply to a read and X - possibly using sendfile.
3476 ****************************************************************************/
3477
3478 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3479                             files_struct *fsp, SMB_OFF_T startpos,
3480                             size_t smb_maxcnt)
3481 {
3482         ssize_t nread = -1;
3483         struct lock_struct lock;
3484         int saved_errno = 0;
3485
3486         if(fsp_stat(fsp) == -1) {
3487                 reply_nterror(req, map_nt_error_from_unix(errno));
3488                 return;
3489         }
3490
3491         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3492             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3493             &lock);
3494
3495         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3496                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3497                 return;
3498         }
3499
3500         if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3501                         (startpos > fsp->fsp_name->st.st_ex_size)
3502                         || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3503                 /*
3504                  * We already know that we would do a short read, so don't
3505                  * try the sendfile() path.
3506                  */
3507                 goto nosendfile_read;
3508         }
3509
3510 #if defined(WITH_SENDFILE)
3511         /*
3512          * We can only use sendfile on a non-chained packet
3513          * but we can use on a non-oplocked file. tridge proved this
3514          * on a train in Germany :-). JRA.
3515          */
3516
3517         if (!req_is_in_chain(req) &&
3518             !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3519             (fsp->wcp == NULL) &&
3520             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3521                 uint8 headerbuf[smb_size + 12 * 2];
3522                 DATA_BLOB header;
3523
3524                 /*
3525                  * Set up the packet header before send. We
3526                  * assume here the sendfile will work (get the
3527                  * correct amount of data).
3528                  */
3529
3530                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3531
3532                 construct_reply_common_req(req, (char *)headerbuf);
3533                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3534
3535                 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3536                                          startpos, smb_maxcnt);
3537                 if (nread == -1) {
3538                         /* Returning ENOSYS means no data at all was sent.
3539                            Do this as a normal read. */
3540                         if (errno == ENOSYS) {
3541                                 goto normal_read;
3542                         }
3543
3544                         /*
3545                          * Special hack for broken Linux with no working sendfile. If we
3546                          * return EINTR we sent the header but not the rest of the data.
3547                          * Fake this up by doing read/write calls.
3548                          */
3549
3550                         if (errno == EINTR) {
3551                                 /* Ensure we don't do this again. */
3552                                 set_use_sendfile(SNUM(conn), False);
3553                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3554                                 nread = fake_sendfile(fsp, startpos,
3555                                                       smb_maxcnt);
3556                                 if (nread == -1) {
3557                                         DEBUG(0,("send_file_readX: "
3558                                                  "fake_sendfile failed for "
3559                                                  "file %s (%s).\n",
3560                                                  fsp_str_dbg(fsp),
3561                                                  strerror(errno)));
3562                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3563                                 }
3564                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3565                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3566                                 /* No outbuf here means successful sendfile. */
3567                                 goto strict_unlock;
3568                         }
3569
3570                         DEBUG(0,("send_file_readX: sendfile failed for file "
3571                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3572                                  strerror(errno)));
3573                         exit_server_cleanly("send_file_readX sendfile failed");
3574                 } else if (nread == 0) {
3575                         /*
3576                          * Some sendfile implementations return 0 to indicate
3577                          * that there was a short read, but nothing was
3578                          * actually written to the socket.  In this case,
3579                          * fallback to the normal read path so the header gets
3580                          * the correct byte count.
3581                          */
3582                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3583                                   "falling back to the normal read: %s\n",
3584                                   fsp_str_dbg(fsp)));
3585                         goto normal_read;
3586                 }
3587
3588                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3589                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3590
3591                 /* Deal with possible short send. */
3592                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3593                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3594                 }
3595                 /* No outbuf here means successful sendfile. */
3596                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3597                 SMB_PERFCOUNT_END(&req->pcd);
3598                 goto strict_unlock;
3599         }
3600
3601 normal_read:
3602
3603 #endif
3604
3605         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3606                 uint8 headerbuf[smb_size + 2*12];
3607
3608                 construct_reply_common_req(req, (char *)headerbuf);
3609                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3610
3611                 /* Send out the header. */
3612                 if (write_data(req->sconn->sock, (char *)headerbuf,
3613                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3614
3615                         char addr[INET6_ADDRSTRLEN];
3616                         /*
3617                          * Try and give an error message saying what
3618                          * client failed.
3619                          */
3620                         DEBUG(0, ("write_data failed for client %s. "
3621                                   "Error %s\n",
3622                                   get_peer_addr(req->sconn->sock, addr,
3623                                                 sizeof(addr)),
3624                                   strerror(errno)));
3625
3626                         DEBUG(0,("send_file_readX: write_data failed for file "
3627                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3628                                  strerror(errno)));
3629                         exit_server_cleanly("send_file_readX sendfile failed");
3630                 }
3631                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3632                 if (nread == -1) {
3633                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3634                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3635                                  strerror(errno)));
3636                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3637                 }
3638                 goto strict_unlock;
3639         }
3640
3641 nosendfile_read:
3642
3643         reply_outbuf(req, 12, smb_maxcnt);
3644
3645         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3646         saved_errno = errno;
3647
3648         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3649
3650         if (nread < 0) {
3651                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3652                 return;
3653         }
3654
3655         setup_readX_header(req, (char *)req->outbuf, nread);
3656
3657         DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3658                     fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3659
3660         chain_reply(req);
3661         return;
3662
3663  strict_unlock:
3664         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3665         TALLOC_FREE(req->outbuf);
3666         return;
3667 }
3668
3669 /****************************************************************************
3670  Reply to a read and X.
3671 ****************************************************************************/
3672
3673 void reply_read_and_X(struct smb_request *req)
3674 {
3675         connection_struct *conn = req->conn;
3676         files_struct *fsp;
3677         SMB_OFF_T startpos;
3678         size_t smb_maxcnt;
3679         bool big_readX = False;
3680 #if 0
3681         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3682 #endif
3683
3684         START_PROFILE(SMBreadX);
3685
3686         if ((req->wct != 10) && (req->wct != 12)) {
3687                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3688                 return;
3689         }
3690
3691         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3692         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3693         smb_maxcnt = SVAL(req->vwv+5, 0);
3694
3695         /* If it's an IPC, pass off the pipe handler. */
3696         if (IS_IPC(conn)) {
3697                 reply_pipe_read_and_X(req);
3698                 END_PROFILE(SMBreadX);
3699                 return;
3700         }
3701
3702         if (!check_fsp(conn, req, fsp)) {
3703                 END_PROFILE(SMBreadX);
3704                 return;
3705         }
3706
3707         if (!CHECK_READ(fsp,req)) {
3708                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3709                 END_PROFILE(SMBreadX);
3710                 return;
3711         }
3712
3713         if (global_client_caps & CAP_LARGE_READX) {
3714                 size_t upper_size = SVAL(req->vwv+7, 0);
3715                 smb_maxcnt |= (upper_size<<16);
3716                 if (upper_size > 1) {
3717                         /* Can't do this on a chained packet. */
3718                         if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3719                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3720                                 END_PROFILE(SMBreadX);
3721                                 return;
3722                         }
3723                         /* We currently don't do this on signed or sealed data. */
3724                         if (srv_is_signing_active(req->sconn) ||
3725                             is_encrypted_packet(req->inbuf)) {
3726                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3727                                 END_PROFILE(SMBreadX);
3728                                 return;
3729                         }
3730                         /* Is there room in the reply for this data ? */
3731                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3732                                 reply_nterror(req,
3733                                               NT_STATUS_INVALID_PARAMETER);
3734                                 END_PROFILE(SMBreadX);
3735                                 return;
3736                         }
3737                         big_readX = True;
3738                 }
3739         }
3740
3741         if (req->wct == 12) {
3742 #ifdef LARGE_SMB_OFF_T
3743                 /*
3744                  * This is a large offset (64 bit) read.
3745                  */
3746                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3747
3748 #else /* !LARGE_SMB_OFF_T */
3749
3750                 /*
3751                  * Ensure we haven't been sent a >32 bit offset.
3752                  */
3753
3754                 if(IVAL(req->vwv+10, 0) != 0) {
3755                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3756                                  "used and we don't support 64 bit offsets.\n",
3757                                  (unsigned int)IVAL(req->vwv+10, 0) ));
3758                         END_PROFILE(SMBreadX);
3759                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3760                         return;
3761                 }
3762
3763 #endif /* LARGE_SMB_OFF_T */
3764
3765         }
3766
3767         if (!big_readX) {
3768                 NTSTATUS status = schedule_aio_read_and_X(conn,
3769                                         req,
3770                                         fsp,
3771                                         startpos,
3772                                         smb_maxcnt);
3773                 if (NT_STATUS_IS_OK(status)) {
3774                         /* Read scheduled - we're done. */
3775                         goto out;
3776                 }
3777                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3778                         /* Real error - report to client. */
3779                         END_PROFILE(SMBreadX);
3780                         reply_nterror(req, status);
3781                         return;
3782                 }
3783                 /* NT_STATUS_RETRY - fall back to sync read. */
3784         }
3785
3786         smbd_lock_socket(req->sconn);
3787         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3788         smbd_unlock_socket(req->sconn);
3789
3790  out:
3791         END_PROFILE(SMBreadX);
3792         return;
3793 }
3794
3795 /****************************************************************************
3796  Error replies to writebraw must have smb_wct == 1. Fix this up.
3797 ****************************************************************************/
3798
3799 void error_to_writebrawerr(struct smb_request *req)
3800 {
3801         uint8 *old_outbuf = req->outbuf;
3802
3803         reply_outbuf(req, 1, 0);
3804
3805         memcpy(req->outbuf, old_outbuf, smb_size);
3806         TALLOC_FREE(old_outbuf);
3807 }
3808
3809 /****************************************************************************
3810  Read 4 bytes of a smb packet and return the smb length of the packet.
3811  Store the result in the buffer. This version of the function will
3812  never return a session keepalive (length of zero).
3813  Timeout is in milliseconds.
3814 ****************************************************************************/
3815
3816 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3817                                 size_t *len)
3818 {
3819         uint8_t msgtype = SMBkeepalive;
3820
3821         while (msgtype == SMBkeepalive) {
3822                 NTSTATUS status;
3823
3824                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3825                                                           len);
3826                 if (!NT_STATUS_IS_OK(status)) {
3827                         char addr[INET6_ADDRSTRLEN];
3828                         /* Try and give an error message
3829                          * saying what client failed. */
3830                         DEBUG(0, ("read_fd_with_timeout failed for "
3831                                   "client %s read error = %s.\n",
3832                                   get_peer_addr(fd,addr,sizeof(addr)),
3833                                   nt_errstr(status)));
3834                         return status;
3835                 }
3836
3837                 msgtype = CVAL(inbuf, 0);
3838         }
3839
3840         DEBUG(10,("read_smb_length: got smb length of %lu\n",
3841                   (unsigned long)len));
3842
3843         return NT_STATUS_OK;
3844 }
3845
3846 /****************************************************************************
3847  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3848 ****************************************************************************/
3849
3850 void reply_writebraw(struct smb_request *req)
3851 {
3852         connection_struct *conn = req->conn;
3853         char *buf = NULL;
3854         ssize_t nwritten=0;
3855         ssize_t total_written=0;
3856         size_t numtowrite=0;
3857         size_t tcount;
3858         SMB_OFF_T startpos;
3859         char *data=NULL;
3860         bool write_through;
3861         files_struct *fsp;
3862         struct lock_struct lock;
3863         NTSTATUS status;
3864
3865         START_PROFILE(SMBwritebraw);
3866
3867         /*
3868          * If we ever reply with an error, it must have the SMB command
3869          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3870          * we're finished.
3871          */
3872         SCVAL(req->inbuf,smb_com,SMBwritec);
3873
3874         if (srv_is_signing_active(req->sconn)) {
3875                 END_PROFILE(SMBwritebraw);
3876                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3877                                 "raw reads/writes are disallowed.");
3878         }
3879
3880         if (req->wct < 12) {
3881                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3882                 error_to_writebrawerr(req);
3883                 END_PROFILE(SMBwritebraw);
3884                 return;
3885         }
3886
3887         if (req->sconn->smb1.echo_handler.trusted_fde) {
3888                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3889                          "'async smb echo handler = yes'\n"));
3890                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3891                 error_to_writebrawerr(req);
3892                 END_PROFILE(SMBwritebraw);
3893                 return;
3894         }
3895
3896         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3897         if (!check_fsp(conn, req, fsp)) {
3898                 error_to_writebrawerr(req);
3899                 END_PROFILE(SMBwritebraw);
3900                 return;
3901         }
3902
3903         if (!CHECK_WRITE(fsp)) {
3904                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3905                 error_to_writebrawerr(req);
3906                 END_PROFILE(SMBwritebraw);
3907                 return;
3908         }
3909
3910         tcount = IVAL(req->vwv+1, 0);
3911         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3912         write_through = BITSETW(req->vwv+7,0);
3913
3914         /* We have to deal with slightly different formats depending
3915                 on whether we are using the core+ or lanman1.0 protocol */
3916
3917         if(get_Protocol() <= PROTOCOL_COREPLUS) {
3918                 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3919                 data = smb_buf(req->inbuf);
3920         } else {
3921                 numtowrite = SVAL(req->vwv+10, 0);
3922                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3923         }
3924
3925         /* Ensure we don't write bytes past the end of this packet. */
3926         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3927                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3928                 error_to_writebrawerr(req);
3929                 END_PROFILE(SMBwritebraw);
3930                 return;
3931         }
3932
3933         if (!fsp->print_file) {
3934                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3935                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3936                     &lock);
3937
3938                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3939                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3940                         error_to_writebrawerr(req);
3941                         END_PROFILE(SMBwritebraw);
3942                         return;
3943                 }
3944         }
3945
3946         if (numtowrite>0) {
3947                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3948         }
3949
3950         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3951                         "wrote=%d sync=%d\n",
3952                 fsp->fnum, (double)startpos, (int)numtowrite,
3953                 (int)nwritten, (int)write_through));
3954
3955         if (nwritten < (ssize_t)numtowrite)  {
3956                 reply_nterror(req, NT_STATUS_DISK_FULL);
3957                 error_to_writebrawerr(req);
3958                 goto strict_unlock;
3959         }
3960
3961         total_written = nwritten;
3962
3963         /* Allocate a buffer of 64k + length. */
3964         buf = TALLOC_ARRAY(NULL, char, 65540);
3965         if (!buf) {
3966                 reply_nterror(req, NT_STATUS_NO_MEMORY);
3967                 error_to_writebrawerr(req);
3968                 goto strict_unlock;
3969         }
3970
3971         /* Return a SMBwritebraw message to the redirector to tell
3972          * it to send more bytes */
3973
3974         memcpy(buf, req->inbuf, smb_size);
3975         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
3976         SCVAL(buf,smb_com,SMBwritebraw);
3977         SSVALS(buf,smb_vwv0,0xFFFF);
3978         show_msg(buf);
3979         if (!srv_send_smb(req->sconn,
3980                           buf,
3981                           false, 0, /* no signing */
3982                           IS_CONN_ENCRYPTED(conn),
3983                           &req->pcd)) {
3984                 exit_server_cleanly("reply_writebraw: srv_send_smb "
3985                         "failed.");
3986         }
3987
3988         /* Now read the raw data into the buffer and write it */
3989         status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
3990                                  &numtowrite);
3991         if (!NT_STATUS_IS_OK(status)) {
3992                 exit_server_cleanly("secondary writebraw failed");
3993         }
3994
3995         /* Set up outbuf to return the correct size */
3996         reply_outbuf(req, 1, 0);
3997
3998         if (numtowrite != 0) {
3999
4000                 if (numtowrite > 0xFFFF) {
4001                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4002                                 "raw requested (%u). Terminating\n",
4003                                 (unsigned int)numtowrite ));
4004                         exit_server_cleanly("secondary writebraw failed");
4005                 }
4006
4007                 if (tcount > nwritten+numtowrite) {
4008                         DEBUG(3,("reply_writebraw: Client overestimated the "
4009                                 "write %d %d %d\n",
4010                                 (int)tcount,(int)nwritten,(int)numtowrite));
4011                 }
4012
4013                 status = read_data(req->sconn->sock, buf+4, numtowrite);
4014
4015                 if (!NT_STATUS_IS_OK(status)) {
4016                         char addr[INET6_ADDRSTRLEN];
4017                         /* Try and give an error message
4018                          * saying what client failed. */
4019                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4020                                   "raw read failed (%s) for client %s. "
4021                                   "Terminating\n", nt_errstr(status),
4022                                   get_peer_addr(req->sconn->sock, addr,
4023                                                 sizeof(addr))));
4024                         exit_server_cleanly("secondary writebraw failed");
4025                 }
4026
4027                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4028                 if (nwritten == -1) {
4029                         TALLOC_FREE(buf);
4030                         reply_nterror(req, map_nt_error_from_unix(errno));
4031                         error_to_writebrawerr(req);
4032                         goto strict_unlock;
4033                 }
4034
4035                 if (nwritten < (ssize_t)numtowrite) {
4036                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4037                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4038                 }
4039
4040                 if (nwritten > 0) {
4041                         total_written += nwritten;
4042                 }
4043         }
4044
4045         TALLOC_FREE(buf);
4046         SSVAL(req->outbuf,smb_vwv0,total_written);
4047
4048         status = sync_file(conn, fsp, write_through);
4049         if (!NT_STATUS_IS_OK(status)) {
4050                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4051                          fsp_str_dbg(fsp), nt_errstr(status)));
4052                 reply_nterror(req, status);
4053                 error_to_writebrawerr(req);
4054                 goto strict_unlock;
4055         }
4056
4057         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4058                 "wrote=%d\n",
4059                 fsp->fnum, (double)startpos, (int)numtowrite,
4060                 (int)total_written));
4061
4062         if (!fsp->print_file) {
4063                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4064         }
4065
4066         /* We won't return a status if write through is not selected - this
4067          * follows what WfWg does */
4068         END_PROFILE(SMBwritebraw);
4069
4070         if (!write_through && total_written==tcount) {
4071
4072 #if RABBIT_PELLET_FIX
4073                 /*
4074                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4075                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
4076                  * JRA.
4077                  */
4078                 if (!send_keepalive(req->sconn->sock)) {
4079                         exit_server_cleanly("reply_writebraw: send of "
4080                                 "keepalive failed");
4081                 }
4082 #endif
4083                 TALLOC_FREE(req->outbuf);
4084         }
4085         return;
4086
4087 strict_unlock:
4088         if (!fsp->print_file) {
4089                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4090         }
4091
4092         END_PROFILE(SMBwritebraw);
4093         return;
4094 }
4095
4096 #undef DBGC_CLASS
4097 #define DBGC_CLASS DBGC_LOCKING
4098
4099 /****************************************************************************
4100  Reply to a writeunlock (core+).
4101 ****************************************************************************/
4102
4103 void reply_writeunlock(struct smb_request *req)
4104 {
4105         connection_struct *conn = req->conn;
4106         ssize_t nwritten = -1;
4107         size_t numtowrite;
4108         SMB_OFF_T startpos;
4109         const char *data;
4110         NTSTATUS status = NT_STATUS_OK;
4111         files_struct *fsp;
4112         struct lock_struct lock;
4113         int saved_errno = 0;
4114
4115         START_PROFILE(SMBwriteunlock);
4116
4117         if (req->wct < 5) {
4118                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4119                 END_PROFILE(SMBwriteunlock);
4120                 return;
4121         }
4122
4123         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4124
4125         if (!check_fsp(conn, req, fsp)) {
4126                 END_PROFILE(SMBwriteunlock);
4127                 return;
4128         }
4129
4130         if (!CHECK_WRITE(fsp)) {
4131                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4132                 END_PROFILE(SMBwriteunlock);
4133                 return;
4134         }
4135
4136         numtowrite = SVAL(req->vwv+1, 0);
4137         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4138         data = (const char *)req->buf + 3;
4139
4140         if (!fsp->print_file && numtowrite > 0) {
4141                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4142                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4143                     &lock);
4144
4145                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4146                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4147                         END_PROFILE(SMBwriteunlock);
4148                         return;
4149                 }
4150         }
4151
4152         /* The special X/Open SMB protocol handling of
4153            zero length writes is *NOT* done for
4154            this call */
4155         if(numtowrite == 0) {
4156                 nwritten = 0;
4157         } else {
4158                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4159                 saved_errno = errno;
4160         }
4161
4162         status = sync_file(conn, fsp, False /* write through */);
4163         if (!NT_STATUS_IS_OK(status)) {
4164                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4165                          fsp_str_dbg(fsp), nt_errstr(status)));
4166                 reply_nterror(req, status);
4167                 goto strict_unlock;
4168         }
4169
4170         if(nwritten < 0) {
4171                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4172                 goto strict_unlock;
4173         }
4174
4175         if((nwritten < numtowrite) && (numtowrite != 0)) {
4176                 reply_nterror(req, NT_STATUS_DISK_FULL);
4177                 goto strict_unlock;
4178         }
4179
4180         if (numtowrite && !fsp->print_file) {
4181                 status = do_unlock(req->sconn->msg_ctx,
4182                                 fsp,
4183                                 (uint64_t)req->smbpid,
4184                                 (uint64_t)numtowrite,
4185                                 (uint64_t)startpos,
4186                                 WINDOWS_LOCK);
4187
4188                 if (NT_STATUS_V(status)) {
4189                         reply_nterror(req, status);
4190                         goto strict_unlock;
4191                 }
4192         }
4193
4194         reply_outbuf(req, 1, 0);
4195
4196         SSVAL(req->outbuf,smb_vwv0,nwritten);
4197
4198         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4199                  fsp->fnum, (int)numtowrite, (int)nwritten));
4200
4201 strict_unlock:
4202         if (numtowrite && !fsp->print_file) {
4203                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4204         }
4205
4206         END_PROFILE(SMBwriteunlock);
4207         return;
4208 }
4209
4210 #undef DBGC_CLASS
4211 #define DBGC_CLASS DBGC_ALL
4212
4213 /****************************************************************************
4214  Reply to a write.
4215 ****************************************************************************/
4216
4217 void reply_write(struct smb_request *req)
4218 {
4219         connection_struct *conn = req->conn;
4220         size_t numtowrite;
4221         ssize_t nwritten = -1;
4222         SMB_OFF_T startpos;
4223         const char *data;
4224         files_struct *fsp;
4225         struct lock_struct lock;
4226         NTSTATUS status;
4227         int saved_errno = 0;
4228
4229         START_PROFILE(SMBwrite);
4230
4231         if (req->wct < 5) {
4232                 END_PROFILE(SMBwrite);
4233                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4234                 return;
4235         }
4236
4237         /* If it's an IPC, pass off the pipe handler. */
4238         if (IS_IPC(conn)) {
4239                 reply_pipe_write(req);
4240                 END_PROFILE(SMBwrite);
4241                 return;
4242         }
4243
4244         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4245
4246         if (!check_fsp(conn, req, fsp)) {
4247                 END_PROFILE(SMBwrite);
4248                 return;
4249         }
4250
4251         if (!CHECK_WRITE(fsp)) {
4252                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4253                 END_PROFILE(SMBwrite);
4254                 return;
4255         }
4256
4257         numtowrite = SVAL(req->vwv+1, 0);
4258         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4259         data = (const char *)req->buf + 3;
4260
4261         if (!fsp->print_file) {
4262                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4263                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4264                         &lock);
4265
4266                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4267                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4268                         END_PROFILE(SMBwrite);
4269                         return;
4270                 }
4271         }
4272
4273         /*
4274          * X/Open SMB protocol says that if smb_vwv1 is
4275          * zero then the file size should be extended or
4276          * truncated to the size given in smb_vwv[2-3].
4277          */
4278
4279         if(numtowrite == 0) {
4280                 /*
4281                  * This is actually an allocate call, and set EOF. JRA.
4282                  */
4283                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4284                 if (nwritten < 0) {
4285                         reply_nterror(req, NT_STATUS_DISK_FULL);
4286                         goto strict_unlock;
4287                 }
4288                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4289                 if (nwritten < 0) {
4290                         reply_nterror(req, NT_STATUS_DISK_FULL);
4291                         goto strict_unlock;
4292                 }
4293                 trigger_write_time_update_immediate(fsp);
4294         } else {
4295                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4296         }
4297
4298         status = sync_file(conn, fsp, False);
4299         if (!NT_STATUS_IS_OK(status)) {
4300                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4301                          fsp_str_dbg(fsp), nt_errstr(status)));
4302                 reply_nterror(req, status);
4303                 goto strict_unlock;
4304         }
4305
4306         if(nwritten < 0) {
4307                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4308                 goto strict_unlock;
4309         }
4310
4311         if((nwritten == 0) && (numtowrite != 0)) {
4312                 reply_nterror(req, NT_STATUS_DISK_FULL);
4313                 goto strict_unlock;
4314         }
4315
4316         reply_outbuf(req, 1, 0);
4317
4318         SSVAL(req->outbuf,smb_vwv0,nwritten);
4319
4320         if (nwritten < (ssize_t)numtowrite) {
4321                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4322                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4323         }
4324
4325         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4326
4327 strict_unlock:
4328         if (!fsp->print_file) {
4329                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4330         }
4331
4332         END_PROFILE(SMBwrite);
4333         return;
4334 }
4335
4336 /****************************************************************************
4337  Ensure a buffer is a valid writeX for recvfile purposes.
4338 ****************************************************************************/
4339
4340 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4341                                                 (2*14) + /* word count (including bcc) */ \
4342                                                 1 /* pad byte */)
4343
4344 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4345                             const uint8_t *inbuf)
4346 {
4347         size_t numtowrite;
4348         connection_struct *conn = NULL;
4349         unsigned int doff = 0;
4350         size_t len = smb_len_large(inbuf);
4351
4352         if (is_encrypted_packet(inbuf)) {
4353                 /* Can't do this on encrypted
4354                  * connections. */
4355                 return false;
4356         }
4357
4358         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4359                 return false;
4360         }
4361
4362         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4363                         CVAL(inbuf,smb_wct) != 14) {
4364                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4365                         "invalid word length.\n"));
4366                 return false;
4367         }
4368
4369         conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4370         if (conn == NULL) {
4371                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4372                 return false;
4373         }
4374         if (IS_IPC(conn)) {
4375                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4376                 return false;
4377         }
4378         if (IS_PRINT(conn)) {
4379                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4380                 return false;
4381         }
4382         doff = SVAL(inbuf,smb_vwv11);
4383
4384         numtowrite = SVAL(inbuf,smb_vwv10);
4385
4386         if (len > doff && len - doff > 0xFFFF) {
4387                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4388         }
4389
4390         if (numtowrite == 0) {
4391                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4392                 return false;
4393         }
4394
4395         /* Ensure the sizes match up. */
4396         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4397                 /* no pad byte...old smbclient :-( */
4398                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4399                         (unsigned int)doff,
4400                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4401                 return false;
4402         }
4403
4404         if (len - doff != numtowrite) {
4405                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4406                         "len = %u, doff = %u, numtowrite = %u\n",
4407                         (unsigned int)len,
4408                         (unsigned int)doff,
4409                         (unsigned int)numtowrite ));
4410                 return false;
4411         }
4412
4413         DEBUG(10,("is_valid_writeX_buffer: true "
4414                 "len = %u, doff = %u, numtowrite = %u\n",
4415                 (unsigned int)len,
4416                 (unsigned int)doff,
4417                 (unsigned int)numtowrite ));
4418
4419         return true;
4420 }
4421
4422 /****************************************************************************
4423  Reply to a write and X.
4424 ****************************************************************************/
4425
4426 void reply_write_and_X(struct smb_request *req)
4427 {
4428         connection_struct *conn = req->conn;
4429         files_struct *fsp;
4430         struct lock_struct lock;
4431         SMB_OFF_T startpos;
4432         size_t numtowrite;
4433         bool write_through;
4434         ssize_t nwritten;
4435         unsigned int smb_doff;
4436         unsigned int smblen;
4437         char *data;
4438         NTSTATUS status;
4439         int saved_errno = 0;
4440
4441         START_PROFILE(SMBwriteX);
4442
4443         if ((req->wct != 12) && (req->wct != 14)) {
4444                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4445                 END_PROFILE(SMBwriteX);
4446                 return;
4447         }
4448
4449         numtowrite = SVAL(req->vwv+10, 0);
4450         smb_doff = SVAL(req->vwv+11, 0);
4451         smblen = smb_len(req->inbuf);
4452
4453         if (req->unread_bytes > 0xFFFF ||
4454                         (smblen > smb_doff &&
4455                                 smblen - smb_doff > 0xFFFF)) {
4456                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4457         }
4458
4459         if (req->unread_bytes) {
4460                 /* Can't do a recvfile write on IPC$ */
4461                 if (IS_IPC(conn)) {
4462                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4463                         END_PROFILE(SMBwriteX);
4464                         return;
4465                 }
4466                 if (numtowrite != req->unread_bytes) {
4467                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4468                         END_PROFILE(SMBwriteX);
4469                         return;
4470                 }
4471         } else {
4472                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4473                                 smb_doff + numtowrite > smblen) {
4474                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4475                         END_PROFILE(SMBwriteX);
4476                         return;
4477                 }
4478         }
4479
4480         /* If it's an IPC, pass off the pipe handler. */
4481         if (IS_IPC(conn)) {
4482                 if (req->unread_bytes) {
4483                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4484                         END_PROFILE(SMBwriteX);
4485                         return;
4486                 }
4487                 reply_pipe_write_and_X(req);
4488                 END_PROFILE(SMBwriteX);
4489                 return;
4490         }
4491
4492         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4493         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4494         write_through = BITSETW(req->vwv+7,0);
4495
4496         if (!check_fsp(conn, req, fsp)) {
4497                 END_PROFILE(SMBwriteX);
4498                 return;
4499         }
4500
4501         if (!CHECK_WRITE(fsp)) {
4502                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4503                 END_PROFILE(SMBwriteX);
4504                 return;
4505         }
4506
4507         data = smb_base(req->inbuf) + smb_doff;
4508
4509         if(req->wct == 14) {
4510 #ifdef LARGE_SMB_OFF_T
4511                 /*
4512                  * This is a large offset (64 bit) write.
4513                  */
4514                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4515
4516 #else /* !LARGE_SMB_OFF_T */
4517
4518                 /*
4519                  * Ensure we haven't been sent a >32 bit offset.
4520                  */
4521
4522                 if(IVAL(req->vwv+12, 0) != 0) {
4523                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4524                                  "used and we don't support 64 bit offsets.\n",
4525                                  (unsigned int)IVAL(req->vwv+12, 0) ));
4526                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4527                         END_PROFILE(SMBwriteX);
4528                         return;
4529                 }
4530
4531 #endif /* LARGE_SMB_OFF_T */
4532         }
4533
4534         /* X/Open SMB protocol says that, unlike SMBwrite
4535         if the length is zero then NO truncation is
4536         done, just a write of zero. To truncate a file,
4537         use SMBwrite. */
4538
4539         if(numtowrite == 0) {
4540                 nwritten = 0;
4541         } else {
4542                 if (req->unread_bytes == 0) {
4543                         status = schedule_aio_write_and_X(conn,
4544                                                 req,
4545                                                 fsp,
4546                                                 data,
4547                                                 startpos,
4548                                                 numtowrite);
4549
4550                         if (NT_STATUS_IS_OK(status)) {
4551                                 /* write scheduled - we're done. */
4552                                 goto out;
4553                         }
4554                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4555                                 /* Real error - report to client. */
4556                                 reply_nterror(req, status);
4557                                 goto out;
4558                         }
4559                         /* NT_STATUS_RETRY - fall through to sync write. */
4560                 }
4561
4562                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4563                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4564                     &lock);
4565
4566                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4567                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4568                         goto out;
4569                 }
4570
4571                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4572                 saved_errno = errno;
4573
4574                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4575         }
4576
4577         if(nwritten < 0) {
4578                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4579                 goto out;
4580         }
4581
4582         if((nwritten == 0) && (numtowrite != 0)) {
4583                 reply_nterror(req, NT_STATUS_DISK_FULL);
4584                 goto out;
4585         }
4586
4587         reply_outbuf(req, 6, 0);
4588         SSVAL(req->outbuf,smb_vwv2,nwritten);
4589         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4590
4591         if (nwritten < (ssize_t)numtowrite) {
4592                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4593                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4594         }
4595
4596         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4597                 fsp->fnum, (int)numtowrite, (int)nwritten));
4598
4599         status = sync_file(conn, fsp, write_through);
4600         if (!NT_STATUS_IS_OK(status)) {
4601                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4602                          fsp_str_dbg(fsp), nt_errstr(status)));
4603                 reply_nterror(req, status);
4604                 goto out;
4605         }
4606
4607         END_PROFILE(SMBwriteX);
4608         chain_reply(req);
4609         return;
4610
4611 out:
4612         END_PROFILE(SMBwriteX);
4613         return;
4614 }
4615
4616 /****************************************************************************
4617  Reply to a lseek.
4618 ****************************************************************************/
4619
4620 void reply_lseek(struct smb_request *req)
4621 {
4622         connection_struct *conn = req->conn;
4623         SMB_OFF_T startpos;
4624         SMB_OFF_T res= -1;
4625         int mode,umode;
4626         files_struct *fsp;
4627
4628         START_PROFILE(SMBlseek);
4629
4630         if (req->wct < 4) {
4631                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4632                 END_PROFILE(SMBlseek);
4633                 return;
4634         }
4635
4636         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4637
4638         if (!check_fsp(conn, req, fsp)) {
4639                 return;
4640         }
4641
4642         flush_write_cache(fsp, SEEK_FLUSH);
4643
4644         mode = SVAL(req->vwv+1, 0) & 3;
4645         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4646         startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4647
4648         switch (mode) {
4649                 case 0:
4650                         umode = SEEK_SET;
4651                         res = startpos;
4652                         break;
4653                 case 1:
4654                         umode = SEEK_CUR;
4655                         res = fsp->fh->pos + startpos;
4656                         break;
4657                 case 2:
4658                         umode = SEEK_END;
4659                         break;
4660                 default:
4661                         umode = SEEK_SET;
4662                         res = startpos;
4663                         break;
4664         }
4665
4666         if (umode == SEEK_END) {
4667                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4668                         if(errno == EINVAL) {
4669                                 SMB_OFF_T current_pos = startpos;
4670
4671                                 if(fsp_stat(fsp) == -1) {
4672                                         reply_nterror(req,
4673                                                 map_nt_error_from_unix(errno));
4674                                         END_PROFILE(SMBlseek);
4675                                         return;
4676                                 }
4677
4678                                 current_pos += fsp->fsp_name->st.st_ex_size;
4679                                 if(current_pos < 0)
4680                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4681                         }
4682                 }
4683
4684                 if(res == -1) {
4685                         reply_nterror(req, map_nt_error_from_unix(errno));
4686                         END_PROFILE(SMBlseek);
4687                         return;
4688                 }
4689         }
4690
4691         fsp->fh->pos = res;
4692
4693         reply_outbuf(req, 2, 0);
4694         SIVAL(req->outbuf,smb_vwv0,res);
4695
4696         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4697                 fsp->fnum, (double)startpos, (double)res, mode));
4698
4699         END_PROFILE(SMBlseek);
4700         return;
4701 }
4702
4703 /****************************************************************************
4704  Reply to a flush.
4705 ****************************************************************************/
4706
4707 void reply_flush(struct smb_request *req)
4708 {
4709         connection_struct *conn = req->conn;
4710         uint16 fnum;
4711         files_struct *fsp;
4712
4713         START_PROFILE(SMBflush);
4714
4715         if (req->wct < 1) {
4716                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4717                 return;
4718         }
4719
4720         fnum = SVAL(req->vwv+0, 0);
4721         fsp = file_fsp(req, fnum);
4722
4723         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4724                 return;
4725         }
4726
4727         if (!fsp) {
4728                 file_sync_all(conn);
4729         } else {
4730                 NTSTATUS status = sync_file(conn, fsp, True);
4731                 if (!NT_STATUS_IS_OK(status)) {
4732                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4733                                 fsp_str_dbg(fsp), nt_errstr(status)));
4734                         reply_nterror(req, status);
4735                         END_PROFILE(SMBflush);
4736                         return;
4737                 }
4738         }
4739
4740         reply_outbuf(req, 0, 0);
4741
4742         DEBUG(3,("flush\n"));
4743         END_PROFILE(SMBflush);
4744         return;
4745 }
4746
4747 /****************************************************************************
4748  Reply to a exit.
4749  conn POINTER CAN BE NULL HERE !
4750 ****************************************************************************/
4751
4752 void reply_exit(struct smb_request *req)
4753 {
4754         START_PROFILE(SMBexit);
4755
4756         file_close_pid(req->smbpid, req->vuid);
4757
4758         reply_outbuf(req, 0, 0);
4759
4760         DEBUG(3,("exit\n"));
4761
4762         END_PROFILE(SMBexit);
4763         return;
4764 }
4765
4766 /****************************************************************************
4767  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4768 ****************************************************************************/
4769
4770 void reply_close(struct smb_request *req)
4771 {
4772         connection_struct *conn = req->conn;
4773         NTSTATUS status = NT_STATUS_OK;
4774         files_struct *fsp = NULL;
4775         START_PROFILE(SMBclose);
4776
4777         if (req->wct < 3) {
4778                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4779                 END_PROFILE(SMBclose);
4780                 return;
4781         }
4782
4783         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4784
4785         /*
4786          * We can only use check_fsp if we know it's not a directory.
4787          */
4788
4789         if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4790                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4791                 END_PROFILE(SMBclose);
4792                 return;
4793         }
4794
4795         if(fsp->is_directory) {
4796                 /*
4797                  * Special case - close NT SMB directory handle.
4798                  */
4799                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4800                 status = close_file(req, fsp, NORMAL_CLOSE);
4801         } else {
4802                 time_t t;
4803                 /*
4804                  * Close ordinary file.
4805                  */
4806
4807                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4808                          fsp->fh->fd, fsp->fnum,
4809                          conn->num_files_open));
4810
4811                 /*
4812                  * Take care of any time sent in the close.
4813                  */
4814
4815                 t = srv_make_unix_date3(req->vwv+1);
4816                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4817
4818                 /*
4819                  * close_file() returns the unix errno if an error
4820                  * was detected on close - normally this is due to
4821                  * a disk full error. If not then it was probably an I/O error.
4822                  */
4823
4824                 status = close_file(req, fsp, NORMAL_CLOSE);
4825         }
4826
4827         if (!NT_STATUS_IS_OK(status)) {
4828                 reply_nterror(req, status);
4829                 END_PROFILE(SMBclose);
4830                 return;
4831         }
4832
4833         reply_outbuf(req, 0, 0);
4834         END_PROFILE(SMBclose);
4835         return;
4836 }
4837
4838 /****************************************************************************
4839  Reply to a writeclose (Core+ protocol).
4840 ****************************************************************************/
4841
4842 void reply_writeclose(struct smb_request *req)
4843 {
4844         connection_struct *conn = req->conn;
4845         size_t numtowrite;
4846         ssize_t nwritten = -1;
4847         NTSTATUS close_status = NT_STATUS_OK;
4848         SMB_OFF_T startpos;
4849         const char *data;
4850         struct timespec mtime;
4851         files_struct *fsp;
4852         struct lock_struct lock;
4853
4854         START_PROFILE(SMBwriteclose);
4855
4856         if (req->wct < 6) {
4857                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4858                 END_PROFILE(SMBwriteclose);
4859                 return;
4860         }
4861
4862         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4863
4864         if (!check_fsp(conn, req, fsp)) {
4865                 END_PROFILE(SMBwriteclose);
4866                 return;
4867         }
4868         if (!CHECK_WRITE(fsp)) {
4869                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4870                 END_PROFILE(SMBwriteclose);
4871                 return;
4872         }
4873
4874         numtowrite = SVAL(req->vwv+1, 0);
4875         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4876         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4877         data = (const char *)req->buf + 1;
4878
4879         if (!fsp->print_file) {
4880                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4881                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4882                     &lock);
4883
4884                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4885                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4886                         END_PROFILE(SMBwriteclose);
4887                         return;
4888                 }
4889         }
4890
4891         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4892
4893         set_close_write_time(fsp, mtime);
4894
4895         /*
4896          * More insanity. W2K only closes the file if writelen > 0.
4897          * JRA.
4898          */
4899
4900         if (numtowrite) {
4901                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4902                          "file %s\n", fsp_str_dbg(fsp)));
4903                 close_status = close_file(req, fsp, NORMAL_CLOSE);
4904         }
4905
4906         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4907                  fsp->fnum, (int)numtowrite, (int)nwritten,
4908                  conn->num_files_open));
4909
4910         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4911                 reply_nterror(req, NT_STATUS_DISK_FULL);
4912                 goto strict_unlock;
4913         }
4914
4915         if(!NT_STATUS_IS_OK(close_status)) {
4916                 reply_nterror(req, close_status);
4917                 goto strict_unlock;
4918         }
4919
4920         reply_outbuf(req, 1, 0);
4921
4922         SSVAL(req->outbuf,smb_vwv0,nwritten);
4923
4924 strict_unlock:
4925         if (numtowrite && !fsp->print_file) {
4926                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4927         }
4928
4929         END_PROFILE(SMBwriteclose);
4930         return;
4931 }
4932
4933 #undef DBGC_CLASS
4934 #define DBGC_CLASS DBGC_LOCKING
4935
4936 /****************************************************************************
4937  Reply to a lock.
4938 ****************************************************************************/
4939
4940 void reply_lock(struct smb_request *req)
4941 {
4942         connection_struct *conn = req->conn;
4943         uint64_t count,offset;
4944         NTSTATUS status;
4945         files_struct *fsp;
4946         struct byte_range_lock *br_lck = NULL;
4947
4948         START_PROFILE(SMBlock);
4949
4950         if (req->wct < 5) {
4951                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4952                 END_PROFILE(SMBlock);
4953                 return;
4954         }
4955
4956         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4957
4958         if (!check_fsp(conn, req, fsp)) {
4959                 END_PROFILE(SMBlock);
4960                 return;
4961         }
4962
4963         count = (uint64_t)IVAL(req->vwv+1, 0);
4964         offset = (uint64_t)IVAL(req->vwv+3, 0);
4965
4966         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4967                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4968
4969         br_lck = do_lock(req->sconn->msg_ctx,
4970                         fsp,
4971                         (uint64_t)req->smbpid,
4972                         count,
4973                         offset,
4974                         WRITE_LOCK,
4975                         WINDOWS_LOCK,
4976                         False, /* Non-blocking lock. */
4977                         &status,
4978                         NULL,
4979                         NULL);
4980
4981         TALLOC_FREE(br_lck);
4982
4983         if (NT_STATUS_V(status)) {
4984                 reply_nterror(req, status);
4985                 END_PROFILE(SMBlock);
4986                 return;
4987         }
4988
4989         reply_outbuf(req, 0, 0);
4990
4991         END_PROFILE(SMBlock);
4992         return;
4993 }
4994
4995 /****************************************************************************
4996  Reply to a unlock.
4997 ****************************************************************************/
4998
4999 void reply_unlock(struct smb_request *req)
5000 {
5001         connection_struct *conn = req->conn;
5002         uint64_t count,offset;
5003         NTSTATUS status;
5004         files_struct *fsp;
5005
5006         START_PROFILE(SMBunlock);
5007
5008         if (req->wct < 5) {
5009                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5010                 END_PROFILE(SMBunlock);
5011                 return;
5012         }
5013
5014         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5015
5016         if (!check_fsp(conn, req, fsp)) {
5017                 END_PROFILE(SMBunlock);
5018                 return;
5019         }
5020
5021         count = (uint64_t)IVAL(req->vwv+1, 0);
5022         offset = (uint64_t)IVAL(req->vwv+3, 0);
5023
5024         status = do_unlock(req->sconn->msg_ctx,
5025                         fsp,
5026                         (uint64_t)req->smbpid,
5027                         count,
5028                         offset,
5029                         WINDOWS_LOCK);
5030
5031         if (NT_STATUS_V(status)) {
5032                 reply_nterror(req, status);
5033                 END_PROFILE(SMBunlock);
5034                 return;
5035         }
5036
5037         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5038                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5039
5040         reply_outbuf(req, 0, 0);
5041
5042         END_PROFILE(SMBunlock);
5043         return;
5044 }
5045
5046 #undef DBGC_CLASS
5047 #define DBGC_CLASS DBGC_ALL
5048
5049 /****************************************************************************
5050  Reply to a tdis.
5051  conn POINTER CAN BE NULL HERE !
5052 ****************************************************************************/
5053
5054 void reply_tdis(struct smb_request *req)
5055 {
5056         connection_struct *conn = req->conn;
5057         START_PROFILE(SMBtdis);
5058
5059         if (!conn) {
5060                 DEBUG(4,("Invalid connection in tdis\n"));
5061                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5062                 END_PROFILE(SMBtdis);
5063                 return;
5064         }
5065
5066         conn->used = False;
5067
5068         close_cnum(conn,req->vuid);
5069         req->conn = NULL;
5070
5071         reply_outbuf(req, 0, 0);
5072         END_PROFILE(SMBtdis);
5073         return;
5074 }
5075
5076 /****************************************************************************
5077  Reply to a echo.
5078  conn POINTER CAN BE NULL HERE !
5079 ****************************************************************************/
5080
5081 void reply_echo(struct smb_request *req)
5082 {
5083         connection_struct *conn = req->conn;
5084         struct smb_perfcount_data local_pcd;
5085         struct smb_perfcount_data *cur_pcd;
5086         int smb_reverb;
5087         int seq_num;
5088
5089         START_PROFILE(SMBecho);
5090
5091         smb_init_perfcount_data(&local_pcd);
5092
5093         if (req->wct < 1) {
5094                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5095                 END_PROFILE(SMBecho);
5096                 return;
5097         }
5098
5099         smb_reverb = SVAL(req->vwv+0, 0);
5100
5101         reply_outbuf(req, 1, req->buflen);
5102
5103         /* copy any incoming data back out */
5104         if (req->buflen > 0) {
5105                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5106         }
5107
5108         if (smb_reverb > 100) {
5109                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5110                 smb_reverb = 100;
5111         }
5112
5113         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5114
5115                 /* this makes sure we catch the request pcd */
5116                 if (seq_num == smb_reverb) {
5117                         cur_pcd = &req->pcd;
5118                 } else {
5119                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5120                         cur_pcd = &local_pcd;
5121                 }
5122
5123                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5124
5125                 show_msg((char *)req->outbuf);
5126                 if (!srv_send_smb(req->sconn,
5127                                 (char *)req->outbuf,
5128                                 true, req->seqnum+1,
5129                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5130                                 cur_pcd))
5131                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5132         }
5133
5134         DEBUG(3,("echo %d times\n", smb_reverb));
5135
5136         TALLOC_FREE(req->outbuf);
5137
5138         END_PROFILE(SMBecho);
5139         return;
5140 }
5141
5142 /****************************************************************************
5143  Reply to a printopen.
5144 ****************************************************************************/
5145
5146 void reply_printopen(struct smb_request *req)
5147 {
5148         connection_struct *conn = req->conn;
5149         files_struct *fsp;
5150         NTSTATUS status;
5151
5152         START_PROFILE(SMBsplopen);
5153
5154         if (req->wct < 2) {
5155                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5156                 END_PROFILE(SMBsplopen);
5157                 return;
5158         }
5159
5160         if (!CAN_PRINT(conn)) {
5161                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5162                 END_PROFILE(SMBsplopen);
5163                 return;
5164         }
5165
5166         status = file_new(req, conn, &fsp);
5167         if(!NT_STATUS_IS_OK(status)) {
5168                 reply_nterror(req, status);
5169                 END_PROFILE(SMBsplopen);
5170                 return;
5171         }
5172
5173         /* Open for exclusive use, write only. */
5174         status = print_spool_open(fsp, NULL, req->vuid);
5175
5176         if (!NT_STATUS_IS_OK(status)) {
5177                 file_free(req, fsp);
5178                 reply_nterror(req, status);
5179                 END_PROFILE(SMBsplopen);
5180                 return;
5181         }
5182
5183         reply_outbuf(req, 1, 0);
5184         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5185
5186         DEBUG(3,("openprint fd=%d fnum=%d\n",
5187                  fsp->fh->fd, fsp->fnum));
5188
5189         END_PROFILE(SMBsplopen);
5190         return;
5191 }
5192
5193 /****************************************************************************
5194  Reply to a printclose.
5195 ****************************************************************************/
5196
5197 void reply_printclose(struct smb_request *req)
5198 {
5199         connection_struct *conn = req->conn;
5200         files_struct *fsp;
5201         NTSTATUS status;
5202
5203         START_PROFILE(SMBsplclose);
5204
5205         if (req->wct < 1) {
5206                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5207                 END_PROFILE(SMBsplclose);
5208                 return;
5209         }
5210
5211         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5212
5213         if (!check_fsp(conn, req, fsp)) {
5214                 END_PROFILE(SMBsplclose);
5215                 return;
5216         }
5217
5218         if (!CAN_PRINT(conn)) {
5219                 reply_force_doserror(req, ERRSRV, ERRerror);
5220                 END_PROFILE(SMBsplclose);
5221                 return;
5222         }
5223
5224         DEBUG(3,("printclose fd=%d fnum=%d\n",
5225                  fsp->fh->fd,fsp->fnum));
5226
5227         status = close_file(req, fsp, NORMAL_CLOSE);
5228
5229         if(!NT_STATUS_IS_OK(status)) {
5230                 reply_nterror(req, status);
5231                 END_PROFILE(SMBsplclose);
5232                 return;
5233         }
5234
5235         reply_outbuf(req, 0, 0);
5236
5237         END_PROFILE(SMBsplclose);
5238         return;
5239 }
5240
5241 /****************************************************************************
5242  Reply to a printqueue.
5243 ****************************************************************************/
5244
5245 void reply_printqueue(struct smb_request *req)
5246 {
5247         connection_struct *conn = req->conn;
5248         int max_count;
5249         int start_index;
5250
5251         START_PROFILE(SMBsplretq);
5252
5253         if (req->wct < 2) {
5254                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5255                 END_PROFILE(SMBsplretq);
5256                 return;
5257         }
5258
5259         max_count = SVAL(req->vwv+0, 0);
5260         start_index = SVAL(req->vwv+1, 0);
5261
5262         /* we used to allow the client to get the cnum wrong, but that
5263            is really quite gross and only worked when there was only
5264            one printer - I think we should now only accept it if they
5265            get it right (tridge) */
5266         if (!CAN_PRINT(conn)) {
5267                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5268                 END_PROFILE(SMBsplretq);
5269                 return;
5270         }
5271
5272         reply_outbuf(req, 2, 3);
5273         SSVAL(req->outbuf,smb_vwv0,0);
5274         SSVAL(req->outbuf,smb_vwv1,0);
5275         SCVAL(smb_buf(req->outbuf),0,1);
5276         SSVAL(smb_buf(req->outbuf),1,0);
5277
5278         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5279                  start_index, max_count));
5280
5281         {
5282                 TALLOC_CTX *mem_ctx = talloc_tos();
5283                 NTSTATUS status;
5284                 WERROR werr;
5285                 const char *sharename = lp_servicename(SNUM(conn));
5286                 struct rpc_pipe_client *cli = NULL;
5287                 struct policy_handle handle;
5288                 struct spoolss_DevmodeContainer devmode_ctr;
5289                 union spoolss_JobInfo *info;
5290                 uint32_t count;
5291                 uint32_t num_to_get;
5292                 uint32_t first;
5293                 uint32_t i;
5294
5295                 ZERO_STRUCT(handle);
5296
5297                 status = rpc_pipe_open_interface(conn,
5298                                                  &ndr_table_spoolss.syntax_id,
5299                                                  conn->server_info,
5300                                                  &conn->sconn->client_id,
5301                                                  conn->sconn->msg_ctx,
5302                                                  &cli);
5303                 if (!NT_STATUS_IS_OK(status)) {
5304                         DEBUG(0, ("reply_printqueue: "
5305                                   "could not connect to spoolss: %s\n",
5306                                   nt_errstr(status)));
5307                         reply_nterror(req, status);
5308                         goto out;
5309                 }
5310
5311                 ZERO_STRUCT(devmode_ctr);
5312
5313                 status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
5314                                                 sharename,
5315                                                 NULL, devmode_ctr,
5316                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5317                                                 &handle,
5318                                                 &werr);
5319                 if (!NT_STATUS_IS_OK(status)) {
5320                         reply_nterror(req, status);
5321                         goto out;
5322                 }
5323                 if (!W_ERROR_IS_OK(werr)) {
5324                         reply_nterror(req, werror_to_ntstatus(werr));
5325                         goto out;
5326                 }
5327
5328                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5329                                                &handle,
5330                                                0, /* firstjob */
5331                                                0xff, /* numjobs */
5332                                                2, /* level */
5333                                                0, /* offered */
5334                                                &count,
5335                                                &info);
5336                 if (!W_ERROR_IS_OK(werr)) {
5337                         reply_nterror(req, werror_to_ntstatus(werr));
5338                         goto out;
5339                 }
5340
5341                 if (max_count > 0) {
5342                         first = start_index;
5343                 } else {
5344                         first = start_index + max_count + 1;
5345                 }
5346
5347                 if (first >= count) {
5348                         num_to_get = first;
5349                 } else {
5350                         num_to_get = first + MIN(ABS(max_count), count - first);
5351                 }
5352
5353                 for (i = first; i < num_to_get; i++) {
5354                         char blob[28];
5355                         char *p = blob;
5356                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5357                         int qstatus;
5358                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5359                                                         info[i].info2.job_id);
5360
5361                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5362                                 qstatus = 2;
5363                         } else {
5364                                 qstatus = 3;
5365                         }
5366
5367                         srv_put_dos_date2(p, 0, qtime);
5368                         SCVAL(p, 4, qstatus);
5369                         SSVAL(p, 5, qrapjobid);
5370                         SIVAL(p, 7, info[i].info2.size);
5371                         SCVAL(p, 11, 0);
5372                         srvstr_push(blob, req->flags2, p+12,
5373                                     info[i].info2.notify_name, 16, STR_ASCII);
5374
5375                         if (message_push_blob(
5376                                     &req->outbuf,
5377                                     data_blob_const(
5378                                             blob, sizeof(blob))) == -1) {
5379                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5380                                 goto out;
5381                         }
5382                 }
5383
5384                 if (count > 0) {
5385                         SSVAL(req->outbuf,smb_vwv0,count);
5386                         SSVAL(req->outbuf,smb_vwv1,
5387                               (max_count>0?first+count:first-1));
5388                         SCVAL(smb_buf(req->outbuf),0,1);
5389                         SSVAL(smb_buf(req->outbuf),1,28*count);
5390                 }
5391
5392
5393                 DEBUG(3, ("%u entries returned in queue\n",
5394                           (unsigned)count));
5395
5396 out:
5397                 if (cli && is_valid_policy_hnd(&handle)) {
5398                         rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
5399                 }
5400
5401         }
5402
5403         END_PROFILE(SMBsplretq);
5404         return;
5405 }
5406
5407 /****************************************************************************
5408  Reply to a printwrite.
5409 ****************************************************************************/
5410
5411 void reply_printwrite(struct smb_request *req)
5412 {
5413         connection_struct *conn = req->conn;
5414         int numtowrite;
5415         const char *data;
5416         files_struct *fsp;
5417
5418         START_PROFILE(SMBsplwr);
5419
5420         if (req->wct < 1) {
5421                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5422                 END_PROFILE(SMBsplwr);
5423                 return;
5424         }
5425
5426         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5427
5428         if (!check_fsp(conn, req, fsp)) {
5429                 END_PROFILE(SMBsplwr);
5430                 return;
5431         }
5432
5433         if (!fsp->print_file) {
5434                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5435                 END_PROFILE(SMBsplwr);
5436                 return;
5437         }
5438
5439         if (!CHECK_WRITE(fsp)) {
5440                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5441                 END_PROFILE(SMBsplwr);
5442                 return;
5443         }
5444
5445         numtowrite = SVAL(req->buf, 1);
5446
5447         if (req->buflen < numtowrite + 3) {
5448                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5449                 END_PROFILE(SMBsplwr);
5450                 return;
5451         }
5452
5453         data = (const char *)req->buf + 3;
5454
5455         if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5456                 reply_nterror(req, map_nt_error_from_unix(errno));
5457                 END_PROFILE(SMBsplwr);
5458                 return;
5459         }
5460
5461         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5462
5463         END_PROFILE(SMBsplwr);
5464         return;
5465 }
5466
5467 /****************************************************************************
5468  Reply to a mkdir.
5469 ****************************************************************************/
5470
5471 void reply_mkdir(struct smb_request *req)
5472 {
5473         connection_struct *conn = req->conn;
5474         struct smb_filename *smb_dname = NULL;
5475         char *directory = NULL;
5476         NTSTATUS status;
5477         TALLOC_CTX *ctx = talloc_tos();
5478
5479         START_PROFILE(SMBmkdir);
5480
5481         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5482                             STR_TERMINATE, &status);
5483         if (!NT_STATUS_IS_OK(status)) {
5484                 reply_nterror(req, status);
5485                 goto out;
5486         }
5487
5488         status = filename_convert(ctx, conn,
5489                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5490                                  directory,
5491                                  0,
5492                                  NULL,
5493                                  &smb_dname);
5494         if (!NT_STATUS_IS_OK(status)) {
5495                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5496                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5497                                         ERRSRV, ERRbadpath);
5498                         goto out;
5499                 }
5500                 reply_nterror(req, status);
5501                 goto out;
5502         }
5503
5504         status = create_directory(conn, req, smb_dname);
5505
5506         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5507
5508         if (!NT_STATUS_IS_OK(status)) {
5509
5510                 if (!use_nt_status()
5511                     && NT_STATUS_EQUAL(status,
5512                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5513                         /*
5514                          * Yes, in the DOS error code case we get a
5515                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5516                          * samba4 torture test.
5517                          */
5518                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5519                 }
5520
5521                 reply_nterror(req, status);
5522                 goto out;
5523         }
5524
5525         reply_outbuf(req, 0, 0);
5526
5527         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5528  out:
5529         TALLOC_FREE(smb_dname);
5530         END_PROFILE(SMBmkdir);
5531         return;
5532 }
5533
5534 /****************************************************************************
5535  Reply to a rmdir.
5536 ****************************************************************************/
5537
5538 void reply_rmdir(struct smb_request *req)
5539 {
5540         connection_struct *conn = req->conn;
5541         struct smb_filename *smb_dname = NULL;
5542         char *directory = NULL;
5543         NTSTATUS status;
5544         TALLOC_CTX *ctx = talloc_tos();
5545         files_struct *fsp = NULL;
5546         int info = 0;
5547         struct smbd_server_connection *sconn = req->sconn;
5548
5549         START_PROFILE(SMBrmdir);
5550
5551         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5552                             STR_TERMINATE, &status);
5553         if (!NT_STATUS_IS_OK(status)) {
5554                 reply_nterror(req, status);
5555                 goto out;
5556         }
5557
5558         status = filename_convert(ctx, conn,
5559                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5560                                  directory,
5561                                  0,
5562                                  NULL,
5563                                  &smb_dname);
5564         if (!NT_STATUS_IS_OK(status)) {
5565                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5566                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5567                                         ERRSRV, ERRbadpath);
5568                         goto out;
5569                 }
5570                 reply_nterror(req, status);
5571                 goto out;
5572         }
5573
5574         if (is_ntfs_stream_smb_fname(smb_dname)) {
5575                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5576                 goto out;
5577         }
5578
5579         status = SMB_VFS_CREATE_FILE(
5580                 conn,                                   /* conn */
5581                 req,                                    /* req */
5582                 0,                                      /* root_dir_fid */
5583                 smb_dname,                              /* fname */
5584                 DELETE_ACCESS,                          /* access_mask */
5585                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5586                         FILE_SHARE_DELETE),
5587                 FILE_OPEN,                              /* create_disposition*/
5588                 FILE_DIRECTORY_FILE,                    /* create_options */
5589                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5590                 0,                                      /* oplock_request */
5591                 0,                                      /* allocation_size */
5592                 0,                                      /* private_flags */
5593                 NULL,                                   /* sd */
5594                 NULL,                                   /* ea_list */
5595                 &fsp,                                   /* result */
5596                 &info);                                 /* pinfo */
5597
5598         if (!NT_STATUS_IS_OK(status)) {
5599                 if (open_was_deferred(req->mid)) {
5600                         /* We have re-scheduled this call. */
5601                         goto out;
5602                 }
5603                 reply_nterror(req, status);
5604                 goto out;
5605         }
5606
5607         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5608         if (!NT_STATUS_IS_OK(status)) {
5609                 close_file(req, fsp, ERROR_CLOSE);
5610                 reply_nterror(req, status);
5611                 goto out;
5612         }
5613
5614         if (!set_delete_on_close(fsp, true, &conn->server_info->utok)) {
5615                 close_file(req, fsp, ERROR_CLOSE);
5616                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5617                 goto out;
5618         }
5619
5620         status = close_file(req, fsp, NORMAL_CLOSE);
5621         if (!NT_STATUS_IS_OK(status)) {
5622                 reply_nterror(req, status);
5623         } else {
5624                 reply_outbuf(req, 0, 0);
5625         }
5626
5627         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5628
5629         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5630  out:
5631         TALLOC_FREE(smb_dname);
5632         END_PROFILE(SMBrmdir);
5633         return;
5634 }
5635
5636 /*******************************************************************
5637  Resolve wildcards in a filename rename.
5638 ********************************************************************/
5639
5640 static bool resolve_wildcards(TALLOC_CTX *ctx,
5641                                 const char *name1,
5642                                 const char *name2,
5643                                 char **pp_newname)
5644 {
5645         char *name2_copy = NULL;
5646         char *root1 = NULL;
5647         char *root2 = NULL;
5648         char *ext1 = NULL;
5649         char *ext2 = NULL;
5650         char *p,*p2, *pname1, *pname2;
5651
5652         name2_copy = talloc_strdup(ctx, name2);
5653         if (!name2_copy) {
5654                 return False;
5655         }
5656
5657         pname1 = strrchr_m(name1,'/');
5658         pname2 = strrchr_m(name2_copy,'/');
5659
5660         if (!pname1 || !pname2) {
5661                 return False;
5662         }
5663
5664         /* Truncate the copy of name2 at the last '/' */
5665         *pname2 = '\0';
5666
5667         /* Now go past the '/' */
5668         pname1++;
5669         pname2++;
5670
5671         root1 = talloc_strdup(ctx, pname1);
5672         root2 = talloc_strdup(ctx, pname2);
5673
5674         if (!root1 || !root2) {
5675                 return False;
5676         }
5677
5678         p = strrchr_m(root1,'.');
5679         if (p) {
5680                 *p = 0;
5681                 ext1 = talloc_strdup(ctx, p+1);
5682         } else {
5683                 ext1 = talloc_strdup(ctx, "");
5684         }
5685         p = strrchr_m(root2,'.');
5686         if (p) {
5687                 *p = 0;
5688                 ext2 = talloc_strdup(ctx, p+1);
5689         } else {
5690                 ext2 = talloc_strdup(ctx, "");
5691         }
5692
5693         if (!ext1 || !ext2) {
5694                 return False;
5695         }
5696
5697         p = root1;
5698         p2 = root2;
5699         while (*p2) {
5700                 if (*p2 == '?') {
5701                         /* Hmmm. Should this be mb-aware ? */
5702                         *p2 = *p;
5703                         p2++;
5704                 } else if (*p2 == '*') {
5705                         *p2 = '\0';
5706                         root2 = talloc_asprintf(ctx, "%s%s",
5707                                                 root2,
5708                                                 p);
5709                         if (!root2) {
5710                                 return False;
5711                         }
5712                         break;
5713                 } else {
5714                         p2++;
5715                 }
5716                 if (*p) {
5717                         p++;
5718                 }
5719         }
5720
5721         p = ext1;
5722         p2 = ext2;
5723         while (*p2) {
5724                 if (*p2 == '?') {
5725                         /* Hmmm. Should this be mb-aware ? */
5726                         *p2 = *p;
5727                         p2++;
5728                 } else if (*p2 == '*') {
5729                         *p2 = '\0';
5730                         ext2 = talloc_asprintf(ctx, "%s%s",
5731                                                 ext2,
5732                                                 p);
5733                         if (!ext2) {
5734                                 return False;
5735                         }
5736                         break;
5737                 } else {
5738                         p2++;
5739                 }
5740                 if (*p) {
5741                         p++;
5742                 }
5743         }
5744
5745         if (*ext2) {
5746                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5747                                 name2_copy,
5748                                 root2,
5749                                 ext2);
5750         } else {
5751                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5752                                 name2_copy,
5753                                 root2);
5754         }
5755
5756         if (!*pp_newname) {
5757                 return False;
5758         }
5759
5760         return True;
5761 }
5762
5763 /****************************************************************************
5764  Ensure open files have their names updated. Updated to notify other smbd's
5765  asynchronously.
5766 ****************************************************************************/
5767
5768 static void rename_open_files(connection_struct *conn,
5769                               struct share_mode_lock *lck,
5770                               const struct smb_filename *smb_fname_dst)
5771 {
5772         files_struct *fsp;
5773         bool did_rename = False;
5774         NTSTATUS status;
5775
5776         for(fsp = file_find_di_first(lck->id); fsp;
5777             fsp = file_find_di_next(fsp)) {
5778                 /* fsp_name is a relative path under the fsp. To change this for other
5779                    sharepaths we need to manipulate relative paths. */
5780                 /* TODO - create the absolute path and manipulate the newname
5781                    relative to the sharepath. */
5782                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5783                         continue;
5784                 }
5785                 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5786                            "(file_id %s) from %s -> %s\n", fsp->fnum,
5787                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5788                            smb_fname_str_dbg(smb_fname_dst)));
5789
5790                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5791                 if (NT_STATUS_IS_OK(status)) {
5792                         did_rename = True;
5793                 }
5794         }
5795
5796         if (!did_rename) {
5797                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5798                            "for %s\n", file_id_string_tos(&lck->id),
5799                            smb_fname_str_dbg(smb_fname_dst)));
5800         }
5801
5802         /* Send messages to all smbd's (not ourself) that the name has changed. */
5803         rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5804                               smb_fname_dst);
5805
5806 }
5807
5808 /****************************************************************************
5809  We need to check if the source path is a parent directory of the destination
5810  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5811  refuse the rename with a sharing violation. Under UNIX the above call can
5812  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5813  probably need to check that the client is a Windows one before disallowing
5814  this as a UNIX client (one with UNIX extensions) can know the source is a
5815  symlink and make this decision intelligently. Found by an excellent bug
5816  report from <AndyLiebman@aol.com>.
5817 ****************************************************************************/
5818
5819 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5820                                      const struct smb_filename *smb_fname_dst)
5821 {
5822         const char *psrc = smb_fname_src->base_name;
5823         const char *pdst = smb_fname_dst->base_name;
5824         size_t slen;
5825
5826         if (psrc[0] == '.' && psrc[1] == '/') {
5827                 psrc += 2;
5828         }
5829         if (pdst[0] == '.' && pdst[1] == '/') {
5830                 pdst += 2;
5831         }
5832         if ((slen = strlen(psrc)) > strlen(pdst)) {
5833                 return False;
5834         }
5835         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5836 }
5837
5838 /*
5839  * Do the notify calls from a rename
5840  */
5841
5842 static void notify_rename(connection_struct *conn, bool is_dir,
5843                           const struct smb_filename *smb_fname_src,
5844                           const struct smb_filename *smb_fname_dst)
5845 {
5846         char *parent_dir_src = NULL;
5847         char *parent_dir_dst = NULL;
5848         uint32 mask;
5849
5850         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5851                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5852
5853         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5854                             &parent_dir_src, NULL) ||
5855             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5856                             &parent_dir_dst, NULL)) {
5857                 goto out;
5858         }
5859
5860         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5861                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5862                              smb_fname_src->base_name);
5863                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5864                              smb_fname_dst->base_name);
5865         }
5866         else {
5867                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5868                              smb_fname_src->base_name);
5869                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5870                              smb_fname_dst->base_name);
5871         }
5872
5873         /* this is a strange one. w2k3 gives an additional event for
5874            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5875            files, but not directories */
5876         if (!is_dir) {
5877                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5878                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5879                              |FILE_NOTIFY_CHANGE_CREATION,
5880                              smb_fname_dst->base_name);
5881         }
5882  out:
5883         TALLOC_FREE(parent_dir_src);
5884         TALLOC_FREE(parent_dir_dst);
5885 }
5886
5887 /****************************************************************************
5888  Rename an open file - given an fsp.
5889 ****************************************************************************/
5890
5891 NTSTATUS rename_internals_fsp(connection_struct *conn,
5892                         files_struct *fsp,
5893                         const struct smb_filename *smb_fname_dst_in,
5894                         uint32 attrs,
5895                         bool replace_if_exists)
5896 {
5897         TALLOC_CTX *ctx = talloc_tos();
5898         struct smb_filename *smb_fname_dst = NULL;
5899         NTSTATUS status = NT_STATUS_OK;
5900         struct share_mode_lock *lck = NULL;
5901         bool dst_exists, old_is_stream, new_is_stream;
5902
5903         status = check_name(conn, smb_fname_dst_in->base_name);
5904         if (!NT_STATUS_IS_OK(status)) {
5905                 return status;
5906         }
5907
5908         /* Make a copy of the dst smb_fname structs */
5909
5910         status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5911         if (!NT_STATUS_IS_OK(status)) {
5912                 goto out;
5913         }
5914
5915         /* Ensure the dst smb_fname contains a '/' */
5916         if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5917                 char * tmp;
5918                 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5919                                       smb_fname_dst->base_name);
5920                 if (!tmp) {
5921                         status = NT_STATUS_NO_MEMORY;
5922                         goto out;
5923                 }
5924                 TALLOC_FREE(smb_fname_dst->base_name);
5925                 smb_fname_dst->base_name = tmp;
5926         }
5927
5928         /*
5929          * Check for special case with case preserving and not
5930          * case sensitive. If the old last component differs from the original
5931          * last component only by case, then we should allow
5932          * the rename (user is trying to change the case of the
5933          * filename).
5934          */
5935         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5936             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
5937             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
5938                 char *last_slash;
5939                 char *fname_dst_lcomp_base_mod = NULL;
5940                 struct smb_filename *smb_fname_orig_lcomp = NULL;
5941
5942                 /*
5943                  * Get the last component of the destination name.  Note that
5944                  * we guarantee that destination name contains a '/' character
5945                  * above.
5946                  */
5947                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5948                 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5949                 if (!fname_dst_lcomp_base_mod) {
5950                         status = NT_STATUS_NO_MEMORY;
5951                         goto out;
5952                 }
5953
5954                 /*
5955                  * Create an smb_filename struct using the original last
5956                  * component of the destination.
5957                  */
5958                 status = create_synthetic_smb_fname_split(ctx,
5959                     smb_fname_dst->original_lcomp, NULL,
5960                     &smb_fname_orig_lcomp);
5961                 if (!NT_STATUS_IS_OK(status)) {
5962                         TALLOC_FREE(fname_dst_lcomp_base_mod);
5963                         goto out;
5964                 }
5965
5966                 /* If the base names only differ by case, use original. */
5967                 if(!strcsequal(fname_dst_lcomp_base_mod,
5968                                smb_fname_orig_lcomp->base_name)) {
5969                         char *tmp;
5970                         /*
5971                          * Replace the modified last component with the
5972                          * original.
5973                          */
5974                         *last_slash = '\0'; /* Truncate at the '/' */
5975                         tmp = talloc_asprintf(smb_fname_dst,
5976                                         "%s/%s",
5977                                         smb_fname_dst->base_name,
5978                                         smb_fname_orig_lcomp->base_name);
5979                         if (tmp == NULL) {
5980                                 status = NT_STATUS_NO_MEMORY;
5981                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5982                                 TALLOC_FREE(smb_fname_orig_lcomp);
5983                                 goto out;
5984                         }
5985                         TALLOC_FREE(smb_fname_dst->base_name);
5986                         smb_fname_dst->base_name = tmp;
5987                 }
5988
5989                 /* If the stream_names only differ by case, use original. */
5990                 if(!strcsequal(smb_fname_dst->stream_name,
5991                                smb_fname_orig_lcomp->stream_name)) {
5992                         char *tmp = NULL;
5993                         /* Use the original stream. */
5994                         tmp = talloc_strdup(smb_fname_dst,
5995                                             smb_fname_orig_lcomp->stream_name);
5996                         if (tmp == NULL) {
5997                                 status = NT_STATUS_NO_MEMORY;
5998                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5999                                 TALLOC_FREE(smb_fname_orig_lcomp);
6000                                 goto out;
6001                         }
6002                         TALLOC_FREE(smb_fname_dst->stream_name);
6003                         smb_fname_dst->stream_name = tmp;
6004                 }
6005                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6006                 TALLOC_FREE(smb_fname_orig_lcomp);
6007         }
6008
6009         /*
6010          * If the src and dest names are identical - including case,
6011          * don't do the rename, just return success.
6012          */
6013
6014         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6015             strcsequal(fsp->fsp_name->stream_name,
6016                        smb_fname_dst->stream_name)) {
6017                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6018                           "- returning success\n",
6019                           smb_fname_str_dbg(smb_fname_dst)));
6020                 status = NT_STATUS_OK;
6021                 goto out;
6022         }
6023
6024         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6025         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6026
6027         /* Return the correct error code if both names aren't streams. */
6028         if (!old_is_stream && new_is_stream) {
6029                 status = NT_STATUS_OBJECT_NAME_INVALID;
6030                 goto out;
6031         }
6032
6033         if (old_is_stream && !new_is_stream) {
6034                 status = NT_STATUS_INVALID_PARAMETER;
6035                 goto out;
6036         }
6037
6038         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6039
6040         if(!replace_if_exists && dst_exists) {
6041                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6042                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6043                           smb_fname_str_dbg(smb_fname_dst)));
6044                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6045                 goto out;
6046         }
6047
6048         if (dst_exists) {
6049                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6050                     &smb_fname_dst->st);
6051                 files_struct *dst_fsp = file_find_di_first(fileid);
6052                 /* The file can be open when renaming a stream */
6053                 if (dst_fsp && !new_is_stream) {
6054                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6055                         status = NT_STATUS_ACCESS_DENIED;
6056                         goto out;
6057                 }
6058         }
6059
6060         /* Ensure we have a valid stat struct for the source. */
6061         status = vfs_stat_fsp(fsp);
6062         if (!NT_STATUS_IS_OK(status)) {
6063                 goto out;
6064         }
6065
6066         status = can_rename(conn, fsp, attrs);
6067
6068         if (!NT_STATUS_IS_OK(status)) {
6069                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6070                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6071                           smb_fname_str_dbg(smb_fname_dst)));
6072                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6073                         status = NT_STATUS_ACCESS_DENIED;
6074                 goto out;
6075         }
6076
6077         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6078                 status = NT_STATUS_ACCESS_DENIED;
6079         }
6080
6081         lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6082                                   NULL);
6083
6084         /*
6085          * We have the file open ourselves, so not being able to get the
6086          * corresponding share mode lock is a fatal error.
6087          */
6088
6089         SMB_ASSERT(lck != NULL);
6090
6091         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6092                 uint32 create_options = fsp->fh->private_options;
6093
6094                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6095                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6096                           smb_fname_str_dbg(smb_fname_dst)));
6097
6098                 if (lp_map_archive(SNUM(conn)) ||
6099                     lp_store_dos_attributes(SNUM(conn))) {
6100                         /* We must set the archive bit on the newly
6101                            renamed file. */
6102                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6103                                 uint32_t old_dosmode = dos_mode(conn,
6104                                                         smb_fname_dst);
6105                                 file_set_dosmode(conn,
6106                                         smb_fname_dst,
6107                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6108                                         NULL,
6109                                         true);
6110                         }
6111                 }
6112
6113                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6114                               smb_fname_dst);
6115
6116                 rename_open_files(conn, lck, smb_fname_dst);
6117
6118                 /*
6119                  * A rename acts as a new file create w.r.t. allowing an initial delete
6120                  * on close, probably because in Windows there is a new handle to the
6121                  * new file. If initial delete on close was requested but not
6122                  * originally set, we need to set it here. This is probably not 100% correct,
6123                  * but will work for the CIFSFS client which in non-posix mode
6124                  * depends on these semantics. JRA.
6125                  */
6126
6127                 if (create_options & FILE_DELETE_ON_CLOSE) {
6128                         status = can_set_delete_on_close(fsp, 0);
6129
6130                         if (NT_STATUS_IS_OK(status)) {
6131                                 /* Note that here we set the *inital* delete on close flag,
6132                                  * not the regular one. The magic gets handled in close. */
6133                                 fsp->initial_delete_on_close = True;
6134                         }
6135                 }
6136                 TALLOC_FREE(lck);
6137                 status = NT_STATUS_OK;
6138                 goto out;
6139         }
6140
6141         TALLOC_FREE(lck);
6142
6143         if (errno == ENOTDIR || errno == EISDIR) {
6144                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6145         } else {
6146                 status = map_nt_error_from_unix(errno);
6147         }
6148
6149         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6150                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6151                   smb_fname_str_dbg(smb_fname_dst)));
6152
6153  out:
6154         TALLOC_FREE(smb_fname_dst);
6155
6156         return status;
6157 }
6158
6159 /****************************************************************************
6160  The guts of the rename command, split out so it may be called by the NT SMB
6161  code.
6162 ****************************************************************************/
6163
6164 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6165                         connection_struct *conn,
6166                         struct smb_request *req,
6167                         struct smb_filename *smb_fname_src,
6168                         struct smb_filename *smb_fname_dst,
6169                         uint32 attrs,
6170                         bool replace_if_exists,
6171                         bool src_has_wild,
6172                         bool dest_has_wild,
6173                         uint32_t access_mask)
6174 {
6175         char *fname_src_dir = NULL;
6176         char *fname_src_mask = NULL;
6177         int count=0;
6178         NTSTATUS status = NT_STATUS_OK;
6179         struct smb_Dir *dir_hnd = NULL;
6180         const char *dname = NULL;
6181         char *talloced = NULL;
6182         long offset = 0;
6183         int create_options = 0;
6184         bool posix_pathnames = lp_posix_pathnames();
6185
6186         /*
6187          * Split the old name into directory and last component
6188          * strings. Note that unix_convert may have stripped off a
6189          * leading ./ from both name and newname if the rename is
6190          * at the root of the share. We need to make sure either both
6191          * name and newname contain a / character or neither of them do
6192          * as this is checked in resolve_wildcards().
6193          */
6194
6195         /* Split up the directory from the filename/mask. */
6196         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6197                                       &fname_src_dir, &fname_src_mask);
6198         if (!NT_STATUS_IS_OK(status)) {
6199                 status = NT_STATUS_NO_MEMORY;
6200                 goto out;
6201         }
6202
6203         /*
6204          * We should only check the mangled cache
6205          * here if unix_convert failed. This means
6206          * that the path in 'mask' doesn't exist
6207          * on the file system and so we need to look
6208          * for a possible mangle. This patch from
6209          * Tine Smukavec <valentin.smukavec@hermes.si>.
6210          */
6211
6212         if (!VALID_STAT(smb_fname_src->st) &&
6213             mangle_is_mangled(fname_src_mask, conn->params)) {
6214                 char *new_mask = NULL;
6215                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6216                                             conn->params);
6217                 if (new_mask) {
6218                         TALLOC_FREE(fname_src_mask);
6219                         fname_src_mask = new_mask;
6220                 }
6221         }
6222
6223         if (!src_has_wild) {
6224                 files_struct *fsp;
6225
6226                 /*
6227                  * Only one file needs to be renamed. Append the mask back
6228                  * onto the directory.
6229                  */
6230                 TALLOC_FREE(smb_fname_src->base_name);
6231                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6232                                                            "%s/%s",
6233                                                            fname_src_dir,
6234                                                            fname_src_mask);
6235                 if (!smb_fname_src->base_name) {
6236                         status = NT_STATUS_NO_MEMORY;
6237                         goto out;
6238                 }
6239
6240                 /* Ensure dst fname contains a '/' also */
6241                 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6242                         char *tmp;
6243                         tmp = talloc_asprintf(smb_fname_dst, "./%s",
6244                                               smb_fname_dst->base_name);
6245                         if (!tmp) {
6246                                 status = NT_STATUS_NO_MEMORY;
6247                                 goto out;
6248                         }
6249                         TALLOC_FREE(smb_fname_dst->base_name);
6250                         smb_fname_dst->base_name = tmp;
6251                 }
6252
6253                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6254                           "case_preserve = %d, short case preserve = %d, "
6255                           "directory = %s, newname = %s, "
6256                           "last_component_dest = %s\n",
6257                           conn->case_sensitive, conn->case_preserve,
6258                           conn->short_case_preserve,
6259                           smb_fname_str_dbg(smb_fname_src),
6260                           smb_fname_str_dbg(smb_fname_dst),
6261                           smb_fname_dst->original_lcomp));
6262
6263                 /* The dest name still may have wildcards. */
6264                 if (dest_has_wild) {
6265                         char *fname_dst_mod = NULL;
6266                         if (!resolve_wildcards(smb_fname_dst,
6267                                                smb_fname_src->base_name,
6268                                                smb_fname_dst->base_name,
6269                                                &fname_dst_mod)) {
6270                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6271                                           "%s %s failed\n",
6272                                           smb_fname_src->base_name,
6273                                           smb_fname_dst->base_name));
6274                                 status = NT_STATUS_NO_MEMORY;
6275                                 goto out;
6276                         }
6277                         TALLOC_FREE(smb_fname_dst->base_name);
6278                         smb_fname_dst->base_name = fname_dst_mod;
6279                 }
6280
6281                 ZERO_STRUCT(smb_fname_src->st);
6282                 if (posix_pathnames) {
6283                         SMB_VFS_LSTAT(conn, smb_fname_src);
6284                 } else {
6285                         SMB_VFS_STAT(conn, smb_fname_src);
6286                 }
6287
6288                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6289                         create_options |= FILE_DIRECTORY_FILE;
6290                 }
6291
6292                 status = SMB_VFS_CREATE_FILE(
6293                         conn,                           /* conn */
6294                         req,                            /* req */
6295                         0,                              /* root_dir_fid */
6296                         smb_fname_src,                  /* fname */
6297                         access_mask,                    /* access_mask */
6298                         (FILE_SHARE_READ |              /* share_access */
6299                             FILE_SHARE_WRITE),
6300                         FILE_OPEN,                      /* create_disposition*/
6301                         create_options,                 /* create_options */
6302                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6303                         0,                              /* oplock_request */
6304                         0,                              /* allocation_size */
6305                         0,                              /* private_flags */
6306                         NULL,                           /* sd */
6307                         NULL,                           /* ea_list */
6308                         &fsp,                           /* result */
6309                         NULL);                          /* pinfo */
6310
6311                 if (!NT_STATUS_IS_OK(status)) {
6312                         DEBUG(3, ("Could not open rename source %s: %s\n",
6313                                   smb_fname_str_dbg(smb_fname_src),
6314                                   nt_errstr(status)));
6315                         goto out;
6316                 }
6317
6318                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6319                                               attrs, replace_if_exists);
6320
6321                 close_file(req, fsp, NORMAL_CLOSE);
6322
6323                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6324                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6325                           smb_fname_str_dbg(smb_fname_dst)));
6326
6327                 goto out;
6328         }
6329
6330         /*
6331          * Wildcards - process each file that matches.
6332          */
6333         if (strequal(fname_src_mask, "????????.???")) {
6334                 TALLOC_FREE(fname_src_mask);
6335                 fname_src_mask = talloc_strdup(ctx, "*");
6336                 if (!fname_src_mask) {
6337                         status = NT_STATUS_NO_MEMORY;
6338                         goto out;
6339                 }
6340         }
6341
6342         status = check_name(conn, fname_src_dir);
6343         if (!NT_STATUS_IS_OK(status)) {
6344                 goto out;
6345         }
6346
6347         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6348                           attrs);
6349         if (dir_hnd == NULL) {
6350                 status = map_nt_error_from_unix(errno);
6351                 goto out;
6352         }
6353
6354         status = NT_STATUS_NO_SUCH_FILE;
6355         /*
6356          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6357          * - gentest fix. JRA
6358          */
6359
6360         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6361                                     &talloced))) {
6362                 files_struct *fsp = NULL;
6363                 char *destname = NULL;
6364                 bool sysdir_entry = False;
6365
6366                 /* Quick check for "." and ".." */
6367                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6368                         if (attrs & aDIR) {
6369                                 sysdir_entry = True;
6370                         } else {
6371                                 TALLOC_FREE(talloced);
6372                                 continue;
6373                         }
6374                 }
6375
6376                 if (!is_visible_file(conn, fname_src_dir, dname,
6377                                      &smb_fname_src->st, false)) {
6378                         TALLOC_FREE(talloced);
6379                         continue;
6380                 }
6381
6382                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6383                         TALLOC_FREE(talloced);
6384                         continue;
6385                 }
6386
6387                 if (sysdir_entry) {
6388                         status = NT_STATUS_OBJECT_NAME_INVALID;
6389                         break;
6390                 }
6391
6392                 TALLOC_FREE(smb_fname_src->base_name);
6393                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6394                                                            "%s/%s",
6395                                                            fname_src_dir,
6396                                                            dname);
6397                 if (!smb_fname_src->base_name) {
6398                         status = NT_STATUS_NO_MEMORY;
6399                         goto out;
6400                 }
6401
6402                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6403                                        smb_fname_dst->base_name,
6404                                        &destname)) {
6405                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6406                                   smb_fname_src->base_name, destname));
6407                         TALLOC_FREE(talloced);
6408                         continue;
6409                 }
6410                 if (!destname) {
6411                         status = NT_STATUS_NO_MEMORY;
6412                         goto out;
6413                 }
6414
6415                 TALLOC_FREE(smb_fname_dst->base_name);
6416                 smb_fname_dst->base_name = destname;
6417
6418                 ZERO_STRUCT(smb_fname_src->st);
6419                 if (posix_pathnames) {
6420                         SMB_VFS_LSTAT(conn, smb_fname_src);
6421                 } else {
6422                         SMB_VFS_STAT(conn, smb_fname_src);
6423                 }
6424
6425                 create_options = 0;
6426
6427                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6428                         create_options |= FILE_DIRECTORY_FILE;
6429                 }
6430
6431                 status = SMB_VFS_CREATE_FILE(
6432                         conn,                           /* conn */
6433                         req,                            /* req */
6434                         0,                              /* root_dir_fid */
6435                         smb_fname_src,                  /* fname */
6436                         access_mask,                    /* access_mask */
6437                         (FILE_SHARE_READ |              /* share_access */
6438                             FILE_SHARE_WRITE),
6439                         FILE_OPEN,                      /* create_disposition*/
6440                         create_options,                 /* create_options */
6441                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6442                         0,                              /* oplock_request */
6443                         0,                              /* allocation_size */
6444                         0,                              /* private_flags */
6445                         NULL,                           /* sd */
6446                         NULL,                           /* ea_list */
6447                         &fsp,                           /* result */
6448                         NULL);                          /* pinfo */
6449
6450                 if (!NT_STATUS_IS_OK(status)) {
6451                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6452                                  "returned %s rename %s -> %s\n",
6453                                  nt_errstr(status),
6454                                  smb_fname_str_dbg(smb_fname_src),
6455                                  smb_fname_str_dbg(smb_fname_dst)));
6456                         break;
6457                 }
6458
6459                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6460                                                               dname);
6461                 if (!smb_fname_dst->original_lcomp) {
6462                         status = NT_STATUS_NO_MEMORY;
6463                         goto out;
6464                 }
6465
6466                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6467                                               attrs, replace_if_exists);
6468
6469                 close_file(req, fsp, NORMAL_CLOSE);
6470
6471                 if (!NT_STATUS_IS_OK(status)) {
6472                         DEBUG(3, ("rename_internals_fsp returned %s for "
6473                                   "rename %s -> %s\n", nt_errstr(status),
6474                                   smb_fname_str_dbg(smb_fname_src),
6475                                   smb_fname_str_dbg(smb_fname_dst)));
6476                         break;
6477                 }
6478
6479                 count++;
6480
6481                 DEBUG(3,("rename_internals: doing rename on %s -> "
6482                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6483                          smb_fname_str_dbg(smb_fname_src)));
6484                 TALLOC_FREE(talloced);
6485         }
6486         TALLOC_FREE(dir_hnd);
6487
6488         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6489                 status = map_nt_error_from_unix(errno);
6490         }
6491
6492  out:
6493         TALLOC_FREE(talloced);
6494         TALLOC_FREE(fname_src_dir);
6495         TALLOC_FREE(fname_src_mask);
6496         return status;
6497 }
6498
6499 /****************************************************************************
6500  Reply to a mv.
6501 ****************************************************************************/
6502
6503 void reply_mv(struct smb_request *req)
6504 {
6505         connection_struct *conn = req->conn;
6506         char *name = NULL;
6507         char *newname = NULL;
6508         const char *p;
6509         uint32 attrs;
6510         NTSTATUS status;
6511         bool src_has_wcard = False;
6512         bool dest_has_wcard = False;
6513         TALLOC_CTX *ctx = talloc_tos();
6514         struct smb_filename *smb_fname_src = NULL;
6515         struct smb_filename *smb_fname_dst = NULL;
6516
6517         START_PROFILE(SMBmv);
6518
6519         if (req->wct < 1) {
6520                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6521                 goto out;
6522         }
6523
6524         attrs = SVAL(req->vwv+0, 0);
6525
6526         p = (const char *)req->buf + 1;
6527         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6528                                        &status, &src_has_wcard);
6529         if (!NT_STATUS_IS_OK(status)) {
6530                 reply_nterror(req, status);
6531                 goto out;
6532         }
6533         p++;
6534         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6535                                        &status, &dest_has_wcard);
6536         if (!NT_STATUS_IS_OK(status)) {
6537                 reply_nterror(req, status);
6538                 goto out;
6539         }
6540
6541         status = filename_convert(ctx,
6542                                   conn,
6543                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6544                                   name,
6545                                   UCF_COND_ALLOW_WCARD_LCOMP,
6546                                   &src_has_wcard,
6547                                   &smb_fname_src);
6548
6549         if (!NT_STATUS_IS_OK(status)) {
6550                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6551                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6552                                         ERRSRV, ERRbadpath);
6553                         goto out;
6554                 }
6555                 reply_nterror(req, status);
6556                 goto out;
6557         }
6558
6559         status = filename_convert(ctx,
6560                                   conn,
6561                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6562                                   newname,
6563                                   UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6564                                   &dest_has_wcard,
6565                                   &smb_fname_dst);
6566
6567         if (!NT_STATUS_IS_OK(status)) {
6568                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6569                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6570                                         ERRSRV, ERRbadpath);
6571                         goto out;
6572                 }
6573                 reply_nterror(req, status);
6574                 goto out;
6575         }
6576
6577         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6578                  smb_fname_str_dbg(smb_fname_dst)));
6579
6580         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6581                                   attrs, False, src_has_wcard, dest_has_wcard,
6582                                   DELETE_ACCESS);
6583         if (!NT_STATUS_IS_OK(status)) {
6584                 if (open_was_deferred(req->mid)) {
6585                         /* We have re-scheduled this call. */
6586                         goto out;
6587                 }
6588                 reply_nterror(req, status);
6589                 goto out;
6590         }
6591
6592         reply_outbuf(req, 0, 0);
6593  out:
6594         TALLOC_FREE(smb_fname_src);
6595         TALLOC_FREE(smb_fname_dst);
6596         END_PROFILE(SMBmv);
6597         return;
6598 }
6599
6600 /*******************************************************************
6601  Copy a file as part of a reply_copy.
6602 ******************************************************************/
6603
6604 /*
6605  * TODO: check error codes on all callers
6606  */
6607
6608 NTSTATUS copy_file(TALLOC_CTX *ctx,
6609                         connection_struct *conn,
6610                         struct smb_filename *smb_fname_src,
6611                         struct smb_filename *smb_fname_dst,
6612                         int ofun,
6613                         int count,
6614                         bool target_is_directory)
6615 {
6616         struct smb_filename *smb_fname_dst_tmp = NULL;
6617         SMB_OFF_T ret=-1;
6618         files_struct *fsp1,*fsp2;
6619         uint32 dosattrs;
6620         uint32 new_create_disposition;
6621         NTSTATUS status;
6622
6623
6624         status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6625         if (!NT_STATUS_IS_OK(status)) {
6626                 return status;
6627         }
6628
6629         /*
6630          * If the target is a directory, extract the last component from the
6631          * src filename and append it to the dst filename
6632          */
6633         if (target_is_directory) {
6634                 const char *p;
6635
6636                 /* dest/target can't be a stream if it's a directory. */
6637                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6638
6639                 p = strrchr_m(smb_fname_src->base_name,'/');
6640                 if (p) {
6641                         p++;
6642                 } else {
6643                         p = smb_fname_src->base_name;
6644                 }
6645                 smb_fname_dst_tmp->base_name =
6646                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6647                                            p);
6648                 if (!smb_fname_dst_tmp->base_name) {
6649                         status = NT_STATUS_NO_MEMORY;
6650                         goto out;
6651                 }
6652         }
6653
6654         status = vfs_file_exist(conn, smb_fname_src);
6655         if (!NT_STATUS_IS_OK(status)) {
6656                 goto out;
6657         }
6658
6659         if (!target_is_directory && count) {
6660                 new_create_disposition = FILE_OPEN;
6661         } else {
6662                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6663                                                  NULL, NULL,
6664                                                  &new_create_disposition,
6665                                                  NULL,
6666                                                  NULL)) {
6667                         status = NT_STATUS_INVALID_PARAMETER;
6668                         goto out;
6669                 }
6670         }
6671
6672         /* Open the src file for reading. */
6673         status = SMB_VFS_CREATE_FILE(
6674                 conn,                                   /* conn */
6675                 NULL,                                   /* req */
6676                 0,                                      /* root_dir_fid */
6677                 smb_fname_src,                          /* fname */
6678                 FILE_GENERIC_READ,                      /* access_mask */
6679                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6680                 FILE_OPEN,                              /* create_disposition*/
6681                 0,                                      /* create_options */
6682                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
6683                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6684                 0,                                      /* allocation_size */
6685                 0,                                      /* private_flags */
6686                 NULL,                                   /* sd */
6687                 NULL,                                   /* ea_list */
6688                 &fsp1,                                  /* result */
6689                 NULL);                                  /* psbuf */
6690
6691         if (!NT_STATUS_IS_OK(status)) {
6692                 goto out;
6693         }
6694
6695         dosattrs = dos_mode(conn, smb_fname_src);
6696
6697         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6698                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6699         }
6700
6701         /* Open the dst file for writing. */
6702         status = SMB_VFS_CREATE_FILE(
6703                 conn,                                   /* conn */
6704                 NULL,                                   /* req */
6705                 0,                                      /* root_dir_fid */
6706                 smb_fname_dst,                          /* fname */
6707                 FILE_GENERIC_WRITE,                     /* access_mask */
6708                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6709                 new_create_disposition,                 /* create_disposition*/
6710                 0,                                      /* create_options */
6711                 dosattrs,                               /* file_attributes */
6712                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6713                 0,                                      /* allocation_size */
6714                 0,                                      /* private_flags */
6715                 NULL,                                   /* sd */
6716                 NULL,                                   /* ea_list */
6717                 &fsp2,                                  /* result */
6718                 NULL);                                  /* psbuf */
6719
6720         if (!NT_STATUS_IS_OK(status)) {
6721                 close_file(NULL, fsp1, ERROR_CLOSE);
6722                 goto out;
6723         }
6724
6725         if ((ofun&3) == 1) {
6726                 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6727                         DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6728                         /*
6729                          * Stop the copy from occurring.
6730                          */
6731                         ret = -1;
6732                         smb_fname_src->st.st_ex_size = 0;
6733                 }
6734         }
6735
6736         /* Do the actual copy. */
6737         if (smb_fname_src->st.st_ex_size) {
6738                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6739         }
6740
6741         close_file(NULL, fsp1, NORMAL_CLOSE);
6742
6743         /* Ensure the modtime is set correctly on the destination file. */
6744         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6745
6746         /*
6747          * As we are opening fsp1 read-only we only expect
6748          * an error on close on fsp2 if we are out of space.
6749          * Thus we don't look at the error return from the
6750          * close of fsp1.
6751          */
6752         status = close_file(NULL, fsp2, NORMAL_CLOSE);
6753
6754         if (!NT_STATUS_IS_OK(status)) {
6755                 goto out;
6756         }
6757
6758         if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6759                 status = NT_STATUS_DISK_FULL;
6760                 goto out;
6761         }
6762
6763         status = NT_STATUS_OK;
6764
6765  out:
6766         TALLOC_FREE(smb_fname_dst_tmp);
6767         return status;
6768 }
6769
6770 /****************************************************************************
6771  Reply to a file copy.
6772 ****************************************************************************/
6773
6774 void reply_copy(struct smb_request *req)
6775 {
6776         connection_struct *conn = req->conn;
6777         struct smb_filename *smb_fname_src = NULL;
6778         struct smb_filename *smb_fname_dst = NULL;
6779         char *fname_src = NULL;
6780         char *fname_dst = NULL;
6781         char *fname_src_mask = NULL;
6782         char *fname_src_dir = NULL;
6783         const char *p;
6784         int count=0;
6785         int error = ERRnoaccess;
6786         int tid2;
6787         int ofun;
6788         int flags;
6789         bool target_is_directory=False;
6790         bool source_has_wild = False;
6791         bool dest_has_wild = False;
6792         NTSTATUS status;
6793         TALLOC_CTX *ctx = talloc_tos();
6794
6795         START_PROFILE(SMBcopy);
6796
6797         if (req->wct < 3) {
6798                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6799                 goto out;
6800         }
6801
6802         tid2 = SVAL(req->vwv+0, 0);
6803         ofun = SVAL(req->vwv+1, 0);
6804         flags = SVAL(req->vwv+2, 0);
6805
6806         p = (const char *)req->buf;
6807         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6808                                        &status, &source_has_wild);
6809         if (!NT_STATUS_IS_OK(status)) {
6810                 reply_nterror(req, status);
6811                 goto out;
6812         }
6813         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6814                                        &status, &dest_has_wild);
6815         if (!NT_STATUS_IS_OK(status)) {
6816                 reply_nterror(req, status);
6817                 goto out;
6818         }
6819
6820         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6821
6822         if (tid2 != conn->cnum) {
6823                 /* can't currently handle inter share copies XXXX */
6824                 DEBUG(3,("Rejecting inter-share copy\n"));
6825                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6826                 goto out;
6827         }
6828
6829         status = filename_convert(ctx, conn,
6830                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6831                                   fname_src,
6832                                   UCF_COND_ALLOW_WCARD_LCOMP,
6833                                   &source_has_wild,
6834                                   &smb_fname_src);
6835         if (!NT_STATUS_IS_OK(status)) {
6836                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6837                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6838                                         ERRSRV, ERRbadpath);
6839                         goto out;
6840                 }
6841                 reply_nterror(req, status);
6842                 goto out;
6843         }
6844
6845         status = filename_convert(ctx, conn,
6846                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6847                                   fname_dst,
6848                                   UCF_COND_ALLOW_WCARD_LCOMP,
6849                                   &dest_has_wild,
6850                                   &smb_fname_dst);
6851         if (!NT_STATUS_IS_OK(status)) {
6852                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6853                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6854                                         ERRSRV, ERRbadpath);
6855                         goto out;
6856                 }
6857                 reply_nterror(req, status);
6858                 goto out;
6859         }
6860
6861         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6862
6863         if ((flags&1) && target_is_directory) {
6864                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
6865                 goto out;
6866         }
6867
6868         if ((flags&2) && !target_is_directory) {
6869                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
6870                 goto out;
6871         }
6872
6873         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6874                 /* wants a tree copy! XXXX */
6875                 DEBUG(3,("Rejecting tree copy\n"));
6876                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6877                 goto out;
6878         }
6879
6880         /* Split up the directory from the filename/mask. */
6881         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6882                                       &fname_src_dir, &fname_src_mask);
6883         if (!NT_STATUS_IS_OK(status)) {
6884                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6885                 goto out;
6886         }
6887
6888         /*
6889          * We should only check the mangled cache
6890          * here if unix_convert failed. This means
6891          * that the path in 'mask' doesn't exist
6892          * on the file system and so we need to look
6893          * for a possible mangle. This patch from
6894          * Tine Smukavec <valentin.smukavec@hermes.si>.
6895          */
6896         if (!VALID_STAT(smb_fname_src->st) &&
6897             mangle_is_mangled(fname_src_mask, conn->params)) {
6898                 char *new_mask = NULL;
6899                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6900                                             &new_mask, conn->params);
6901
6902                 /* Use demangled name if one was successfully found. */
6903                 if (new_mask) {
6904                         TALLOC_FREE(fname_src_mask);
6905                         fname_src_mask = new_mask;
6906                 }
6907         }
6908
6909         if (!source_has_wild) {
6910
6911                 /*
6912                  * Only one file needs to be copied. Append the mask back onto
6913                  * the directory.
6914                  */
6915                 TALLOC_FREE(smb_fname_src->base_name);
6916                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6917                                                            "%s/%s",
6918                                                            fname_src_dir,
6919                                                            fname_src_mask);
6920                 if (!smb_fname_src->base_name) {
6921                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6922                         goto out;
6923                 }
6924
6925                 if (dest_has_wild) {
6926                         char *fname_dst_mod = NULL;
6927                         if (!resolve_wildcards(smb_fname_dst,
6928                                                smb_fname_src->base_name,
6929                                                smb_fname_dst->base_name,
6930                                                &fname_dst_mod)) {
6931                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6932                                 goto out;
6933                         }
6934                         TALLOC_FREE(smb_fname_dst->base_name);
6935                         smb_fname_dst->base_name = fname_dst_mod;
6936                 }
6937
6938                 status = check_name(conn, smb_fname_src->base_name);
6939                 if (!NT_STATUS_IS_OK(status)) {
6940                         reply_nterror(req, status);
6941                         goto out;
6942                 }
6943
6944                 status = check_name(conn, smb_fname_dst->base_name);
6945                 if (!NT_STATUS_IS_OK(status)) {
6946                         reply_nterror(req, status);
6947                         goto out;
6948                 }
6949
6950                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6951                                    ofun, count, target_is_directory);
6952
6953                 if(!NT_STATUS_IS_OK(status)) {
6954                         reply_nterror(req, status);
6955                         goto out;
6956                 } else {
6957                         count++;
6958                 }
6959         } else {
6960                 struct smb_Dir *dir_hnd = NULL;
6961                 const char *dname = NULL;
6962                 char *talloced = NULL;
6963                 long offset = 0;
6964
6965                 /*
6966                  * There is a wildcard that requires us to actually read the
6967                  * src dir and copy each file matching the mask to the dst.
6968                  * Right now streams won't be copied, but this could
6969                  * presumably be added with a nested loop for reach dir entry.
6970                  */
6971                 SMB_ASSERT(!smb_fname_src->stream_name);
6972                 SMB_ASSERT(!smb_fname_dst->stream_name);
6973
6974                 smb_fname_src->stream_name = NULL;
6975                 smb_fname_dst->stream_name = NULL;
6976
6977                 if (strequal(fname_src_mask,"????????.???")) {
6978                         TALLOC_FREE(fname_src_mask);
6979                         fname_src_mask = talloc_strdup(ctx, "*");
6980                         if (!fname_src_mask) {
6981                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6982                                 goto out;
6983                         }
6984                 }
6985
6986                 status = check_name(conn, fname_src_dir);
6987                 if (!NT_STATUS_IS_OK(status)) {
6988                         reply_nterror(req, status);
6989                         goto out;
6990                 }
6991
6992                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6993                 if (dir_hnd == NULL) {
6994                         status = map_nt_error_from_unix(errno);
6995                         reply_nterror(req, status);
6996                         goto out;
6997                 }
6998
6999                 error = ERRbadfile;
7000
7001                 /* Iterate over the src dir copying each entry to the dst. */
7002                 while ((dname = ReadDirName(dir_hnd, &offset,
7003                                             &smb_fname_src->st, &talloced))) {
7004                         char *destname = NULL;
7005
7006                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7007                                 TALLOC_FREE(talloced);
7008                                 continue;
7009                         }
7010
7011                         if (!is_visible_file(conn, fname_src_dir, dname,
7012                                              &smb_fname_src->st, false)) {
7013                                 TALLOC_FREE(talloced);
7014                                 continue;
7015                         }
7016
7017                         if(!mask_match(dname, fname_src_mask,
7018                                        conn->case_sensitive)) {
7019                                 TALLOC_FREE(talloced);
7020                                 continue;
7021                         }
7022
7023                         error = ERRnoaccess;
7024
7025                         /* Get the src smb_fname struct setup. */
7026                         TALLOC_FREE(smb_fname_src->base_name);
7027                         smb_fname_src->base_name =
7028                             talloc_asprintf(smb_fname_src, "%s/%s",
7029                                             fname_src_dir, dname);
7030
7031                         if (!smb_fname_src->base_name) {
7032                                 TALLOC_FREE(dir_hnd);
7033                                 TALLOC_FREE(talloced);
7034                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7035                                 goto out;
7036                         }
7037
7038                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7039                                                smb_fname_dst->base_name,
7040                                                &destname)) {
7041                                 TALLOC_FREE(talloced);
7042                                 continue;
7043                         }
7044                         if (!destname) {
7045                                 TALLOC_FREE(dir_hnd);
7046                                 TALLOC_FREE(talloced);
7047                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7048                                 goto out;
7049                         }
7050
7051                         TALLOC_FREE(smb_fname_dst->base_name);
7052                         smb_fname_dst->base_name = destname;
7053
7054                         status = check_name(conn, smb_fname_src->base_name);
7055                         if (!NT_STATUS_IS_OK(status)) {
7056                                 TALLOC_FREE(dir_hnd);
7057                                 TALLOC_FREE(talloced);
7058                                 reply_nterror(req, status);
7059                                 goto out;
7060                         }
7061
7062                         status = check_name(conn, smb_fname_dst->base_name);
7063                         if (!NT_STATUS_IS_OK(status)) {
7064                                 TALLOC_FREE(dir_hnd);
7065                                 TALLOC_FREE(talloced);
7066                                 reply_nterror(req, status);
7067                                 goto out;
7068                         }
7069
7070                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7071                                 smb_fname_src->base_name,
7072                                 smb_fname_dst->base_name));
7073
7074                         status = copy_file(ctx, conn, smb_fname_src,
7075                                            smb_fname_dst, ofun, count,
7076                                            target_is_directory);
7077                         if (NT_STATUS_IS_OK(status)) {
7078                                 count++;
7079                         }
7080
7081                         TALLOC_FREE(talloced);
7082                 }
7083                 TALLOC_FREE(dir_hnd);
7084         }
7085
7086         if (count == 0) {
7087                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7088                 goto out;
7089         }
7090
7091         reply_outbuf(req, 1, 0);
7092         SSVAL(req->outbuf,smb_vwv0,count);
7093  out:
7094         TALLOC_FREE(smb_fname_src);
7095         TALLOC_FREE(smb_fname_dst);
7096         TALLOC_FREE(fname_src);
7097         TALLOC_FREE(fname_dst);
7098         TALLOC_FREE(fname_src_mask);
7099         TALLOC_FREE(fname_src_dir);
7100
7101         END_PROFILE(SMBcopy);
7102         return;
7103 }
7104
7105 #undef DBGC_CLASS
7106 #define DBGC_CLASS DBGC_LOCKING
7107
7108 /****************************************************************************
7109  Get a lock pid, dealing with large count requests.
7110 ****************************************************************************/
7111
7112 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7113                     bool large_file_format)
7114 {
7115         if(!large_file_format)
7116                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7117         else
7118                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7119 }
7120
7121 /****************************************************************************
7122  Get a lock count, dealing with large count requests.
7123 ****************************************************************************/
7124
7125 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7126                         bool large_file_format)
7127 {
7128         uint64_t count = 0;
7129
7130         if(!large_file_format) {
7131                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7132         } else {
7133
7134 #if defined(HAVE_LONGLONG)
7135                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7136                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7137 #else /* HAVE_LONGLONG */
7138
7139                 /*
7140                  * NT4.x seems to be broken in that it sends large file (64 bit)
7141                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7142                  * negotiated. For boxes without large unsigned ints truncate the
7143                  * lock count by dropping the top 32 bits.
7144                  */
7145
7146                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7147                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7148                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7149                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7150                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7151                 }
7152
7153                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7154 #endif /* HAVE_LONGLONG */
7155         }
7156
7157         return count;
7158 }
7159
7160 #if !defined(HAVE_LONGLONG)
7161 /****************************************************************************
7162  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7163 ****************************************************************************/
7164
7165 static uint32 map_lock_offset(uint32 high, uint32 low)
7166 {
7167         unsigned int i;
7168         uint32 mask = 0;
7169         uint32 highcopy = high;
7170
7171         /*
7172          * Try and find out how many significant bits there are in high.
7173          */
7174
7175         for(i = 0; highcopy; i++)
7176                 highcopy >>= 1;
7177
7178         /*
7179          * We use 31 bits not 32 here as POSIX
7180          * lock offsets may not be negative.
7181          */
7182
7183         mask = (~0) << (31 - i);
7184
7185         if(low & mask)
7186                 return 0; /* Fail. */
7187
7188         high <<= (31 - i);
7189
7190         return (high|low);
7191 }
7192 #endif /* !defined(HAVE_LONGLONG) */
7193
7194 /****************************************************************************
7195  Get a lock offset, dealing with large offset requests.
7196 ****************************************************************************/
7197
7198 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7199                          bool large_file_format, bool *err)
7200 {
7201         uint64_t offset = 0;
7202
7203         *err = False;
7204
7205         if(!large_file_format) {
7206                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7207         } else {
7208
7209 #if defined(HAVE_LONGLONG)
7210                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7211                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7212 #else /* HAVE_LONGLONG */
7213
7214                 /*
7215                  * NT4.x seems to be broken in that it sends large file (64 bit)
7216                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7217                  * negotiated. For boxes without large unsigned ints mangle the
7218                  * lock offset by mapping the top 32 bits onto the lower 32.
7219                  */
7220
7221                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7222                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7223                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7224                         uint32 new_low = 0;
7225
7226                         if((new_low = map_lock_offset(high, low)) == 0) {
7227                                 *err = True;
7228                                 return (uint64_t)-1;
7229                         }
7230
7231                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7232                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7233                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7234                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7235                 }
7236
7237                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7238 #endif /* HAVE_LONGLONG */
7239         }
7240
7241         return offset;
7242 }
7243
7244 NTSTATUS smbd_do_locking(struct smb_request *req,
7245                          files_struct *fsp,
7246                          uint8_t type,
7247                          int32_t timeout,
7248                          uint16_t num_ulocks,
7249                          struct smbd_lock_element *ulocks,
7250                          uint16_t num_locks,
7251                          struct smbd_lock_element *locks,
7252                          bool *async)
7253 {
7254         connection_struct *conn = req->conn;
7255         int i;
7256         NTSTATUS status = NT_STATUS_OK;
7257
7258         *async = false;
7259
7260         /* Data now points at the beginning of the list
7261            of smb_unlkrng structs */
7262         for(i = 0; i < (int)num_ulocks; i++) {
7263                 struct smbd_lock_element *e = &ulocks[i];
7264
7265                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7266                           "pid %u, file %s\n",
7267                           (double)e->offset,
7268                           (double)e->count,
7269                           (unsigned int)e->smblctx,
7270                           fsp_str_dbg(fsp)));
7271
7272                 if (e->brltype != UNLOCK_LOCK) {
7273                         /* this can only happen with SMB2 */
7274                         return NT_STATUS_INVALID_PARAMETER;
7275                 }
7276
7277                 status = do_unlock(req->sconn->msg_ctx,
7278                                 fsp,
7279                                 e->smblctx,
7280                                 e->count,
7281                                 e->offset,
7282                                 WINDOWS_LOCK);
7283
7284                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7285                     nt_errstr(status)));
7286
7287                 if (!NT_STATUS_IS_OK(status)) {
7288                         return status;
7289                 }
7290         }
7291
7292         /* Setup the timeout in seconds. */
7293
7294         if (!lp_blocking_locks(SNUM(conn))) {
7295                 timeout = 0;
7296         }
7297
7298         /* Data now points at the beginning of the list
7299            of smb_lkrng structs */
7300
7301         for(i = 0; i < (int)num_locks; i++) {
7302                 struct smbd_lock_element *e = &locks[i];
7303
7304                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7305                           "%llu, file %s timeout = %d\n",
7306                           (double)e->offset,
7307                           (double)e->count,
7308                           (unsigned long long)e->smblctx,
7309                           fsp_str_dbg(fsp),
7310                           (int)timeout));
7311
7312                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7313                         struct blocking_lock_record *blr = NULL;
7314
7315                         if (num_locks > 1) {
7316                                 /*
7317                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7318                                  * if the lock vector contains one entry. When given mutliple cancel
7319                                  * requests in a single PDU we expect the server to return an
7320                                  * error. Windows servers seem to accept the request but only
7321                                  * cancel the first lock.
7322                                  * JRA - Do what Windows does (tm) :-).
7323                                  */
7324
7325 #if 0
7326                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7327                                 return NT_STATUS_DOS(ERRDOS,
7328                                                 ERRcancelviolation);
7329 #else
7330                                 /* Windows behavior. */
7331                                 if (i != 0) {
7332                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7333                                                 "cancel request\n"));
7334                                         continue;
7335                                 }
7336 #endif
7337                         }
7338
7339                         if (lp_blocking_locks(SNUM(conn))) {
7340
7341                                 /* Schedule a message to ourselves to
7342                                    remove the blocking lock record and
7343                                    return the right error. */
7344
7345                                 blr = blocking_lock_cancel_smb1(fsp,
7346                                                 e->smblctx,
7347                                                 e->offset,
7348                                                 e->count,
7349                                                 WINDOWS_LOCK,
7350                                                 type,
7351                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7352                                 if (blr == NULL) {
7353                                         return NT_STATUS_DOS(
7354                                                         ERRDOS,
7355                                                         ERRcancelviolation);
7356                                 }
7357                         }
7358                         /* Remove a matching pending lock. */
7359                         status = do_lock_cancel(fsp,
7360                                                 e->smblctx,
7361                                                 e->count,
7362                                                 e->offset,
7363                                                 WINDOWS_LOCK,
7364                                                 blr);
7365                 } else {
7366                         bool blocking_lock = timeout ? true : false;
7367                         bool defer_lock = false;
7368                         struct byte_range_lock *br_lck;
7369                         uint64_t block_smblctx;
7370
7371                         br_lck = do_lock(req->sconn->msg_ctx,
7372                                         fsp,
7373                                         e->smblctx,
7374                                         e->count,
7375                                         e->offset,
7376                                         e->brltype,
7377                                         WINDOWS_LOCK,
7378                                         blocking_lock,
7379                                         &status,
7380                                         &block_smblctx,
7381                                         NULL);
7382
7383                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7384                                 /* Windows internal resolution for blocking locks seems
7385                                    to be about 200ms... Don't wait for less than that. JRA. */
7386                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7387                                         timeout = lp_lock_spin_time();
7388                                 }
7389                                 defer_lock = true;
7390                         }
7391
7392                         /* If a lock sent with timeout of zero would fail, and
7393                          * this lock has been requested multiple times,
7394                          * according to brl_lock_failed() we convert this
7395                          * request to a blocking lock with a timeout of between
7396                          * 150 - 300 milliseconds.
7397                          *
7398                          * If lp_lock_spin_time() has been set to 0, we skip
7399                          * this blocking retry and fail immediately.
7400                          *
7401                          * Replacement for do_lock_spin(). JRA. */
7402
7403                         if (!req->sconn->using_smb2 &&
7404                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7405                             lp_lock_spin_time() && !blocking_lock &&
7406                             NT_STATUS_EQUAL((status),
7407                                 NT_STATUS_FILE_LOCK_CONFLICT))
7408                         {
7409                                 defer_lock = true;
7410                                 timeout = lp_lock_spin_time();
7411                         }
7412
7413                         if (br_lck && defer_lock) {
7414                                 /*
7415                                  * A blocking lock was requested. Package up
7416                                  * this smb into a queued request and push it
7417                                  * onto the blocking lock queue.
7418                                  */
7419                                 if(push_blocking_lock_request(br_lck,
7420                                                         req,
7421                                                         fsp,
7422                                                         timeout,
7423                                                         i,
7424                                                         e->smblctx,
7425                                                         e->brltype,
7426                                                         WINDOWS_LOCK,
7427                                                         e->offset,
7428                                                         e->count,
7429                                                         block_smblctx)) {
7430                                         TALLOC_FREE(br_lck);
7431                                         *async = true;
7432                                         return NT_STATUS_OK;
7433                                 }
7434                         }
7435
7436                         TALLOC_FREE(br_lck);
7437                 }
7438
7439                 if (!NT_STATUS_IS_OK(status)) {
7440                         break;
7441                 }
7442         }
7443
7444         /* If any of the above locks failed, then we must unlock
7445            all of the previous locks (X/Open spec). */
7446
7447         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7448
7449                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7450                         i = -1; /* we want to skip the for loop */
7451                 }
7452
7453                 /*
7454                  * Ensure we don't do a remove on the lock that just failed,
7455                  * as under POSIX rules, if we have a lock already there, we
7456                  * will delete it (and we shouldn't) .....
7457                  */
7458                 for(i--; i >= 0; i--) {
7459                         struct smbd_lock_element *e = &locks[i];
7460
7461                         do_unlock(req->sconn->msg_ctx,
7462                                 fsp,
7463                                 e->smblctx,
7464                                 e->count,
7465                                 e->offset,
7466                                 WINDOWS_LOCK);
7467                 }
7468                 return status;
7469         }
7470
7471         DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7472                   fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7473
7474         return NT_STATUS_OK;
7475 }
7476
7477 /****************************************************************************
7478  Reply to a lockingX request.
7479 ****************************************************************************/
7480
7481 void reply_lockingX(struct smb_request *req)
7482 {
7483         connection_struct *conn = req->conn;
7484         files_struct *fsp;
7485         unsigned char locktype;
7486         unsigned char oplocklevel;
7487         uint16 num_ulocks;
7488         uint16 num_locks;
7489         int32 lock_timeout;
7490         int i;
7491         const uint8_t *data;
7492         bool large_file_format;
7493         bool err;
7494         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7495         struct smbd_lock_element *ulocks;
7496         struct smbd_lock_element *locks;
7497         bool async = false;
7498
7499         START_PROFILE(SMBlockingX);
7500
7501         if (req->wct < 8) {
7502                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7503                 END_PROFILE(SMBlockingX);
7504                 return;
7505         }
7506
7507         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7508         locktype = CVAL(req->vwv+3, 0);
7509         oplocklevel = CVAL(req->vwv+3, 1);
7510         num_ulocks = SVAL(req->vwv+6, 0);
7511         num_locks = SVAL(req->vwv+7, 0);
7512         lock_timeout = IVAL(req->vwv+4, 0);
7513         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7514
7515         if (!check_fsp(conn, req, fsp)) {
7516                 END_PROFILE(SMBlockingX);
7517                 return;
7518         }
7519
7520         data = req->buf;
7521
7522         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7523                 /* we don't support these - and CANCEL_LOCK makes w2k
7524                    and XP reboot so I don't really want to be
7525                    compatible! (tridge) */
7526                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7527                 END_PROFILE(SMBlockingX);
7528                 return;
7529         }
7530
7531         /* Check if this is an oplock break on a file
7532            we have granted an oplock on.
7533         */
7534         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7535                 /* Client can insist on breaking to none. */
7536                 bool break_to_none = (oplocklevel == 0);
7537                 bool result;
7538
7539                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7540                          "for fnum = %d\n", (unsigned int)oplocklevel,
7541                          fsp->fnum ));
7542
7543                 /*
7544                  * Make sure we have granted an exclusive or batch oplock on
7545                  * this file.
7546                  */
7547
7548                 if (fsp->oplock_type == 0) {
7549
7550                         /* The Samba4 nbench simulator doesn't understand
7551                            the difference between break to level2 and break
7552                            to none from level2 - it sends oplock break
7553                            replies in both cases. Don't keep logging an error
7554                            message here - just ignore it. JRA. */
7555
7556                         DEBUG(5,("reply_lockingX: Error : oplock break from "
7557                                  "client for fnum = %d (oplock=%d) and no "
7558                                  "oplock granted on this file (%s).\n",
7559                                  fsp->fnum, fsp->oplock_type,
7560                                  fsp_str_dbg(fsp)));
7561
7562                         /* if this is a pure oplock break request then don't
7563                          * send a reply */
7564                         if (num_locks == 0 && num_ulocks == 0) {
7565                                 END_PROFILE(SMBlockingX);
7566                                 return;
7567                         } else {
7568                                 END_PROFILE(SMBlockingX);
7569                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7570                                 return;
7571                         }
7572                 }
7573
7574                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7575                     (break_to_none)) {
7576                         result = remove_oplock(fsp);
7577                 } else {
7578                         result = downgrade_oplock(fsp);
7579                 }
7580
7581                 if (!result) {
7582                         DEBUG(0, ("reply_lockingX: error in removing "
7583                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
7584                         /* Hmmm. Is this panic justified? */
7585                         smb_panic("internal tdb error");
7586                 }
7587
7588                 reply_to_oplock_break_requests(fsp);
7589
7590                 /* if this is a pure oplock break request then don't send a
7591                  * reply */
7592                 if (num_locks == 0 && num_ulocks == 0) {
7593                         /* Sanity check - ensure a pure oplock break is not a
7594                            chained request. */
7595                         if(CVAL(req->vwv+0, 0) != 0xff)
7596                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
7597                                          "break is a chained %d request !\n",
7598                                          (unsigned int)CVAL(req->vwv+0, 0)));
7599                         END_PROFILE(SMBlockingX);
7600                         return;
7601                 }
7602         }
7603
7604         if (req->buflen <
7605             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7606                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7607                 END_PROFILE(SMBlockingX);
7608                 return;
7609         }
7610
7611         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7612         if (ulocks == NULL) {
7613                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7614                 END_PROFILE(SMBlockingX);
7615                 return;
7616         }
7617
7618         locks = talloc_array(req, struct smbd_lock_element, num_locks);
7619         if (locks == NULL) {
7620                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7621                 END_PROFILE(SMBlockingX);
7622                 return;
7623         }
7624
7625         /* Data now points at the beginning of the list
7626            of smb_unlkrng structs */
7627         for(i = 0; i < (int)num_ulocks; i++) {
7628                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7629                 ulocks[i].count = get_lock_count(data, i, large_file_format);
7630                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7631                 ulocks[i].brltype = UNLOCK_LOCK;
7632
7633                 /*
7634                  * There is no error code marked "stupid client bug".... :-).
7635                  */
7636                 if(err) {
7637                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7638                         END_PROFILE(SMBlockingX);
7639                         return;
7640                 }
7641         }
7642
7643         /* Now do any requested locks */
7644         data += ((large_file_format ? 20 : 10)*num_ulocks);
7645
7646         /* Data now points at the beginning of the list
7647            of smb_lkrng structs */
7648
7649         for(i = 0; i < (int)num_locks; i++) {
7650                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7651                 locks[i].count = get_lock_count(data, i, large_file_format);
7652                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7653
7654                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7655                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7656                                 locks[i].brltype = PENDING_READ_LOCK;
7657                         } else {
7658                                 locks[i].brltype = READ_LOCK;
7659                         }
7660                 } else {
7661                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7662                                 locks[i].brltype = PENDING_WRITE_LOCK;
7663                         } else {
7664                                 locks[i].brltype = WRITE_LOCK;
7665                         }
7666                 }
7667
7668                 /*
7669                  * There is no error code marked "stupid client bug".... :-).
7670                  */
7671                 if(err) {
7672                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7673                         END_PROFILE(SMBlockingX);
7674                         return;
7675                 }
7676         }
7677
7678         status = smbd_do_locking(req, fsp,
7679                                  locktype, lock_timeout,
7680                                  num_ulocks, ulocks,
7681                                  num_locks, locks,
7682                                  &async);
7683         if (!NT_STATUS_IS_OK(status)) {
7684                 END_PROFILE(SMBlockingX);
7685                 reply_nterror(req, status);
7686                 return;
7687         }
7688         if (async) {
7689                 END_PROFILE(SMBlockingX);
7690                 return;
7691         }
7692
7693         reply_outbuf(req, 2, 0);
7694
7695         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7696                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7697
7698         END_PROFILE(SMBlockingX);
7699         chain_reply(req);
7700 }
7701
7702 #undef DBGC_CLASS
7703 #define DBGC_CLASS DBGC_ALL
7704
7705 /****************************************************************************
7706  Reply to a SMBreadbmpx (read block multiplex) request.
7707  Always reply with an error, if someone has a platform really needs this,
7708  please contact vl@samba.org
7709 ****************************************************************************/
7710
7711 void reply_readbmpx(struct smb_request *req)
7712 {
7713         START_PROFILE(SMBreadBmpx);
7714         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7715         END_PROFILE(SMBreadBmpx);
7716         return;
7717 }
7718
7719 /****************************************************************************
7720  Reply to a SMBreadbs (read block multiplex secondary) request.
7721  Always reply with an error, if someone has a platform really needs this,
7722  please contact vl@samba.org
7723 ****************************************************************************/
7724
7725 void reply_readbs(struct smb_request *req)
7726 {
7727         START_PROFILE(SMBreadBs);
7728         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7729         END_PROFILE(SMBreadBs);
7730         return;
7731 }
7732
7733 /****************************************************************************
7734  Reply to a SMBsetattrE.
7735 ****************************************************************************/
7736
7737 void reply_setattrE(struct smb_request *req)
7738 {
7739         connection_struct *conn = req->conn;
7740         struct smb_file_time ft;
7741         files_struct *fsp;
7742         NTSTATUS status;
7743
7744         START_PROFILE(SMBsetattrE);
7745         ZERO_STRUCT(ft);
7746
7747         if (req->wct < 7) {
7748                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7749                 goto out;
7750         }
7751
7752         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7753
7754         if(!fsp || (fsp->conn != conn)) {
7755                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7756                 goto out;
7757         }
7758
7759         /*
7760          * Convert the DOS times into unix times.
7761          */
7762
7763         ft.atime = convert_time_t_to_timespec(
7764             srv_make_unix_date2(req->vwv+3));
7765         ft.mtime = convert_time_t_to_timespec(
7766             srv_make_unix_date2(req->vwv+5));
7767         ft.create_time = convert_time_t_to_timespec(
7768             srv_make_unix_date2(req->vwv+1));
7769
7770         reply_outbuf(req, 0, 0);
7771
7772         /*
7773          * Patch from Ray Frush <frush@engr.colostate.edu>
7774          * Sometimes times are sent as zero - ignore them.
7775          */
7776
7777         /* Ensure we have a valid stat struct for the source. */
7778         status = vfs_stat_fsp(fsp);
7779         if (!NT_STATUS_IS_OK(status)) {
7780                 reply_nterror(req, status);
7781                 goto out;
7782         }
7783
7784         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7785         if (!NT_STATUS_IS_OK(status)) {
7786                 reply_nterror(req, status);
7787                 goto out;
7788         }
7789
7790         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7791                " createtime=%u\n",
7792                 fsp->fnum,
7793                 (unsigned int)ft.atime.tv_sec,
7794                 (unsigned int)ft.mtime.tv_sec,
7795                 (unsigned int)ft.create_time.tv_sec
7796                 ));
7797  out:
7798         END_PROFILE(SMBsetattrE);
7799         return;
7800 }
7801
7802
7803 /* Back from the dead for OS/2..... JRA. */
7804
7805 /****************************************************************************
7806  Reply to a SMBwritebmpx (write block multiplex primary) request.
7807  Always reply with an error, if someone has a platform really needs this,
7808  please contact vl@samba.org
7809 ****************************************************************************/
7810
7811 void reply_writebmpx(struct smb_request *req)
7812 {
7813         START_PROFILE(SMBwriteBmpx);
7814         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7815         END_PROFILE(SMBwriteBmpx);
7816         return;
7817 }
7818
7819 /****************************************************************************
7820  Reply to a SMBwritebs (write block multiplex secondary) request.
7821  Always reply with an error, if someone has a platform really needs this,
7822  please contact vl@samba.org
7823 ****************************************************************************/
7824
7825 void reply_writebs(struct smb_request *req)
7826 {
7827         START_PROFILE(SMBwriteBs);
7828         reply_force_doserror(req, ERRSRV, ERRuseSTD);
7829         END_PROFILE(SMBwriteBs);
7830         return;
7831 }
7832
7833 /****************************************************************************
7834  Reply to a SMBgetattrE.
7835 ****************************************************************************/
7836
7837 void reply_getattrE(struct smb_request *req)
7838 {
7839         connection_struct *conn = req->conn;
7840         int mode;
7841         files_struct *fsp;
7842         struct timespec create_ts;
7843
7844         START_PROFILE(SMBgetattrE);
7845
7846         if (req->wct < 1) {
7847                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7848                 END_PROFILE(SMBgetattrE);
7849                 return;
7850         }
7851
7852         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7853
7854         if(!fsp || (fsp->conn != conn)) {
7855                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7856                 END_PROFILE(SMBgetattrE);
7857                 return;
7858         }
7859
7860         /* Do an fstat on this file */
7861         if(fsp_stat(fsp)) {
7862                 reply_nterror(req, map_nt_error_from_unix(errno));
7863                 END_PROFILE(SMBgetattrE);
7864                 return;
7865         }
7866
7867         mode = dos_mode(conn, fsp->fsp_name);
7868
7869         /*
7870          * Convert the times into dos times. Set create
7871          * date to be last modify date as UNIX doesn't save
7872          * this.
7873          */
7874
7875         reply_outbuf(req, 11, 0);
7876
7877         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7878         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7879         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7880                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
7881         /* Should we check pending modtime here ? JRA */
7882         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7883                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
7884
7885         if (mode & aDIR) {
7886                 SIVAL(req->outbuf, smb_vwv6, 0);
7887                 SIVAL(req->outbuf, smb_vwv8, 0);
7888         } else {
7889                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
7890                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
7891                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7892         }
7893         SSVAL(req->outbuf,smb_vwv10, mode);
7894
7895         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7896
7897         END_PROFILE(SMBgetattrE);
7898         return;
7899 }